diff --git a/.github/actions/setup-integration-test-env/action.yml b/.github/actions/setup-integration-test-env/action.yml
index ee71d7b708..c4373614a1 100644
--- a/.github/actions/setup-integration-test-env/action.yml
+++ b/.github/actions/setup-integration-test-env/action.yml
@@ -3,7 +3,7 @@ description: Prepare toolchains, Viceroy, and Docker images for integration test
 
 inputs:
   origin-port:
-    description: Fixed origin port baked into the WASM binary for integration tests.
+    description: Fixed origin port used by integration runtime configuration and container mappings.
     required: true
   install-viceroy:
     description: Install the Viceroy binary used by integration tests.
diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
index f458572eb7..42e7ed4350 100644
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -1,4 +1,4 @@
-name: "Run Format"
+name: 'Run Format'
 
 on:
   push:
@@ -61,7 +61,7 @@ jobs:
         uses: ./.github/actions/setup-rust
         with:
           target: wasm32-wasip1,wasm32-unknown-unknown
-          components: "clippy, rustfmt"
+          components: 'clippy, rustfmt'
           cache-key: cargo-clippy
 
       - name: Run cargo fmt
@@ -113,14 +113,14 @@ jobs:
       - name: Retrieve Node.js version
         id: node-version
         working-directory: .
-        run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
         shell: bash
 
       - name: Use Node.js
         uses: actions/setup-node@v4
         with:
           node-version: ${{ steps.node-version.outputs.node-version }}
-          cache: "npm"
+          cache: 'npm'
           cache-dependency-path: crates/trusted-server-js/lib/package.json
 
       - name: Install dependencies
@@ -144,14 +144,14 @@ jobs:
       - name: Retrieve Node.js version
         id: node-version
         working-directory: .
-        run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
         shell: bash
 
       - name: Use Node.js
         uses: actions/setup-node@v4
         with:
           node-version: ${{ steps.node-version.outputs.node-version }}
-          cache: "npm"
+          cache: 'npm'
           cache-dependency-path: docs/package.json
 
       - name: Install dependencies
@@ -167,7 +167,7 @@ jobs:
         working-directory: .
         run: >-
           docs/node_modules/.bin/prettier --config docs/.prettierrc --check
-          "*.md" ".claude/**/*.md" ".github/**/*.md" "crates/**/*.md" "scripts/**/*.md" "tinybird/**/*.md"
+          "*.md" ".claude/**/*.md" ".github/**/*.md" "crates/**/*.md" "scripts/**/*.md" "scripts/**/*.mjs" "tinybird/**/*.md"
 
       - name: Build with VitePress (fails on dead links)
         run: npm run build
@@ -180,7 +180,7 @@ jobs:
 
       - name: Retrieve Node.js version
         id: node-version
-        run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
         shell: bash
 
       - name: Use Node.js
diff --git a/.github/workflows/release-validation.mjs b/.github/workflows/release-validation.mjs
new file mode 100644
index 0000000000..ffb740a0dd
--- /dev/null
+++ b/.github/workflows/release-validation.mjs
@@ -0,0 +1,339 @@
+import { readFile } from 'node:fs/promises'
+import { pathToFileURL } from 'node:url'
+
+const shaPattern = /^[0-9a-f]{40}$/
+const numericIdentifier = '(?:0|[1-9][0-9]*)'
+const prereleaseIdentifier = `(?:${numericIdentifier}|[0-9]*[A-Za-z-][0-9A-Za-z-]*)`
+const tagPattern = new RegExp(
+  `^v${numericIdentifier}\\.${numericIdentifier}\\.${numericIdentifier}(?:-${prereleaseIdentifier}(?:\\.${prereleaseIdentifier})*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$`
+)
+const requireValue = (condition, message) => {
+  if (!condition) throw new Error(message)
+}
+
+export function validateContext(env, policy) {
+  const source = env.SOURCE_SHA
+  requireValue(
+    shaPattern.test(source ?? '') &&
+      source === env.GITHUB_SHA &&
+      source === env.WORKFLOW_SHA,
+    'Source and workflow must be the same full commit'
+  )
+  requireValue(
+    policy.cohort === 'phase1-fastly-cli' &&
+      env.GITHUB_REPOSITORY === policy.repository &&
+      env.GITHUB_REPOSITORY_ID === policy.repository_id &&
+      env.GITHUB_REPOSITORY_OWNER_ID === policy.repository_owner_id,
+    'Official repository identity required'
+  )
+  requireValue(
+    env.GITHUB_EVENT_NAME === 'push' && policy.identity.event === 'push',
+    'Tag push event required'
+  )
+  const ref = env.GITHUB_REF
+  requireValue(
+    typeof ref === 'string' &&
+      ref.startsWith('refs/tags/') &&
+      tagPattern.test(ref.slice(10)),
+    'Strict SemVer full tag ref required'
+  )
+  requireValue(
+    Buffer.byteLength(ref.slice(10), 'utf8') <= 128,
+    'Tag exceeds 128 byte maximum'
+  )
+  requireValue(
+    env.WORKFLOW_REF ===
+      `${policy.repository}/${policy.identity.caller_path}@${ref}` &&
+      policy.identity.caller_path === '.github/workflows/release.yml',
+    'Exact same-tag caller workflow required'
+  )
+  requireValue(
+    /^[1-9][0-9]*$/.test(env.GITHUB_RUN_ID ?? '') &&
+      /^[1-9][0-9]*$/.test(env.GITHUB_RUN_ATTEMPT ?? ''),
+    'Current run and attempt required'
+  )
+  return {
+    source,
+    ref,
+    tag: ref.slice(10),
+    repository: policy.repository,
+    repositoryId: policy.repository_id,
+    ownerId: policy.repository_owner_id,
+    runId: env.GITHUB_RUN_ID,
+    attempt: env.GITHUB_RUN_ATTEMPT,
+  }
+}
+
+export const governanceGap =
+  'Production source eligibility unavailable: missing independently approved governance, ruleset, and bypass approval profile'
+
+export async function verifySource(context, api) {
+  const base = `/repos/${context.repository}`
+  const tag = await api(
+    `${base}/git/ref/tags/${encodeURIComponent(context.tag)}`
+  )
+  requireValue(
+    tag.ref === context.ref &&
+      tag.object?.type === 'commit' &&
+      tag.object.sha === context.source,
+    'Remote lightweight tag must target exact source commit'
+  )
+  const main = await api(`${base}/git/ref/heads/main`)
+  requireValue(
+    main.ref === 'refs/heads/main' &&
+      main.object?.type === 'commit' &&
+      shaPattern.test(main.object.sha ?? ''),
+    'Remote main commit required'
+  )
+  const comparison = await api(
+    `${base}/compare/${context.source}...${main.object.sha}`
+  )
+  requireValue(
+    ['ahead', 'identical'].includes(comparison.status) &&
+      comparison.merge_base_commit?.sha === context.source,
+    'Source must be an ancestor of remote main'
+  )
+}
+
+export async function admit(context, api) {
+  await verifySource(context, api)
+  // Ancestry observations and validation gates do not establish review authority.
+  return { source_eligibility: false, diagnostic: governanceGap }
+}
+
+export const requiredJobNames = Object.freeze([
+  'Release validation admission',
+  'Release validation Fastly',
+  'Release validation native and parity',
+  'Release validation Cloudflare and Spin',
+  'Release validation release tool Linux',
+  'Release validation release tool macOS',
+  'Release validation JavaScript',
+  'Release validation docs',
+])
+
+export function inspectJobs(context, body, requiredNames = requiredJobNames) {
+  requireValue(
+    Number.isInteger(body.total_count) &&
+      body.total_count <= 100 &&
+      Array.isArray(body.jobs) &&
+      body.jobs.length === body.total_count,
+    'Jobs response is truncated or invalid'
+  )
+  const observed = new Map()
+  for (const job of body.jobs) {
+    const name = job.name?.split(' / ').at(-1)
+    if (!requiredNames.includes(name)) continue
+    requireValue(!observed.has(name), 'Duplicate required job')
+    requireValue(
+      String(job.run_id) === context.runId &&
+        (job.run_attempt === undefined ||
+          String(job.run_attempt) === context.attempt) &&
+        job.head_sha === context.source,
+      'Job must belong to current source, run, and attempt'
+    )
+    requireValue(
+      [
+        'queued',
+        'in_progress',
+        'waiting',
+        'pending',
+        'requested',
+        'completed',
+      ].includes(job.status),
+      'Unknown required job status'
+    )
+    if (job.status === 'completed')
+      requireValue(
+        job.conclusion === 'success',
+        'Required job does not succeed. Rerun all jobs within the current validation window; no previous-attempt results count'
+      )
+    else
+      requireValue(
+        job.conclusion === null,
+        'Pending required job has a conclusion'
+      )
+    observed.set(name, job.status === 'completed')
+  }
+  return requiredNames.every((name) => observed.get(name) === true)
+}
+
+function validateRun(context, run) {
+  requireValue(
+    String(run.id) === context.runId &&
+      String(run.run_attempt) === context.attempt &&
+      run.head_sha === context.source &&
+      run.head_branch === context.tag &&
+      run.event === 'push' &&
+      [
+        '.github/workflows/release.yml',
+        `.github/workflows/release.yml@${context.ref}`,
+      ].includes(run.path),
+    'Run must match current tag, source, caller, event, and attempt'
+  )
+  requireValue(
+    run.repository?.full_name === context.repository &&
+      String(run.repository.id) === context.repositoryId &&
+      String(run.repository.owner?.id) === context.ownerId,
+    'Run repository identity mismatch'
+  )
+  requireValue(
+    Number.isFinite(Date.parse(run.created_at)),
+    'Run creation timestamp required'
+  )
+}
+
+const deadlineMessage =
+  '90 minute validation deadline exceeded (includes queue time). Reruns cannot reset this deadline; a fresh trusted invocation is required'
+
+export async function wait(
+  context,
+  {
+    api,
+    requiredNames = requiredJobNames,
+    now = Date.now,
+    monotonic = () => performance.now(),
+    sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+  }
+) {
+  const start = monotonic()
+  const wallStart = now()
+  const base = `/repos/${context.repository}/actions/runs/${context.runId}/attempts/${context.attempt}`
+  const run = await api(base, 90 * 60 * 1000)
+  validateRun(context, run)
+  const budget = Date.parse(run.created_at) + 90 * 60 * 1000 - wallStart
+  const remaining = () => budget - (monotonic() - start)
+  const boundedApi = (path) => {
+    requireValue(remaining() > 0, deadlineMessage)
+    return api(path, remaining())
+  }
+  requireValue(
+    budget <= 90 * 60 * 1000,
+    'Run creation timestamp is in the future'
+  )
+  while (true) {
+    requireValue(remaining() > 0, deadlineMessage)
+    const current = await boundedApi(base)
+    validateRun(context, current)
+    requireValue(
+      current.created_at === run.created_at,
+      'Run creation timestamp changed'
+    )
+    const body = await boundedApi(`${base}/jobs?per_page=100`)
+    requireValue(remaining() > 0, deadlineMessage)
+    if (inspectJobs(context, body, requiredNames)) {
+      await verifySource(context, boundedApi)
+      requireValue(remaining() > 0, deadlineMessage)
+      throw new Error(governanceGap)
+    }
+    await sleep(Math.min(15000, remaining()))
+  }
+}
+
+// The fixed official REST origin receives the explicit read-only token.
+export const apiOrigin = 'https://api.github.com' // allow-domain: api.github.com
+
+export function createApi(token, fetchImpl = fetch) {
+  requireValue(
+    typeof token === 'string' && token.length > 0 && !/[\r\n]/.test(token),
+    'Explicit read token required'
+  )
+  return async (path, remainingBudget = 15000) => {
+    requireValue(
+      Number.isFinite(remainingBudget) && remainingBudget > 0,
+      deadlineMessage
+    )
+    requireValue(
+      typeof path === 'string' &&
+        /^\/repos\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/(?:git\/ref\/heads\/main|git\/ref\/tags\/v[A-Za-z0-9.%+-]+|compare\/[a-f0-9]{40}\.\.\.[a-f0-9]{40}|actions\/runs\/[1-9][0-9]*\/attempts\/[1-9][0-9]*(?:\/jobs\?per_page=100)?)$/.test(
+          path
+        ),
+      'Fixed repository API path required'
+    )
+    const controller = new AbortController()
+    const timer = setTimeout(
+      () => controller.abort(),
+      Math.min(15000, remainingBudget)
+    )
+    let reader
+    try {
+      const response = await fetchImpl(`${apiOrigin}${path}`, {
+        method: 'GET',
+        redirect: 'error',
+        signal: controller.signal,
+        headers: {
+          Authorization: `Bearer ${token}`,
+          Accept: 'application/vnd.github+json',
+          'X-GitHub-Api-Version': '2022-11-28',
+        },
+      })
+      requireValue(
+        response.ok && !response.redirected,
+        'GitHub API request unsuccessful'
+      )
+      requireValue(
+        !response.headers.get('link'),
+        'Paginated GitHub API responses are unavailable'
+      )
+      const limit = 2 * 1024 * 1024
+      const length = response.headers.get('content-length')
+      requireValue(
+        length === null || (/^[0-9]+$/.test(length) && Number(length) <= limit),
+        'GitHub API body exceeds bound'
+      )
+      requireValue(response.body, 'GitHub API body required')
+      reader = response.body.getReader()
+      const chunks = []
+      let size = 0
+      while (true) {
+        const { done, value } = await reader.read()
+        if (done) break
+        size += value.byteLength
+        requireValue(size <= limit, 'GitHub API body exceeds bound')
+        chunks.push(value)
+      }
+      return JSON.parse(Buffer.concat(chunks, size).toString('utf8'))
+    } catch {
+      // Network and response errors may contain credentials or untrusted content.
+      throw new Error(
+        'Bounded GitHub API read failed. Rerun all jobs within the current validation window; an expired window requires a fresh trusted invocation'
+      )
+    } finally {
+      clearTimeout(timer)
+      if (reader) await reader.cancel().catch(() => {})
+    }
+  }
+}
+
+// Importing this module for pure tests never invokes the CI entry point.
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  try {
+    requireValue(
+      process.argv.length === 3 && ['admit', 'wait'].includes(process.argv[2]),
+      'Expected admit or wait command'
+    )
+    const policy = JSON.parse(
+      await readFile(
+        new URL(
+          '../../crates/trusted-server-cli/release-policy.json',
+          import.meta.url
+        ),
+        'utf8'
+      )
+    )
+    const context = validateContext(process.env, policy)
+    const api = createApi(process.env.GH_TOKEN)
+    if (process.argv[2] === 'admit') {
+      const result = await admit(context, api)
+      process.stdout.write(`${JSON.stringify(result)}\n`)
+    } else {
+      await wait(context, { api })
+    }
+  } catch (error) {
+    process.stderr.write(`${error.message}\n`)
+    process.exitCode = 1
+  }
+}
diff --git a/.github/workflows/release-validation.test.mjs b/.github/workflows/release-validation.test.mjs
new file mode 100644
index 0000000000..f961df2d61
--- /dev/null
+++ b/.github/workflows/release-validation.test.mjs
@@ -0,0 +1,462 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+import * as validation from './release-validation.mjs'
+
+const sha = 'a'.repeat(40)
+const policy = {
+  repository: 'example-org/example-repo',
+  repository_id: '99999',
+  repository_owner_id: '99998',
+  cohort: 'phase1-fastly-cli',
+  identity: { event: 'push', caller_path: '.github/workflows/release.yml' },
+}
+const env = {
+  SOURCE_SHA: sha,
+  GITHUB_SHA: sha,
+  GITHUB_REF: 'refs/tags/v1.2.3',
+  GITHUB_EVENT_NAME: 'push',
+  GITHUB_REPOSITORY: policy.repository,
+  GITHUB_REPOSITORY_ID: '99999',
+  GITHUB_REPOSITORY_OWNER_ID: '99998',
+  GITHUB_RUN_ID: '123',
+  GITHUB_RUN_ATTEMPT: '2',
+  WORKFLOW_SHA: sha,
+  WORKFLOW_REF:
+    'example-org/example-repo/.github/workflows/release.yml@refs/tags/v1.2.3',
+}
+
+test('context requires same source, official identity, event, and strict full SemVer tag', async (t) => {
+  assert.equal(typeof validation.validateContext, 'function')
+  assert.equal(validation.validateContext(env, policy).source, sha)
+  for (const change of [
+    { SOURCE_SHA: 'b'.repeat(40) },
+    { WORKFLOW_SHA: 'b'.repeat(40) },
+    { GITHUB_EVENT_NAME: 'workflow_dispatch' },
+    { GITHUB_REPOSITORY_ID: '99997' },
+    { GITHUB_REF: 'refs/heads/main' },
+    { GITHUB_REF: 'refs/tags/v01.2.3' },
+    { GITHUB_REF: 'refs/tags/v1.2.3-01' },
+    { GITHUB_REF: 'refs/tags/v1.2.3/' },
+    { GITHUB_RUN_ATTEMPT: '0' },
+  ]) {
+    await t.test(`rejects ${JSON.stringify(change)}`, () =>
+      assert.throws(() =>
+        validation.validateContext(
+          {
+            ...env,
+            ...change,
+            ...(change.GITHUB_REF
+              ? {
+                  WORKFLOW_REF: `${policy.repository}/.github/workflows/release.yml@${change.GITHUB_REF}`,
+                }
+              : {}),
+          },
+          policy
+        )
+      )
+    )
+  }
+  for (const tag of ['v1.2.3+example.01', 'v1.2.3-rc.1']) {
+    await t.test(`parses ${tag} without eligibility authority`, () =>
+      assert.equal(
+        validation.validateContext(
+          {
+            ...env,
+            GITHUB_REF: `refs/tags/${tag}`,
+            WORKFLOW_REF: `example-org/example-repo/.github/workflows/release.yml@refs/tags/${tag}`,
+          },
+          policy
+        ).tag,
+        tag
+      )
+    )
+  }
+})
+
+const context = () => validation.validateContext(env, policy)
+const sourceApi =
+  (change = {}) =>
+  async (path) => {
+    if (path.includes('/git/ref/tags/'))
+      return {
+        ref: env.GITHUB_REF,
+        object: { type: 'commit', sha },
+        ...change.tag,
+      }
+    if (path.endsWith('/git/ref/heads/main'))
+      return {
+        ref: 'refs/heads/main',
+        object: { type: 'commit', sha: 'b'.repeat(40) },
+        ...change.main,
+      }
+    if (path.includes('/compare/'))
+      return { status: 'ahead', merge_base_commit: { sha }, ...change.compare }
+    throw new Error('Unexpected fixture endpoint')
+  }
+test('remote lightweight tag and main ancestry provide observations without eligibility authority', async (t) => {
+  assert.equal(typeof validation.admit, 'function')
+  assert.deepEqual(await validation.admit(context(), sourceApi()), {
+    source_eligibility: false,
+    diagnostic: validation.governanceGap,
+  })
+  for (const change of [
+    { tag: { object: { type: 'tag', sha } } },
+    { tag: { object: { type: 'commit', sha: 'b'.repeat(40) } } },
+    { compare: { status: 'behind' } },
+    { compare: { merge_base_commit: { sha: 'b'.repeat(40) } } },
+  ]) {
+    await t.test(`rejects remote ${JSON.stringify(change)}`, async () =>
+      assert.rejects(validation.admit(context(), sourceApi(change)))
+    )
+  }
+  const rc = validation.validateContext(
+    {
+      ...env,
+      GITHUB_REF: 'refs/tags/v1.2.3-rc.1',
+      WORKFLOW_REF:
+        'example-org/example-repo/.github/workflows/release.yml@refs/tags/v1.2.3-rc.1',
+      CANDIDATE_ALLOWLIST: sha,
+      LOCAL_REF: 'refs/heads/main',
+    },
+    policy
+  )
+  const rcApi = async (path) =>
+    path.includes('/git/ref/tags/')
+      ? { ref: rc.ref, object: { type: 'commit', sha } }
+      : sourceApi()(path)
+  assert.equal((await validation.admit(rc, rcApi)).source_eligibility, false)
+})
+
+const requiredNames = [
+  'Release validation admission',
+  'Release validation Fastly',
+]
+const run = () => ({
+  id: 123,
+  run_attempt: 2,
+  head_sha: sha,
+  head_branch: 'v1.2.3',
+  event: 'push',
+  path: '.github/workflows/release.yml',
+  created_at: '2026-01-01T00:00:00Z',
+  repository: { full_name: policy.repository, id: 99999, owner: { id: 99998 } },
+})
+const jobs = () => ({
+  total_count: 2,
+  jobs: requiredNames.map((name, index) => ({
+    id: index + 1,
+    name: `caller / ${name}`,
+    run_id: 123,
+    run_attempt: 2,
+    head_sha: sha,
+    status: 'completed',
+    conclusion: 'success',
+  })),
+})
+test('waiter binds exact gates to own run attempt and fails closed on every terminal outcome', async (t) => {
+  assert.equal(typeof validation.inspectJobs, 'function')
+  assert.equal(validation.inspectJobs(context(), jobs(), requiredNames), true)
+  for (const change of [
+    { run_id: 124 },
+    { run_attempt: 1 },
+    { head_sha: 'b'.repeat(40) },
+    { conclusion: 'skipped' },
+    { conclusion: 'cancelled' },
+    { conclusion: 'timed_out' },
+    { conclusion: 'failure' },
+    { name: 'unrelated success' },
+  ]) {
+    await t.test(`gate rejects or waits for ${JSON.stringify(change)}`, () => {
+      const body = jobs()
+      Object.assign(body.jobs[0], change)
+      if (change.name)
+        assert.equal(
+          validation.inspectJobs(context(), body, requiredNames),
+          false
+        )
+      else
+        assert.throws(() =>
+          validation.inspectJobs(context(), body, requiredNames)
+        )
+    })
+  }
+  const duplicate = jobs()
+  duplicate.jobs[1].name = duplicate.jobs[0].name
+  assert.throws(
+    () => validation.inspectJobs(context(), duplicate, requiredNames),
+    /Duplicate/
+  )
+  assert.throws(
+    () =>
+      validation.inspectJobs(
+        context(),
+        { ...jobs(), total_count: 101 },
+        requiredNames
+      ),
+    /truncated/
+  )
+  const pending = jobs()
+  pending.jobs[0].status = 'queued'
+  pending.jobs[0].conclusion = null
+  assert.equal(validation.inspectJobs(context(), pending, requiredNames), false)
+})
+test('waiter deadline includes queue time and successful gates never approve governance', async (t) => {
+  assert.equal(typeof validation.wait, 'function')
+  const api = async (path) =>
+    path.endsWith('/jobs?per_page=100')
+      ? jobs()
+      : path.includes('/actions/runs/')
+        ? run()
+        : sourceApi()(path)
+  const options = {
+    api,
+    requiredNames,
+    now: () => Date.parse('2026-01-01T00:01:00Z'),
+    monotonic: () => 100,
+    sleep: async () => {},
+  }
+  await assert.rejects(
+    validation.wait(context(), options),
+    /missing independently approved governance/
+  )
+  await assert.rejects(
+    validation.wait(context(), {
+      ...options,
+      now: () => Date.parse('2026-01-01T01:30:00Z'),
+    }),
+    /90 minute/
+  )
+  for (const change of [
+    { run_attempt: 1 },
+    { head_sha: 'b'.repeat(40) },
+    { event: 'workflow_dispatch' },
+    { head_branch: 'main' },
+    {
+      repository: {
+        full_name: policy.repository,
+        id: 99997,
+        owner: { id: 99998 },
+      },
+    },
+  ]) {
+    await t.test(`rejects run ${JSON.stringify(change)}`, async () =>
+      assert.rejects(
+        validation.wait(context(), {
+          ...options,
+          api: async (path) =>
+            path.includes('/actions/runs/') && !path.includes('/jobs?')
+              ? { ...run(), ...change }
+              : api(path),
+        }),
+        change.repository
+          ? /Run repository identity mismatch/
+          : /Run must match/
+      )
+    )
+  }
+  let elapsed = 0
+  const queued = jobs()
+  queued.jobs[0].status = 'queued'
+  queued.jobs[0].conclusion = null
+  await assert.rejects(
+    validation.wait(context(), {
+      ...options,
+      api: async (path) =>
+        path.endsWith('/jobs?per_page=100') ? queued : api(path),
+      now: () => Date.parse('2026-01-01T01:29:59Z'),
+      monotonic: () => elapsed,
+      sleep: async (ms) => {
+        elapsed += ms
+      },
+    }),
+    /90 minute/
+  )
+})
+
+test('transport fixes origin, blocks redirects and pagination, bounds body, and keeps credentials out of errors', async () => {
+  assert.equal(typeof validation.createApi, 'function')
+  let seen
+  const api = validation.createApi('example-token', async (url, options) => {
+    seen = { url, options }
+    return new Response('{"value":1}')
+  })
+  assert.deepEqual(
+    await api('/repos/example-org/example-repo/git/ref/heads/main'),
+    { value: 1 }
+  )
+  assert.equal(
+    seen.url,
+    `${validation.apiOrigin}/repos/example-org/example-repo/git/ref/heads/main`
+  )
+  assert.equal(seen.options.redirect, 'error')
+  assert.equal(seen.options.headers.Authorization, 'Bearer example-token')
+  assert.ok(seen.options.signal instanceof AbortSignal)
+  assert.throws(() => validation.createApi(''))
+  await assert.rejects(api('https://example.com/'), /path/)
+  for (const response of [
+    new Response('{}', { status: 302 }),
+    new Response('{}', {
+      headers: { link: '<https://example.com/>; rel="next"' },
+    }),
+    new Response('x'.repeat(2 * 1024 * 1024 + 1)),
+    new Response('{}', { headers: { 'content-length': '9999999' } }),
+  ]) {
+    await assert.rejects(
+      validation.createApi(
+        'example-token',
+        async () => response
+      )('/repos/example-org/example-repo/git/ref/heads/main')
+    )
+  }
+  await assert.rejects(
+    validation.createApi('example-token', async () => {
+      throw new Error('example-token')
+    })('/repos/example-org/example-repo/git/ref/heads/main'),
+    (error) => !error.message.includes('example-token')
+  )
+})
+
+test('tag byte length matches the consumer maximum', () => {
+  const tag = `v1.2.3+${'a'.repeat(122)}`
+  assert.throws(
+    () =>
+      validation.validateContext(
+        {
+          ...env,
+          GITHUB_REF: `refs/tags/${tag}`,
+          WORKFLOW_REF: `${policy.repository}/.github/workflows/release.yml@refs/tags/${tag}`,
+        },
+        policy
+      ),
+    /128/
+  )
+})
+
+test('attempt endpoint supports documented jobs without a job attempt field', async () => {
+  const body = jobs()
+  for (const job of body.jobs) delete job.run_attempt
+  assert.equal(validation.inspectJobs(context(), body, requiredNames), true)
+})
+
+for (const conclusion of ['skipped', 'cancelled', 'timed_out']) {
+  test(`${conclusion} gate tells operators to rerun all jobs`, () => {
+    const body = jobs()
+    body.jobs[0].conclusion = conclusion
+    assert.throws(
+      () => validation.inspectJobs(context(), body, requiredNames),
+      /Rerun all jobs/
+    )
+  })
+}
+
+test('all waiter reads receive the remaining global deadline including source reads', async () => {
+  let elapsed = 0
+  const calls = []
+  const api = async (path, remaining) => {
+    calls.push({ path, remaining })
+    assert.ok(remaining > 0 && remaining <= 5400000)
+    elapsed += 1
+    return path.endsWith('/jobs?per_page=100')
+      ? jobs()
+      : path.includes('/actions/runs/')
+        ? run()
+        : sourceApi()(path)
+  }
+  await assert.rejects(
+    validation.wait(context(), {
+      api,
+      requiredNames,
+      now: () => Date.parse('2026-01-01T01:29:59Z'),
+      monotonic: () => elapsed,
+    }),
+    /missing independently approved governance/
+  )
+  assert.equal(calls.length, 6)
+  assert.ok(calls.slice(1).every(({ remaining }) => remaining <= 1000))
+})
+
+test('API request abort is clipped to the remaining global budget', async (t) => {
+  t.mock.timers.enable({ apis: ['setTimeout'] })
+  let signal
+  const api = validation.createApi('example-token', async (_url, options) => {
+    signal = options.signal
+    return new Promise((_resolve, reject) =>
+      signal.addEventListener('abort', () => reject(new Error('aborted')), {
+        once: true,
+      })
+    )
+  })
+  const pending = api('/repos/example-org/example-repo/git/ref/heads/main', 10)
+  t.mock.timers.tick(10)
+  assert.equal(signal.aborted, true)
+  await assert.rejects(pending, /rerun|Rerun/)
+})
+
+test('run path accepts only exact bare caller or caller at the current tag', async () => {
+  const api = async (path) =>
+    path.endsWith('/jobs?per_page=100')
+      ? jobs()
+      : path.includes('/actions/runs/')
+        ? { ...run(), path: `.github/workflows/release.yml@${env.GITHUB_REF}` }
+        : sourceApi()(path)
+  await assert.rejects(
+    validation.wait(context(), {
+      api,
+      requiredNames,
+      now: () => Date.parse('2026-01-01T00:01:00Z'),
+    }),
+    /missing independently approved governance/
+  )
+})
+
+test('retry does not reset the queue inclusive deadline and explains fresh invocation requirement', async () => {
+  const api = async () => ({ ...run(), run_started_at: '2026-01-01T02:00:00Z' })
+  await assert.rejects(
+    validation.wait(context(), {
+      api,
+      now: () => Date.parse('2026-01-01T02:00:00Z'),
+    }),
+    /fresh trusted invocation/
+  )
+})
+
+for (const extra of [
+  { CANDIDATE_ALLOWLIST: sha },
+  { LOCAL_REF: 'refs/heads/main' },
+]) {
+  test(`unlisted RC remains ineligible despite ${Object.keys(extra)[0]}`, async () => {
+    const tag = 'v1.2.3-rc.1'
+    const current = validation.validateContext(
+      {
+        ...env,
+        ...extra,
+        GITHUB_REF: `refs/tags/${tag}`,
+        WORKFLOW_REF: `${policy.repository}/.github/workflows/release.yml@refs/tags/${tag}`,
+      },
+      policy
+    )
+    const api = async (path) =>
+      path.includes('/git/ref/tags/')
+        ? { ref: current.ref, object: { type: 'commit', sha } }
+        : sourceApi()(path)
+    assert.equal(
+      (await validation.admit(current, api)).source_eligibility,
+      false
+    )
+  })
+}
+
+test('admission composes with bounded transport through the remote compare endpoint', async () => {
+  const paths = []
+  const api = validation.createApi('example-token', async (url) => {
+    const path = new URL(url).pathname
+    paths.push(path)
+    return Response.json(await sourceApi()(path))
+  })
+  assert.deepEqual(await validation.admit(context(), api), {
+    source_eligibility: false,
+    diagnostic: validation.governanceGap,
+  })
+  assert.equal(paths.length, 3)
+  assert.ok(paths[2].endsWith(`/compare/${sha}...${'b'.repeat(40)}`))
+})
diff --git a/.github/workflows/release-validation.yml b/.github/workflows/release-validation.yml
new file mode 100644
index 0000000000..350d093c2c
--- /dev/null
+++ b/.github/workflows/release-validation.yml
@@ -0,0 +1,428 @@
+# Callable quality validation only. No release trigger or publication authority.
+# Governance approval is not configured: the terminal result remains closed.
+name: Release validation
+
+on:
+  workflow_call:
+    inputs:
+      source_sha:
+        description: Exact lowercase source commit; must equal the caller revision.
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  admission:
+    name: Release validation admission
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 (Node 24)
+        with:
+          ref: ${{ inputs.source_sha }}
+          persist-credentials: false
+      - name: Read pinned Node version
+        id: node
+        shell: bash
+        run: echo "version=$(awk '$1 == "nodejs" { print $2 }' .tool-versions)" >> "$GITHUB_OUTPUT"
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 (Node 24)
+        with:
+          node-version: ${{ steps.node.outputs.version }}
+      - name: Check same-commit invocation and remote lightweight tag
+        env:
+          SOURCE_SHA: ${{ inputs.source_sha }}
+          WORKFLOW_SHA: ${{ github.workflow_sha }}
+          WORKFLOW_REF: ${{ github.workflow_ref }}
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          node .github/workflows/release-validation.mjs admit
+
+  fastly:
+    name: Release validation Fastly
+    needs: admission
+    runs-on: ubuntu-24.04
+    timeout-minutes: 75
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 (Node 24)
+        with:
+          ref: ${{ inputs.source_sha }}
+          persist-credentials: false
+      - name: Read pinned Node version
+        id: node
+        shell: bash
+        run: echo "version=$(awk '$1 == "nodejs" { print $2 }' .tool-versions)" >> "$GITHUB_OUTPUT"
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 (Node 24)
+        with:
+          node-version: ${{ steps.node.outputs.version }}
+      # Shell installation follows the existing native release-tool gate and
+      # avoids inheriting floating composite-action dependencies or shared caches.
+      - name: Install pinned Rust toolchain
+        shell: bash
+        run: |
+          set -euo pipefail
+          RUST_VERSION="$(awk '$1 == "rust" { print $2 }' .tool-versions)"
+          rustup toolchain install "$RUST_VERSION" --profile minimal --component clippy,rustfmt --target wasm32-wasip1
+          rustup override set "$RUST_VERSION"
+          HOST_TARGET="$(rustc -vV | sed -n 's/^host: //p')"
+          test -n "$HOST_TARGET"
+          echo "HOST_TARGET=$HOST_TARGET" >> "$GITHUB_ENV"
+      - name: Install JavaScript build dependencies
+        shell: bash
+        run: |
+          npm ci --prefix crates/trusted-server-js/lib
+      - name: Install pinned Viceroy
+        shell: bash
+        run: |
+          VICEROY_VERSION="$(awk '$1 == "viceroy" { print $2 }' .tool-versions)"
+          cargo install viceroy --version "$VICEROY_VERSION" --locked --force
+      - name: Run Fastly gates
+        shell: bash
+        run: |
+          set -euo pipefail
+          cargo test-fastly
+          cargo test-fastly-reuse
+          cargo clippy-fastly
+          BID_DELAY=3 ./scripts/template-cache-local-test.sh esi
+          BID_DELAY=3 ./scripts/template-cache-local-test.sh inline
+          BID_DELAY=3 ./scripts/template-cache-local-test.sh purge
+
+  native:
+    name: Release validation native and parity
+    needs: admission
+    runs-on: ubuntu-24.04
+    timeout-minutes: 75
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 (Node 24)
+        with:
+          ref: ${{ inputs.source_sha }}
+          persist-credentials: false
+      - name: Read pinned Node version
+        id: node
+        shell: bash
+        run: echo "version=$(awk '$1 == "nodejs" { print $2 }' .tool-versions)" >> "$GITHUB_OUTPUT"
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 (Node 24)
+        with:
+          node-version: ${{ steps.node.outputs.version }}
+      # Shell installation follows the existing native release-tool gate and
+      # avoids inheriting floating composite-action dependencies or shared caches.
+      - name: Install pinned Rust toolchain
+        shell: bash
+        run: |
+          set -euo pipefail
+          RUST_VERSION="$(awk '$1 == "rust" { print $2 }' .tool-versions)"
+          rustup toolchain install "$RUST_VERSION" --profile minimal --component clippy,rustfmt --target wasm32-wasip1
+          rustup override set "$RUST_VERSION"
+          HOST_TARGET="$(rustc -vV | sed -n 's/^host: //p')"
+          test -n "$HOST_TARGET"
+          echo "HOST_TARGET=$HOST_TARGET" >> "$GITHUB_ENV"
+      - name: Install JavaScript build dependencies
+        shell: bash
+        run: |
+          npm ci --prefix crates/trusted-server-js/lib
+      - name: Install native trust test tools
+        shell: bash
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes libnss3-tools openssl
+      - name: Run native and parity gates
+        shell: bash
+        run: |
+          set -euo pipefail
+          cargo fmt --all -- --check
+          cargo build -p trusted-server-adapter-axum
+          cargo test-axum
+          cargo clippy-axum
+          cargo test -p trusted-server-core --test template_build_digest
+          cargo clippy -p trusted-server-core --test template_build_digest -- -D warnings
+          cargo bench -p trusted-server-core --bench html_processor_bench -- --test
+          ./scripts/test-cli.sh
+          cargo clippy-cli
+          cargo test -p trusted-server-openrtb-codegen --target "$HOST_TARGET"
+          cargo clippy-codegen
+          cargo fmt --manifest-path crates/trusted-server-integration-tests/Cargo.toml -- --check
+          cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test parity
+          cargo clippy --manifest-path crates/trusted-server-integration-tests/Cargo.toml --all-targets -- -D warnings
+          cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
+      - name: Guard and run real NSS trust fixtures
+        shell: bash
+        run: |
+          set -euo pipefail
+          TEST_LIST="$(mktemp)"
+          trap 'rm -f "$TEST_LIST"' EXIT
+          cargo test --package trusted-server-cli --target "$HOST_TARGET" --test proxy_trust_linux -- --ignored --list > "$TEST_LIST"
+          awk '/: test$/ { count++ } END { if (count == 0) exit 1 }' "$TEST_LIST"
+          cargo test --package trusted-server-cli --target "$HOST_TARGET" --test proxy_trust_linux -- --ignored
+
+  runtimes:
+    name: Release validation Cloudflare and Spin
+    needs: admission
+    runs-on: ubuntu-24.04
+    timeout-minutes: 75
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 (Node 24)
+        with:
+          ref: ${{ inputs.source_sha }}
+          persist-credentials: false
+      - name: Read pinned Node version
+        id: node
+        shell: bash
+        run: echo "version=$(awk '$1 == "nodejs" { print $2 }' .tool-versions)" >> "$GITHUB_OUTPUT"
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 (Node 24)
+        with:
+          node-version: ${{ steps.node.outputs.version }}
+      # Shell installation follows the existing native release-tool gate and
+      # avoids inheriting floating composite-action dependencies or shared caches.
+      - name: Install pinned Rust toolchain
+        shell: bash
+        run: |
+          set -euo pipefail
+          RUST_VERSION="$(awk '$1 == "rust" { print $2 }' .tool-versions)"
+          rustup toolchain install "$RUST_VERSION" --profile minimal --component clippy,rustfmt --target wasm32-wasip1,wasm32-unknown-unknown
+          rustup override set "$RUST_VERSION"
+          HOST_TARGET="$(rustc -vV | sed -n 's/^host: //p')"
+          test -n "$HOST_TARGET"
+          echo "HOST_TARGET=$HOST_TARGET" >> "$GITHUB_ENV"
+      - name: Install JavaScript build dependencies
+        shell: bash
+        run: |
+          npm ci --prefix crates/trusted-server-js/lib
+      - name: Run Cloudflare and Spin gates
+        shell: bash
+        run: |
+          set -euo pipefail
+          cargo check -p trusted-server-adapter-cloudflare
+          cargo check-cloudflare
+          cargo test-cloudflare
+          cargo clippy-cloudflare
+          cargo clippy-cloudflare-wasm
+          scripts/lint-wasm-clock.sh
+          cargo check -p trusted-server-adapter-spin
+          cargo check-spin
+          cargo test-spin
+          cargo clippy-spin-native
+          cargo clippy-spin-wasm
+      - name: Build Spin release artifact
+        env:
+          TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:8080
+          TRUSTED_SERVER__PUBLISHER__PROXY_SECRET: example-integration-secret
+          TRUSTED_SERVER__EC__PASSPHRASE: example-ec-passphrase-padded-to-32
+          TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: 'false'
+        shell: bash
+        run: |
+          cargo build --package trusted-server-adapter-spin --target wasm32-wasip1 --features spin --release
+
+  release-tool-linux:
+    name: Release validation release tool Linux
+    needs: admission
+    runs-on: ubuntu-24.04
+    timeout-minutes: 75
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 (Node 24)
+        with:
+          ref: ${{ inputs.source_sha }}
+          persist-credentials: false
+      - name: Read pinned Node version
+        id: node
+        shell: bash
+        run: echo "version=$(awk '$1 == "nodejs" { print $2 }' .tool-versions)" >> "$GITHUB_OUTPUT"
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 (Node 24)
+        with:
+          node-version: ${{ steps.node.outputs.version }}
+      # Shell installation follows the existing native release-tool gate and
+      # avoids inheriting floating composite-action dependencies or shared caches.
+      - name: Install pinned Rust toolchain
+        shell: bash
+        run: |
+          set -euo pipefail
+          RUST_VERSION="$(awk '$1 == "rust" { print $2 }' .tool-versions)"
+          rustup toolchain install "$RUST_VERSION" --profile minimal --component clippy,rustfmt
+          rustup override set "$RUST_VERSION"
+          HOST_TARGET="$(rustc -vV | sed -n 's/^host: //p')"
+          test -n "$HOST_TARGET"
+          echo "HOST_TARGET=$HOST_TARGET" >> "$GITHUB_ENV"
+      - name: Install JavaScript build dependencies
+        shell: bash
+        run: |
+          npm ci --prefix crates/trusted-server-js/lib
+      - name: Check the reviewed workflow contract
+        shell: bash
+        run: |
+          set -euo pipefail
+          cargo run --package trusted-server-release --target "$HOST_TARGET" --locked -- check-workflow-contract --workflow .github/workflows/release-validation.yml
+      - name: Guard and run host release-tool and prebuilt gates
+        shell: bash
+        run: |
+          set -euo pipefail
+          TEST_LIST="$(mktemp)"
+          trap 'rm -f "$TEST_LIST"' EXIT
+          cargo test -p trusted-server-release --target "$HOST_TARGET" --all-features --locked -- --list > "$TEST_LIST"
+          awk '/: test$/ { count++ } END { if (count == 0) exit 1 }' "$TEST_LIST"
+          cargo test -p trusted-server-release --target "$HOST_TARGET" --all-features --locked
+          cargo clippy -p trusted-server-release --target "$HOST_TARGET" --all-targets --all-features --locked -- -D warnings
+          cargo doc -p trusted-server-release --target "$HOST_TARGET" --no-deps --all-features --locked
+          cargo test -p trusted-server-js --target "$HOST_TARGET" --test release_prebuilt --locked -- --list > "$TEST_LIST"
+          awk '/: test$/ { count++ } END { if (count == 0) exit 1 }' "$TEST_LIST"
+          cargo test -p trusted-server-js --target "$HOST_TARGET" --test release_prebuilt --locked
+          cargo clippy -p trusted-server-js --target "$HOST_TARGET" --all-targets --all-features --locked -- -D warnings
+
+  release-tool-macos:
+    name: Release validation release tool macOS
+    needs: admission
+    runs-on: macos-15
+    timeout-minutes: 75
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 (Node 24)
+        with:
+          ref: ${{ inputs.source_sha }}
+          persist-credentials: false
+      - name: Read pinned Node version
+        id: node
+        shell: bash
+        run: echo "version=$(awk '$1 == "nodejs" { print $2 }' .tool-versions)" >> "$GITHUB_OUTPUT"
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 (Node 24)
+        with:
+          node-version: ${{ steps.node.outputs.version }}
+      # Shell installation follows the existing native release-tool gate and
+      # avoids inheriting floating composite-action dependencies or shared caches.
+      - name: Install pinned Rust toolchain
+        shell: bash
+        run: |
+          set -euo pipefail
+          RUST_VERSION="$(awk '$1 == "rust" { print $2 }' .tool-versions)"
+          rustup toolchain install "$RUST_VERSION" --profile minimal --component clippy,rustfmt
+          rustup override set "$RUST_VERSION"
+          HOST_TARGET="$(rustc -vV | sed -n 's/^host: //p')"
+          test -n "$HOST_TARGET"
+          echo "HOST_TARGET=$HOST_TARGET" >> "$GITHUB_ENV"
+      - name: Install JavaScript build dependencies
+        shell: bash
+        run: |
+          npm ci --prefix crates/trusted-server-js/lib
+      - name: Check the reviewed workflow contract
+        shell: bash
+        run: |
+          set -euo pipefail
+          cargo run --package trusted-server-release --target "$HOST_TARGET" --locked -- check-workflow-contract --workflow .github/workflows/release-validation.yml
+      - name: Guard and run host release-tool and prebuilt gates
+        shell: bash
+        run: |
+          set -euo pipefail
+          TEST_LIST="$(mktemp)"
+          trap 'rm -f "$TEST_LIST"' EXIT
+          cargo test -p trusted-server-release --target "$HOST_TARGET" --all-features --locked -- --list > "$TEST_LIST"
+          awk '/: test$/ { count++ } END { if (count == 0) exit 1 }' "$TEST_LIST"
+          cargo test -p trusted-server-release --target "$HOST_TARGET" --all-features --locked
+          cargo clippy -p trusted-server-release --target "$HOST_TARGET" --all-targets --all-features --locked -- -D warnings
+          cargo doc -p trusted-server-release --target "$HOST_TARGET" --no-deps --all-features --locked
+          cargo test -p trusted-server-js --target "$HOST_TARGET" --test release_prebuilt --locked -- --list > "$TEST_LIST"
+          awk '/: test$/ { count++ } END { if (count == 0) exit 1 }' "$TEST_LIST"
+          cargo test -p trusted-server-js --target "$HOST_TARGET" --test release_prebuilt --locked
+          cargo clippy -p trusted-server-js --target "$HOST_TARGET" --all-targets --all-features --locked -- -D warnings
+
+  javascript:
+    name: Release validation JavaScript
+    needs: admission
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 (Node 24)
+        with:
+          ref: ${{ inputs.source_sha }}
+          persist-credentials: false
+      - name: Read pinned Node version
+        id: node
+        shell: bash
+        run: echo "version=$(awk '$1 == "nodejs" { print $2 }' .tool-versions)" >> "$GITHUB_OUTPUT"
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 (Node 24)
+        with:
+          node-version: ${{ steps.node.outputs.version }}
+      - name: Run JavaScript gates
+        env:
+          TRUSTED_SERVER__RELEASE_JS_TESTS: '1'
+        shell: bash
+        run: |
+          set -euo pipefail
+          npm ci --prefix crates/trusted-server-js/lib
+          npm run build --prefix crates/trusted-server-js/lib
+          npm test --prefix crates/trusted-server-js/lib -- --run
+          npm run lint --prefix crates/trusted-server-js/lib
+          npm run format --prefix crates/trusted-server-js/lib
+          node --test .github/workflows/release-validation.test.mjs
+
+  docs:
+    name: Release validation docs
+    needs: admission
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 (Node 24)
+        with:
+          ref: ${{ inputs.source_sha }}
+          persist-credentials: false
+      - name: Read pinned Node version
+        id: node
+        shell: bash
+        run: echo "version=$(awk '$1 == "nodejs" { print $2 }' .tool-versions)" >> "$GITHUB_OUTPUT"
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 (Node 24)
+        with:
+          node-version: ${{ steps.node.outputs.version }}
+      - name: Run documentation and proposal gates
+        shell: bash
+        run: |
+          set -euo pipefail
+          npm ci --prefix docs
+          npm run lint --prefix docs
+          npm run format --prefix docs
+          docs/node_modules/.bin/prettier --config docs/.prettierrc --check "*.md" ".claude/**/*.md" ".github/**/*.md" "crates/**/*.md" "scripts/**/*.md" "scripts/**/*.mjs" "tinybird/**/*.md"
+          npm run build --prefix docs
+          shellcheck scripts/docs-proposal/*.sh
+          node --test scripts/docs-proposal/hunks.test.mjs
+          scripts/docs-proposal/test.sh
+      - name: Verify instruction symlink and shared Rust setup policy
+        shell: bash
+        run: |
+          set -euo pipefail
+          test "$(git ls-tree HEAD CLAUDE.md | awk '{print $1}')" = 120000
+          test "$(git cat-file blob HEAD:CLAUDE.md)" = AGENTS.md
+          test -f AGENTS.md
+          if grep -rnE "uses:[[:space:]]*[\"']?(actions-rust-lang/setup-rust-toolchain|Swatinem/rust-cache)@" .github | grep -v '^\.github/actions/setup-rust/action\.yml:'; then
+            echo 'Use the shared Rust setup action rather than direct external Rust setup actions.' >&2
+            exit 1
+          fi
+
+  terminal-results:
+    name: Release validation terminal results
+    permissions:
+      contents: read
+      actions: read
+    needs: admission
+    runs-on: ubuntu-24.04
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 (Node 24)
+        with:
+          ref: ${{ inputs.source_sha }}
+          persist-credentials: false
+      - name: Read pinned Node version
+        id: node
+        shell: bash
+        run: echo "version=$(awk '$1 == "nodejs" { print $2 }' .tool-versions)" >> "$GITHUB_OUTPUT"
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 (Node 24)
+        with:
+          node-version: ${{ steps.node.outputs.version }}
+      - name: Wait for this invocation and retain the governance block
+        env:
+          SOURCE_SHA: ${{ inputs.source_sha }}
+          WORKFLOW_SHA: ${{ github.workflow_sha }}
+          WORKFLOW_REF: ${{ github.workflow_ref }}
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          node .github/workflows/release-validation.mjs wait
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b27173dd66..e85f165ab4 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,4 +1,4 @@
-name: "Run Tests"
+name: 'Run Tests'
 
 permissions:
   contents: read
@@ -7,6 +7,11 @@ on:
   push:
     branches: [main]
   pull_request:
+  # The scheduled and dispatched runs measure the native CLI reproduction
+  # builds that push and pull request runs defer (TS_RELEASE_NATIVE_REPRODUCTION).
+  schedule:
+    - cron: '23 4 * * *'
+  workflow_dispatch:
 
 jobs:
   test-rust:
@@ -20,12 +25,12 @@ jobs:
         id: viceroy-version
         # `.tool-versions` is the single source of truth so this workflow and
         # `.github/actions/setup-integration-test-env/action.yml` can't drift.
-        run: echo "viceroy-version=$(grep '^viceroy ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        run: echo "viceroy-version=$(grep '^viceroy ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
         shell: bash
 
       - name: Retrieve Node.js version
         id: node-version
-        run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
         shell: bash
 
       - name: Set up Rust toolchain
@@ -153,15 +158,13 @@ jobs:
         run: cargo check-spin
 
       - name: Build Spin adapter release WASM
-        # Mirror the Fastly release-build overrides so the artifact embeds usable
-        # settings instead of the trusted-server.toml placeholders, which startup
-        # rejects (falling back to the generic 503 router). This proves the
-        # documented Spin artifact can boot, not just compile.
+        # Compile the documented Spin artifact. Application settings and secrets
+        # are supplied separately at runtime; compilation does not prove startup.
         env:
           TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:8080
           TRUSTED_SERVER__PUBLISHER__PROXY_SECRET: integration-test-proxy-secret
           TRUSTED_SERVER__EC__PASSPHRASE: integration-test-ec-secret-padded-32
-          TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
+          TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: 'false'
         run: cargo build --package trusted-server-adapter-spin --target wasm32-wasip1 --features spin --release
 
       - name: Run Spin adapter tests (native host)
@@ -201,7 +204,7 @@ jobs:
       - name: Set up Rust toolchain
         uses: ./.github/actions/setup-rust
         with:
-          components: "clippy, rustfmt"
+          components: 'clippy, rustfmt'
           cache-key: cargo-cli
 
       - name: Read pinned Node.js version for CLI fixtures
@@ -256,6 +259,1060 @@ jobs:
           cargo test --manifest-path crates/trusted-server-cli/Cargo.toml --target "$TARGET" \
             --test proxy_trust_linux -- --ignored
 
+  # Ordinary source-built behavior checks; this matrix is not release qualification.
+  test-release-native:
+    name: cargo test (release tooling and JS prebuilt, native)
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, macos-15]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 (Node 24)
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Read pinned tool versions
+        id: tools
+        shell: bash
+        run: |
+          set -euo pipefail
+          echo "rust=$(awk '$1 == "rust" { print $2 }' .tool-versions)" >> "$GITHUB_OUTPUT"
+          echo "node=$(awk '$1 == "nodejs" { print $2 }' .tool-versions)" >> "$GITHUB_OUTPUT"
+
+      - name: Use pinned Node.js
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 (Node 24)
+        with:
+          node-version: ${{ steps.tools.outputs.node }}
+          cache: npm
+          cache-dependency-path: crates/trusted-server-js/lib/package-lock.json
+
+      - name: Install JS dependencies
+        working-directory: crates/trusted-server-js/lib
+        run: npm ci
+
+      # The runner's installed rustup bootstraps ordinary CI, not the release producer.
+      - name: Install pinned native Rust toolchain
+        env:
+          RUST_VERSION: ${{ steps.tools.outputs.rust }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          rustup toolchain install "$RUST_VERSION" --profile minimal --component clippy
+          rustup override set "$RUST_VERSION"
+          HOST_TARGET="$(rustc -vV | sed -n 's/^host: //p')"
+          test -n "$HOST_TARGET"
+          echo "HOST_TARGET=$HOST_TARGET" >> "$GITHUB_ENV"
+
+      - name: Guard and run all native release-tool tests
+        shell: bash
+        run: |
+          set -euo pipefail
+          TEST_LIST="$(mktemp)"
+          trap 'rm -f "$TEST_LIST"' EXIT
+          cargo test -p trusted-server-release --target "$HOST_TARGET" --all-features -- --list > "$TEST_LIST"
+          awk '/: test$/ { count++ } END { if (count == 0) { print "No native release-tool tests selected"; exit 1 } print "Selected " count " native release-tool tests" }' "$TEST_LIST"
+          cargo test -p trusted-server-release --target "$HOST_TARGET" --all-features
+          cargo clippy -p trusted-server-release --target "$HOST_TARGET" --all-targets --all-features -- -D warnings
+          cargo doc -p trusted-server-release --target "$HOST_TARGET" --no-deps --all-features
+
+      - name: Prepare original-only full JS fixture (Linux)
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          set -euo pipefail
+          cargo build -p trusted-server-release --target "$HOST_TARGET" --locked
+          FIXTURE_ROOT="$RUNNER_TEMP/release-js-original-fixture"
+          node scripts/release/tests/prepare-js-fixture.mjs "$FIXTURE_ROOT" "target/$HOST_TARGET/debug/trusted-server-release"
+          echo "TS_RELEASE_JS_FIXTURE_ROOT=$FIXTURE_ROOT" >> "$GITHUB_ENV"
+
+      - name: Prove two fresh offline JS builds (Linux)
+        if: runner.os == 'Linux'
+        shell: bash
+        env:
+          # Optimize repeated whole-input hashes with test safety checks retained.
+          CARGO_PROFILE_TEST_OPT_LEVEL: '2'
+          CARGO_PROFILE_TEST_DEBUG_ASSERTIONS: 'true'
+          CARGO_PROFILE_TEST_OVERFLOW_CHECKS: 'true'
+        run: |
+          set -euo pipefail
+          TEST_NAME=preparation::tests::full::real_two_fresh_js_builds
+          TEST_LIST="$(mktemp)"
+          trap 'rm -f "$TEST_LIST"' EXIT
+          cargo test -p trusted-server-release --target "$HOST_TARGET" --locked "$TEST_NAME" -- --ignored --exact --list > "$TEST_LIST"
+          awk '/: test$/ { count++ } END { if (count != 1) { print "Expected exactly one full JS execution fixture"; exit 1 } }' "$TEST_LIST"
+          cargo test -p trusted-server-release --target "$HOST_TARGET" --locked "$TEST_NAME" -- --ignored --exact --nocapture
+          cat "$TS_RELEASE_JS_FIXTURE_ROOT/js-execution-measurement.json"
+
+      - name: Guard and run native JS prebuilt tests
+        shell: bash
+        run: |
+          set -euo pipefail
+          TEST_LIST="$(mktemp)"
+          trap 'rm -f "$TEST_LIST"' EXIT
+          cargo test -p trusted-server-js --target "$HOST_TARGET" --test release_prebuilt -- --list > "$TEST_LIST"
+          awk '/: test$/ { count++ } END { if (count == 0) { print "No native JS prebuilt tests selected"; exit 1 } print "Selected " count " native JS prebuilt tests" }' "$TEST_LIST"
+          cargo test -p trusted-server-js --target "$HOST_TARGET" --test release_prebuilt
+          cargo clippy -p trusted-server-js --target "$HOST_TARGET" --all-targets --all-features -- -D warnings
+
+  # Ordinary CI candidate evidence of the confined Cargo recipe; this job is
+  # not release qualification (every measurement reports it as such).
+  test-release-cargo-candidate:
+    name: cargo test (confined release Cargo candidate, Linux)
+    runs-on: ubuntu-24.04
+    # Fixture preparation, two fresh JS builds (~12 min), then two confined
+    # Fastly builds each with its own vendoring (~3-4 min each) and the
+    # final-byte comparison: 45 minutes left too little headroom. The
+    # uncached Viceroy install (~5-8 min) and three gate runs add to that.
+    timeout-minutes: 75
+    outputs:
+      # CI-internal descriptor of the uploaded candidate entry, for the
+      # candidate index collector; not a release schema.
+      candidate-entry: ${{ steps.describe-entry.outputs.candidate-entry }}
+    env:
+      # Optimize repeated whole-input hashes with test safety checks retained.
+      CARGO_PROFILE_TEST_OPT_LEVEL: '2'
+      CARGO_PROFILE_TEST_DEBUG_ASSERTIONS: 'true'
+      CARGO_PROFILE_TEST_OVERFLOW_CHECKS: 'true'
+      TS_RELEASE_CANDIDATE_ENTRY_UPLOAD: candidate-entry-trusted-server-fastly.wasm-${{ github.run_id }}-${{ github.run_attempt }}
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 (Node 24)
+        with:
+          persist-credentials: false
+          # Full history: the fixtures clone this checkout, and source
+          # authentication rejects a shallow repository (`.git/shallow`).
+          fetch-depth: 0
+
+      - name: Read pinned tool versions
+        id: tools
+        shell: bash
+        run: |
+          set -euo pipefail
+          {
+            echo "rust=$(awk '$1 == "rust" { print $2 }' .tool-versions)"
+            echo "node=$(awk '$1 == "nodejs" { print $2 }' .tool-versions)"
+            echo "viceroy=$(awk '$1 == "viceroy" { print $2 }' .tool-versions)"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Use pinned Node.js
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 (Node 24)
+        with:
+          node-version: ${{ steps.tools.outputs.node }}
+          cache: npm
+          cache-dependency-path: crates/trusted-server-js/lib/package-lock.json
+
+      # The runner's installed rustup bootstraps ordinary CI, not the release producer.
+      - name: Install pinned native Rust toolchain with the Wasm target
+        env:
+          RUST_VERSION: ${{ steps.tools.outputs.rust }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          rustup toolchain install "$RUST_VERSION" --profile minimal
+          rustup target add --toolchain "$RUST_VERSION" wasm32-wasip1
+          rustup override set "$RUST_VERSION"
+          HOST_TARGET="$(rustc -vV | sed -n 's/^host: //p')"
+          test -n "$HOST_TARGET"
+          echo "HOST_TARGET=$HOST_TARGET" >> "$GITHUB_ENV"
+
+      # Restores the host release-tool build (third-party rlibs; Cargo still
+      # rebuilds trusted-server-release from the checkout). This calls
+      # actions/cache directly, not ./.github/actions/setup-rust, which the
+      # format.yml guard requires for Rust caching elsewhere: these jobs
+      # install the pinned toolchain with rustup on purpose, and setup-rust
+      # would export RUSTFLAGS and other environment into the release tool.
+      # The guard only rejects setup-rust-toolchain and rust-cache steps.
+      # Only main saves (below), so a pull request restores only main's
+      # entry, never another pull request's. ~/.cargo/registry is never
+      # cached. A restored build stays ordinary CI evidence only: every
+      # measurement records `release_qualification: false` and the key.
+      - name: Restore the release-tool host build cache
+        id: release-tool-cache
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 (Node 24)
+        with:
+          path: target
+          key: release-tool-${{ runner.os }}-${{ env.HOST_TARGET }}-rust-${{ steps.tools.outputs.rust }}-${{ hashFiles('Cargo.lock', 'rust-toolchain.toml', '.tool-versions', 'crates/trusted-server-release/Cargo.toml') }}-test-o${{ env.CARGO_PROFILE_TEST_OPT_LEVEL }}-da${{ env.CARGO_PROFILE_TEST_DEBUG_ASSERTIONS }}-oc${{ env.CARGO_PROFILE_TEST_OVERFLOW_CHECKS }}
+
+      # Same pinned source install as the other Viceroy jobs, but uncached and
+      # into a private root: the runtime gate selects this exact absolute path,
+      # checks its reported version and records its digest.
+      - name: Install pinned Viceroy for the final-byte runtime gate
+        env:
+          VICEROY_VERSION: ${{ steps.tools.outputs.viceroy }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          test -n "$VICEROY_VERSION"
+          VICEROY_ROOT="$RUNNER_TEMP/release-viceroy"
+          cargo install viceroy --version "$VICEROY_VERSION" --locked --root "$VICEROY_ROOT"
+          test "$("$VICEROY_ROOT/bin/viceroy" --version)" = "viceroy $VICEROY_VERSION"
+          echo "TS_RELEASE_VICEROY=$VICEROY_ROOT/bin/viceroy" >> "$GITHUB_ENV"
+
+      - name: Prepare ordinary CI JS and Cargo fixtures
+        shell: bash
+        run: |
+          set -euo pipefail
+          cargo build -p trusted-server-release --target "$HOST_TARGET" --locked
+          # Build the test binary now so the cache below holds its dependencies.
+          cargo test -p trusted-server-release --target "$HOST_TARGET" --locked --no-run
+          PRODUCER="target/$HOST_TARGET/debug/trusted-server-release"
+          JS_FIXTURE_ROOT="$RUNNER_TEMP/release-js-original-fixture"
+          CARGO_FIXTURE_ROOT="$RUNNER_TEMP/release-cargo-fixture"
+          node scripts/release/tests/prepare-js-fixture.mjs "$JS_FIXTURE_ROOT" "$PRODUCER"
+          node scripts/release/tests/prepare-cargo-fixture.mjs "$CARGO_FIXTURE_ROOT" "$PRODUCER"
+          echo "TS_RELEASE_JS_FIXTURE_ROOT=$JS_FIXTURE_ROOT" >> "$GITHUB_ENV"
+          echo "TS_RELEASE_CARGO_FIXTURE_ROOT=$CARGO_FIXTURE_ROOT" >> "$GITHUB_ENV"
+          df -h "$RUNNER_TEMP"
+
+      # Saved before any ignored fixture test runs, so no fixture output can
+      # enter the cache. The Linux CLI and JS handoff jobs restore this same
+      # key without saving it.
+      - name: Drop incremental state before saving the host build cache
+        if: github.ref == 'refs/heads/main' && steps.release-tool-cache.outputs.cache-hit != 'true'
+        shell: bash
+        run: rm -rf target/debug/incremental target/*/debug/incremental
+
+      - name: Save the release-tool host build cache (main only)
+        if: github.ref == 'refs/heads/main' && steps.release-tool-cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 (Node 24)
+        with:
+          path: target
+          key: ${{ steps.release-tool-cache.outputs.cache-primary-key }}
+
+      - name: Prove Cargo build scripts and proc macros inherit denial (Linux)
+        env:
+          TS_RELEASE_CI_BUILD_CACHE: ${{ steps.release-tool-cache.outputs.cache-matched-key || 'miss' }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          TEST_NAME=recipe::tests::full::cargo_children_inherit_denial
+          TEST_LIST="$(mktemp)"
+          trap 'rm -f "$TEST_LIST"' EXIT
+          cargo test -p trusted-server-release --target "$HOST_TARGET" --locked "$TEST_NAME" -- --ignored --exact --list > "$TEST_LIST"
+          awk '/: test$/ { count++ } END { if (count != 1) { print "Expected exactly one Cargo denial fixture"; exit 1 } }' "$TEST_LIST"
+          cargo test -p trusted-server-release --target "$HOST_TARGET" --locked "$TEST_NAME" -- --ignored --exact --nocapture
+          cat "$TS_RELEASE_CARGO_FIXTURE_ROOT/cargo-denial-measurement.json"
+
+      # Before each build, the producer-normalized Git manifests are compared
+      # with cargo vendor's for dependency resolution (evidence only). The
+      # canonical and reproduction builds use the same JS handoff in
+      # separate fresh roots and boundaries; the final Fastly files must be
+      # byte-identical. Both outputs then pass the final-byte Viceroy runtime
+      # gate, and a closed-origin run must be rejected despite a healthy probe.
+      - name: Build canonical and reproduction Fastly from one JS handoff, compare final bytes and run the Viceroy gate (Linux)
+        env:
+          TS_RELEASE_CI_BUILD_CACHE: ${{ steps.release-tool-cache.outputs.cache-matched-key || 'miss' }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          TEST_NAME=recipe::tests::full::fastly_canonical_and_reproduction_builds_are_byte_identical
+          TEST_LIST="$(mktemp)"
+          trap 'rm -f "$TEST_LIST"' EXIT
+          cargo test -p trusted-server-release --target "$HOST_TARGET" --locked "$TEST_NAME" -- --ignored --exact --list > "$TEST_LIST"
+          awk '/: test$/ { count++ } END { if (count != 1) { print "Expected exactly one Fastly canonical/reproduction equality fixture"; exit 1 } }' "$TEST_LIST"
+          cargo test -p trusted-server-release --target "$HOST_TARGET" --locked "$TEST_NAME" -- --ignored --exact --nocapture
+          cat "$TS_RELEASE_CARGO_FIXTURE_ROOT/normalized-manifest-differential-measurement.json"
+          cat "$TS_RELEASE_CARGO_FIXTURE_ROOT/cargo-canonical-reproduction-equality-measurement.json"
+          cat "$TS_RELEASE_CARGO_FIXTURE_ROOT/fastly-runtime-gate-measurement.json"
+
+      # The rechecked canonical entry and its final executable, as six flat
+      # files, for the candidate index collector. Unauthenticated ordinary CI
+      # evidence; fork pull requests skip it like the transfer fixture.
+      - name: Upload the unqualified Fastly candidate entry for the index collector
+        id: upload-entry
+        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 (Node 24)
+        with:
+          name: ${{ env.TS_RELEASE_CANDIDATE_ENTRY_UPLOAD }}
+          path: ${{ env.TS_RELEASE_CARGO_FIXTURE_ROOT }}/candidate-entry
+          if-no-files-found: error
+          retention-days: 1
+
+      - name: Describe the uploaded Fastly candidate entry
+        id: describe-entry
+        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+        shell: bash
+        env:
+          TRANSFER_FILE: ${{ env.TS_RELEASE_CARGO_FIXTURE_ROOT }}/candidate-entry-transfer.json
+          ARTIFACT_ID: ${{ steps.upload-entry.outputs.artifact-id }}
+          ARTIFACT_DIGEST: ${{ steps.upload-entry.outputs.artifact-digest }}
+        run: |
+          set -euo pipefail
+          DESCRIPTOR="$(jq -c --argjson id "$ARTIFACT_ID" --arg name "$TS_RELEASE_CANDIDATE_ENTRY_UPLOAD" --arg digest "$ARTIFACT_DIGEST" --argjson attempt "$GITHUB_RUN_ATTEMPT" '. + {artifact_id: $id, artifact_name: $name, archive_sha256: $digest, run_attempt: $attempt}' "$TRANSFER_FILE")"
+          echo "$DESCRIPTOR"
+          echo "candidate-entry=$DESCRIPTOR" >> "$GITHUB_OUTPUT"
+
+  test-release-cli-candidate:
+    name: cargo test (Linux ts CLI release candidate)
+    runs-on: ubuntu-24.04
+    # Fixture preparation (~6 min, including the UBI 9 builder image and the
+    # three startup image pulls), two fresh JS builds (~12 min), then the
+    # canonical and, when measured, the reproduction confined CLI builds
+    # (~10-15 min each, about twice the Fastly dependency closure plus C
+    # code) and three clean-container startups.
+    timeout-minutes: 75
+    outputs:
+      # CI-internal descriptor of the uploaded candidate entry, for the
+      # candidate index collector; not a release schema.
+      candidate-entry: ${{ steps.describe-entry.outputs.candidate-entry }}
+    env:
+      # Optimize repeated whole-input hashes with test safety checks retained.
+      CARGO_PROFILE_TEST_OPT_LEVEL: '2'
+      CARGO_PROFILE_TEST_DEBUG_ASSERTIONS: 'true'
+      CARGO_PROFILE_TEST_OVERFLOW_CHECKS: 'true'
+      TS_RELEASE_CANDIDATE_ENTRY_UPLOAD: candidate-entry-ts-x86_64-unknown-linux-gnu-${{ github.run_id }}-${{ github.run_attempt }}
+      # The reproduction build is a measurement, never a gate. Scheduled and
+      # dispatched runs (and pull requests labelled before the push) measure
+      # it; every other run records it as deferred. The test rejects a
+      # missing value and `defer` on a scheduled or dispatched run.
+      TS_RELEASE_NATIVE_REPRODUCTION: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || contains(github.event.pull_request.labels.*.name, 'release-native-reproduction')) && 'measure' || 'defer' }}
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 (Node 24)
+        with:
+          persist-credentials: false
+          # Full history: the fixtures clone this checkout, and source
+          # authentication rejects a shallow repository (`.git/shallow`).
+          fetch-depth: 0
+
+      - name: Read pinned tool versions
+        id: tools
+        shell: bash
+        run: |
+          set -euo pipefail
+          {
+            echo "rust=$(awk '$1 == "rust" { print $2 }' .tool-versions)"
+            echo "node=$(awk '$1 == "nodejs" { print $2 }' .tool-versions)"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Use pinned Node.js
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 (Node 24)
+        with:
+          node-version: ${{ steps.tools.outputs.node }}
+          cache: npm
+          cache-dependency-path: crates/trusted-server-js/lib/package-lock.json
+
+      # The runner's installed rustup bootstraps ordinary CI, not the release
+      # producer. The copied toolchain keeps its host x86_64-unknown-linux-gnu
+      # standard library, which the CLI targets; the Cargo fixture also
+      # requires the Wasm one.
+      - name: Install pinned native Rust toolchain with the Wasm target
+        env:
+          RUST_VERSION: ${{ steps.tools.outputs.rust }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          rustup toolchain install "$RUST_VERSION" --profile minimal
+          rustup target add --toolchain "$RUST_VERSION" wasm32-wasip1
+          rustup override set "$RUST_VERSION"
+          HOST_TARGET="$(rustc -vV | sed -n 's/^host: //p')"
+          test "$HOST_TARGET" = x86_64-unknown-linux-gnu
+          echo "HOST_TARGET=$HOST_TARGET" >> "$GITHUB_ENV"
+
+      # Restore only: the Cargo candidate job saves this key (see its comment
+      # for why this is actions/cache and what the cache may and may not
+      # hold). The fixture probes here come from the uncached in-container
+      # bootstrap below; only the host test binary uses the restored build.
+      - name: Restore the release-tool host build cache
+        id: release-tool-cache
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 (Node 24)
+        with:
+          path: target
+          key: release-tool-${{ runner.os }}-${{ env.HOST_TARGET }}-rust-${{ steps.tools.outputs.rust }}-${{ hashFiles('Cargo.lock', 'rust-toolchain.toml', '.tool-versions', 'crates/trusted-server-release/Cargo.toml') }}-test-o${{ env.CARGO_PROFILE_TEST_OPT_LEVEL }}-da${{ env.CARGO_PROFILE_TEST_DEBUG_ASSERTIONS }}-oc${{ env.CARGO_PROFILE_TEST_OVERFLOW_CHECKS }}
+
+      - name: Prepare ordinary CI JS, Cargo and CLI fixtures
+        shell: bash
+        run: |
+          set -euo pipefail
+          cargo build -p trusted-server-release --target "$HOST_TARGET" --locked
+          cargo test -p trusted-server-release --target "$HOST_TARGET" --locked --no-run
+          PRODUCER="target/$HOST_TARGET/debug/trusted-server-release"
+          JS_FIXTURE_ROOT="$RUNNER_TEMP/release-js-original-fixture"
+          CARGO_FIXTURE_ROOT="$RUNNER_TEMP/release-cargo-fixture"
+          CLI_FIXTURE_ROOT="$RUNNER_TEMP/release-cli-fixture"
+          node scripts/release/tests/prepare-cli-fixture.mjs "$CLI_FIXTURE_ROOT"
+          # Rebuild the same producer inside the GNU baseline. The Ubuntu
+          # host binary requires a newer libc and cannot serve as its probe.
+          # These cached downloads remain unauthenticated candidate inputs.
+          BOOTSTRAP_ROOT="$(mktemp -d "$RUNNER_TEMP/cli-producer.XXXXXX")"
+          BOOTSTRAP_NAME="ts-cli-producer-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
+          BOOTSTRAP_ID=
+          BOOTSTRAP_CREATE_STARTED=false
+          mkdir "$BOOTSTRAP_ROOT/cargo-home" "$BOOTSTRAP_ROOT/target" "$BOOTSTRAP_ROOT/docker-config"
+          cleanup_cli_bootstrap() {
+            local build_status=$?
+            trap - EXIT
+            local reference="$BOOTSTRAP_NAME" filter="name=^/$BOOTSTRAP_NAME$"
+            if [[ -n "$BOOTSTRAP_ID" ]]; then
+              reference="$BOOTSTRAP_ID"
+              filter="id=$BOOTSTRAP_ID"
+            elif [[ "$BOOTSTRAP_CREATE_STARTED" == true ]]; then
+              printf '%s\n' 'Bootstrap creation was not acknowledged; no start was issued.' >&2
+              [[ "$build_status" -ne 0 ]] || build_status=1
+            fi
+            timeout --kill-after=5s 30s docker --config "$BOOTSTRAP_ROOT/docker-config" --host unix:///var/run/docker.sock stop --time 2 "$reference" >/dev/null 2>&1 || true
+            timeout --kill-after=5s 30s docker --config "$BOOTSTRAP_ROOT/docker-config" --host unix:///var/run/docker.sock rm --force "$reference" >/dev/null 2>&1 || true
+            local survivors
+            survivors="$(timeout --kill-after=5s 30s docker --config "$BOOTSTRAP_ROOT/docker-config" --host unix:///var/run/docker.sock ps --all --quiet --filter "$filter")" || exit 1
+            [[ -z "$survivors" ]] || exit 1
+            exit "$build_status"
+          }
+          trap cleanup_cli_bootstrap EXIT
+          cp -R "$HOME/.cargo/registry" "$BOOTSTRAP_ROOT/cargo-home/registry"
+          if [[ -d "$HOME/.cargo/git" ]]; then
+            cp -R "$HOME/.cargo/git" "$BOOTSTRAP_ROOT/cargo-home/git"
+          fi
+          BUILDER_IMAGE="$(node -p 'JSON.parse(require("node:fs").readFileSync(process.argv[1], "utf8")).builder_image_id' "$CLI_FIXTURE_ROOT/cli-fixture.json")"
+          TOOLCHAIN_ROOT="$(rustc --print sysroot)"
+          BOOTSTRAP_CREATE_STARTED=true
+          BOOTSTRAP_CREATED="$(timeout --kill-after=5s 60s docker --config "$BOOTSTRAP_ROOT/docker-config" --host unix:///var/run/docker.sock create \
+            --init --name "$BOOTSTRAP_NAME" --pull=never --network=none --read-only \
+            --user "$(id -u):$(id -g)" --cap-drop=ALL --security-opt=no-new-privileges \
+            --pids-limit=256 --memory=4g --cpus=2 --tmpfs /tmp:rw,nosuid,nodev,size=256m \
+            --mount "type=bind,src=$GITHUB_WORKSPACE,dst=/source,readonly" \
+            --mount "type=bind,src=$TOOLCHAIN_ROOT,dst=/tools,readonly" \
+            --mount "type=bind,src=$BOOTSTRAP_ROOT/cargo-home,dst=/cargo-home" \
+            --mount "type=bind,src=$BOOTSTRAP_ROOT/target,dst=/target" \
+            --workdir /source --env PATH=/tools/bin:/usr/bin:/bin --env HOME=/tmp \
+            --env CARGO_HOME=/cargo-home --env CARGO_TARGET_DIR=/target --env RUSTC=/tools/bin/rustc \
+            --env GIT_CONFIG_NOSYSTEM=1 --env GIT_CONFIG_GLOBAL=/dev/null \
+            --entrypoint /tools/bin/cargo "$BUILDER_IMAGE" \
+            build -p trusted-server-release --target "$HOST_TARGET" --locked --offline)"
+          [[ "$BOOTSTRAP_CREATED" =~ ^[a-f0-9]{64}$ ]]
+          BOOTSTRAP_ID="$BOOTSTRAP_CREATED"
+          timeout --kill-after=10s 15m docker --config "$BOOTSTRAP_ROOT/docker-config" --host unix:///var/run/docker.sock start --attach "$BOOTSTRAP_ID"
+          PRODUCER="$BOOTSTRAP_ROOT/target/$HOST_TARGET/debug/trusted-server-release"
+          node scripts/release/tests/prepare-js-fixture.mjs "$JS_FIXTURE_ROOT" "$PRODUCER"
+          node scripts/release/tests/prepare-cargo-fixture.mjs "$CARGO_FIXTURE_ROOT" "$PRODUCER"
+          {
+            echo "TS_RELEASE_JS_FIXTURE_ROOT=$JS_FIXTURE_ROOT"
+            echo "TS_RELEASE_CARGO_FIXTURE_ROOT=$CARGO_FIXTURE_ROOT"
+            echo "TS_RELEASE_CLI_FIXTURE_ROOT=$CLI_FIXTURE_ROOT"
+          } >> "$GITHUB_ENV"
+          cat "$CLI_FIXTURE_ROOT/cli-fixture.json"
+          df -h "$RUNNER_TEMP"
+
+      - name: Verify startup timeout removes its owned container
+        shell: bash
+        run: |
+          set -euo pipefail
+          TEST_NAME=recipe::startup::tests::startup_timeout_removes_only_its_owned_container
+          TEST_LIST="$(mktemp)"
+          trap 'rm -f "$TEST_LIST"' EXIT
+          cargo test -p trusted-server-release --target "$HOST_TARGET" --locked "$TEST_NAME" -- --ignored --exact --list > "$TEST_LIST"
+          awk '/: test$/ { count++ } END { if (count != 1) { print "Expected exactly one startup cleanup fixture"; exit 1 } }' "$TEST_LIST"
+          cargo test -p trusted-server-release --target "$HOST_TARGET" --locked "$TEST_NAME" -- --ignored --exact --nocapture
+
+      # The canonical build is gated: glibc 2.34 ELF policy with retained
+      # debug info, the remap scan, planted operator values absent and
+      # `ts --version` in clean UBI 9, Ubuntu 22.04 and Debian 12 containers.
+      # The reproduction build is recorded, never a gate, and only built when
+      # TS_RELEASE_NATIVE_REPRODUCTION is `measure`.
+      - name: Build, inspect and start the Linux ts candidate; reproduction per TS_RELEASE_NATIVE_REPRODUCTION (Linux)
+        env:
+          TS_RELEASE_CI_BUILD_CACHE: ${{ steps.release-tool-cache.outputs.cache-matched-key || 'miss' }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          echo "Native reproduction: $TS_RELEASE_NATIVE_REPRODUCTION (event ${GITHUB_EVENT_NAME})"
+          TEST_NAME=recipe::tests::cli::linux_cli_candidate_builds_inspects_and_starts_cleanly
+          TEST_LIST="$(mktemp)"
+          trap 'rm -f "$TEST_LIST"' EXIT
+          cargo test -p trusted-server-release --target "$HOST_TARGET" --locked "$TEST_NAME" -- --ignored --exact --list > "$TEST_LIST"
+          awk '/: test$/ { count++ } END { if (count != 1) { print "Expected exactly one Linux CLI candidate fixture"; exit 1 } }' "$TEST_LIST"
+          cargo test -p trusted-server-release --target "$HOST_TARGET" --locked "$TEST_NAME" -- --ignored --exact --nocapture
+          cat "$TS_RELEASE_CLI_FIXTURE_ROOT/linux-cli-candidate-measurement.json"
+          df -h "$RUNNER_TEMP"
+
+      # The rechecked canonical entry and its final executable, as six flat
+      # files, for the candidate index collector. Unauthenticated ordinary CI
+      # evidence; fork pull requests skip it like the transfer fixture.
+      - name: Upload the unqualified Linux CLI candidate entry for the index collector
+        id: upload-entry
+        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 (Node 24)
+        with:
+          name: ${{ env.TS_RELEASE_CANDIDATE_ENTRY_UPLOAD }}
+          path: ${{ env.TS_RELEASE_CLI_FIXTURE_ROOT }}/candidate-entry
+          if-no-files-found: error
+          retention-days: 1
+
+      - name: Describe the uploaded Linux CLI candidate entry
+        id: describe-entry
+        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+        shell: bash
+        env:
+          TRANSFER_FILE: ${{ env.TS_RELEASE_CLI_FIXTURE_ROOT }}/candidate-entry-transfer.json
+          ARTIFACT_ID: ${{ steps.upload-entry.outputs.artifact-id }}
+          ARTIFACT_DIGEST: ${{ steps.upload-entry.outputs.artifact-digest }}
+        run: |
+          set -euo pipefail
+          DESCRIPTOR="$(jq -c --argjson id "$ARTIFACT_ID" --arg name "$TS_RELEASE_CANDIDATE_ENTRY_UPLOAD" --arg digest "$ARTIFACT_DIGEST" --argjson attempt "$GITHUB_RUN_ATTEMPT" '. + {artifact_id: $id, artifact_name: $name, archive_sha256: $digest, run_attempt: $attempt}' "$TRANSFER_FILE")"
+          echo "$DESCRIPTOR"
+          echo "candidate-entry=$DESCRIPTOR" >> "$GITHUB_OUTPUT"
+
+      - name: Preserve available CLI candidate measurements in the job log
+        if: always()
+        shell: bash
+        run: |
+          if [[ -n "${TS_RELEASE_CLI_FIXTURE_ROOT:-}" ]]; then
+            for report in builder-filesystem-controls.json linux-cli-candidate-measurement.json; do
+              if [[ -f "$TS_RELEASE_CLI_FIXTURE_ROOT/$report" ]]; then
+                cat "$TS_RELEASE_CLI_FIXTURE_ROOT/$report"
+              fi
+            done
+          fi
+
+      # Measured runs keep the reproduction measurement as an artifact so
+      # reports can cite it, not only the job log.
+      - name: Upload the measured Linux CLI candidate measurement
+        if: ${{ !cancelled() && env.TS_RELEASE_NATIVE_REPRODUCTION == 'measure' }}
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 (Node 24)
+        with:
+          name: linux-cli-candidate-measurement
+          path: ${{ env.TS_RELEASE_CLI_FIXTURE_ROOT }}/linux-cli-candidate-measurement.json
+          if-no-files-found: warn
+          retention-days: 90
+          # A re-run of this job replaces its own earlier upload.
+          overwrite: true
+
+  # Decides whether the macOS candidate jobs and their Linux JS handoff run.
+  # It fails open: any error, a new branch or an unknown event selects them.
+  # Skipped jobs report success. The candidate index collector needs all four
+  # candidate jobs to succeed, so a deselected range also skips it; the step
+  # summary records that reason. The collector is not a required check.
+  changes:
+    name: Detect release candidate changes
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    outputs:
+      release: ${{ steps.filter.outputs.release }}
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 (Node 24)
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Match changed paths against the release candidate inputs
+        id: filter
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          PULL_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PULL_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PUSH_BEFORE_SHA: ${{ github.event.before }}
+          PUSH_AFTER_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          node --test scripts/release/tests/candidate-changes.test.mjs
+          select_release() {
+            echo "release=$1" >> "$GITHUB_OUTPUT"
+            echo "Release candidate jobs selected: $1 ($2)"
+            if [[ "$1" != true ]]; then
+              echo "Candidate index collector not selected: the macOS candidates are deselected ($2), and the four-asset candidate index is assembled only when all four candidate jobs succeed." >> "$GITHUB_STEP_SUMMARY"
+            fi
+            exit 0
+          }
+          case "$EVENT_NAME" in
+            pull_request) RANGE="$PULL_BASE_SHA...$PULL_HEAD_SHA" ;;
+            push) RANGE="$PUSH_BEFORE_SHA..$PUSH_AFTER_SHA" ;;
+            *) select_release true "event $EVENT_NAME" ;;
+          esac
+          if [[ "$RANGE" == *0000000000000000000000000000000000000000* || "$RANGE" == ...* || "$RANGE" == *... || "$RANGE" == ..* ]]; then
+            select_release true "no comparable base"
+          fi
+          if ! SELECTED="$(bash scripts/release/tests/candidate-changes.sh "$RANGE")"; then
+            select_release true "cannot classify $RANGE"
+          fi
+          case "$SELECTED" in
+            true|false) select_release "$SELECTED" "comparison $RANGE" ;;
+            *) select_release true "unexpected classifier result" ;;
+          esac
+
+  # Exports the Linux two-fresh JS handoff for the macOS candidate jobs,
+  # which cannot run the Linux-only JS build. The artifact is unauthenticated
+  # ordinary CI evidence; the adopting job labels it so.
+  test-release-js-handoff:
+    name: cargo test (export Linux JS handoff for macOS candidates)
+    needs: changes
+    if: ${{ !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.release == 'true') }}
+    runs-on: ubuntu-24.04
+    # Fixture preparation (~3 min, including the JS fixture image) and the
+    # two fresh JS builds (~12 min).
+    timeout-minutes: 30
+    env:
+      # Optimize repeated whole-input hashes with test safety checks retained.
+      CARGO_PROFILE_TEST_OPT_LEVEL: '2'
+      CARGO_PROFILE_TEST_DEBUG_ASSERTIONS: 'true'
+      CARGO_PROFILE_TEST_OVERFLOW_CHECKS: 'true'
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 (Node 24)
+        with:
+          persist-credentials: false
+          # Full history: the fixture clones this checkout, and source
+          # authentication rejects a shallow repository (`.git/shallow`).
+          fetch-depth: 0
+
+      - name: Read pinned tool versions
+        id: tools
+        shell: bash
+        run: |
+          set -euo pipefail
+          {
+            echo "rust=$(awk '$1 == "rust" { print $2 }' .tool-versions)"
+            echo "node=$(awk '$1 == "nodejs" { print $2 }' .tool-versions)"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Use pinned Node.js
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 (Node 24)
+        with:
+          node-version: ${{ steps.tools.outputs.node }}
+          cache: npm
+          cache-dependency-path: crates/trusted-server-js/lib/package-lock.json
+
+      # The runner's installed rustup bootstraps ordinary CI, not the release producer.
+      - name: Install pinned native Rust toolchain
+        env:
+          RUST_VERSION: ${{ steps.tools.outputs.rust }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          rustup toolchain install "$RUST_VERSION" --profile minimal
+          rustup override set "$RUST_VERSION"
+          HOST_TARGET="$(rustc -vV | sed -n 's/^host: //p')"
+          test "$HOST_TARGET" = x86_64-unknown-linux-gnu
+          echo "HOST_TARGET=$HOST_TARGET" >> "$GITHUB_ENV"
+
+      # Restore only: the Cargo candidate job saves this key (see its comment
+      # for why this is actions/cache and what the cache may and may not
+      # hold). The Wasm target it also installs does not change host output.
+      - name: Restore the release-tool host build cache
+        id: release-tool-cache
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 (Node 24)
+        with:
+          path: target
+          key: release-tool-${{ runner.os }}-${{ env.HOST_TARGET }}-rust-${{ steps.tools.outputs.rust }}-${{ hashFiles('Cargo.lock', 'rust-toolchain.toml', '.tool-versions', 'crates/trusted-server-release/Cargo.toml') }}-test-o${{ env.CARGO_PROFILE_TEST_OPT_LEVEL }}-da${{ env.CARGO_PROFILE_TEST_DEBUG_ASSERTIONS }}-oc${{ env.CARGO_PROFILE_TEST_OVERFLOW_CHECKS }}
+
+      - name: Prepare original-only full JS fixture
+        shell: bash
+        run: |
+          set -euo pipefail
+          cargo build -p trusted-server-release --target "$HOST_TARGET" --locked
+          cargo test -p trusted-server-release --target "$HOST_TARGET" --locked --no-run
+          FIXTURE_ROOT="$RUNNER_TEMP/release-js-original-fixture"
+          EXPORT_ROOT="$RUNNER_TEMP/release-js-handoff"
+          test ! -e "$EXPORT_ROOT"
+          node scripts/release/tests/prepare-js-fixture.mjs "$FIXTURE_ROOT" "target/$HOST_TARGET/debug/trusted-server-release"
+          {
+            echo "TS_RELEASE_JS_FIXTURE_ROOT=$FIXTURE_ROOT"
+            echo "TS_RELEASE_JS_HANDOFF_EXPORT=$EXPORT_ROOT"
+          } >> "$GITHUB_ENV"
+
+      - name: Run two fresh offline JS builds and export the retained handoff
+        shell: bash
+        run: |
+          set -euo pipefail
+          TEST_NAME=preparation::tests::full::export_js_handoff_for_candidates
+          TEST_LIST="$(mktemp)"
+          trap 'rm -f "$TEST_LIST"' EXIT
+          cargo test -p trusted-server-release --target "$HOST_TARGET" --locked "$TEST_NAME" -- --ignored --exact --list > "$TEST_LIST"
+          awk '/: test$/ { count++ } END { if (count != 1) { print "Expected exactly one JS handoff export fixture"; exit 1 } }' "$TEST_LIST"
+          cargo test -p trusted-server-release --target "$HOST_TARGET" --locked "$TEST_NAME" -- --ignored --exact --nocapture
+          find "$TS_RELEASE_JS_HANDOFF_EXPORT" -type f | sort
+
+      - name: Upload the unauthenticated JS handoff for the macOS candidates
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 (Node 24)
+        with:
+          name: release-js-handoff
+          path: ${{ env.TS_RELEASE_JS_HANDOFF_EXPORT }}
+          if-no-files-found: error
+          retention-days: 1
+          # A re-run of this job replaces its own earlier upload.
+          overwrite: true
+
+  # Ordinary CI candidate evidence of the Darwin ts on native arm64 and Intel
+  # macOS 15; not release qualification (every measurement reports it). The
+  # unqualified sandbox only reaps descendants after each run, the Xcode is
+  # the runner's, and the JS handoff is the Linux job's unauthenticated
+  # artifact.
+  test-release-macos-cli-candidate:
+    name: cargo test (macOS ts CLI release candidate, ${{ matrix.os }})
+    needs: test-release-js-handoff
+    if: ${{ !cancelled() && needs.test-release-js-handoff.result == 'success' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15, macos-15-intel]
+    runs-on: ${{ matrix.os }}
+    # Setup, fixtures and the producer build (~16 min), four denial builds
+    # (~10 min), then the canonical and, when measured, the reproduction
+    # confined CLI builds and one native startup. On macos-15-intel the
+    # canonical build alone measured 24 min and the two-job reproduction is
+    # slower, so a 90-minute limit cancelled run 39529002302
+    # mid-reproduction.
+    timeout-minutes: 150
+    outputs:
+      # Per-leg keys: each leg sets only its own, so the two descriptors of
+      # the CI-internal candidate-entry upload stay apart in matrix outputs.
+      macos-15-candidate-entry: ${{ steps.describe-entry.outputs.macos-15-candidate-entry }}
+      macos-15-intel-candidate-entry: ${{ steps.describe-entry.outputs.macos-15-intel-candidate-entry }}
+    env:
+      # Optimize repeated whole-input hashes with test safety checks retained.
+      CARGO_PROFILE_TEST_OPT_LEVEL: '2'
+      CARGO_PROFILE_TEST_DEBUG_ASSERTIONS: 'true'
+      CARGO_PROFILE_TEST_OVERFLOW_CHECKS: 'true'
+      TS_RELEASE_CANDIDATE_ENTRY_UPLOAD: candidate-entry-${{ matrix.os == 'macos-15' && 'ts-aarch64-apple-darwin' || 'ts-x86_64-apple-darwin' }}-${{ github.run_id }}-${{ github.run_attempt }}
+      # The reproduction build is a measurement, never a gate. Scheduled and
+      # dispatched runs (and pull requests labelled before the push) measure
+      # it; every other run records it as deferred. The test rejects a
+      # missing value and `defer` on a scheduled or dispatched run.
+      TS_RELEASE_NATIVE_REPRODUCTION: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || contains(github.event.pull_request.labels.*.name, 'release-native-reproduction')) && 'measure' || 'defer' }}
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 (Node 24)
+        with:
+          persist-credentials: false
+          # Full history: the fixture clones this checkout, and source
+          # authentication rejects a shallow repository (`.git/shallow`).
+          fetch-depth: 0
+
+      - name: Read pinned tool versions
+        id: tools
+        shell: bash
+        run: |
+          set -euo pipefail
+          {
+            echo "rust=$(awk '$1 == "rust" { print $2 }' .tool-versions)"
+            echo "node=$(awk '$1 == "nodejs" { print $2 }' .tool-versions)"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Use pinned Node.js
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 (Node 24)
+        with:
+          node-version: ${{ steps.tools.outputs.node }}
+
+      # The runner's installed rustup bootstraps ordinary CI, not the release
+      # producer. The copied toolchain keeps only its host Darwin standard
+      # library, which both the CLI and the denial fixture target.
+      - name: Install pinned native Rust toolchain and check the native host
+        env:
+          RUST_VERSION: ${{ steps.tools.outputs.rust }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          rustup toolchain install "$RUST_VERSION" --profile minimal
+          rustup override set "$RUST_VERSION"
+          HOST_TARGET="$(rustc -vV | sed -n 's/^host: //p')"
+          case "$(uname -m)" in
+            arm64) EXPECTED_TARGET=aarch64-apple-darwin ;;
+            x86_64) EXPECTED_TARGET=x86_64-apple-darwin ;;
+            *) echo "Unsupported macOS machine $(uname -m)" >&2; exit 1 ;;
+          esac
+          test "$HOST_TARGET" = "$EXPECTED_TARGET"
+          # Absent on Intel hardware; 1 would mean a Rosetta-translated shell.
+          TRANSLATED="$(sysctl -n sysctl.proc_translated 2>/dev/null || echo absent)"
+          echo "sysctl.proc_translated=$TRANSLATED"
+          test "$TRANSLATED" != 1
+          echo "Selected Xcode developer directory: $(xcode-select -p)"
+          echo "HOST_TARGET=$HOST_TARGET" >> "$GITHUB_ENV"
+
+      # Each matrix entry restores and (on main) saves its own host target's
+      # key. See the Cargo candidate job for why this is actions/cache and
+      # what the cache may and may not hold.
+      - name: Restore the release-tool host build cache
+        id: release-tool-cache
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 (Node 24)
+        with:
+          path: target
+          key: release-tool-${{ runner.os }}-${{ env.HOST_TARGET }}-rust-${{ steps.tools.outputs.rust }}-${{ hashFiles('Cargo.lock', 'rust-toolchain.toml', '.tool-versions', 'crates/trusted-server-release/Cargo.toml') }}-test-o${{ env.CARGO_PROFILE_TEST_OPT_LEVEL }}-da${{ env.CARGO_PROFILE_TEST_DEBUG_ASSERTIONS }}-oc${{ env.CARGO_PROFILE_TEST_OVERFLOW_CHECKS }}
+
+      - name: Prepare ordinary CI Darwin Cargo fixture
+        shell: bash
+        run: |
+          set -euo pipefail
+          cargo build -p trusted-server-release --target "$HOST_TARGET" --locked
+          # Build the test binary now so the cache below holds its dependencies.
+          cargo test -p trusted-server-release --target "$HOST_TARGET" --locked --no-run
+          CARGO_FIXTURE_ROOT="$RUNNER_TEMP/release-cargo-fixture"
+          JS_HANDOFF_ROOT="$RUNNER_TEMP/release-js-handoff"
+          test ! -e "$JS_HANDOFF_ROOT"
+          node scripts/release/tests/prepare-cargo-fixture.mjs "$CARGO_FIXTURE_ROOT" "target/$HOST_TARGET/debug/trusted-server-release"
+          {
+            echo "TS_RELEASE_CARGO_FIXTURE_ROOT=$CARGO_FIXTURE_ROOT"
+            echo "TS_RELEASE_JS_HANDOFF_ROOT=$JS_HANDOFF_ROOT"
+          } >> "$GITHUB_ENV"
+          df -h "$RUNNER_TEMP"
+
+      # Saved before any ignored fixture test runs, so no fixture output can
+      # enter the cache.
+      - name: Drop incremental state before saving the host build cache
+        if: github.ref == 'refs/heads/main' && steps.release-tool-cache.outputs.cache-hit != 'true'
+        shell: bash
+        run: rm -rf target/debug/incremental target/*/debug/incremental
+
+      - name: Save the release-tool host build cache (main only)
+        if: github.ref == 'refs/heads/main' && steps.release-tool-cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 (Node 24)
+        with:
+          path: target
+          key: ${{ steps.release-tool-cache.outputs.cache-primary-key }}
+
+      - name: Download the Linux JS handoff into a fresh directory
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 (Node 24)
+        with:
+          name: release-js-handoff
+          path: ${{ env.TS_RELEASE_JS_HANDOFF_ROOT }}
+
+      - name: Prove Cargo build scripts and proc macros inherit denial (macOS)
+        env:
+          TS_RELEASE_CI_BUILD_CACHE: ${{ steps.release-tool-cache.outputs.cache-matched-key || 'miss' }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          TEST_NAME=recipe::tests::full_macos::cargo_children_inherit_denial_macos
+          TEST_LIST="$(mktemp)"
+          trap 'rm -f "$TEST_LIST"' EXIT
+          cargo test -p trusted-server-release --target "$HOST_TARGET" --locked "$TEST_NAME" -- --ignored --exact --list > "$TEST_LIST"
+          awk '/: test$/ { count++ } END { if (count != 1) { print "Expected exactly one macOS Cargo denial fixture"; exit 1 } }' "$TEST_LIST"
+          cargo test -p trusted-server-release --target "$HOST_TARGET" --locked "$TEST_NAME" -- --ignored --exact --nocapture
+          cat "$TS_RELEASE_CARGO_FIXTURE_ROOT/cargo-denial-measurement.json"
+
+      # The canonical build is gated: Mach-O acceptance with the measured SDK
+      # and a relative debug map, the remap and final-path scans, planted
+      # operator values absent and a native `ts --version` on the reviewed
+      # host. The reproduction build is recorded, never a gate, and only built
+      # when TS_RELEASE_NATIVE_REPRODUCTION is `measure`.
+      - name: Build, inspect and start the macOS ts candidate; reproduction per TS_RELEASE_NATIVE_REPRODUCTION (macOS)
+        env:
+          TS_RELEASE_CI_BUILD_CACHE: ${{ steps.release-tool-cache.outputs.cache-matched-key || 'miss' }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          echo "Native reproduction: $TS_RELEASE_NATIVE_REPRODUCTION (event ${GITHUB_EVENT_NAME})"
+          TEST_NAME=recipe::tests::macos_cli::macos_cli_candidate_builds_inspects_and_starts_cleanly
+          TEST_LIST="$(mktemp)"
+          trap 'rm -f "$TEST_LIST"' EXIT
+          cargo test -p trusted-server-release --target "$HOST_TARGET" --locked "$TEST_NAME" -- --ignored --exact --list > "$TEST_LIST"
+          awk '/: test$/ { count++ } END { if (count != 1) { print "Expected exactly one macOS CLI candidate fixture"; exit 1 } }' "$TEST_LIST"
+          cargo test -p trusted-server-release --target "$HOST_TARGET" --locked "$TEST_NAME" -- --ignored --exact --nocapture
+          cat "$TS_RELEASE_CARGO_FIXTURE_ROOT/macos-cli-candidate-measurement.json"
+          df -h "$RUNNER_TEMP"
+
+      # The rechecked canonical entry and its final executable, as six flat
+      # files, for the candidate index collector. Unauthenticated ordinary CI
+      # evidence; fork pull requests skip it like the transfer fixture.
+      - name: Upload the unqualified macOS CLI candidate entry for the index collector
+        id: upload-entry
+        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 (Node 24)
+        with:
+          name: ${{ env.TS_RELEASE_CANDIDATE_ENTRY_UPLOAD }}
+          path: ${{ env.TS_RELEASE_CARGO_FIXTURE_ROOT }}/candidate-entry
+          if-no-files-found: error
+          retention-days: 1
+
+      - name: Describe the uploaded macOS CLI candidate entry
+        id: describe-entry
+        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+        shell: bash
+        env:
+          TRANSFER_FILE: ${{ env.TS_RELEASE_CARGO_FIXTURE_ROOT }}/candidate-entry-transfer.json
+          ARTIFACT_ID: ${{ steps.upload-entry.outputs.artifact-id }}
+          ARTIFACT_DIGEST: ${{ steps.upload-entry.outputs.artifact-digest }}
+          MATRIX_OS: ${{ matrix.os }}
+        run: |
+          set -euo pipefail
+          DESCRIPTOR="$(jq -c --argjson id "$ARTIFACT_ID" --arg name "$TS_RELEASE_CANDIDATE_ENTRY_UPLOAD" --arg digest "$ARTIFACT_DIGEST" --argjson attempt "$GITHUB_RUN_ATTEMPT" '. + {artifact_id: $id, artifact_name: $name, archive_sha256: $digest, run_attempt: $attempt}' "$TRANSFER_FILE")"
+          echo "$DESCRIPTOR"
+          echo "${MATRIX_OS}-candidate-entry=$DESCRIPTOR" >> "$GITHUB_OUTPUT"
+
+      - name: Preserve available macOS candidate measurements in the job log
+        if: always()
+        shell: bash
+        run: |
+          if [[ -n "${TS_RELEASE_CARGO_FIXTURE_ROOT:-}" ]]; then
+            for report in cargo-denial-measurement.json macos-cli-candidate-measurement.json; do
+              if [[ -f "$TS_RELEASE_CARGO_FIXTURE_ROOT/$report" ]]; then
+                cat "$TS_RELEASE_CARGO_FIXTURE_ROOT/$report"
+              fi
+            done
+          fi
+
+      # Measured runs keep the reproduction measurement as an artifact so
+      # reports can cite it, not only the job log.
+      - name: Upload the measured macOS CLI candidate measurement
+        if: ${{ !cancelled() && env.TS_RELEASE_NATIVE_REPRODUCTION == 'measure' }}
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 (Node 24)
+        with:
+          name: macos-cli-candidate-measurement-${{ matrix.os }}
+          path: ${{ env.TS_RELEASE_CARGO_FIXTURE_ROOT }}/macos-cli-candidate-measurement.json
+          if-no-files-found: warn
+          retention-days: 90
+          # A re-run of this job replaces its own earlier upload.
+          overwrite: true
+
+      # Bounded: two minutes of wall time and the last 400 lines at most.
+      - name: Show recent sandbox denials on failure
+        if: failure()
+        shell: bash
+        run: |
+          perl -e 'alarm 120; exec @ARGV or die "cannot run log: $!"' \
+            /usr/bin/log show --last 15m --style compact --predicate 'sender=="Sandbox"' \
+            | tail -n 400 || true
+
+  # Joins the four real candidate entries into one unqualified candidate
+  # index. It downloads each candidate job's exact upload through the bounded
+  # release-tool backend, rebuilds every entry from its bytes, derives the
+  # policy from a source-checked clean clone, and runs the CLI consumer's
+  # unsigned joins. Ordinary CI evidence only: no signing, publication,
+  # trusted workflow binding or qualification. It runs only when all four
+  # candidate jobs succeeded (the macOS matrix result covers both legs), so it
+  # never assembles from fewer than four entries. It is not a required check.
+  test-release-candidate-index:
+    name: Assemble the unqualified four-asset candidate index
+    needs:
+      - test-release-cargo-candidate
+      - test-release-cli-candidate
+      - test-release-macos-cli-candidate
+    if: ${{ !cancelled() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && needs.test-release-cargo-candidate.result == 'success' && needs.test-release-cli-candidate.result == 'success' && needs.test-release-macos-cli-candidate.result == 'success' }}
+    runs-on: ubuntu-24.04
+    # Release-tool test build (1-3 min with a warm cache), the CLI library
+    # test build (3-5 min; its dependencies are outside the release-tool
+    # cache, and the embedded JS needs npm), then four downloads, the largest
+    # being the ~285 MB Linux CLI with debug info.
+    timeout-minutes: 45
+    permissions:
+      contents: read
+      actions: read
+    env:
+      # Same profile as the candidate jobs, so the restored cache key matches.
+      CARGO_PROFILE_TEST_OPT_LEVEL: '2'
+      CARGO_PROFILE_TEST_DEBUG_ASSERTIONS: 'true'
+      CARGO_PROFILE_TEST_OVERFLOW_CHECKS: 'true'
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 (Node 24)
+        with:
+          persist-credentials: false
+          # Full history: the retained clone below must not be shallow.
+          fetch-depth: 0
+
+      - name: Read pinned tool versions
+        id: tools
+        shell: bash
+        run: |
+          set -euo pipefail
+          {
+            echo "rust=$(awk '$1 == "rust" { print $2 }' .tool-versions)"
+            echo "node=$(awk '$1 == "nodejs" { print $2 }' .tool-versions)"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Use pinned Node.js
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 (Node 24)
+        with:
+          node-version: ${{ steps.tools.outputs.node }}
+          cache: npm
+          cache-dependency-path: crates/trusted-server-js/lib/package-lock.json
+
+      - name: Install pinned native Rust toolchain
+        env:
+          RUST_VERSION: ${{ steps.tools.outputs.rust }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          rustup toolchain install "$RUST_VERSION" --profile minimal
+          rustup override set "$RUST_VERSION"
+          HOST_TARGET="$(rustc -vV | sed -n 's/^host: //p')"
+          test "$HOST_TARGET" = x86_64-unknown-linux-gnu
+          echo "HOST_TARGET=$HOST_TARGET" >> "$GITHUB_ENV"
+
+      # Restore only: the Cargo candidate job saves this key (see its comment
+      # for why this is actions/cache and what the cache may and may not hold).
+      - name: Restore the release-tool host build cache
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 (Node 24)
+        with:
+          path: target
+          key: release-tool-${{ runner.os }}-${{ env.HOST_TARGET }}-rust-${{ steps.tools.outputs.rust }}-${{ hashFiles('Cargo.lock', 'rust-toolchain.toml', '.tool-versions', 'crates/trusted-server-release/Cargo.toml') }}-test-o${{ env.CARGO_PROFILE_TEST_OPT_LEVEL }}-da${{ env.CARGO_PROFILE_TEST_DEBUG_ASSERTIONS }}-oc${{ env.CARGO_PROFILE_TEST_OVERFLOW_CHECKS }}
+
+      # Source authentication rejects untracked paths such as this checkout's
+      # target/ and node_modules/, so the policy is read from a fresh clone of
+      # the checked-out commit with the minimal Git configuration the
+      # fixtures use.
+      - name: Retain a clean clone of the candidate commit
+        shell: bash
+        run: |
+          set -euo pipefail
+          SOURCE_ROOT="$RUNNER_TEMP/release-candidate-source"
+          INDEX_ROOT="$RUNNER_TEMP/release-candidate-index"
+          test ! -e "$SOURCE_ROOT"
+          test ! -e "$INDEX_ROOT"
+          git clone --no-hardlinks --no-checkout -- "$GITHUB_WORKSPACE" "$SOURCE_ROOT"
+          git -C "$SOURCE_ROOT" checkout --detach --force HEAD
+          printf '[core]\nrepositoryformatversion = 0\nbare = false\nfilemode = true\n' > "$SOURCE_ROOT/.git/config"
+          test "$(git -C "$SOURCE_ROOT" rev-parse HEAD)" = "$GITHUB_SHA"
+          {
+            echo "TS_RELEASE_CANDIDATE_SOURCE_ROOT=$SOURCE_ROOT"
+            echo "TS_RELEASE_CANDIDATE_INDEX_ROOT=$INDEX_ROOT"
+          } >> "$GITHUB_ENV"
+
+      - name: Compile and require exactly one collector and one consumer fixture
+        shell: bash
+        run: |
+          set -euo pipefail
+          TEST_LIST="$(mktemp)"
+          trap 'rm -f "$TEST_LIST"' EXIT
+          cargo test -p trusted-server-release --target "$HOST_TARGET" --locked distribution::ordinary::real_four_job_candidate_index -- --ignored --exact --list > "$TEST_LIST"
+          awk '/: test$/ { count++ } END { if (count != 1) { print "Expected exactly one candidate index collector"; exit 1 } }' "$TEST_LIST"
+          cargo test -p trusted-server-cli --target "$HOST_TARGET" --locked --lib release::evidence::candidate_fixture_tests::ordinary_ci_assembled_candidate_passes_unsigned_consumer_joins -- --ignored --exact --list > "$TEST_LIST"
+          awk '/: test$/ { count++ } END { if (count != 1) { print "Expected exactly one candidate index consumer check"; exit 1 } }' "$TEST_LIST"
+
+      - name: Download, rebuild and assemble the four real candidate entries
+        shell: bash
+        env:
+          # The read-only token (contents/actions read) is visible to this
+          # same-repository test binary, which needs it to download; build
+          # scripts already ran without it in the listing step above, and fork
+          # PRs never reach this job.
+          GH_TOKEN: ${{ github.token }}
+          TS_RELEASE_TRANSFER_RUN_ID: ${{ github.run_id }}
+          # REST identifies the PR head; the checkout and every candidate
+          # build use its synthetic merge, which is the candidate source.
+          # Neither identity grants approved-source or release authority here.
+          TS_RELEASE_TRANSFER_RUN_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          TS_RELEASE_CANDIDATE_SOURCE_COMMIT: ${{ github.sha }}
+          TS_RELEASE_CANDIDATE_ENTRY_FASTLY: ${{ needs.test-release-cargo-candidate.outputs.candidate-entry }}
+          TS_RELEASE_CANDIDATE_ENTRY_LINUX: ${{ needs.test-release-cli-candidate.outputs.candidate-entry }}
+          TS_RELEASE_CANDIDATE_ENTRY_MACOS_ARM: ${{ needs.test-release-macos-cli-candidate.outputs.macos-15-candidate-entry }}
+          TS_RELEASE_CANDIDATE_ENTRY_MACOS_INTEL: ${{ needs.test-release-macos-cli-candidate.outputs.macos-15-intel-candidate-entry }}
+        run: |
+          set -euo pipefail
+          cargo test -p trusted-server-release --target "$HOST_TARGET" --locked distribution::ordinary::real_four_job_candidate_index -- --ignored --exact --nocapture
+
+      - name: Run the consumer's unsigned joins over the assembled index
+        shell: bash
+        env:
+          TS_RELEASE_CANDIDATE_SOURCE_COMMIT: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          cargo test -p trusted-server-cli --target "$HOST_TARGET" --locked --lib release::evidence::candidate_fixture_tests::ordinary_ci_assembled_candidate_passes_unsigned_consumer_joins -- --ignored --exact --nocapture
+
+      - name: Print the unqualified candidate index and its SHA-256
+        shell: bash
+        run: |
+          set -euo pipefail
+          cat "$TS_RELEASE_CANDIDATE_INDEX_ROOT/candidate-release-index.json"
+          echo
+          (cd "$TS_RELEASE_CANDIDATE_INDEX_ROOT" && sha256sum -- *)
+
+      # Short-retention citable evidence of an unqualified, unsigned candidate;
+      # never a release asset.
+      - name: Upload the assembled unqualified candidate index evidence
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 (Node 24)
+        with:
+          name: unqualified-candidate-release-index-evidence-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ env.TS_RELEASE_CANDIDATE_INDEX_ROOT }}
+          if-no-files-found: error
+          retention-days: 7
+
   test-typescript:
     name: vitest
     runs-on: ubuntu-latest
@@ -263,19 +1320,21 @@ jobs:
       run:
         working-directory: crates/trusted-server-js/lib
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 (Node 24)
+        with:
+          persist-credentials: false
 
       - name: Retrieve Node.js version
         id: node-version
         working-directory: .
-        run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
         shell: bash
 
       - name: Use Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 (Node 24)
         with:
           node-version: ${{ steps.node-version.outputs.node-version }}
-          cache: "npm"
+          cache: 'npm'
           cache-dependency-path: crates/trusted-server-js/lib/package.json
 
       - name: Install dependencies
@@ -285,4 +1344,120 @@ jobs:
         run: npm run build
 
       - name: Run unit tests
+        env:
+          TRUSTED_SERVER__RELEASE_JS_TESTS: '1'
         run: npm test -- --run
+
+  # Four inert files exercise actual upload/REST/original-ZIP interoperability.
+  # This is ordinary CI diagnostics and supplies no release qualification.
+  test-release-transfer-upload:
+    name: Upload fictional release transfer fixture
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    outputs:
+      artifact-id: ${{ steps.upload.outputs.artifact-id }}
+      artifact-digest: ${{ steps.upload.outputs.artifact-digest }}
+      artifact-name: ${{ steps.fixture.outputs.name }}
+    steps:
+      - name: Create four fixed fictional members
+        id: fixture
+        shell: bash
+        env:
+          FIXTURE_NAME: release-transfer-interop-${{ github.run_id }}-${{ github.run_attempt }}
+        run: |
+          set -euo pipefail
+          FIXTURE_DIRECTORY="$RUNNER_TEMP/release-transfer-fixture"
+          mkdir "$FIXTURE_DIRECTORY"
+          printf '%s\n' 'fictional transfer executable bytes' > "$FIXTURE_DIRECTORY/artifact"
+          printf '%s\n' '{"kind":"fictional-build-record","release_qualification":false}' > "$FIXTURE_DIRECTORY/build-record.json"
+          printf '%s\n' '{"kind":"fictional-composition","complete":false}' > "$FIXTURE_DIRECTORY/composition.json"
+          printf '%s\n' '{"kind":"fictional-javascript-inventory","modules":[]}' > "$FIXTURE_DIRECTORY/tsjs-inventory.json"
+          echo "name=$FIXTURE_NAME" >> "$GITHUB_OUTPUT"
+
+      - name: Upload the fictional archive with the selected action
+        id: upload
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 (Node 24)
+        with:
+          name: ${{ steps.fixture.outputs.name }}
+          path: ${{ runner.temp }}/release-transfer-fixture
+          if-no-files-found: error
+          retention-days: 1
+
+  test-release-transfer-receive:
+    name: Retrieve exact ordinary-CI upload through bounded HTTP
+    needs: test-release-transfer-upload
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 (Node 24)
+        with:
+          persist-credentials: false
+
+      - name: Install the source-pinned Rust toolchain
+        shell: bash
+        run: |
+          set -euo pipefail
+          RUST_VERSION="$(awk '$1 == "rust" { print $2 }' .tool-versions)"
+          test -n "$RUST_VERSION"
+          rustup toolchain install "$RUST_VERSION" --profile minimal
+          HOST_TARGET="$(rustup run "$RUST_VERSION" rustc -vV | sed -n 's/^host: //p')"
+          test -n "$HOST_TARGET"
+          {
+            echo "RUST_VERSION=$RUST_VERSION"
+            echo "HOST_TARGET=$HOST_TARGET"
+          } >> "$GITHUB_ENV"
+
+      - name: Compile and require exactly one ignored interoperability fixture
+        shell: bash
+        run: |
+          set -euo pipefail
+          TEST_NAME=collection::transfer::ordinary::real_uploaded_archive
+          TEST_LIST="$(mktemp)"
+          trap 'rm -f "$TEST_LIST"' EXIT
+          cargo +"$RUST_VERSION" test -p trusted-server-release --target "$HOST_TARGET" --locked "$TEST_NAME" -- --ignored --exact --list > "$TEST_LIST"
+          awk '/: test$/ { count++ } END { if (count != 1) { print "Expected exactly one ordinary transfer fixture"; exit 1 } }' "$TEST_LIST"
+
+      - name: Download and check the exact selected original archive twice
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TS_RELEASE_TRANSFER_RUN_ID: ${{ github.run_id }}
+          # REST identifies the PR head; checkout may hold its synthetic merge.
+          # Neither identity grants approved-source or release authority here.
+          TS_RELEASE_TRANSFER_RUN_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          TS_RELEASE_TRANSFER_ARTIFACT_ID: ${{ needs.test-release-transfer-upload.outputs.artifact-id }}
+          TS_RELEASE_TRANSFER_ARTIFACT_NAME: ${{ needs.test-release-transfer-upload.outputs.artifact-name }}
+          TS_RELEASE_TRANSFER_ARCHIVE_SHA256: ${{ needs.test-release-transfer-upload.outputs.artifact-digest }}
+        run: |
+          set -euo pipefail
+          TEST_NAME=collection::transfer::ordinary::real_uploaded_archive
+          cargo +"$RUST_VERSION" test -p trusted-server-release --target "$HOST_TARGET" --locked "$TEST_NAME" -- --ignored --exact --nocapture
+
+  test-release-workflow-contract:
+    name: Release validation helper contracts (pure)
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 (Node 24)
+        with:
+          persist-credentials: false
+
+      - name: Read pinned Node version
+        id: node
+        shell: bash
+        run: |
+          echo "version=$(awk '$1 == "nodejs" { print $2 }' .tool-versions)" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 (Node 24)
+        with:
+          node-version: ${{ steps.node.outputs.version }}
+
+      - name: Check invocation and waiter contracts without network or child processes
+        run: node --test .github/workflows/release-validation.test.mjs
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f691c6a005..70220a2ba8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,7 +9,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- **Breaking:** `x-ts-version` now reports the deployed git version — the release tag, else the branch, else the first 6 characters of the commit — compiled in from the build-time `TRUSTED_SERVER__GIT_VERSION` (set by the deploy pipeline) or local git, and is sent by every adapter, including on the Fastly `GET /health` probe. The Fastly service version it previously carried is now `x-ts-fastly-version`; update dashboards, monitors, and scripts that read `x-ts-version` as the Fastly version number. Builds with neither the override nor git omit the header.
+- **Breaking:** `x-ts-version` reports the approved full 40-character source commit for canonical attested releases; the external release tag belongs to the signed release index. Development source builds retain the build-time `TRUSTED_SERVER__GIT_VERSION` override, else local tag, branch or first 6 commit characters, and omit the header when neither override nor Git is available. Every adapter sends the available value, including on the Fastly `GET /health` probe. The Fastly service version is now `x-ts-fastly-version`; update dashboards, monitors and scripts that read `x-ts-version` as the Fastly version number. The source header alone does not authenticate executable bytes.
+- Document manual Fastly production consumption of retained verified wasm with a source-built package inspector, a restricted deployment-only manifest, exact package/member checks and explicit service/base-version selection. This route does not supply integrated preactivation binding checks, staging isolation or durable structured recovery; provider-free checks do not establish live deployment qualification.
 - **Breaking:** `ts prebid bundle` is now `ts prebid client`, alongside the new `ts prebid server` namespace. Update scripts and runbooks to use `ts prebid client` with the same arguments. The old `bundle` spelling is no longer accepted and has no compatibility alias.
 - The S2S `/_ts/api/v1/batch-sync` endpoint now validates the full batch and calls the CAS-protected update path once per distinct normalized EC ID. The last valid UID wins within a group, and infrastructure failures reject the failing and each unprocessed group, so accepted and `kv_unavailable` input indexes may interleave.
 - **Breaking:** Auction providers and bidder routes now use the configuration-first `[auction.providers.<id>]` and `[auction.bidders.<id>]` maps. The removed `[auction].providers = [...]` list and removed server fields under `[integrations.prebid]` and `[integrations.aps]` are rejected even when those integrations are disabled, and `ts config push` rejects the old shape before publication. Move PBS `server_url` to provider `endpoint`, server timeout to provider `timeout_ms`, request controls and bidder-parameter overrides to the `prebid-server` `profile_config`, notification suppression to `notifications`, and each former server bidder to an `[auction.bidders.<id>]` route. Move APS endpoint, timeout, account, inventory, debug, and creative controls to an `aps` provider and its `profile_config`. Browser Prebid settings remain under `[integrations.prebid]`; values such as timeout and debug that previously affected both browser and server behavior must now be configured for each owner. Provider endpoints must be absolute HTTPS URLs. Only bidder codes present in `[auction.bidders]` are folded into Trusted Server requests; unlisted publisher bids remain native browser demand. Provider response names now use the configured provider ID, such as `pbs-main`, instead of the legacy literal `prebid`; audit consumers that match `AuctionResponse.provider`. This schema has no mixed-version-safe deployment order: old binaries reject the maps and new binaries reject the retired fields, so activate the new binary and config blob together. Rollbacks must restore an old-schema blob together with the old binary.
diff --git a/Cargo.lock b/Cargo.lock
index 7ebc0b08ea..361f3b3c64 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -18,6 +18,20 @@ dependencies = [
  "inout",
 ]
 
+[[package]]
+name = "ahash"
+version = "0.8.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
+dependencies = [
+ "cfg-if",
+ "getrandom 0.3.4",
+ "once_cell",
+ "serde",
+ "version_check",
+ "zerocopy",
+]
+
 [[package]]
 name = "aho-corasick"
 version = "1.1.4"
@@ -387,6 +401,21 @@ version = "1.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
+[[package]]
+name = "bit-set"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
+dependencies = [
+ "bit-vec",
+]
+
+[[package]]
+name = "bit-vec"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
+
 [[package]]
 name = "bitflags"
 version = "1.3.2"
@@ -515,6 +544,12 @@ dependencies = [
  "serde_with",
 ]
 
+[[package]]
+name = "borrow-or-share"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc0b364ead1874514c8c2855ab558056ebfeb775653e7ae45ff72f28f8f3166c"
+
 [[package]]
 name = "brotli"
 version = "8.0.4"
@@ -568,6 +603,12 @@ version = "3.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
 
+[[package]]
+name = "bytecount"
+version = "0.6.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "175812e0be2bccb6abe50bb8d566126198344f707e304f45c648fd8f2cc0365e"
+
 [[package]]
 name = "byteorder"
 version = "1.5.0"
@@ -1037,6 +1078,30 @@ dependencies = [
  "itertools 0.10.5",
 ]
 
+[[package]]
+name = "critical-section"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "98b0cc327b5bc766e7fda9c9260cc0fa81b43a8e240440422dff70788e3f9ef1"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
+dependencies = [
+ "crossbeam-utils",
+]
+
 [[package]]
 name = "crossbeam-utils"
 version = "0.8.23"
@@ -1760,6 +1825,15 @@ dependencies = [
  "stable_deref_trait",
 ]
 
+[[package]]
+name = "email_address"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e079f19b08ca6239f47f8ba8509c11cf3ea30095831f7fed61441475edd8c449"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "encoding_rs"
 version = "0.8.35"
@@ -1769,6 +1843,18 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "enum-as-inner"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1e6a265c649f3f5979b601d26f1d05ada116434c87741c9493cb56218f76cbc"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+]
+
 [[package]]
 name = "env_filter"
 version = "2.0.0"
@@ -1872,6 +1958,17 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
 
+[[package]]
+name = "fancy-regex"
+version = "0.19.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d301f5bf187b3c295fce6468d3875037a0bccc5f6b151c63cac2f85babf21912"
+dependencies = [
+ "bit-set",
+ "regex-automata",
+ "regex-syntax",
+]
+
 [[package]]
 name = "faster-hex"
 version = "0.10.0"
@@ -2015,6 +2112,17 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "fluent-uri"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc74ac4d8359ae70623506d512209619e5cf8f347124910440dbc221714b328e"
+dependencies = [
+ "borrow-or-share",
+ "ref-cast",
+ "serde",
+]
+
 [[package]]
 name = "fnv"
 version = "1.0.7"
@@ -2036,6 +2144,16 @@ dependencies = [
  "percent-encoding",
 ]
 
+[[package]]
+name = "fraction"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e246562084dde8ebbcc943b261c406ce4f68e5032ec28029a251a47d6a295500"
+dependencies = [
+ "num",
+ "num-bigint",
+]
+
 [[package]]
 name = "fs_extra"
 version = "1.3.0"
@@ -3220,6 +3338,52 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
+[[package]]
+name = "hickory-proto"
+version = "0.25.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8a6fe56c0038198998a6f217ca4e7ef3a5e51f46163bd6dd60b5c71ca6c6502"
+dependencies = [
+ "async-trait",
+ "cfg-if",
+ "data-encoding",
+ "enum-as-inner",
+ "futures-channel",
+ "futures-io",
+ "futures-util",
+ "idna",
+ "ipnet",
+ "once_cell",
+ "rand 0.9.4",
+ "ring",
+ "thiserror 2.0.18",
+ "tinyvec",
+ "tokio",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "hickory-resolver"
+version = "0.25.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc62a9a99b0bfb44d2ab95a7208ac952d31060efc16241c87eaf36406fecf87a"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "hickory-proto",
+ "ipconfig",
+ "moka",
+ "once_cell",
+ "parking_lot",
+ "rand 0.9.4",
+ "resolv-conf",
+ "smallvec",
+ "thiserror 2.0.18",
+ "tokio",
+ "tracing",
+]
+
 [[package]]
 name = "hmac"
 version = "0.13.0"
@@ -3428,7 +3592,7 @@ dependencies = [
  "prettyplease",
  "proc-macro2",
  "quote",
- "strum_macros",
+ "strum_macros 0.27.2",
  "syn 2.0.118",
  "thiserror 2.0.18",
  "walkdir",
@@ -3626,6 +3790,19 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "ipconfig"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d40460c0ce33d6ce4b0630ad68ff63d6661961c48b6dba35e5a4d81cfb48222"
+dependencies = [
+ "socket2",
+ "widestring",
+ "windows-registry",
+ "windows-result",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "ipnet"
 version = "2.12.0"
@@ -3832,6 +4009,59 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "jsonschema"
+version = "0.58.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f622c574a29fb3034a0a90645afee194dfedc75fc124228801b6e77041075bd1"
+dependencies = [
+ "ahash",
+ "bytecount",
+ "data-encoding",
+ "email_address",
+ "fancy-regex",
+ "fraction",
+ "getrandom 0.3.4",
+ "itoa",
+ "jsonschema-regex",
+ "jsonschema-value",
+ "num-cmp",
+ "num-traits",
+ "percent-encoding",
+ "referencing",
+ "regex",
+ "serde",
+ "serde_json",
+ "strum 0.28.0",
+ "unicode-general-category",
+ "uuid-simd",
+]
+
+[[package]]
+name = "jsonschema-regex"
+version = "0.58.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a968fffd387b2ab005bf00c1851f5d26e90df05b6f7ad609ed0d620033cca5e7"
+dependencies = [
+ "regex-syntax",
+]
+
+[[package]]
+name = "jsonschema-value"
+version = "0.58.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39b7670345e5ce87371339d13705dbb9276b7e3e934bbe1efa2c6734a1f65a96"
+dependencies = [
+ "ahash",
+ "bytecount",
+ "fraction",
+ "getrandom 0.3.4",
+ "num-cmp",
+ "num-traits",
+ "serde_json",
+ "zmij",
+]
+
 [[package]]
 name = "kstring"
 version = "2.0.2"
@@ -4047,6 +4277,12 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "micromap"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a86d3146ed3995b5913c414f6664344b9617457320782e64f0bb44afd49d74"
+
 [[package]]
 name = "mime"
 version = "0.3.17"
@@ -4080,6 +4316,23 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "moka"
+version = "0.12.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "957228ad12042ee839f93c8f257b62b4c0ab5eaae1d4fa60de53b27c9d7c5046"
+dependencies = [
+ "crossbeam-channel",
+ "crossbeam-epoch",
+ "crossbeam-utils",
+ "equivalent",
+ "parking_lot",
+ "portable-atomic",
+ "smallvec",
+ "tagptr",
+ "uuid",
+]
+
 [[package]]
 name = "multimap"
 version = "0.10.1"
@@ -4148,9 +4401,9 @@ dependencies = [
 
 [[package]]
 name = "num-bigint"
-version = "0.4.6"
+version = "0.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
+checksum = "c89e69e7e0f03bea5ef08013795c25018e101932225a656383bd384495ecc367"
 dependencies = [
  "num-integer",
  "num-traits",
@@ -4172,6 +4425,12 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "num-cmp"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63335b2e2c34fae2fb0aa2cecfd9f0832a1e24b3b32ecec612c3426d46dc8aaa"
+
 [[package]]
 name = "num-complex"
 version = "0.4.6"
@@ -4263,6 +4522,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "object"
+version = "0.37.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff76201f031d8863c38aa7f905eca4f53abbfa15f609db4277d44cd8938f33fe"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "oid-registry"
 version = "0.7.1"
@@ -4277,6 +4545,10 @@ name = "once_cell"
 version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+dependencies = [
+ "critical-section",
+ "portable-atomic",
+]
 
 [[package]]
 name = "once_cell_polyfill"
@@ -4318,6 +4590,12 @@ dependencies = [
  "hashbrown 0.14.5",
 ]
 
+[[package]]
+name = "outref"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a80800c0488c3a21695ea981a54918fbb37abf04f4d0720c453632255e2ff0e"
+
 [[package]]
 name = "p256"
 version = "0.13.2"
@@ -5079,6 +5357,23 @@ dependencies = [
  "syn 2.0.118",
 ]
 
+[[package]]
+name = "referencing"
+version = "0.58.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "558f3855529c0a7e78a48e409fa653456e55f1b167eab4109c16a255b7727e3f"
+dependencies = [
+ "ahash",
+ "fluent-uri",
+ "getrandom 0.3.4",
+ "hashbrown 0.17.1",
+ "itoa",
+ "micromap",
+ "parking_lot",
+ "percent-encoding",
+ "serde_json",
+]
+
 [[package]]
 name = "regex"
 version = "1.12.4"
@@ -5093,9 +5388,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.14"
+version = "0.4.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -5121,6 +5416,7 @@ dependencies = [
  "futures-channel",
  "futures-core",
  "futures-util",
+ "hickory-resolver",
  "http",
  "http-body",
  "http-body-util",
@@ -5129,6 +5425,7 @@ dependencies = [
  "hyper-util",
  "js-sys",
  "log",
+ "once_cell",
  "percent-encoding",
  "pin-project-lite",
  "quinn",
@@ -5189,6 +5486,12 @@ dependencies = [
  "web-sys",
 ]
 
+[[package]]
+name = "resolv-conf"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e061d1b48cb8d38042de4ae0a7a6401009d6143dc80d2e2d6f31f0bdd6470c7"
+
 [[package]]
 name = "ring"
 version = "0.17.14"
@@ -6004,7 +6307,16 @@ version = "0.27.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "af23d6f6c1a224baef9d3f61e287d2761385a5b88fdab4eb4c6f11aeb54c4bcf"
 dependencies = [
- "strum_macros",
+ "strum_macros 0.27.2",
+]
+
+[[package]]
+name = "strum"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9628de9b8791db39ceda2b119bbe13134770b56c138ec1d3af810d045c04f9bd"
+dependencies = [
+ "strum_macros 0.28.0",
 ]
 
 [[package]]
@@ -6019,6 +6331,18 @@ dependencies = [
  "syn 2.0.118",
 ]
 
+[[package]]
+name = "strum_macros"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab85eea0270ee17587ed4156089e10b9e6880ee688791d45a905f5b1ca36f664"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+]
+
 [[package]]
 name = "subtle"
 version = "2.6.1"
@@ -6078,6 +6402,22 @@ dependencies = [
  "syn 2.0.118",
 ]
 
+[[package]]
+name = "tagptr"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b2093cf4c8eb1e67749a6762251bc9cd836b6fc171623bd0a9d324d37af2417"
+
+[[package]]
+name = "tar"
+version = "0.4.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f6221d9a6003c78398e3b239969f352578258df48c8eb051caadae0015bc840"
+dependencies = [
+ "filetime",
+ "libc",
+]
+
 [[package]]
 name = "temp-env"
 version = "0.3.6"
@@ -6646,10 +6986,13 @@ dependencies = [
  "futures",
  "gix",
  "glob",
+ "hex",
  "http",
  "http-body-util",
  "hyper",
  "hyper-util",
+ "jsonschema",
+ "libc",
  "log",
  "predicates",
  "rand 0.8.6",
@@ -6663,6 +7006,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_yaml_ng",
+ "sha2 0.11.1",
  "similar 2.7.0",
  "temp-env",
  "tempfile",
@@ -6768,7 +7112,11 @@ version = "0.1.0"
 dependencies = [
  "build-print",
  "hex",
+ "libc",
+ "serde",
+ "serde_json",
  "sha2 0.11.1",
+ "tempfile",
  "which",
 ]
 
@@ -6788,6 +7136,35 @@ dependencies = [
  "prost-build",
 ]
 
+[[package]]
+name = "trusted-server-release"
+version = "0.1.0"
+dependencies = [
+ "base64",
+ "clap",
+ "derive_more",
+ "error-stack",
+ "flate2",
+ "hex",
+ "hmac",
+ "jsonschema",
+ "libc",
+ "object",
+ "rcgen",
+ "reqwest 0.12.28",
+ "rustls",
+ "serde",
+ "serde_json",
+ "serde_yaml_ng",
+ "sha1-checked",
+ "sha2 0.11.1",
+ "tar",
+ "tempfile",
+ "tokio",
+ "toml",
+ "wasmparser",
+]
+
 [[package]]
 name = "try-lock"
 version = "0.2.5"
@@ -6845,6 +7222,12 @@ version = "2.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7eec5d1121208364f6793f7d2e222bf75a915c19557537745b195b253dd64217"
 
+[[package]]
+name = "unicode-general-category"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b993bddc193ae5bd0d623b49ec06ac3e9312875fdae725a975c51db1cc1677f"
+
 [[package]]
 name = "unicode-ident"
 version = "1.0.24"
@@ -6981,6 +7364,16 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "uuid-simd"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b082222b4f6619906941c17eb2297fff4c2fb96cb60164170522942a200bd8"
+dependencies = [
+ "outref",
+ "vsimd",
+]
+
 [[package]]
 name = "validator"
 version = "0.21.0"
@@ -7022,6 +7415,12 @@ version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
+[[package]]
+name = "vsimd"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c3082ca00d5a5ef149bb8b555a72ae84c9c59f7250f013ac822ac2e49b19c64"
+
 [[package]]
 name = "wait-timeout"
 version = "0.2.1"
@@ -7239,6 +7638,12 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "widestring"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72069c3113ab32ab29e5584db3c6ec55d416895e60715417b5b883a357c3e471"
+
 [[package]]
 name = "winapi"
 version = "0.3.9"
@@ -7635,7 +8040,7 @@ dependencies = [
  "serde-wasm-bindgen",
  "serde_json",
  "serde_urlencoded",
- "strum",
+ "strum 0.27.2",
  "tokio",
  "url",
  "wasm-bindgen",
@@ -7655,7 +8060,7 @@ dependencies = [
  "async-trait",
  "proc-macro2",
  "quote",
- "strum",
+ "strum 0.27.2",
  "syn 2.0.118",
  "wasm-bindgen",
  "wasm-bindgen-macro-support",
@@ -7842,6 +8247,6 @@ checksum = "34b31d188d9d685a4f9c7b46d6e36631b07058d2cfe190267adce54dc230bf12"
 
 [[package]]
 name = "zmij"
-version = "1.0.21"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
diff --git a/Cargo.toml b/Cargo.toml
index 72fecdf6b5..b8525f032d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -13,6 +13,7 @@ members = [
     # Manual protobuf codegen tool — a member so it shares workspace settings,
     # but no default member or alias builds it. Run it explicitly with `-p`.
     "crates/trusted-server-openrtb-codegen",
+    "crates/trusted-server-release",
 ]
 
 # Viceroy (cargo test-fastly runner) calls `cargo run --bin trusted-server-adapter-fastly`
diff --git a/crates/trusted-server-adapter-cloudflare/build.sh b/crates/trusted-server-adapter-cloudflare/build.sh
index 844503f30a..b3a6dd3a30 100644
--- a/crates/trusted-server-adapter-cloudflare/build.sh
+++ b/crates/trusted-server-adapter-cloudflare/build.sh
@@ -25,6 +25,9 @@ cd "$SCRIPT_DIR"
 # — a flag the CLI matching the pinned wasm-bindgen (0.2.123, via worker 0.8.4)
 # does not understand. Tracking the locked worker version keeps the toolchain in
 # lockstep, and the pin advances automatically when the lockfile bumps.
+# `--locked` installs with worker-build's own published Cargo.lock: a fresh
+# resolution fails once its dependencies yank every compatible release (for
+# example every `zip` 2.x needed by its `binary-install` dependency).
 WORKER_VERSION="$(
   grep -A1 '^name = "worker"$' "$SCRIPT_DIR/../../Cargo.lock" |
     sed -nE 's/^version = "(.*)"/\1/p' | head -1
@@ -33,7 +36,4 @@ if [ -z "$WORKER_VERSION" ]; then
   echo "error: could not determine the worker crate version from Cargo.lock" >&2
   exit 1
 fi
-# --locked builds from worker-build's published Cargo.lock. Without it, cargo
-# re-resolves dependencies, and a yanked transitive release (zip 2.x) fails the
-# install.
-cargo install -q --force --locked --version "=$WORKER_VERSION" worker-build && worker-build --release
+cargo install -q --locked --force --version "=$WORKER_VERSION" worker-build && worker-build --release
diff --git a/crates/trusted-server-adapter-fastly/build.rs b/crates/trusted-server-adapter-fastly/build.rs
new file mode 100644
index 0000000000..0889fe217b
--- /dev/null
+++ b/crates/trusted-server-adapter-fastly/build.rs
@@ -0,0 +1,26 @@
+//! Compile immutable facts owned by the Fastly product.
+
+#![allow(
+    clippy::print_stdout,
+    reason = "Cargo build script directives use stdout"
+)]
+
+#[allow(
+    dead_code,
+    reason = "This owner uses only release validation from the shared resolver"
+)]
+#[path = "../trusted-server-core/build_support/git_version.rs"]
+mod git_version;
+
+fn main() {
+    println!("cargo:rerun-if-changed=build.rs");
+    println!("cargo:rerun-if-changed=../trusted-server-core/build_support/git_version.rs");
+    println!("cargo:rerun-if-env-changed=TRUSTED_SERVER__RELEASE_BUILD");
+    println!("cargo:rerun-if-env-changed=TRUSTED_SERVER__GIT_VERSION");
+    let control = std::env::var_os("TRUSTED_SERVER__RELEASE_BUILD");
+    let source = std::env::var_os("TRUSTED_SERVER__GIT_VERSION");
+    git_version::release_source(control.as_deref(), source.as_deref())
+        .expect("should provide valid release build inputs");
+    let target = std::env::var("TARGET").expect("should set the owning Cargo target");
+    println!("cargo:rustc-env=TRUSTED_SERVER__BUILD_TARGET={target}");
+}
diff --git a/crates/trusted-server-adapter-fastly/src/main.rs b/crates/trusted-server-adapter-fastly/src/main.rs
index b8f814a01c..c3e8090f43 100644
--- a/crates/trusted-server-adapter-fastly/src/main.rs
+++ b/crates/trusted-server-adapter-fastly/src/main.rs
@@ -11,6 +11,7 @@ use error_stack::Report;
 use fastly::http::Method as FastlyMethod;
 use fastly::{Request as FastlyRequest, Response as FastlyResponse};
 
+use trusted_server_core::build_info::{BuildInfo, BuildVariant};
 use trusted_server_core::cache_policy::{EdgeCacheHeader, cache_control_headers_have_directive};
 use trusted_server_core::constants::HEADER_X_TS_VERSION;
 use trusted_server_core::ec::device::DeviceSignals;
@@ -56,6 +57,17 @@ use crate::sandbox::{RetainedApp, Sandbox, SandboxCounters, ServeMode, StartupDi
 #[cfg(feature = "reusable-sandbox")]
 use crate::sandbox::RetirementCounters;
 
+/// Immutable facts compiled into the owning Fastly product.
+pub const BUILD_INFO: BuildInfo = BuildInfo::new(
+    env!("CARGO_PKG_VERSION"),
+    env!("TRUSTED_SERVER__BUILD_TARGET"),
+    if cfg!(feature = "reusable-sandbox") {
+        BuildVariant::ReusableSandbox
+    } else {
+        BuildVariant::Default
+    },
+);
+
 /// Opens the Fastly Config Store used by the `EdgeZero` dispatcher.
 ///
 /// # Errors
@@ -97,10 +109,7 @@ fn main() {
 
     // Held outside the sandbox: `serve_custom` owns the `Sandbox` and exposes
     // no slot for application state that is not the retained payload.
-    let mut startup = StartupDiagnostics::default();
-    for message in diagnostics {
-        startup.push(message);
-    }
+    let mut startup = startup_diagnostics(diagnostics);
 
     match mode {
         ServeMode::Single => {
@@ -116,6 +125,21 @@ fn main() {
     }
 }
 
+fn startup_diagnostics(diagnostics: Vec<String>) -> StartupDiagnostics {
+    let mut startup = StartupDiagnostics::default();
+    startup.push(format!(
+        "Build facts: package={} source={} target={} variant={}",
+        BUILD_INFO.package_version(),
+        BUILD_INFO.source().unwrap_or("unknown"),
+        BUILD_INFO.target(),
+        BUILD_INFO.variant()
+    ));
+    for message in diagnostics {
+        startup.push(message);
+    }
+    startup
+}
+
 /// Serves requests from one sandbox under explicit bounds.
 ///
 /// Only compiled with the `reusable-sandbox` feature; [`serve_mode`] can never
@@ -912,6 +936,51 @@ mod tests {
         );
     }
 
+    #[test]
+    fn fastly_build_info_uses_actual_owning_package_target_source_and_feature() {
+        assert_eq!(
+            BUILD_INFO.package_version(),
+            env!("CARGO_PKG_VERSION"),
+            "should own Fastly package version"
+        );
+        assert_eq!(
+            BUILD_INFO.target(),
+            "wasm32-wasip1",
+            "should own Fastly Cargo target"
+        );
+        assert_eq!(
+            BUILD_INFO.source(),
+            trusted_server_core::constants::TS_GIT_VERSION,
+            "should read source from core"
+        );
+        let expected = if cfg!(feature = "reusable-sandbox") {
+            BuildVariant::ReusableSandbox
+        } else {
+            BuildVariant::Default
+        };
+        assert_eq!(
+            BUILD_INFO.variant(),
+            expected,
+            "should derive actual Fastly feature variant"
+        );
+    }
+
+    #[test]
+    fn startup_queues_one_build_fact_message_for_existing_log_flush() {
+        let startup = startup_diagnostics(Vec::new());
+        assert_eq!(
+            startup.pending(),
+            1,
+            "should queue exactly one build fact message"
+        );
+        let startup = startup_diagnostics(vec!["example diagnostic".to_owned()]);
+        assert_eq!(
+            startup.pending(),
+            2,
+            "should preserve existing startup diagnostics"
+        );
+    }
+
     #[test]
     fn health_response_reports_git_version_only() {
         let req = FastlyRequest::get("https://example.com/health");
diff --git a/crates/trusted-server-adapter-spin/src/app.rs b/crates/trusted-server-adapter-spin/src/app.rs
index 804a23b620..d82c667913 100644
--- a/crates/trusted-server-adapter-spin/src/app.rs
+++ b/crates/trusted-server-adapter-spin/src/app.rs
@@ -567,8 +567,8 @@ impl TrustedServerApp {
     /// Build the full application router from explicit settings.
     ///
     /// Testing seam: cross-adapter parity tests use this to drive the router
-    /// with known-good settings instead of the baked `get_settings()` result,
-    /// whose embedded placeholder secrets fail validation by design.
+    /// with known-good settings without external runtime configuration or
+    /// secret-store bindings.
     ///
     /// # Errors
     ///
diff --git a/crates/trusted-server-adapter-spin/src/middleware.rs b/crates/trusted-server-adapter-spin/src/middleware.rs
index fc1b939bd5..94e875cfd3 100644
--- a/crates/trusted-server-adapter-spin/src/middleware.rs
+++ b/crates/trusted-server-adapter-spin/src/middleware.rs
@@ -221,9 +221,8 @@ mod tests {
     }
 
     fn settings_with_response_headers(headers: Vec<(&str, &str)>) -> Settings {
-        // Build from explicit test settings: the settings baked into the
-        // binary contain placeholder secrets that `get_settings()` rejects
-        // by design.
+        // Build explicit, deterministic test settings without external runtime
+        // configuration or secret-store bindings.
         let mut s = Settings::from_toml(
             r#"
                 [[handlers]]
diff --git a/crates/trusted-server-adapter-spin/tests/routes.rs b/crates/trusted-server-adapter-spin/tests/routes.rs
index 613832b059..4e999e0e0a 100644
--- a/crates/trusted-server-adapter-spin/tests/routes.rs
+++ b/crates/trusted-server-adapter-spin/tests/routes.rs
@@ -14,9 +14,9 @@ use trusted_server_core::settings::Settings;
 
 /// Build the full application router from explicit test settings.
 ///
-/// The settings baked into the binary contain placeholder secrets that
-/// `get_settings()` rejects by design, which would turn every route into a
-/// startup error page (and its route table into the fallback-only set).
+/// Explicit settings exercise the full route table without external runtime
+/// configuration or secret-store bindings. Missing runtime settings would
+/// otherwise select the startup error router.
 /// The handler regex is the production-shaped `^/_ts/admin`, matching
 /// `Settings::ADMIN_ENDPOINTS` and the default config, so the canonical
 /// `/_ts/admin/keys/*` routes are auth-gated exactly as in production.
diff --git a/crates/trusted-server-cli/Cargo.toml b/crates/trusted-server-cli/Cargo.toml
index ce97919c81..ec620760ed 100644
--- a/crates/trusted-server-cli/Cargo.toml
+++ b/crates/trusted-server-cli/Cargo.toml
@@ -85,6 +85,17 @@ hyper = { workspace = true, features = ["http1", "client"] }
 hyper-util = { workspace = true, features = ["tokio"] }
 tokio = { workspace = true, features = ["net", "rt-multi-thread"] }
 
+# Consumer release verification (`src/release`), compiled only where the
+# module is: Unix hosts. `sha2`/`hex` hash exact distributed bytes, `libc`
+# provides process-group termination and `openat` snapshot reads, and
+# `jsonschema` evaluates the governing release-index schema offline. The
+# `jsonschema` exact pin and empty default features match `trusted-server-release`.
+[target.'cfg(all(unix, not(target_arch = "wasm32")))'.dependencies]
+hex = { workspace = true }
+jsonschema = { version = "=0.58.6", default-features = false }
+libc = { workspace = true }
+sha2 = { workspace = true }
+
 # The shared proxy engine supports macOS and Linux only.
 [target.'cfg(any(target_os = "macos", target_os = "linux"))'.dependencies]
 base64 = { workspace = true }
diff --git a/crates/trusted-server-cli/README.md b/crates/trusted-server-cli/README.md
index e73c646283..dbff696426 100644
--- a/crates/trusted-server-cli/README.md
+++ b/crates/trusted-server-cli/README.md
@@ -22,6 +22,22 @@ two-platform command inventory and the
 [EdgeZero guide](../../docs/guide/edgezero.md) for configuration lifecycle and
 store semantics.
 
+`ts --version` labels four compiled facts:
+`ts package=<pkg> source=<identity> target=<triple> variant=default`.
+The external release tag belongs to the signed release index and is distinct
+from the owning Cargo package version.
+Release builds set `TRUSTED_SERVER__RELEASE_BUILD=1` and require
+`TRUSTED_SERVER__GIT_VERSION` to contain exactly 40 lowercase hexadecimal commit
+characters. Any other present release control fails the build. Without that
+control, development builds retain tag, branch and abbreviated commit discovery.
+These compiled facts identify inputs; they do not establish release provenance.
+
+Help, version output and `ts config init` work outside a source checkout. Config
+initialization writes the embedded fictional example scaffold for the operator
+to configure. `ts prebid client` requires the repository's JavaScript sources and
+local build prerequisites. Release builds discover those resources from the
+current directory's ancestors and omit the developer checkout fallback.
+
 ## Experimental PBS commands
 
 `ts prebid server` manages local configuration inputs and a small set of AWS operations for self-hosted Prebid Server Go. It sits beside `ts prebid client`, which builds browser JavaScript, and remains separate from the existing Trusted Server `ts config` and `ts deploy` commands.
diff --git a/crates/trusted-server-cli/build.rs b/crates/trusted-server-cli/build.rs
new file mode 100644
index 0000000000..1c40ab678b
--- /dev/null
+++ b/crates/trusted-server-cli/build.rs
@@ -0,0 +1,31 @@
+//! Compile immutable facts owned by the CLI product.
+
+#![allow(
+    clippy::print_stdout,
+    reason = "Cargo build script directives use stdout"
+)]
+
+#[allow(
+    dead_code,
+    reason = "This owner uses only release validation from the shared resolver"
+)]
+#[path = "../trusted-server-core/build_support/git_version.rs"]
+mod git_version;
+
+fn main() {
+    println!("cargo:rerun-if-changed=build.rs");
+    println!("cargo:rerun-if-changed=../trusted-server-core/build_support/git_version.rs");
+    println!("cargo:rerun-if-env-changed=TRUSTED_SERVER__RELEASE_BUILD");
+    println!("cargo:rerun-if-env-changed=TRUSTED_SERVER__GIT_VERSION");
+    println!("cargo:rustc-check-cfg=cfg(trusted_server_release_build)");
+    let control = std::env::var_os("TRUSTED_SERVER__RELEASE_BUILD");
+    let source = std::env::var_os("TRUSTED_SERVER__GIT_VERSION");
+    if git_version::release_source(control.as_deref(), source.as_deref())
+        .expect("should provide valid release build inputs")
+        .is_some()
+    {
+        println!("cargo:rustc-cfg=trusted_server_release_build");
+    }
+    let target = std::env::var("TARGET").expect("should set the owning Cargo target");
+    println!("cargo:rustc-env=TRUSTED_SERVER__BUILD_TARGET={target}");
+}
diff --git a/crates/trusted-server-cli/release-policy.json b/crates/trusted-server-cli/release-policy.json
new file mode 100644
index 0000000000..4aa1115dfa
--- /dev/null
+++ b/crates/trusted-server-cli/release-policy.json
@@ -0,0 +1,140 @@
+{
+  "artifacts": [
+    {
+      "actions": ["readonly-verify"],
+      "assurance_profile": "provenance-sbom-repeatable",
+      "bin": "trusted-server-adapter-fastly",
+      "capabilities": ["fastly-production"],
+      "compatibility": {
+        "architecture": "wasm32",
+        "minimum_version": "wasip1",
+        "runtime": "fastly-compute"
+      },
+      "default_features": true,
+      "features": [],
+      "kind": "wasm-core",
+      "name": "trusted-server-fastly.wasm",
+      "package": "trusted-server-adapter-fastly",
+      "role": "server",
+      "target": "wasm32-wasip1",
+      "variant": "default"
+    },
+    {
+      "actions": ["readonly-verify"],
+      "assurance_profile": "provenance-sbom",
+      "bin": "ts",
+      "capabilities": ["cli-execute"],
+      "compatibility": {
+        "architecture": "aarch64",
+        "minimum_version": "13.0",
+        "runtime": "macos"
+      },
+      "default_features": true,
+      "features": [],
+      "kind": "native-executable",
+      "name": "ts-aarch64-apple-darwin",
+      "package": "trusted-server-cli",
+      "role": "operator-cli",
+      "target": "aarch64-apple-darwin",
+      "variant": "default"
+    },
+    {
+      "actions": ["readonly-verify"],
+      "assurance_profile": "provenance-sbom",
+      "bin": "ts",
+      "capabilities": ["cli-execute"],
+      "compatibility": {
+        "architecture": "x86_64",
+        "minimum_version": "13.0",
+        "runtime": "macos"
+      },
+      "default_features": true,
+      "features": [],
+      "kind": "native-executable",
+      "name": "ts-x86_64-apple-darwin",
+      "package": "trusted-server-cli",
+      "role": "operator-cli",
+      "target": "x86_64-apple-darwin",
+      "variant": "default"
+    },
+    {
+      "actions": ["readonly-verify"],
+      "assurance_profile": "provenance-sbom",
+      "bin": "ts",
+      "capabilities": ["cli-execute"],
+      "compatibility": {
+        "architecture": "x86_64",
+        "minimum_version": "glibc-2.34",
+        "runtime": "linux-gnu"
+      },
+      "default_features": true,
+      "features": [],
+      "kind": "native-executable",
+      "name": "ts-x86_64-unknown-linux-gnu",
+      "package": "trusted-server-cli",
+      "role": "operator-cli",
+      "target": "x86_64-unknown-linux-gnu",
+      "variant": "default"
+    }
+  ],
+  "bounds": {
+    "attempt_seconds": 900,
+    "bundle_bytes": 33554432,
+    "child_seconds": 120,
+    "cohort_executables": 4,
+    "companion_bytes": 33554432,
+    "executable_bytes": 536870912,
+    "index_bytes": 1048576,
+    "inventory_bytes": 1048576,
+    "json_depth": 64,
+    "matching_attestations_per_bundle": 1,
+    "metadata_bytes": 1048576,
+    "policy_bytes": 1048576,
+    "spdx_bytes": 16777216,
+    "stderr_bytes": 1048576,
+    "stdout_bytes": 134217728,
+    "trusted_roots_bytes": 1048576
+  },
+  "cohort": "phase1-fastly-cli",
+  "github_host": "github.com",
+  "historical_producer_policies": [],
+  "identity": {
+    "builder_id": "https://github.com/IABTechLab/trusted-server/.github/workflows/release-build.yml@refs/tags/<tag>",
+    "caller_commit": "same-approved-source-commit",
+    "caller_path": ".github/workflows/release.yml",
+    "caller_repository": "https://github.com/IABTechLab/trusted-server",
+    "certificate_fields": [
+      "buildConfigDigest",
+      "buildConfigURI",
+      "buildTrigger",
+      "runInvocationURI",
+      "sourceRepositoryIdentifier",
+      "sourceRepositoryOwnerIdentifier"
+    ],
+    "certificate_san": "https://github.com/IABTechLab/trusted-server/.github/workflows/release-build.yml@refs/tags/<tag>",
+    "event": "push",
+    "external_parameters": "exact-caller-workflow-only-no-inputs",
+    "invocation": "same-repository-run-and-attempt-across-certificate-and-provenance",
+    "issuer": "https://token.actions.githubusercontent.com",
+    "runner": "github-hosted",
+    "signer_commit": "same-approved-source-commit",
+    "source_commit": "independently-approved-40-lowercase-hex",
+    "source_dependency": "git+https://github.com/IABTechLab/trusted-server@refs/tags/<tag>",
+    "source_ref": "refs/tags/<tag>"
+  },
+  "policy_version": 1,
+  "predicates": {
+    "build_type": "https://actions.github.io/buildtypes/workflow/v1",
+    "provenance": "https://slsa.dev/provenance/v1",
+    "sbom": "https://spdx.dev/Document/v2.3"
+  },
+  "public_actions": ["readonly-verify"],
+  "repository": "IABTechLab/trusted-server",
+  "repository_id": "950860906",
+  "repository_owner_id": "82903538",
+  "tool_versions": {
+    "actions_attest": "4.2.2",
+    "actions_attest_revision": "1e69f48acb82d1966a394da916b4c1698aa569d6",
+    "gh": "2.97.0"
+  }
+}
diff --git a/crates/trusted-server-cli/src/commands/dev/lint/domains.rs b/crates/trusted-server-cli/src/commands/dev/lint/domains.rs
index 8978af61c0..7ca6449c84 100644
--- a/crates/trusted-server-cli/src/commands/dev/lint/domains.rs
+++ b/crates/trusted-server-cli/src/commands/dev/lint/domains.rs
@@ -112,8 +112,11 @@ pub const REFERENCE_HOSTS: &[&str] = &[
     "iabtechlab.github.io",
     "iabeurope.github.io",
     // Specs (supply chain)
+    "actions.github.io",
     "in-toto.io",
     "rslstandard.org",
+    "slsa.dev",
+    "spdx.dev",
     // Specs (other)
     "webassembly.org",
     // Fastly docs
@@ -497,6 +500,36 @@ fn canonical_host(authority: &str) -> String {
     }
 }
 
+// These are exact standard identifiers, rather than general host permissions.
+const STANDARD_IDENTIFIERS: &[&str] = &[
+    "http://json-schema.org/draft-07/schema#",
+    "https://json-schema.org/draft/2020-12/schema",
+    "http://spdx.org/rdf/terms/2.3",
+    "http://spdx.org/rdf/terms#none",
+    "http://spdx.org/rdf/terms#noassertion",
+];
+
+fn is_standard_identifier(line: &str, start: usize) -> bool {
+    let Some(prefix) = line.get(..start) else {
+        return false;
+    };
+    let Some(suffix) = line.get(start..) else {
+        return false;
+    };
+    if prefix.chars().next_back().is_some_and(|character| {
+        !character.is_whitespace() && !matches!(character, '"' | '\'' | '`' | '(' | '[' | '<' | '{')
+    }) {
+        return false;
+    }
+    STANDARD_IDENTIFIERS.iter().any(|identifier| {
+        suffix.strip_prefix(identifier).is_some_and(|rest| {
+            rest.chars().next().is_none_or(|character| {
+                character.is_whitespace() || matches!(character, '"' | '\'' | '`')
+            })
+        })
+    })
+}
+
 /// Extract and normalise every host from absolute URLs on `line`.
 ///
 /// The scheme itself marks these as URLs, so an authority that merely
@@ -507,6 +540,11 @@ fn extract_absolute_hosts(line: &str) -> Vec<String> {
     let line = unescape_solidus(line);
     absolute_url_regex()
         .captures_iter(&line)
+        .filter(|capture| {
+            !capture
+                .get(0)
+                .is_some_and(|matched| is_standard_identifier(&line, matched.start()))
+        })
         .filter_map(|c| c.get(1).map(|m| canonical_host(m.as_str())))
         .filter(|host| host.chars().any(char::is_alphanumeric))
         .collect()
@@ -1369,6 +1407,245 @@ mod scan_line_tests {
         }
     }
 
+    fn standard_identifiers() -> [&'static str; 5] {
+        [
+            "http://json-schema.org/draft-07/schema#",
+            "https://json-schema.org/draft/2020-12/schema",
+            "http://spdx.org/rdf/terms/2.3",
+            "http://spdx.org/rdf/terms#none",
+            "http://spdx.org/rdf/terms#noassertion",
+        ]
+    }
+
+    fn standard_host(identifier: &str) -> String {
+        Url::parse(identifier)
+            .expect("should parse exact standard identifier")
+            .host_str()
+            .expect("should include standard host")
+            .to_owned()
+    }
+
+    #[test]
+    fn normative_identifiers_accept_exact_json_and_quoted_prose() {
+        for identifier in standard_identifiers() {
+            for line in [
+                format!(r#"{{"$schema":"{identifier}"}}"#),
+                format!("The identifier is `{identifier}` in this fixture."),
+                identifier.to_owned(),
+                format!("'{}'", identifier.replace('/', "\\/")),
+            ] {
+                assert!(
+                    hosts(&line).is_empty(),
+                    "should accept exact standard identifier: {line}"
+                );
+            }
+        }
+    }
+
+    #[test]
+    fn normative_identifiers_reject_prefixed_text_and_every_uri_continuation() {
+        for identifier in standard_identifiers() {
+            let expected = standard_host(identifier);
+            for suffix in [
+                "/",
+                "/extra",
+                "?query",
+                "#fragment",
+                "%20",
+                "@reserved.invalid",
+                ":80",
+                ";extra",
+                ")",
+                ",",
+                "*",
+                "extra",
+            ] {
+                let line = format!("\"{identifier}{suffix}\"");
+                assert_eq!(
+                    hosts(&line),
+                    vec![expected.clone()],
+                    "should reject continued standard URI: {line}"
+                );
+            }
+            assert_eq!(
+                hosts(&format!("\"prefixed{identifier}\"")),
+                vec![expected],
+                "should reject identifier embedded in prefixed text"
+            );
+        }
+    }
+
+    #[test]
+    fn normative_identifiers_require_source_opening_prefix_boundaries() {
+        for identifier in standard_identifiers() {
+            let host = standard_host(identifier);
+            for prefix in [
+                ":",
+                "=",
+                "/",
+                ";",
+                ")",
+                "]",
+                "}",
+                "@",
+                "%",
+                "?",
+                "#",
+                "urn:reference:",
+                "query=",
+            ] {
+                assert_eq!(
+                    hosts(&format!("{prefix}{identifier}\"")),
+                    vec![host.clone()],
+                    "should reject nested or continued URI prefixes"
+                );
+            }
+            for prefix in [" ", "\t", "\"", "'", "`", "(", "[", "<", "{"] {
+                assert!(
+                    hosts(&format!("{prefix}{identifier}\"")).is_empty(),
+                    "should accept source-opening prefix boundary"
+                );
+            }
+        }
+    }
+
+    #[test]
+    fn normative_identifiers_reject_scheme_authority_and_host_variants() {
+        for identifier in standard_identifiers() {
+            let parsed = Url::parse(identifier).expect("should parse standard URI");
+            let scheme = parsed.scheme();
+            let host = standard_host(identifier);
+            let rest = identifier
+                .strip_prefix(&format!("{scheme}://{host}"))
+                .expect("should provide canonical authority");
+            for authority in [
+                format!("user@{host}"),
+                format!("{host}:80"),
+                format!("subdomain.{host}"),
+                format!("lookalike-{host}"),
+                format!("{host}.unreviewed"),
+                host.replacen('o', "%6f", 1),
+                host.to_uppercase(),
+            ] {
+                let line = format!("\"{scheme}://{authority}{rest}\"");
+                assert!(
+                    !hosts(&line).is_empty(),
+                    "should reject noncanonical standard authority: {line}"
+                );
+            }
+            for line in [
+                format!("\"//{host}{rest}\""),
+                format!("\"{}://{host}{rest}\"", scheme.to_uppercase()),
+                format!(
+                    "\"{}://{host}{rest}\"",
+                    if scheme == "http" { "https" } else { "http" }
+                ),
+            ] {
+                assert_eq!(
+                    hosts(&line),
+                    vec![host.clone()],
+                    "should reject noncanonical scheme or protocol-relative URI: {line}"
+                );
+            }
+        }
+    }
+
+    #[test]
+    fn normative_identifiers_do_not_hide_same_host_urls_in_either_order() {
+        for identifier in standard_identifiers() {
+            let host = standard_host(identifier);
+            let noncanonical = format!("{identifier}/unregistered");
+            for line in [
+                format!("\"{identifier}\" \"{noncanonical}\""),
+                format!("\"{noncanonical}\" \"{identifier}\""),
+            ] {
+                assert_eq!(
+                    hosts(&line),
+                    vec![host.clone()],
+                    "should retain the noncanonical occurrence before host deduplication"
+                );
+            }
+        }
+    }
+
+    #[test]
+    fn normative_identifiers_preserve_other_host_violations() {
+        for identifier in standard_identifiers() {
+            let other = if standard_host(identifier) == "spdx.org" {
+                "https://json-schema.org/unregistered"
+            } else {
+                "http://spdx.org/unregistered"
+            };
+            assert_eq!(
+                hosts(&format!("\"{identifier}\" \"{other}\"")),
+                vec![standard_host(other)],
+                "should retain other disallowed URL beside exact identifier"
+            );
+        }
+    }
+
+    #[test]
+    fn normative_identifiers_leave_host_suppressions_unused() {
+        for identifier in standard_identifiers() {
+            let host = standard_host(identifier);
+            let outcome = scan_line(&format!("\"{identifier}\" // allow-domain: {host}"));
+            assert!(
+                outcome.violations.is_empty(),
+                "should accept exact identifier without suppression"
+            );
+            assert_eq!(
+                outcome.unused_suppressions,
+                vec![host],
+                "should report unused host suppression"
+            );
+        }
+    }
+
+    #[test]
+    fn release_policy_standard_identifiers_pass_without_suppression() {
+        let policy = include_str!(concat!(env!("CARGO_MANIFEST_DIR"), "/release-policy.json"));
+        for line in policy.lines() {
+            assert!(
+                hosts(line).is_empty(),
+                "should accept reviewed production policy identifiers: {line}"
+            );
+        }
+    }
+
+    #[test]
+    fn release_policy_standard_hosts_reject_subdomains_and_lookalikes() {
+        let policy: serde_json::Value = serde_json::from_str(include_str!(concat!(
+            env!("CARGO_MANIFEST_DIR"),
+            "/release-policy.json"
+        )))
+        .expect("should parse the production release policy");
+        let predicates = policy["predicates"]
+            .as_object()
+            .expect("should provide fixed predicate identities");
+        for predicate in predicates.values() {
+            let identifier = predicate
+                .as_str()
+                .expect("should provide a string predicate identifier");
+            let authority = identifier
+                .strip_prefix("https://")
+                .expect("should use an HTTPS predicate identifier")
+                .split('/')
+                .next()
+                .expect("should contain the standard host");
+            for host in [
+                format!("subdomain.{authority}"),
+                format!("{authority}.unreviewed"),
+                format!("lookalike-{authority}"),
+            ] {
+                assert_eq!(
+                    hosts(&format!("https://{host}/example")),
+                    vec![host],
+                    "should reject unreviewed standard-host variants"
+                );
+            }
+        }
+    }
+
     #[test]
     fn disallowed_reports() {
         assert_eq!(hosts("see https://test.com"), vec!["test.com"]);
diff --git a/crates/trusted-server-cli/src/commands/mod.rs b/crates/trusted-server-cli/src/commands/mod.rs
index 0f4354f007..4a5ff7b707 100644
--- a/crates/trusted-server-cli/src/commands/mod.rs
+++ b/crates/trusted-server-cli/src/commands/mod.rs
@@ -9,3 +9,6 @@ pub(crate) mod pbs;
 pub mod cache;
 pub mod dev;
 pub mod origin;
+
+#[cfg(unix)]
+pub(crate) mod release;
diff --git a/crates/trusted-server-cli/src/commands/release.rs b/crates/trusted-server-cli/src/commands/release.rs
new file mode 100644
index 0000000000..13335ccacf
--- /dev/null
+++ b/crates/trusted-server-cli/src/commands/release.rs
@@ -0,0 +1,35 @@
+//! Read-only verification of official release assets.
+
+use clap::{Args, Subcommand};
+
+use crate::release;
+
+/// Read-only operations over the fixed official release cohort.
+#[derive(Debug, Subcommand)]
+pub(crate) enum ReleaseCommand {
+    /// Verify an official release asset against an independently approved commit.
+    Verify(VerifyArgs),
+}
+
+/// An independently approved source and the exact release asset to verify.
+#[derive(Debug, Args)]
+pub(crate) struct VerifyArgs {
+    /// Exact release tag, such as v1.2.0.
+    tag: String,
+    /// Exact executable name in the embedded release cohort.
+    #[arg(long)]
+    asset: String,
+    /// Independently approved full, lowercase source commit.
+    #[arg(long)]
+    expected_source_commit: String,
+}
+
+/// Runs release verification without invoking provider or build operations.
+///
+/// # Errors
+///
+/// Returns a diagnostic when any input, evidence or publication check fails.
+pub(crate) fn run(command: ReleaseCommand) -> Result<(), String> {
+    let ReleaseCommand::Verify(args) = command;
+    release::verify(&args.tag, &args.asset, &args.expected_source_commit)
+}
diff --git a/crates/trusted-server-cli/src/lib.rs b/crates/trusted-server-cli/src/lib.rs
index 24e001d853..1bdfc9d931 100644
--- a/crates/trusted-server-cli/src/lib.rs
+++ b/crates/trusted-server-cli/src/lib.rs
@@ -6,6 +6,17 @@ mod app_config;
 mod error;
 #[cfg(not(target_arch = "wasm32"))]
 mod prebid_bundle;
+// Consumer-side release attestation verification. Unix-only because the gh
+// runner terminates whole process groups. The public command is read-only.
+#[cfg(all(unix, not(target_arch = "wasm32")))]
+#[cfg_attr(
+    not(test),
+    expect(
+        dead_code,
+        reason = "private offline and future action-consumption helpers have no public command surface"
+    )
+)]
+mod release;
 #[cfg(not(target_arch = "wasm32"))]
 mod run;
 #[cfg(not(target_arch = "wasm32"))]
@@ -14,7 +25,7 @@ mod tls;
 mod url_guard;
 
 #[cfg(not(target_arch = "wasm32"))]
-pub use run::{RunOutcome, run_from_env};
+pub use run::{BUILD_INFO, RunOutcome, run_from_env};
 
 // Every `ts` subcommand's implementation lives under `commands/<name>`. The
 // `ts dev` group is available on every host target; `ts dev lint` and
diff --git a/crates/trusted-server-cli/src/prebid_bundle.rs b/crates/trusted-server-cli/src/prebid_bundle.rs
index 609c950531..1ad5d605b1 100644
--- a/crates/trusted-server-cli/src/prebid_bundle.rs
+++ b/crates/trusted-server-cli/src/prebid_bundle.rs
@@ -620,6 +620,18 @@ fn ensure_file_exists(path: &Path, description: &str) -> CliResult<()> {
 }
 
 fn find_js_lib_dir(start: &Path) -> CliResult<PathBuf> {
+    #[cfg(not(trusted_server_release_build))]
+    let fallback = Some(
+        PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+            .join("../..")
+            .join("crates/trusted-server-js/lib"),
+    );
+    #[cfg(trusted_server_release_build)]
+    let fallback: Option<PathBuf> = None;
+    find_js_lib_dir_with_fallback(start, fallback.as_deref())
+}
+
+fn find_js_lib_dir_with_fallback(start: &Path, fallback: Option<&Path>) -> CliResult<PathBuf> {
     for ancestor in start.ancestors() {
         let candidate = ancestor.join("crates/trusted-server-js/lib");
         if is_js_lib_dir(&candidate) {
@@ -627,11 +639,9 @@ fn find_js_lib_dir(start: &Path) -> CliResult<PathBuf> {
         }
     }
 
-    let manifest_dir = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
-    let candidate = manifest_dir
-        .join("../..")
-        .join("crates/trusted-server-js/lib");
-    if is_js_lib_dir(&candidate) {
+    if let Some(candidate) = fallback
+        && is_js_lib_dir(candidate)
+    {
         return candidate.canonicalize().map_err(|error| {
             report_error(format!(
                 "failed to resolve JS library directory {}: {error}",
@@ -835,6 +845,71 @@ fn write_atomic(path: &Path, contents: &str) -> CliResult<()> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn resource_discovery_without_fallback_requires_runtime_checkout() {
+        let directory = tempfile::tempdir().expect("should create outside checkout fixture");
+        let error = find_js_lib_dir_with_fallback(directory.path(), None)
+            .expect_err("should require runtime checkout when fallback is absent");
+        assert!(
+            error
+                .to_string()
+                .contains("run `ts prebid client` from the Trusted Server repository"),
+            "should explain the missing source prerequisites"
+        );
+        let resources = directory.path().join("crates/trusted-server-js/lib");
+        fs::create_dir_all(&resources).expect("should create runtime resources");
+        fs::write(resources.join("package.json"), "{}").expect("should create package fixture");
+        fs::write(resources.join("build-prebid-external.mjs"), "")
+            .expect("should create builder fixture");
+        let nested = directory.path().join("nested");
+        fs::create_dir(&nested).expect("should create nested current directory");
+        assert_eq!(
+            find_js_lib_dir_with_fallback(&nested, None)
+                .expect("should discover actual runtime checkout"),
+            resources,
+            "should discover runtime ancestor resources"
+        );
+    }
+
+    #[test]
+    fn resource_discovery_uses_explicit_development_fallback() {
+        let directory = tempfile::tempdir().expect("should create fixture");
+        let resources = directory.path().join("development-lib");
+        fs::create_dir(&resources).expect("should create development fallback");
+        fs::write(resources.join("package.json"), "{}").expect("should create package fixture");
+        fs::write(resources.join("build-prebid-external.mjs"), "")
+            .expect("should create builder fixture");
+        assert_eq!(
+            find_js_lib_dir_with_fallback(directory.path(), Some(&resources))
+                .expect("should use explicit development fallback"),
+            resources
+                .canonicalize()
+                .expect("should canonicalize fallback"),
+            "should preserve development fallback behavior"
+        );
+    }
+
+    #[test]
+    fn actual_resource_discovery_uses_owning_release_cfg() {
+        let directory = tempfile::tempdir().expect("should create outside checkout fixture");
+        let result = find_js_lib_dir(directory.path());
+        if cfg!(trusted_server_release_build) {
+            let error =
+                result.expect_err("should exclude the compiled developer checkout in release mode");
+            assert!(
+                error
+                    .to_string()
+                    .contains("run `ts prebid client` from the Trusted Server repository"),
+                "should identify release source prerequisites"
+            );
+        } else {
+            assert!(
+                result.is_ok(),
+                "should retain the compiled checkout fallback in development"
+            );
+        }
+    }
+
     fn managed_config(managed: &str, user_id: &str) -> String {
         format!(
             r#"
diff --git a/crates/trusted-server-cli/src/release/artifact.rs b/crates/trusted-server-cli/src/release/artifact.rs
new file mode 100644
index 0000000000..3db444a858
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/artifact.rs
@@ -0,0 +1,586 @@
+//! Retained release asset bytes and the read-only verification report.
+//!
+//! Downloads stream into a private, unlinked temporary file while the role
+//! byte limit is enforced chunk by chunk, so an oversize executable is
+//! rejected mid-transfer instead of after it was fully written. A
+//! [`RetainedAsset`] is only a measured download; a [`VerifiedReleaseAsset`]
+//! is constructed exclusively from a [`PublicationVerified`] state that names
+//! the same asset, digest and length, and is re-hashed before every later use.
+//!
+//! Nothing here authorizes deployment: [`VerificationReport`] is a read-only
+//! summary, and action-scoped authorization belongs to a later integration.
+
+use std::fs::{File, OpenOptions};
+use std::io::{Read as _, Seek as _, SeekFrom, Write as _};
+use std::os::unix::fs::OpenOptionsExt as _;
+use std::path::{Path, PathBuf};
+use std::time::Instant;
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256};
+
+use super::bounds::{self, AttemptDeadline, Cancellation};
+use super::error::{ReleaseError, report};
+use super::evidence::ComparisonOutcome;
+use super::github::PublicationVerified;
+
+/// Read buffer used when re-hashing a retained file.
+const REHASH_CHUNK: usize = 64 * 1024;
+
+/// The byte-limit class of a release asset.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum AssetRole {
+    /// A cohort executable (512 MiB).
+    Executable,
+    /// A Sigstore bundle or build companion (32 MiB).
+    Companion,
+    /// An SPDX SBOM document (16 MiB).
+    Spdx,
+    /// The index, JS inventory or `SHA256SUMS` (1 MiB).
+    Metadata,
+}
+
+impl AssetRole {
+    /// Returns the R-BOUNDS byte limit for this role.
+    pub(crate) const fn limit(self) -> u64 {
+        match self {
+            Self::Executable => bounds::EXECUTABLE_BYTES,
+            Self::Companion => bounds::COMPANION_BYTES,
+            Self::Spdx => bounds::SPDX_BYTES,
+            Self::Metadata => bounds::METADATA_BYTES,
+        }
+    }
+}
+
+/// The exact SHA-256 and length of distributed bytes.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct AssetMeasurement {
+    sha256: String,
+    length: u64,
+}
+
+impl AssetMeasurement {
+    /// Measures exact in-memory bytes without reserializing them.
+    pub(crate) fn of_bytes(bytes: &[u8]) -> Self {
+        Self {
+            sha256: hex::encode(Sha256::digest(bytes)),
+            length: bytes.len() as u64,
+        }
+    }
+
+    /// Records a length and digest declared by already verified evidence.
+    ///
+    /// Used only for expectations; retained bytes are always re-hashed
+    /// before a [`VerifiedReleaseAsset`] is constructed.
+    pub(crate) fn declared(sha256: &str, length: u64) -> Self {
+        Self {
+            sha256: sha256.to_owned(),
+            length,
+        }
+    }
+
+    /// Returns the lowercase hexadecimal SHA-256.
+    pub(crate) fn sha256(&self) -> &str {
+        &self.sha256
+    }
+
+    /// Returns the byte length.
+    pub(crate) fn length(&self) -> u64 {
+        self.length
+    }
+}
+
+/// A download in progress into a private retained file.
+#[derive(Debug)]
+pub(crate) struct RetainedDownload {
+    name: String,
+    role: AssetRole,
+    file: File,
+    hasher: Sha256,
+    length: u64,
+}
+
+impl RetainedDownload {
+    /// Starts a download into a new anonymous, owner-only temporary file.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Asset`] if the private file cannot be created.
+    pub(crate) fn start(name: &str, role: AssetRole) -> Result<Self, Report<ReleaseError>> {
+        let file = tempfile::tempfile().map_err(|source| report(ReleaseError::Asset, source))?;
+        Ok(Self {
+            name: name.to_owned(),
+            role,
+            file,
+            hasher: Sha256::new(),
+            length: 0,
+        })
+    }
+
+    /// Appends one received chunk, enforcing the role limit before writing.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Asset`] once the total would exceed the role
+    /// limit (the transfer must then be aborted) or the write fails.
+    pub(crate) fn push(&mut self, chunk: &[u8]) -> Result<(), Report<ReleaseError>> {
+        let remaining = self.role.limit().saturating_sub(self.length);
+        if chunk.len() as u64 > remaining {
+            return Err(report(
+                ReleaseError::Asset,
+                format!(
+                    "asset `{}` exceeds its {} byte role limit; download aborted",
+                    self.name,
+                    self.role.limit()
+                ),
+            ));
+        }
+        self.file
+            .write_all(chunk)
+            .map_err(|source| report(ReleaseError::Asset, source))?;
+        self.hasher.update(chunk);
+        self.length += chunk.len() as u64;
+        Ok(())
+    }
+
+    /// Completes the download and returns the measured retained asset.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Asset`] if the file cannot be flushed.
+    pub(crate) fn finish(mut self) -> Result<RetainedAsset, Report<ReleaseError>> {
+        self.file
+            .flush()
+            .map_err(|source| report(ReleaseError::Asset, source))?;
+        Ok(RetainedAsset {
+            name: self.name,
+            role: self.role,
+            file: self.file,
+            measurement: AssetMeasurement {
+                sha256: hex::encode(self.hasher.finalize()),
+                length: self.length,
+            },
+        })
+    }
+}
+
+/// Streams a response body into a retained file under the role limit.
+///
+/// A declared `Content-Length` above the limit is rejected before any byte
+/// is read; the streamed total is enforced independently while receiving.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Asset`] for oversize or failed transfers and
+/// [`ReleaseError::Timeout`] when the attempt deadline elapses.
+pub(crate) async fn stream_into(
+    mut response: reqwest::Response,
+    mut download: RetainedDownload,
+    deadline: AttemptDeadline,
+) -> Result<RetainedAsset, Report<ReleaseError>> {
+    if response
+        .content_length()
+        .is_some_and(|length| length > download.role.limit())
+    {
+        return Err(report(
+            ReleaseError::Asset,
+            format!(
+                "asset `{}` declares more than its role limit",
+                download.name
+            ),
+        ));
+    }
+    let transfer = async {
+        while let Some(chunk) = response
+            .chunk()
+            .await
+            .map_err(|source| report(ReleaseError::Asset, source.without_url()))?
+        {
+            download.push(&chunk)?;
+        }
+        download.finish()
+    };
+    tokio::time::timeout_at(tokio::time::Instant::from_std(deadline.instant()), transfer)
+        .await
+        .map_err(|_| {
+            report(
+                ReleaseError::Timeout,
+                "asset download exceeded the deadline",
+            )
+        })?
+}
+
+/// A fully downloaded, measured but not yet verified release asset.
+#[derive(Debug)]
+pub(crate) struct RetainedAsset {
+    name: String,
+    role: AssetRole,
+    file: File,
+    measurement: AssetMeasurement,
+}
+
+impl RetainedAsset {
+    /// Copies retained bytes to a canonical private filename for gh snapshots.
+    ///
+    /// # Errors
+    ///
+    /// Rejects unsafe names, collisions, changed bytes, limits or cancellation.
+    pub(crate) fn materialize(
+        &mut self,
+        directory: &Path,
+        deadline: AttemptDeadline,
+        cancellation: &Cancellation,
+    ) -> Result<PathBuf, Report<ReleaseError>> {
+        if !super::documents::safe_name(&self.name) || !directory.is_absolute() {
+            return Err(report(
+                ReleaseError::Asset,
+                "unsafe retained materialization path",
+            ));
+        }
+        let path = directory.join(&self.name);
+        let mut output = OpenOptions::new()
+            .write(true)
+            .create_new(true)
+            .mode(0o600)
+            .open(&path)
+            .map_err(|error| report(ReleaseError::Asset, error))?;
+        self.file
+            .seek(SeekFrom::Start(0))
+            .map_err(|error| report(ReleaseError::Asset, error))?;
+        let mut hasher = Sha256::new();
+        let mut length = 0_u64;
+        let mut buffer = [0_u8; REHASH_CHUNK];
+        loop {
+            if cancellation.is_cancelled() {
+                return Err(report(ReleaseError::Cancelled, "retained copy cancelled"));
+            }
+            if Instant::now() >= deadline.instant() {
+                return Err(report(
+                    ReleaseError::Timeout,
+                    "retained copy exceeded deadline",
+                ));
+            }
+            let read = self
+                .file
+                .read(&mut buffer)
+                .map_err(|error| report(ReleaseError::Asset, error))?;
+            if read == 0 {
+                break;
+            }
+            length += read as u64;
+            if length > self.role.limit() {
+                return Err(report(
+                    ReleaseError::Asset,
+                    "retained copy exceeds role limit",
+                ));
+            }
+            let chunk = &buffer[..read];
+            output
+                .write_all(chunk)
+                .map_err(|error| report(ReleaseError::Asset, error))?;
+            hasher.update(chunk);
+        }
+        let measurement = AssetMeasurement::declared(&hex::encode(hasher.finalize()), length);
+        if measurement != self.measurement {
+            return Err(report(
+                ReleaseError::Asset,
+                "retained bytes changed before gh verification",
+            ));
+        }
+        output
+            .flush()
+            .map_err(|error| report(ReleaseError::Asset, error))?;
+        Ok(path)
+    }
+
+    /// Returns the release asset name.
+    pub(crate) fn name(&self) -> &str {
+        &self.name
+    }
+
+    /// Returns the measured digest and length.
+    pub(crate) fn measurement(&self) -> &AssetMeasurement {
+        &self.measurement
+    }
+
+    /// Re-reads the retained bytes of a non-executable document after
+    /// re-checking their digest.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Asset`] for executables (never buffered whole)
+    /// or if the retained bytes changed.
+    pub(crate) fn document_bytes(&mut self) -> Result<Vec<u8>, Report<ReleaseError>> {
+        if self.role == AssetRole::Executable {
+            return Err(report(
+                ReleaseError::Asset,
+                "executables are verified by streamed digest, not buffered",
+            ));
+        }
+        let bytes = read_bounded(&mut self.file, self.role.limit())?;
+        if AssetMeasurement::of_bytes(&bytes) != self.measurement {
+            return Err(report(
+                ReleaseError::Asset,
+                format!("retained asset `{}` changed after download", self.name),
+            ));
+        }
+        Ok(bytes)
+    }
+}
+
+fn read_bounded(file: &mut File, limit: u64) -> Result<Vec<u8>, Report<ReleaseError>> {
+    file.seek(SeekFrom::Start(0))
+        .map_err(|source| report(ReleaseError::Asset, source))?;
+    let mut bytes = Vec::new();
+    file.take(limit + 1)
+        .read_to_end(&mut bytes)
+        .map_err(|source| report(ReleaseError::Asset, source))?;
+    if bytes.len() as u64 > limit {
+        return Err(report(
+            ReleaseError::Asset,
+            "retained asset grew past its role limit",
+        ));
+    }
+    Ok(bytes)
+}
+
+fn rehash(
+    file: &mut File,
+    limit: u64,
+    deadline: AttemptDeadline,
+    cancellation: &Cancellation,
+) -> Result<AssetMeasurement, Report<ReleaseError>> {
+    file.seek(SeekFrom::Start(0))
+        .map_err(|source| report(ReleaseError::Asset, source))?;
+    let mut hasher = Sha256::new();
+    let mut length = 0_u64;
+    let mut buffer = vec![0_u8; REHASH_CHUNK];
+    loop {
+        check_attempt(deadline, cancellation)?;
+        let read = file
+            .read(&mut buffer)
+            .map_err(|source| report(ReleaseError::Asset, source))?;
+        if read == 0 {
+            break;
+        }
+        length += read as u64;
+        if length > limit {
+            return Err(report(
+                ReleaseError::Asset,
+                "retained asset grew past its role limit",
+            ));
+        }
+        hasher.update(buffer.get(..read).unwrap_or_default());
+    }
+    Ok(AssetMeasurement {
+        sha256: hex::encode(hasher.finalize()),
+        length,
+    })
+}
+
+/// Checks the shared deadline and cancellation before file work or success.
+pub(crate) fn check_attempt(
+    deadline: AttemptDeadline,
+    cancellation: &Cancellation,
+) -> Result<(), Report<ReleaseError>> {
+    if cancellation.is_cancelled() {
+        return Err(report(
+            ReleaseError::Cancelled,
+            "release verification cancelled",
+        ));
+    }
+    if Instant::now() >= deadline.instant() {
+        return Err(report(
+            ReleaseError::Timeout,
+            "release verification deadline elapsed",
+        ));
+    }
+    Ok(())
+}
+
+/// A retained release executable whose bytes match verified, published
+/// evidence.
+///
+/// Constructed only by [`VerifiedReleaseAsset::from_publication_bounded`]; an
+/// asserted path or hash cannot build one.
+#[derive(Debug)]
+pub(crate) struct VerifiedReleaseAsset {
+    name: String,
+    file: File,
+    measurement: AssetMeasurement,
+    assurance_profile: String,
+    comparison: ComparisonOutcome,
+    publication_index: AssetMeasurement,
+}
+
+impl VerifiedReleaseAsset {
+    /// Test compatibility wrapper; production must pass its attempt bounds.
+    #[cfg(test)]
+    pub(crate) fn from_publication(
+        publication: &PublicationVerified,
+        asset: RetainedAsset,
+    ) -> Result<Self, Report<ReleaseError>> {
+        Self::from_publication_bounded(
+            publication,
+            asset,
+            AttemptDeadline::start(),
+            &Cancellation::default(),
+        )
+    }
+
+    /// Binds a retained executable to the publication-verified evidence.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Asset`] unless the asset is a retained
+    /// executable consumed by `publication` whose re-hashed bytes equal the
+    /// verified digest and length.
+    pub(crate) fn from_publication_bounded(
+        publication: &PublicationVerified,
+        mut asset: RetainedAsset,
+        deadline: AttemptDeadline,
+        cancellation: &Cancellation,
+    ) -> Result<Self, Report<ReleaseError>> {
+        let consumed = publication
+            .build()
+            .consumed()
+            .iter()
+            .find(|consumed| consumed.name() == asset.name)
+            .ok_or_else(|| {
+                report(
+                    ReleaseError::Asset,
+                    format!("asset `{}` was not consumed by verification", asset.name),
+                )
+            })?;
+        if asset.role != AssetRole::Executable {
+            return Err(report(
+                ReleaseError::Asset,
+                "only retained executables become verified release assets",
+            ));
+        }
+        check_attempt(deadline, cancellation)?;
+        let measured = rehash(
+            &mut asset.file,
+            AssetRole::Executable.limit(),
+            deadline,
+            cancellation,
+        )?;
+        if measured != asset.measurement || &measured != consumed.measurement() {
+            return Err(report(
+                ReleaseError::Asset,
+                format!("asset `{}` does not match verified evidence", asset.name),
+            ));
+        }
+        Ok(Self {
+            name: asset.name,
+            file: asset.file,
+            measurement: measured,
+            assurance_profile: consumed.assurance_profile().to_owned(),
+            comparison: consumed.comparison(),
+            publication_index: publication.build().index_measurement().clone(),
+        })
+    }
+
+    /// Re-hashes the retained bytes; call before every later use.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Asset`] if the retained bytes changed.
+    pub(crate) fn rehash_bounded(
+        &mut self,
+        deadline: AttemptDeadline,
+        cancellation: &Cancellation,
+    ) -> Result<&AssetMeasurement, Report<ReleaseError>> {
+        let measured = rehash(
+            &mut self.file,
+            AssetRole::Executable.limit(),
+            deadline,
+            cancellation,
+        )?;
+        if measured != self.measurement {
+            return Err(report(
+                ReleaseError::Asset,
+                format!("verified asset `{}` changed after verification", self.name),
+            ));
+        }
+        Ok(&self.measurement)
+    }
+
+    /// Returns the asset name.
+    pub(crate) fn name(&self) -> &str {
+        &self.name
+    }
+}
+
+/// Read-only summary of one complete online verification.
+///
+/// It is not a deployment authorization and cannot construct one.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct VerificationReport {
+    pub(crate) consumer_policy_version: u64,
+    pub(crate) consumer_policy_sha256: String,
+    pub(crate) producer_policy_version: u64,
+    pub(crate) producer_policy_sha256: String,
+    pub(crate) repository: &'static str,
+    pub(crate) tag: String,
+    pub(crate) source_commit: String,
+    pub(crate) asset: String,
+    pub(crate) asset_sha256: String,
+    pub(crate) asset_length: u64,
+    pub(crate) assurance_profile: String,
+    pub(crate) run_invocation: String,
+    /// Informational rebuild comparison; never an authorization input.
+    pub(crate) comparison: ComparisonOutcome,
+}
+
+impl VerificationReport {
+    /// Test compatibility wrapper; production must pass its attempt bounds.
+    #[cfg(test)]
+    pub(crate) fn new(
+        publication: &PublicationVerified,
+        asset: &mut VerifiedReleaseAsset,
+    ) -> Result<Self, Report<ReleaseError>> {
+        Self::new_bounded(
+            publication,
+            asset,
+            AttemptDeadline::start(),
+            &Cancellation::default(),
+        )
+    }
+    /// Summarizes a publication-verified asset after re-hashing it.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Asset`] if the retained bytes changed.
+    pub(crate) fn new_bounded(
+        publication: &PublicationVerified,
+        asset: &mut VerifiedReleaseAsset,
+        deadline: AttemptDeadline,
+        cancellation: &Cancellation,
+    ) -> Result<Self, Report<ReleaseError>> {
+        let measurement = asset.rehash_bounded(deadline, cancellation)?.clone();
+        let build = publication.build();
+        if &asset.publication_index != build.index_measurement() {
+            return Err(report(
+                ReleaseError::Asset,
+                "asset belongs to another publication",
+            ));
+        }
+        check_attempt(deadline, cancellation)?;
+        Ok(Self {
+            consumer_policy_version: build.consumer_policy_version(),
+            consumer_policy_sha256: build.consumer_policy_sha256().to_owned(),
+            producer_policy_version: build.index().policy_version,
+            producer_policy_sha256: build.index().policy_sha256.clone(),
+            repository: super::policy::REPOSITORY,
+            tag: build.release().tag().as_str().to_owned(),
+            source_commit: build.release().commit().as_str().to_owned(),
+            asset: asset.name.clone(),
+            asset_sha256: measurement.sha256().to_owned(),
+            asset_length: measurement.length(),
+            assurance_profile: asset.assurance_profile.clone(),
+            run_invocation: build.run_invocation().to_owned(),
+            comparison: asset.comparison,
+        })
+    }
+}
diff --git a/crates/trusted-server-cli/src/release/bounds.rs b/crates/trusted-server-cli/src/release/bounds.rs
new file mode 100644
index 0000000000..35c9561263
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/bounds.rs
@@ -0,0 +1,115 @@
+//! Fixed R-BOUNDS resource limits.
+//!
+//! These values mirror the embedded policy `bounds` object, which
+//! [`super::policy`] requires to match exactly. They change only through a
+//! reviewed policy update.
+
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::time::{Duration, Instant};
+
+const MIB: u64 = 1024 * 1024;
+
+/// Maximum release-index bytes.
+pub(crate) const INDEX_BYTES: u64 = MIB;
+/// Maximum release-policy bytes, embedded or approved-source.
+pub(crate) const POLICY_BYTES: u64 = MIB;
+/// Maximum JS inventory bytes.
+pub(crate) const INVENTORY_BYTES: u64 = MIB;
+/// Maximum generic metadata bytes.
+pub(crate) const METADATA_BYTES: u64 = MIB;
+/// Maximum Sigstore bundle bytes.
+pub(crate) const BUNDLE_BYTES: u64 = 32 * MIB;
+/// Maximum build companion bytes.
+pub(crate) const COMPANION_BYTES: u64 = 32 * MIB;
+/// Maximum SPDX SBOM bytes (the pinned action's limit).
+pub(crate) const SPDX_BYTES: u64 = 16 * MIB;
+/// Maximum trusted-root snapshot bytes.
+pub(crate) const TRUSTED_ROOTS_BYTES: u64 = MIB;
+/// Maximum executable bytes.
+pub(crate) const EXECUTABLE_BYTES: u64 = 512 * MIB;
+/// Maximum JSON container nesting, counting the root.
+pub(crate) const JSON_DEPTH: usize = 64;
+/// Exact number of executables in the cohort.
+pub(crate) const COHORT_EXECUTABLES: usize = 4;
+/// Exact number of matching attestation results accepted per bundle.
+pub(crate) const MATCHING_ATTESTATIONS_PER_BUNDLE: usize = 1;
+/// Per-child wall-clock deadline in seconds.
+pub(crate) const CHILD_SECONDS: u64 = 120;
+/// Whole verification attempt deadline in seconds.
+pub(crate) const ATTEMPT_SECONDS: u64 = 900;
+/// Maximum child stdout bytes.
+pub(crate) const STDOUT_BYTES: u64 = 128 * MIB;
+/// Maximum child stderr bytes.
+pub(crate) const STDERR_BYTES: u64 = MIB;
+
+/// Bounded wait for pipe drains after the child process group is killed.
+///
+/// This is a runner-internal liveness bound, not an R-BOUNDS policy value: a
+/// killed group closes its pipes promptly, so anything still holding them
+/// after this grace has escaped the group and is reported as such.
+const KILL_GRACE: Duration = Duration::from_secs(2);
+
+/// Per-child process limits.
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct ProcessBounds {
+    pub(crate) child_timeout: Duration,
+    pub(crate) stdout_bytes: u64,
+    pub(crate) stderr_bytes: u64,
+    pub(crate) kill_grace: Duration,
+}
+
+impl ProcessBounds {
+    /// Returns the fixed production limits.
+    pub(crate) const fn production() -> Self {
+        Self {
+            child_timeout: Duration::from_secs(CHILD_SECONDS),
+            stdout_bytes: STDOUT_BYTES,
+            stderr_bytes: STDERR_BYTES,
+            kill_grace: KILL_GRACE,
+        }
+    }
+}
+
+/// The overall deadline shared by every step of one verification attempt.
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct AttemptDeadline(Instant);
+
+impl AttemptDeadline {
+    /// Starts the fixed 15-minute attempt deadline now.
+    pub(crate) fn start() -> Self {
+        Self(Instant::now() + Duration::from_secs(ATTEMPT_SECONDS))
+    }
+
+    /// Uses an explicit instant, for callers that already hold a deadline.
+    pub(crate) const fn at(instant: Instant) -> Self {
+        Self(instant)
+    }
+
+    /// Returns the deadline instant.
+    pub(crate) const fn instant(self) -> Instant {
+        self.0
+    }
+}
+
+/// A cancellation flag shared between the caller and running children.
+#[derive(Clone, Debug, Default)]
+pub(crate) struct Cancellation(Arc<AtomicBool>);
+
+impl Cancellation {
+    /// Waits for cancellation while leaving stalled HTTP futures interruptible.
+    pub(crate) async fn cancelled(&self) {
+        while !self.is_cancelled() {
+            tokio::time::sleep(Duration::from_millis(25)).await;
+        }
+    }
+    /// Requests cancellation of every child observing this flag.
+    pub(crate) fn cancel(&self) {
+        self.0.store(true, Ordering::Release);
+    }
+
+    /// Returns whether cancellation was requested.
+    pub(crate) fn is_cancelled(&self) -> bool {
+        self.0.load(Ordering::Acquire)
+    }
+}
diff --git a/crates/trusted-server-cli/src/release/documents.rs b/crates/trusted-server-cli/src/release/documents.rs
new file mode 100644
index 0000000000..0b80dd2492
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/documents.rs
@@ -0,0 +1,716 @@
+//! Byte-first strict JSON parsing and closed release-index validation.
+//!
+//! This mirrors the producer's strict parser without depending on the release
+//! crate: role byte limits apply before decoding, then BOM, UTF-8, lexical
+//! number range, duplicate keys (rejected before insertion), nesting depth and
+//! trailing data are checked. Hashes always cover the exact distributed bytes.
+//!
+//! [`parse_release_index`] enforces the closed field set and every semantic
+//! rule for the fixed cohort, and additionally evaluates the retained
+//! governing release-index schema with explicit Draft 2020-12, offline.
+
+use std::collections::BTreeSet;
+use std::fmt;
+use std::sync::LazyLock;
+
+use error_stack::Report;
+use jsonschema::Draft;
+use regex::Regex;
+use serde::Deserialize;
+use serde::de::{DeserializeSeed, MapAccess, SeqAccess, Visitor};
+use serde_json::{Map, Number, Value};
+use sha2::{Digest as _, Sha256};
+
+use super::bounds;
+use super::error::{ReleaseError, report};
+use super::policy::{ConsumerPolicy, DeclaredIdentity, FixedArtifact, check_capability_vocabulary};
+
+/// Largest integer every JSON implementation represents exactly.
+const SAFE_INTEGER_MAX: u64 = 9_007_199_254_740_991;
+/// Fixed name of the shared JS inventory asset.
+const INVENTORY_NAME: &str = "tsjs-inventory.json";
+/// Maximum flat asset name length from the governing schema.
+const NAME_MAX: usize = 160;
+/// Maximum release tag length from the governing schema.
+const TAG_MAX: usize = 128;
+
+static TAG_PATTERN: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(
+        r"^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(?:-(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$",
+    )
+    .expect("should compile the reviewed release tag pattern")
+});
+
+/// Byte-limit class selected before a document is parsed.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum Role {
+    Index,
+    Policy,
+    Inventory,
+    Companion,
+    Bundle,
+    Spdx,
+    GhOutput,
+    /// Bounded official REST metadata responses.
+    Metadata,
+}
+
+impl Role {
+    /// Returns the R-BOUNDS byte limit for this role.
+    pub(crate) const fn limit(self) -> u64 {
+        match self {
+            Self::Index => bounds::INDEX_BYTES,
+            Self::Policy => bounds::POLICY_BYTES,
+            Self::Inventory => bounds::INVENTORY_BYTES,
+            Self::Companion => bounds::COMPANION_BYTES,
+            Self::Bundle => bounds::BUNDLE_BYTES,
+            Self::Spdx => bounds::SPDX_BYTES,
+            Self::GhOutput => bounds::STDOUT_BYTES,
+            Self::Metadata => bounds::METADATA_BYTES,
+        }
+    }
+}
+
+/// Parses bounded strict JSON with unique keys and finite in-range numbers.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Document`] for oversize input, a BOM, invalid UTF-8,
+/// out-of-range numbers, duplicate keys, nesting beyond 64 levels or trailing
+/// data.
+pub(crate) fn parse_json(bytes: &[u8], role: Role) -> Result<Value, Report<ReleaseError>> {
+    if bytes.len() as u64 > role.limit() {
+        return Err(report(
+            ReleaseError::Document,
+            "document exceeds role byte limit",
+        ));
+    }
+    if bytes.starts_with(b"\xef\xbb\xbf") {
+        return Err(report(
+            ReleaseError::Document,
+            "document must not start with a BOM",
+        ));
+    }
+    let text = std::str::from_utf8(bytes)
+        .map_err(|_| report(ReleaseError::Document, "document must be UTF-8"))?;
+    validate_numbers(text)?;
+    let mut parser = serde_json::Deserializer::from_str(text);
+    let value = StrictSeed { depth: 1 }
+        .deserialize(&mut parser)
+        .map_err(|source| report(ReleaseError::Document, source))?;
+    parser
+        .end()
+        .map_err(|source| report(ReleaseError::Document, source))?;
+    Ok(value)
+}
+
+/// Returns the lowercase hexadecimal SHA-256 of the exact bytes.
+pub(crate) fn sha256_hex(bytes: &[u8]) -> String {
+    hex::encode(Sha256::digest(bytes))
+}
+
+/// Returns whether `value` is exactly `length` lowercase hexadecimal digits.
+pub(crate) fn lower_hex(value: &str, length: usize) -> bool {
+    value.len() == length
+        && value
+            .bytes()
+            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+}
+
+/// Returns whether `name` is a safe flat asset name.
+///
+/// Rejects path separators, `..`, empty segments, control characters and
+/// anything outside the governing schema's name pattern.
+pub(crate) fn safe_name(name: &str) -> bool {
+    let mut parts = name.split('.');
+    let first = parts.next().unwrap_or_default();
+    name.len() <= NAME_MAX
+        && first
+            .as_bytes()
+            .first()
+            .is_some_and(u8::is_ascii_alphanumeric)
+        && std::iter::once(first).chain(parts).all(|part| {
+            !part.is_empty()
+                && part
+                    .bytes()
+                    .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'_' | b'-'))
+        })
+}
+
+/// An independently approved full 40-character lowercase source commit.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct ApprovedCommit(String);
+
+impl ApprovedCommit {
+    /// Parses an approved commit supplied by trusted consumer approval.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Policy`] unless the value is 40 lowercase hex digits.
+    pub(crate) fn parse(value: &str) -> Result<Self, Report<ReleaseError>> {
+        if !lower_hex(value, 40) {
+            return Err(report(
+                ReleaseError::Policy,
+                "approved source commit must be 40 lowercase hexadecimal digits",
+            ));
+        }
+        Ok(Self(value.to_owned()))
+    }
+
+    /// Returns the commit text.
+    pub(crate) fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+/// A release tag matching the governing `SemVer` `v`-prefixed pattern.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct ReleaseTag(String);
+
+impl ReleaseTag {
+    /// Parses a release tag.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Policy`] for tags outside the reviewed pattern.
+    pub(crate) fn parse(value: &str) -> Result<Self, Report<ReleaseError>> {
+        if value.len() > TAG_MAX || !TAG_PATTERN.is_match(value) {
+            return Err(report(
+                ReleaseError::Policy,
+                "release tag must be a v-prefixed SemVer tag",
+            ));
+        }
+        Ok(Self(value.to_owned()))
+    }
+
+    /// Returns the tag text.
+    pub(crate) fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+/// The tag and source commit approved independently of downloaded metadata.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct ApprovedRelease {
+    tag: ReleaseTag,
+    commit: ApprovedCommit,
+}
+
+impl ApprovedRelease {
+    /// Pairs an approved tag with its approved source commit.
+    pub(crate) fn new(tag: ReleaseTag, commit: ApprovedCommit) -> Self {
+        Self { tag, commit }
+    }
+
+    /// Returns the approved tag.
+    pub(crate) fn tag(&self) -> &ReleaseTag {
+        &self.tag
+    }
+
+    /// Returns the approved source commit.
+    pub(crate) fn commit(&self) -> &ApprovedCommit {
+        &self.commit
+    }
+}
+
+/// One named, sized and digested release file.
+#[derive(Clone, Debug, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub(crate) struct FileRecord {
+    pub(crate) name: String,
+    pub(crate) size: u64,
+    pub(crate) sha256: String,
+}
+
+/// Declared runtime compatibility of an artifact.
+#[derive(Clone, Debug, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub(crate) struct Compatibility {
+    pub(crate) runtime: String,
+    pub(crate) minimum_version: String,
+    pub(crate) architecture: String,
+}
+
+/// The six per-executable companion files.
+#[derive(Clone, Debug, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub(crate) struct Companions {
+    pub(crate) sbom: FileRecord,
+    pub(crate) provenance: FileRecord,
+    pub(crate) sbom_attestation: FileRecord,
+    pub(crate) build_evidence: FileRecord,
+    pub(crate) build_recipe: FileRecord,
+    pub(crate) rebuild_check: FileRecord,
+}
+
+impl Companions {
+    fn records(&self) -> [(&'static str, u64, &FileRecord); 6] {
+        [
+            (".spdx.json", bounds::SPDX_BYTES, &self.sbom),
+            (
+                ".provenance.sigstore.json",
+                bounds::BUNDLE_BYTES,
+                &self.provenance,
+            ),
+            (
+                ".sbom.sigstore.json",
+                bounds::BUNDLE_BYTES,
+                &self.sbom_attestation,
+            ),
+            (
+                ".build-evidence.json",
+                bounds::COMPANION_BYTES,
+                &self.build_evidence,
+            ),
+            (
+                ".build-recipe.json",
+                bounds::COMPANION_BYTES,
+                &self.build_recipe,
+            ),
+            (
+                ".rebuild-check.json",
+                bounds::COMPANION_BYTES,
+                &self.rebuild_check,
+            ),
+        ]
+    }
+}
+
+/// One executable entry of a release index.
+#[derive(Clone, Debug, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub(crate) struct IndexArtifact {
+    pub(crate) name: String,
+    pub(crate) size: u64,
+    pub(crate) sha256: String,
+    pub(crate) role: String,
+    pub(crate) kind: String,
+    pub(crate) package: String,
+    pub(crate) target: String,
+    pub(crate) variant: String,
+    pub(crate) assurance_profile: String,
+    pub(crate) capabilities: Vec<String>,
+    pub(crate) compatibility: Compatibility,
+    pub(crate) js_inventory_sha256: String,
+    pub(crate) companions: Companions,
+}
+
+/// A strictly parsed, policy-checked version-1 release index.
+///
+/// Its `policy_version`/`policy_sha256` identify the producer policy only;
+/// [`super::policy::accept_producer_policy`] must still bind them to
+/// approved-source bytes.
+#[derive(Clone, Debug, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub(crate) struct ReleaseIndex {
+    pub(crate) schema_version: u64,
+    pub(crate) repository: String,
+    pub(crate) tag: String,
+    pub(crate) source_commit: String,
+    pub(crate) recipe_source_commit: String,
+    pub(crate) cohort_source_commit: String,
+    pub(crate) cohort: String,
+    pub(crate) policy_version: u64,
+    pub(crate) policy_sha256: String,
+    pub(crate) tsjs_inventory: FileRecord,
+    pub(crate) artifacts: Vec<IndexArtifact>,
+}
+
+/// Exact bytes of the governing release-index v1 schema.
+const INDEX_SCHEMA: &[u8] =
+    include_bytes!("../../../../docs/superpowers/specs/schemas/release-index-v1.schema.json");
+
+/// Evaluates `value` against `schema` with explicit Draft 2020-12, offline.
+///
+/// Offline evaluation rejects every unregistered reference, so no remote or
+/// file retrieval can occur.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Document`] if the schema does not compile.
+pub(crate) fn schema_accepts(schema: &Value, value: &Value) -> Result<bool, Report<ReleaseError>> {
+    let validator = jsonschema::options()
+        .with_draft(Draft::Draft202012)
+        .offline()
+        .build(schema)
+        .map_err(|source| report(ReleaseError::Document, source))?;
+    Ok(validator.is_valid(value))
+}
+
+/// Validates a strictly parsed index against the retained governing schema.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Document`] when the schema rejects the document.
+pub(crate) fn validate_index_schema(value: &Value) -> Result<(), Report<ReleaseError>> {
+    let schema = parse_json(INDEX_SCHEMA, Role::Index)?;
+    if !schema_accepts(&schema, value)? {
+        return Err(report(
+            ReleaseError::Document,
+            "release index does not match the governing release-index v1 schema",
+        ));
+    }
+    Ok(())
+}
+
+/// Parses and validates release-index bytes against the consumer policy.
+///
+/// Semantic checks run first so diagnostics name the precise contract rule;
+/// the governing schema is then evaluated as an independent structural gate.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Document`] for malformed, ambiguous or open-field
+/// JSON and [`ReleaseError::Policy`] for any semantic contract violation.
+pub(crate) fn parse_release_index(
+    bytes: &[u8],
+    policy: &ConsumerPolicy,
+    approved: &ApprovedRelease,
+) -> Result<ReleaseIndex, Report<ReleaseError>> {
+    let value = parse_json(bytes, Role::Index)?;
+    validate_safe_integers(&value)?;
+    let index = ReleaseIndex::deserialize(&value)
+        .map_err(|source| report(ReleaseError::Document, source))?;
+    check_index_header(&index, policy, approved)?;
+    let mut names = BTreeSet::new();
+    if index.tsjs_inventory.name != INVENTORY_NAME {
+        return Err(report(
+            ReleaseError::Policy,
+            "JS inventory must be named tsjs-inventory.json",
+        ));
+    }
+    check_file(
+        &index.tsjs_inventory,
+        0,
+        bounds::INVENTORY_BYTES,
+        &mut names,
+    )?;
+    if index.artifacts.len() != policy.artifacts().len() {
+        return Err(report(
+            ReleaseError::Policy,
+            "release index must list exactly the cohort artifacts",
+        ));
+    }
+    for artifact in &index.artifacts {
+        let fixed = policy.artifact(&artifact.name).ok_or_else(|| {
+            report(
+                ReleaseError::Policy,
+                format!("unknown artifact `{}`", artifact.name),
+            )
+        })?;
+        check_artifact(artifact, fixed, &index.tsjs_inventory, &mut names)?;
+    }
+    validate_index_schema(&value)?;
+    Ok(index)
+}
+
+fn check_index_header(
+    index: &ReleaseIndex,
+    policy: &ConsumerPolicy,
+    approved: &ApprovedRelease,
+) -> Result<(), Report<ReleaseError>> {
+    if index.schema_version != 1 {
+        return Err(report(
+            ReleaseError::Policy,
+            "unsupported release-index schema version",
+        ));
+    }
+    if index.repository != policy.repository() || index.cohort != policy.cohort() {
+        return Err(report(
+            ReleaseError::Policy,
+            "release index names another repository or cohort",
+        ));
+    }
+    ReleaseTag::parse(&index.tag)?;
+    if index.tag != approved.tag().as_str() {
+        return Err(report(
+            ReleaseError::Policy,
+            "release index tag is not the approved tag",
+        ));
+    }
+    if !lower_hex(&index.source_commit, 40) || index.source_commit != approved.commit().as_str() {
+        return Err(report(
+            ReleaseError::Policy,
+            "release index source commit is not the approved commit",
+        ));
+    }
+    if index.recipe_source_commit != index.source_commit
+        || index.cohort_source_commit != index.source_commit
+    {
+        return Err(report(
+            ReleaseError::Policy,
+            "recipe and cohort source commits must equal the approved source",
+        ));
+    }
+    if index.policy_version < 1 || !lower_hex(&index.policy_sha256, 64) {
+        return Err(report(
+            ReleaseError::Policy,
+            "release index producer policy identity is malformed",
+        ));
+    }
+    Ok(())
+}
+
+fn check_file(
+    record: &FileRecord,
+    minimum: u64,
+    maximum: u64,
+    names: &mut BTreeSet<String>,
+) -> Result<(), Report<ReleaseError>> {
+    if !safe_name(&record.name) {
+        return Err(report(
+            ReleaseError::Policy,
+            "release file name is not a safe flat name",
+        ));
+    }
+    if record.size < minimum || record.size > maximum {
+        return Err(report(
+            ReleaseError::Policy,
+            format!(
+                "release file `{}` length is outside its role bound",
+                record.name
+            ),
+        ));
+    }
+    if !lower_hex(&record.sha256, 64) {
+        return Err(report(
+            ReleaseError::Policy,
+            format!(
+                "release file `{}` digest must be 64 lowercase hex digits",
+                record.name
+            ),
+        ));
+    }
+    if !names.insert(record.name.to_ascii_lowercase()) {
+        return Err(report(
+            ReleaseError::Policy,
+            format!("release file `{}` is listed more than once", record.name),
+        ));
+    }
+    Ok(())
+}
+
+fn check_artifact(
+    artifact: &IndexArtifact,
+    fixed: &FixedArtifact,
+    inventory: &FileRecord,
+    names: &mut BTreeSet<String>,
+) -> Result<(), Report<ReleaseError>> {
+    let file = FileRecord {
+        name: artifact.name.clone(),
+        size: artifact.size,
+        sha256: artifact.sha256.clone(),
+    };
+    check_file(&file, 1, bounds::EXECUTABLE_BYTES, names)?;
+    check_capabilities(artifact)?;
+    let declared = DeclaredIdentity {
+        role: &artifact.role,
+        kind: &artifact.kind,
+        package: &artifact.package,
+        target: &artifact.target,
+        variant: &artifact.variant,
+        assurance_profile: &artifact.assurance_profile,
+        capabilities: &artifact.capabilities,
+        compatibility: &artifact.compatibility,
+    };
+    if !fixed.matches(&declared) {
+        return Err(report(
+            ReleaseError::Policy,
+            format!(
+                "artifact `{}` differs from the supported role/kind/package/target/variant/profile/capability combination",
+                artifact.name
+            ),
+        ));
+    }
+    if artifact.js_inventory_sha256 != inventory.sha256 {
+        return Err(report(
+            ReleaseError::Policy,
+            format!(
+                "artifact `{}` names a different JS inventory",
+                artifact.name
+            ),
+        ));
+    }
+    check_companions(artifact, names)
+}
+
+fn check_companions(
+    artifact: &IndexArtifact,
+    names: &mut BTreeSet<String>,
+) -> Result<(), Report<ReleaseError>> {
+    for (suffix, maximum, record) in artifact.companions.records() {
+        if record.name != format!("{}{suffix}", artifact.name) {
+            return Err(report(
+                ReleaseError::Policy,
+                format!(
+                    "artifact `{}` companion must be named `{}{suffix}`",
+                    artifact.name, artifact.name
+                ),
+            ));
+        }
+        check_file(record, 0, maximum, names)?;
+    }
+    Ok(())
+}
+
+fn check_capabilities(artifact: &IndexArtifact) -> Result<(), Report<ReleaseError>> {
+    let unique: BTreeSet<&str> = artifact.capabilities.iter().map(String::as_str).collect();
+    if unique.is_empty() || unique.len() != artifact.capabilities.len() || unique.len() > 2 {
+        return Err(report(
+            ReleaseError::Policy,
+            format!(
+                "artifact `{}` capabilities must be one or two unique values",
+                artifact.name
+            ),
+        ));
+    }
+    check_capability_vocabulary(&artifact.capabilities)
+}
+
+/// Requires every number to be a nonnegative safe integer token.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Document`] for negative, fractional or unsafe numbers.
+pub(crate) fn validate_safe_integers(value: &Value) -> Result<(), Report<ReleaseError>> {
+    match value {
+        Value::Number(number)
+            if number
+                .as_u64()
+                .is_none_or(|integer| integer > SAFE_INTEGER_MAX) =>
+        {
+            Err(report(
+                ReleaseError::Document,
+                "closed release documents require nonnegative safe integer tokens",
+            ))
+        }
+        Value::Object(values) => values.values().try_for_each(validate_safe_integers),
+        Value::Array(values) => values.iter().try_for_each(validate_safe_integers),
+        _ => Ok(()),
+    }
+}
+
+// Serde may otherwise convert overflowing integer tokens to finite floats, so
+// every numeric token outside strings is range-checked lexically first.
+fn validate_numbers(text: &str) -> Result<(), Report<ReleaseError>> {
+    let bytes = text.as_bytes();
+    let mut cursor = 0;
+    while cursor < bytes.len() {
+        if bytes[cursor] == b'"' {
+            cursor += 1;
+            while cursor < bytes.len() {
+                match bytes[cursor] {
+                    b'\\' => cursor += 2,
+                    b'"' => {
+                        cursor += 1;
+                        break;
+                    }
+                    _ => cursor += 1,
+                }
+            }
+        } else if bytes[cursor] == b'-' || bytes[cursor].is_ascii_digit() {
+            let start = cursor;
+            while cursor < bytes.len()
+                && matches!(
+                    bytes[cursor],
+                    b'-' | b'+' | b'.' | b'e' | b'E' | b'0'..=b'9'
+                )
+            {
+                cursor += 1;
+            }
+            let token = text.get(start..cursor).unwrap_or_default();
+            let valid = if token.contains(['.', 'e', 'E']) {
+                token.parse::<f64>().is_ok_and(f64::is_finite)
+            } else if token.starts_with('-') {
+                token.parse::<i64>().is_ok()
+            } else {
+                token.parse::<u64>().is_ok()
+            };
+            if !valid {
+                return Err(report(
+                    ReleaseError::Document,
+                    "JSON number exceeds its finite numeric range",
+                ));
+            }
+        } else {
+            cursor += 1;
+        }
+    }
+    Ok(())
+}
+
+struct StrictSeed {
+    depth: usize,
+}
+
+impl<'de> DeserializeSeed<'de> for StrictSeed {
+    type Value = Value;
+
+    fn deserialize<D: serde::Deserializer<'de>>(self, deserializer: D) -> Result<Value, D::Error> {
+        deserializer.deserialize_any(self)
+    }
+}
+
+impl<'de> Visitor<'de> for StrictSeed {
+    type Value = Value;
+
+    fn expecting(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("JSON with unique object keys")
+    }
+
+    fn visit_bool<E: serde::de::Error>(self, value: bool) -> Result<Value, E> {
+        Ok(Value::Bool(value))
+    }
+
+    fn visit_unit<E: serde::de::Error>(self) -> Result<Value, E> {
+        Ok(Value::Null)
+    }
+
+    fn visit_str<E: serde::de::Error>(self, value: &str) -> Result<Value, E> {
+        Ok(Value::String(value.to_owned()))
+    }
+
+    fn visit_i64<E: serde::de::Error>(self, value: i64) -> Result<Value, E> {
+        Ok(Value::Number(Number::from(value)))
+    }
+
+    fn visit_u64<E: serde::de::Error>(self, value: u64) -> Result<Value, E> {
+        Ok(Value::Number(Number::from(value)))
+    }
+
+    fn visit_f64<E: serde::de::Error>(self, value: f64) -> Result<Value, E> {
+        Number::from_f64(value)
+            .map(Value::Number)
+            .ok_or_else(|| E::custom("nonfinite number"))
+    }
+
+    fn visit_seq<A: SeqAccess<'de>>(self, mut access: A) -> Result<Value, A::Error> {
+        if self.depth > bounds::JSON_DEPTH {
+            return Err(serde::de::Error::custom("JSON container depth exceeds 64"));
+        }
+        let mut values = Vec::new();
+        while let Some(value) = access.next_element_seed(StrictSeed {
+            depth: self.depth + 1,
+        })? {
+            values.push(value);
+        }
+        Ok(Value::Array(values))
+    }
+
+    fn visit_map<A: MapAccess<'de>>(self, mut access: A) -> Result<Value, A::Error> {
+        if self.depth > bounds::JSON_DEPTH {
+            return Err(serde::de::Error::custom("JSON container depth exceeds 64"));
+        }
+        let mut values = Map::new();
+        while let Some(key) = access.next_key::<String>()? {
+            if values.contains_key(&key) {
+                return Err(serde::de::Error::custom("duplicate object key"));
+            }
+            let value = access.next_value_seed(StrictSeed {
+                depth: self.depth + 1,
+            })?;
+            values.insert(key, value);
+        }
+        Ok(Value::Object(values))
+    }
+}
diff --git a/crates/trusted-server-cli/src/release/environment.rs b/crates/trusted-server-cli/src/release/environment.rs
new file mode 100644
index 0000000000..7e349d69ab
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/environment.rs
@@ -0,0 +1,107 @@
+//! Caller environment snapshots and the explicit GitHub credential.
+
+use std::collections::BTreeMap;
+use std::ffi::{OsStr, OsString};
+use std::fmt;
+
+use error_stack::Report;
+
+use super::error::{ReleaseError, report};
+
+/// Text substituted for the credential in every diagnostic.
+pub(crate) const REDACTED: &str = "[redacted]";
+
+/// A snapshot of the caller's environment, taken once.
+///
+/// The gh runner reads only explicit entries from it and never lets the child
+/// inherit it.
+#[derive(Clone, Debug, Default)]
+pub(crate) struct CallerEnvironment(BTreeMap<OsString, OsString>);
+
+impl CallerEnvironment {
+    /// Snapshots the current process environment.
+    pub(crate) fn from_process() -> Self {
+        Self(std::env::vars_os().collect())
+    }
+
+    /// Builds a snapshot from explicit pairs.
+    #[cfg(test)]
+    pub(crate) fn from_pairs<K, V, I>(pairs: I) -> Self
+    where
+        K: Into<OsString>,
+        V: Into<OsString>,
+        I: IntoIterator<Item = (K, V)>,
+    {
+        Self(
+            pairs
+                .into_iter()
+                .map(|(key, value)| (key.into(), value.into()))
+                .collect(),
+        )
+    }
+
+    /// Returns one variable's value.
+    pub(crate) fn get(&self, name: &str) -> Option<&OsStr> {
+        self.0.get(OsStr::new(name)).map(OsString::as_os_str)
+    }
+
+    /// Iterates over variable names.
+    pub(crate) fn names(&self) -> impl Iterator<Item = &OsStr> {
+        self.0.keys().map(OsString::as_os_str)
+    }
+}
+
+/// An explicit read-only GitHub credential.
+///
+/// Its [`fmt::Debug`] output never includes the secret.
+#[derive(Clone)]
+pub(crate) struct GithubToken(String);
+
+impl fmt::Debug for GithubToken {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(formatter, "GithubToken({REDACTED})")
+    }
+}
+
+impl GithubToken {
+    /// Selects explicit `GH_TOKEN`, else `GITHUB_TOKEN`, from the snapshot.
+    ///
+    /// Stored `gh auth login` credentials are deliberately not used.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Environment`] when neither variable holds a
+    /// nonempty, printable, whitespace-free value.
+    pub(crate) fn select(environment: &CallerEnvironment) -> Result<Self, Report<ReleaseError>> {
+        let selected = ["GH_TOKEN", "GITHUB_TOKEN"]
+            .into_iter()
+            .find_map(|name| environment.get(name).filter(|value| !value.is_empty()))
+            .ok_or_else(|| {
+                report(
+                    ReleaseError::Environment,
+                    "release verification requires an explicit read-only GH_TOKEN \
+                     (or GITHUB_TOKEN); stored `gh auth login` credentials are not used",
+                )
+            })?;
+        let token = selected
+            .to_str()
+            .filter(|token| token.bytes().all(|byte| byte.is_ascii_graphic()))
+            .ok_or_else(|| {
+                report(
+                    ReleaseError::Environment,
+                    "the GitHub token must be printable ASCII without whitespace",
+                )
+            })?;
+        Ok(Self(token.to_owned()))
+    }
+
+    /// Returns the secret for the single place it is transmitted.
+    pub(crate) fn expose(&self) -> &str {
+        &self.0
+    }
+
+    /// Replaces every occurrence of the secret in `text`.
+    pub(crate) fn redact(&self, text: &str) -> String {
+        text.replace(&self.0, REDACTED)
+    }
+}
diff --git a/crates/trusted-server-cli/src/release/error.rs b/crates/trusted-server-cli/src/release/error.rs
new file mode 100644
index 0000000000..11c72052da
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/error.rs
@@ -0,0 +1,73 @@
+//! Concrete release verification errors.
+
+use std::fmt;
+
+use error_stack::Report;
+
+/// Reports why release verification refused an input, policy or process.
+///
+/// Every variant is fail-closed: no verified value is constructed after any of
+/// them. Diagnostic attachments never contain credentials.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, derive_more::Display)]
+pub(crate) enum ReleaseError {
+    /// A JSON document is malformed, ambiguous, oversized or schema-invalid.
+    #[display("invalid release document")]
+    Document,
+    /// The embedded consumer policy or a release index violates the compiled contract.
+    #[display("release policy rejects the input")]
+    Policy,
+    /// The producer policy identity is not current or reviewed historical policy.
+    #[display("producer release policy is not accepted")]
+    ProducerPolicy,
+    /// The approved-source policy could not be acquired from the fixed endpoint.
+    #[display("approved source policy acquisition failed")]
+    PolicyFetch,
+    /// The caller environment cannot safely run the GitHub CLI.
+    #[display("GitHub CLI environment is rejected")]
+    Environment,
+    /// The resolved GitHub CLI is missing or not the qualified version.
+    #[display("unsupported GitHub CLI")]
+    UnsupportedTool,
+    /// A child process could not be spawned, signalled or reaped.
+    #[display("GitHub CLI process failed")]
+    Process,
+    /// A child or attempt deadline elapsed.
+    #[display("release verification deadline elapsed")]
+    Timeout,
+    /// The caller cancelled the verification attempt.
+    #[display("release verification was cancelled")]
+    Cancelled,
+    /// Child stdout or stderr exceeded its byte bound.
+    #[display("GitHub CLI output exceeds its byte bound")]
+    OutputLimit,
+    /// A descendant left the child process group and kept its pipes open.
+    #[display("a GitHub CLI descendant escaped process-group termination")]
+    DescendantEscaped,
+    /// The child exited unsuccessfully; its output is never trusted.
+    #[display("GitHub CLI exited unsuccessfully")]
+    ExitFailure,
+    /// Successful child output is not exactly one attestation result.
+    #[display("GitHub CLI output is rejected")]
+    Output,
+    /// A verified proof, document or digest join of the evidence graph is
+    /// missing, extra or mismatched.
+    #[display("release evidence graph is inconsistent")]
+    Evidence,
+    /// The official GitHub release, tag or release statement is not the
+    /// immutable publication of the verified evidence.
+    #[display("official release publication check failed")]
+    Publication,
+    /// A retained release asset exceeds its role bound, cannot be retained or
+    /// no longer matches its verified digest.
+    #[display("release asset retention failed")]
+    Asset,
+}
+
+impl core::error::Error for ReleaseError {}
+
+/// Builds a report for `context` with one diagnostic attachment.
+///
+/// Callers must never pass credentials or secret context in `message`.
+pub(super) fn report(context: ReleaseError, message: impl fmt::Display) -> Report<ReleaseError> {
+    Report::new(context).attach(message.to_string())
+}
diff --git a/crates/trusted-server-cli/src/release/evidence.rs b/crates/trusted-server-cli/src/release/evidence.rs
new file mode 100644
index 0000000000..75cf189b0b
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/evidence.rs
@@ -0,0 +1,778 @@
+//! R-EVIDENCE: the complete verified evidence graph of an official release.
+//!
+//! Every proof is the single result object of one successful pinned
+//! `gh attestation verify --bundle ... --format json` run (see
+//! [`super::gh::GhRunner::verify_attestation`]). Primitive gh success is
+//! never sufficient: every certificate field, statement subject and predicate
+//! edge below is checked again here, and any missing, extra or mismatched
+//! edge fails closed.
+//!
+//! JSON shape of the pinned gh 2.97.0 output, confirmed from primary sources:
+//! - Each array element is `AttestationProcessingResult` with `attestation`
+//!   and `verificationResult`:
+//!   <https://github.com/cli/cli/blob/v2.97.0/pkg/cmd/attestation/verification/sigstore.go>
+//!   and the `--format json` help text in
+//!   <https://github.com/cli/cli/blob/v2.97.0/pkg/cmd/attestation/verify/verify.go>.
+//! - `verificationResult` is sigstore-go v1.2.2 (pinned in gh's `go.mod`)
+//!   `VerificationResult`: `mediaType`, `statement` (protojson in-toto v1
+//!   Statement: `_type`, `subject[].name`, `subject[].digest`,
+//!   `predicateType`, `predicate`) and `signature.certificate`, a
+//!   `certificate.Summary` with Fulcio `Extensions` flattened into it:
+//!   <https://github.com/sigstore/sigstore-go/blob/v1.2.2/pkg/verify/signed_entity.go>,
+//!   <https://github.com/sigstore/sigstore-go/blob/v1.2.2/pkg/fulcio/certificate/summarize.go>,
+//!   <https://github.com/sigstore/sigstore-go/blob/v1.2.2/pkg/fulcio/certificate/extensions.go>,
+//!   <https://github.com/in-toto/attestation/blob/v1.2.0/go/v1/statement.pb.go>.
+//! - The GitHub workflow provenance predicate layout follows the
+//!   `@actions/attest` builder:
+//!   <https://github.com/actions/toolkit/blob/main/packages/attest/src/provenance.ts>.
+//!   Real attest 4.2.2 provenance/SPDX fixtures were verified with gh 2.97.0;
+//!   the measured consumer qualification report records their identities,
+//!   digests and replay commands. Official project first-use remains separate.
+
+mod joins;
+
+#[cfg(test)]
+mod candidate_fixture_tests;
+#[cfg(test)]
+mod upstream_format_tests;
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::sync::LazyLock;
+
+use error_stack::Report;
+use regex::Regex;
+use serde_json::{Map, Value, json};
+
+use super::artifact::AssetMeasurement;
+use super::documents::{
+    ApprovedRelease, FileRecord, IndexArtifact, ReleaseIndex, Role, lower_hex, parse_json,
+    parse_release_index,
+};
+use super::error::{ReleaseError, report};
+use super::gh::{PredicateKind, VerificationMode, VerifiedAttestation};
+use super::policy::{
+    AcceptanceRules, AcceptedProducerPolicy, BUILD_TYPE, ConsumerPolicy, GITHUB_HOST, ISSUER,
+    PROVENANCE_PREDICATE, REPOSITORY, REPOSITORY_ID, REPOSITORY_OWNER_ID, SBOM_PREDICATE,
+    accept_producer_policy, certificate_identity,
+};
+use super::source_policy::ApprovedSourcePolicy;
+
+pub(crate) use joins::ComparisonOutcome;
+
+/// sigstore-go `VerificationResultMediaType01`.
+const VERIFICATION_MEDIA_TYPE: &str =
+    "application/vnd.dev.sigstore.verificationresult+json;version=0.1";
+/// in-toto v1 statement type.
+const STATEMENT_TYPE: &str = "https://in-toto.io/Statement/v1";
+/// Fixed name of the signed release index.
+pub(crate) const INDEX_NAME: &str = "release-index.json";
+/// Fixed sentinel tag of every unqualified candidate index the release tool
+/// assembles; it never names an official release.
+const CANDIDATE_TAG: &str = "v0.0.0-unqualified-candidate";
+/// Companion field a candidate producer sets to `false`.
+const RELEASE_QUALIFICATION: &str = "release_qualification";
+/// Caller workflow path inside the official repository.
+const CALLER_PATH: &str = ".github/workflows/release.yml";
+const CERTIFICATE: [&str; 3] = ["verificationResult", "signature", "certificate"];
+const STATEMENT: [&str; 2] = ["verificationResult", "statement"];
+
+static RUN_URI: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(
+        r"^https://github\.com/IABTechLab/trusted-server/actions/runs/[1-9][0-9]{0,19}/attempts/[1-9][0-9]{0,4}$", // allow-domain: github
+    )
+    .expect("should compile the reviewed run invocation pattern")
+});
+
+/// Identity values derived only from the independently approved release.
+struct Expected {
+    san: String,
+    caller: String,
+    source_ref: String,
+    commit: String,
+    repository_uri: String,
+}
+
+impl Expected {
+    fn new(release: &ApprovedRelease) -> Self {
+        let repository_uri = format!("https://{GITHUB_HOST}/{REPOSITORY}");
+        let source_ref = format!("refs/tags/{}", release.tag().as_str());
+        Self {
+            san: certificate_identity(release.tag()),
+            caller: format!("{repository_uri}/{CALLER_PATH}@{source_ref}"),
+            source_ref,
+            commit: release.commit().as_str().to_owned(),
+            repository_uri,
+        }
+    }
+}
+
+pub(super) fn at<'a>(value: &'a Value, path: &[&str]) -> Option<&'a Value> {
+    path.iter().try_fold(value, |current, key| current.get(key))
+}
+
+pub(super) fn evidence_error(message: impl std::fmt::Display) -> Report<ReleaseError> {
+    report(ReleaseError::Evidence, message)
+}
+
+fn require_text<'a>(value: &'a Value, path: &[&str]) -> Result<&'a str, Report<ReleaseError>> {
+    at(value, path)
+        .and_then(Value::as_str)
+        .ok_or_else(|| evidence_error(format!("proof field `{}` is missing", path.join("."))))
+}
+
+/// Checks the verified certificate of one proof and returns its run URI.
+fn check_certificate(proof: &Value, expected: &Expected) -> Result<String, Report<ReleaseError>> {
+    let certificate = at(proof, &CERTIFICATE)
+        .ok_or_else(|| evidence_error("proof has no verified certificate"))?;
+    let fields = [
+        ("subjectAlternativeName", expected.san.as_str()),
+        ("issuer", ISSUER),
+        ("buildSignerURI", expected.san.as_str()),
+        ("buildSignerDigest", expected.commit.as_str()),
+        ("sourceRepositoryURI", expected.repository_uri.as_str()),
+        ("sourceRepositoryDigest", expected.commit.as_str()),
+        ("sourceRepositoryRef", expected.source_ref.as_str()),
+        ("sourceRepositoryIdentifier", REPOSITORY_ID),
+        ("sourceRepositoryOwnerIdentifier", REPOSITORY_OWNER_ID),
+        ("buildConfigURI", expected.caller.as_str()),
+        ("buildConfigDigest", expected.commit.as_str()),
+        ("buildTrigger", "push"),
+        ("runnerEnvironment", "github-hosted"),
+    ];
+    for (field, value) in fields {
+        if require_text(certificate, &[field])? != value {
+            return Err(evidence_error(format!(
+                "certificate `{field}` differs from the approved release identity"
+            )));
+        }
+    }
+    let run = require_text(certificate, &["runInvocationURI"])?;
+    if !RUN_URI.is_match(run) {
+        return Err(evidence_error(
+            "certificate `runInvocationURI` is not an official repository run attempt",
+        ));
+    }
+    Ok(run.to_owned())
+}
+
+/// Returns the verified statement after checking its envelope types.
+fn statement<'a>(
+    proof: &'a Value,
+    predicate_type: &str,
+) -> Result<&'a Value, Report<ReleaseError>> {
+    if require_text(proof, &["verificationResult", "mediaType"])? != VERIFICATION_MEDIA_TYPE {
+        return Err(evidence_error("unsupported verification result media type"));
+    }
+    let statement =
+        at(proof, &STATEMENT).ok_or_else(|| evidence_error("proof has no verified statement"))?;
+    if require_text(statement, &["_type"])? != STATEMENT_TYPE {
+        return Err(evidence_error("statement is not an in-toto v1 statement"));
+    }
+    if require_text(statement, &["predicateType"])? != predicate_type {
+        return Err(evidence_error(format!(
+            "statement predicate type is not `{predicate_type}`"
+        )));
+    }
+    Ok(statement)
+}
+
+fn subject_entry(subject: &Value) -> Option<(&str, &str)> {
+    let object = subject.as_object()?;
+    let digest = object.get("digest")?.as_object()?;
+    let name = object.get("name")?.as_str()?;
+    let sha256 = digest.get("sha256")?.as_str()?;
+    (object.len() == 2 && digest.len() == 1 && lower_hex(sha256, 64)).then_some((name, sha256))
+}
+
+/// Requires the statement subjects to be exactly `expected` (name → SHA-256).
+fn check_subjects(
+    statement: &Value,
+    expected: &BTreeMap<&str, &str>,
+) -> Result<(), Report<ReleaseError>> {
+    let subjects = at(statement, &["subject"])
+        .and_then(Value::as_array)
+        .ok_or_else(|| evidence_error("statement has no subject array"))?;
+    let mut signed = BTreeMap::new();
+    for subject in subjects {
+        let (name, sha256) = subject_entry(subject)
+            .ok_or_else(|| evidence_error("statement subject is not exactly {name, sha256}"))?;
+        if signed.insert(name, sha256).is_some() {
+            return Err(evidence_error(format!(
+                "statement names subject `{name}` twice"
+            )));
+        }
+    }
+    if &signed != expected {
+        return Err(evidence_error(
+            "signed subjects differ from the exact expected names and digests",
+        ));
+    }
+    Ok(())
+}
+
+fn expected_provenance(expected: &Expected, run: &str) -> Value {
+    json!({
+        "buildDefinition": {
+            "buildType": BUILD_TYPE,
+            "externalParameters": {
+                "workflow": {
+                    "ref": expected.source_ref,
+                    "repository": expected.repository_uri,
+                    "path": CALLER_PATH,
+                }
+            },
+            "internalParameters": {
+                "github": {
+                    "event_name": "push",
+                    "repository_id": REPOSITORY_ID,
+                    "repository_owner_id": REPOSITORY_OWNER_ID,
+                    "runner_environment": "github-hosted",
+                }
+            },
+            "resolvedDependencies": [{
+                "uri": format!("git+{}@{}", expected.repository_uri, expected.source_ref),
+                "digest": {"gitCommit": expected.commit},
+            }],
+        },
+        "runDetails": {
+            "builder": {"id": expected.san},
+            "metadata": {"invocationId": run},
+        },
+    })
+}
+
+/// Checks the SLSA predicate section by section, then exactly.
+fn check_provenance_predicate(
+    statement: &Value,
+    expected: &Expected,
+    run: &str,
+) -> Result<(), Report<ReleaseError>> {
+    let wanted = expected_provenance(expected, run);
+    let actual = at(statement, &["predicate"])
+        .ok_or_else(|| evidence_error("provenance statement has no predicate"))?;
+    let sections: [&[&str]; 6] = [
+        &["buildDefinition", "buildType"],
+        &["buildDefinition", "externalParameters"],
+        &["buildDefinition", "internalParameters"],
+        &["buildDefinition", "resolvedDependencies"],
+        &["runDetails", "builder"],
+        &["runDetails", "metadata"],
+    ];
+    for section in sections {
+        if at(actual, section) != at(&wanted, section) {
+            return Err(evidence_error(format!(
+                "provenance `{}` differs from the approved caller, source or run",
+                section.join(".")
+            )));
+        }
+    }
+    if actual != &wanted {
+        return Err(evidence_error(
+            "provenance predicate contains unexpected structures",
+        ));
+    }
+    Ok(())
+}
+
+/// Verifies one provenance proof and returns its certificate run URI.
+fn check_provenance_proof(
+    proof: &Value,
+    expected: &Expected,
+    subjects: &BTreeMap<&str, &str>,
+) -> Result<String, Report<ReleaseError>> {
+    let run = check_certificate(proof, expected)?;
+    let statement = statement(proof, PROVENANCE_PREDICATE)?;
+    check_provenance_predicate(statement, expected, &run)?;
+    check_subjects(statement, subjects)?;
+    Ok(run)
+}
+
+fn require_same_run(run: &str, other: &str) -> Result<(), Report<ReleaseError>> {
+    if run != other {
+        return Err(evidence_error(
+            "collected proofs come from different workflow runs or attempts",
+        ));
+    }
+    Ok(())
+}
+
+fn check_measurement(
+    record: &FileRecord,
+    actual: &AssetMeasurement,
+) -> Result<(), Report<ReleaseError>> {
+    if record.size != actual.length() || record.sha256 != actual.sha256() {
+        return Err(evidence_error(format!(
+            "`{}` bytes differ from the signed index length or digest",
+            record.name
+        )));
+    }
+    Ok(())
+}
+
+/// Retained bytes and verified proofs for one consumed cohort artifact.
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct ConsumedArtifact<'a> {
+    pub(crate) name: &'a str,
+    pub(crate) executable: &'a AssetMeasurement,
+    pub(crate) spdx: &'a [u8],
+    pub(crate) build_evidence: &'a [u8],
+    pub(crate) build_recipe: &'a [u8],
+    pub(crate) rebuild_check: &'a [u8],
+    pub(crate) provenance_bundle: &'a AssetMeasurement,
+    pub(crate) sbom_bundle: &'a AssetMeasurement,
+    pub(crate) provenance_proof: &'a VerifiedAttestation,
+    pub(crate) spdx_proof: &'a VerifiedAttestation,
+}
+
+/// Every independently obtained trust input and downloaded evidence item.
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct EvidenceInputs<'a> {
+    pub(crate) release: &'a ApprovedRelease,
+    pub(crate) consumer_policy: &'a ConsumerPolicy,
+    pub(crate) source_policy: &'a ApprovedSourcePolicy,
+    pub(crate) index_bytes: &'a [u8],
+    pub(crate) index_proof: &'a VerifiedAttestation,
+    pub(crate) index_bundle: &'a AssetMeasurement,
+    pub(crate) inventory_bytes: &'a [u8],
+    pub(crate) artifacts: &'a [ConsumedArtifact<'a>],
+}
+
+/// The verified evidence of one consumed artifact.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct VerifiedArtifactEvidence {
+    name: String,
+    measurement: AssetMeasurement,
+    assurance_profile: String,
+    comparison: ComparisonOutcome,
+}
+
+impl VerifiedArtifactEvidence {
+    /// Returns the asset name.
+    pub(crate) fn name(&self) -> &str {
+        &self.name
+    }
+
+    /// Returns the verified executable digest and length.
+    pub(crate) fn measurement(&self) -> &AssetMeasurement {
+        &self.measurement
+    }
+
+    /// Returns the required assurance profile of this artifact.
+    pub(crate) fn assurance_profile(&self) -> &str {
+        &self.assurance_profile
+    }
+
+    /// Returns the informational rebuild comparison outcome.
+    pub(crate) fn comparison(&self) -> ComparisonOutcome {
+        self.comparison
+    }
+}
+
+/// Every R-EVIDENCE edge held for the consumed artifacts.
+///
+/// Only [`verify_build_evidence`] constructs it. It proves build evidence,
+/// not official publication; see [`super::github::verify_publication`].
+#[derive(Debug)]
+pub(crate) struct BuildEvidenceVerified {
+    mode: VerificationMode,
+    release: ApprovedRelease,
+    index: ReleaseIndex,
+    index_measurement: AssetMeasurement,
+    index_bundle: AssetMeasurement,
+    consumer_policy: ConsumerPolicy,
+    producer_policy: AcceptedProducerPolicy,
+    run_invocation: String,
+    consumed: Vec<VerifiedArtifactEvidence>,
+}
+
+impl BuildEvidenceVerified {
+    /// Returns the trust context shared by every build proof.
+    pub(crate) fn mode(&self) -> VerificationMode {
+        self.mode
+    }
+    /// Returns the approved release.
+    pub(crate) fn release(&self) -> &ApprovedRelease {
+        &self.release
+    }
+
+    /// Returns the provenance-verified index.
+    pub(crate) fn index(&self) -> &ReleaseIndex {
+        &self.index
+    }
+
+    /// Returns the exact index bytes' digest and length.
+    pub(crate) fn index_measurement(&self) -> &AssetMeasurement {
+        &self.index_measurement
+    }
+
+    /// Returns the exact provenance bundle verified for this index.
+    pub(crate) fn index_bundle(&self) -> &AssetMeasurement {
+        &self.index_bundle
+    }
+
+    /// Returns the consumer policy version.
+    pub(crate) fn consumer_policy_version(&self) -> u64 {
+        self.consumer_policy.version()
+    }
+
+    /// Returns the consumer policy exact-byte digest.
+    pub(crate) fn consumer_policy_sha256(&self) -> &str {
+        self.consumer_policy.sha256()
+    }
+
+    /// Returns how the producer policy was accepted.
+    pub(crate) fn producer_policy(&self) -> &AcceptedProducerPolicy {
+        &self.producer_policy
+    }
+
+    /// Returns the single workflow run attempt shared by every proof.
+    pub(crate) fn run_invocation(&self) -> &str {
+        &self.run_invocation
+    }
+
+    /// Returns the verified consumed artifacts.
+    pub(crate) fn consumed(&self) -> &[VerifiedArtifactEvidence] {
+        &self.consumed
+    }
+}
+
+/// Verifies index provenance and approved-source policy before using its fields.
+///
+/// # Errors
+///
+/// Returns evidence, document or policy errors for any invalid proof or binding.
+pub(crate) fn verify_index(
+    release: &ApprovedRelease,
+    policy: &ConsumerPolicy,
+    source: &ApprovedSourcePolicy,
+    bytes: &[u8],
+    proof: &VerifiedAttestation,
+    bundle: &AssetMeasurement,
+) -> Result<ReleaseIndex, Report<ReleaseError>> {
+    check_not_candidate_tag(release)?;
+    let measurement = AssetMeasurement::of_bytes(bytes);
+    let subjects = BTreeMap::from([(INDEX_NAME, measurement.sha256())]);
+    let claims = proof.for_inputs(release, PredicateKind::Provenance, &measurement, bundle)?;
+    check_provenance_proof(claims, &Expected::new(release), &subjects)?;
+    let index = parse_release_index(bytes, policy, release)?;
+    index.artifacts.iter().try_for_each(check_bundle_records)?;
+    accept_producer_policy(&index, source, &AcceptanceRules::compiled(policy))?;
+    Ok(index)
+}
+
+/// Verifies the complete evidence graph for the consumed artifacts.
+///
+/// Index provenance is verified against the approved release before any
+/// index field is trusted; the index is then parsed under the embedded
+/// policy and its producer-policy identity bound to approved-source bytes.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Evidence`] for any missing, extra or mismatched
+/// edge, and document or policy errors from index parsing and producer-policy
+/// acceptance.
+pub(crate) fn verify_build_evidence(
+    inputs: &EvidenceInputs<'_>,
+) -> Result<BuildEvidenceVerified, Report<ReleaseError>> {
+    check_not_candidate_tag(inputs.release)?;
+    check_consumed_names(inputs.artifacts)?;
+    let mode = inputs.index_proof.mode();
+    if inputs.artifacts.iter().any(|artifact| {
+        artifact.provenance_proof.mode() != mode || artifact.spdx_proof.mode() != mode
+    }) {
+        return Err(evidence_error(
+            "build proofs have different online/offline trust contexts",
+        ));
+    }
+
+    let expected = Expected::new(inputs.release);
+    let index_measurement = AssetMeasurement::of_bytes(inputs.index_bytes);
+    let index_subject = BTreeMap::from([(INDEX_NAME, index_measurement.sha256())]);
+    let index_proof = inputs.index_proof.for_inputs(
+        inputs.release,
+        PredicateKind::Provenance,
+        &index_measurement,
+        inputs.index_bundle,
+    )?;
+    let run = check_provenance_proof(index_proof, &expected, &index_subject)?;
+    let index = parse_release_index(inputs.index_bytes, inputs.consumer_policy, inputs.release)?;
+    // Every indexed artifact, consumed or not, must name non-empty bundles:
+    // an unsigned candidate index is rejected as a whole.
+    index.artifacts.iter().try_for_each(check_bundle_records)?;
+    let producer_policy = accept_producer_policy(
+        &index,
+        inputs.source_policy,
+        &AcceptanceRules::compiled(inputs.consumer_policy),
+    )?;
+    check_measurement(
+        &index.tsjs_inventory,
+        &AssetMeasurement::of_bytes(inputs.inventory_bytes),
+    )?;
+    let modules = joins::parse_inventory(inputs.inventory_bytes, &expected.commit)?;
+    let context = ArtifactContext {
+        index: &index,
+        expected: &expected,
+        run: &run,
+        modules: &modules,
+        release: inputs.release,
+    };
+    let consumed = inputs
+        .artifacts
+        .iter()
+        .map(|artifact| context.verify(artifact))
+        .collect::<Result<Vec<_>, _>>()?;
+    Ok(BuildEvidenceVerified {
+        mode,
+        release: inputs.release.clone(),
+        index,
+        index_measurement,
+        index_bundle: inputs.index_bundle.clone(),
+        consumer_policy: inputs.consumer_policy.clone(),
+        producer_policy,
+        run_invocation: run,
+        consumed,
+    })
+}
+
+fn check_consumed_names(artifacts: &[ConsumedArtifact<'_>]) -> Result<(), Report<ReleaseError>> {
+    let names: BTreeSet<&str> = artifacts.iter().map(|artifact| artifact.name).collect();
+    if artifacts.is_empty() || names.len() != artifacts.len() {
+        return Err(evidence_error(
+            "verification needs one or more distinct consumed artifacts",
+        ));
+    }
+    Ok(())
+}
+
+struct ArtifactContext<'a> {
+    index: &'a ReleaseIndex,
+    expected: &'a Expected,
+    run: &'a str,
+    modules: &'a [joins::ModuleRecord],
+    release: &'a ApprovedRelease,
+}
+
+impl ArtifactContext<'_> {
+    fn verify(
+        &self,
+        consumed: &ConsumedArtifact<'_>,
+    ) -> Result<VerifiedArtifactEvidence, Report<ReleaseError>> {
+        let entry = self
+            .index
+            .artifacts
+            .iter()
+            .find(|entry| entry.name == consumed.name)
+            .ok_or_else(|| {
+                evidence_error(format!(
+                    "`{}` is not a signed index artifact",
+                    consumed.name
+                ))
+            })?;
+        check_bundle_records(entry)?;
+        check_companion_bytes(entry, consumed)?;
+        check_release_qualification(entry, consumed)?;
+        joins::parse_informational(consumed.build_recipe)?;
+        let provenance_subjects = provenance_subjects(entry);
+        let proof = consumed.provenance_proof.for_inputs(
+            self.release,
+            PredicateKind::Provenance,
+            consumed.executable,
+            consumed.provenance_bundle,
+        )?;
+        let run = check_provenance_proof(proof, self.expected, &provenance_subjects)?;
+        require_same_run(self.run, &run)?;
+        self.check_sbom_proof(entry, consumed)?;
+        joins::check_build_evidence(consumed.build_evidence, entry, self.index, self.modules)?;
+        Ok(VerifiedArtifactEvidence {
+            name: entry.name.clone(),
+            measurement: consumed.executable.clone(),
+            assurance_profile: entry.assurance_profile.clone(),
+            comparison: joins::parse_comparison(consumed.rebuild_check)?,
+        })
+    }
+
+    fn check_sbom_proof(
+        &self,
+        entry: &IndexArtifact,
+        consumed: &ConsumedArtifact<'_>,
+    ) -> Result<(), Report<ReleaseError>> {
+        let proof = consumed.spdx_proof.for_inputs(
+            self.release,
+            PredicateKind::Spdx,
+            consumed.executable,
+            consumed.sbom_bundle,
+        )?;
+        let run = check_certificate(proof, self.expected)?;
+        require_same_run(self.run, &run)?;
+        let statement = statement(proof, SBOM_PREDICATE)?;
+        check_subjects(
+            statement,
+            &BTreeMap::from([(entry.name.as_str(), entry.sha256.as_str())]),
+        )?;
+        let predicate = at(statement, &["predicate"])
+            .ok_or_else(|| evidence_error("SPDX statement has no predicate"))?;
+        joins::check_spdx(predicate, consumed.spdx, &entry.sha256)
+    }
+}
+
+/// Requires both signature bundle records to name non-empty files.
+///
+/// An unsigned candidate index records each awaiting-signature bundle as the
+/// true empty-file record (size 0). Provenance and SBOM sigstore bundles must
+/// exist, so a size-0 record fails closed before any byte or proof
+/// comparison. Verification applies this to every indexed artifact right
+/// after parsing the index, and again to each consumed artifact.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Evidence`] when either bundle record has size 0.
+fn check_bundle_records(entry: &IndexArtifact) -> Result<(), Report<ReleaseError>> {
+    let companions = &entry.companions;
+    for record in [&companions.provenance, &companions.sbom_attestation] {
+        if record.size == 0 {
+            return Err(evidence_error(format!(
+                "signature bundle `{}` is empty; an unsigned candidate index cannot be verified",
+                record.name
+            )));
+        }
+    }
+    Ok(())
+}
+
+/// Rejects the candidate sentinel tag before any proof or index field is used.
+///
+/// Full verification requires an index tag equal to the approved tag, so
+/// checking the approved release rejects every candidate index. The match is
+/// exact: the release-index v1 schema reserves no `v0.0.0-` prefix, and
+/// other `v0.0.0` pre-release tags remain valid semantic-version tags.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Policy`] when the approved tag is the sentinel.
+fn check_not_candidate_tag(release: &ApprovedRelease) -> Result<(), Report<ReleaseError>> {
+    if release.tag().as_str() == CANDIDATE_TAG {
+        return Err(report(
+            ReleaseError::Policy,
+            format!(
+                "`{CANDIDATE_TAG}` is the unqualified candidate sentinel tag, not an official release"
+            ),
+        ));
+    }
+    Ok(())
+}
+
+/// Rejects consumed companions that declare themselves unqualified.
+///
+/// Build evidence, build recipe and rebuild check of a candidate carry
+/// `"release_qualification": false`. The R-INDEX field contracts do not
+/// define the field and no closed companion schema is retained, so an absent
+/// field is accepted and `true` is accepted; `false` and any non-boolean
+/// value fail closed. Runs after [`check_companion_bytes`] so only the
+/// index-authenticated bytes are read, and independently of
+/// [`check_bundle_records`].
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Document`] for malformed JSON and
+/// [`ReleaseError::Evidence`] for a `false` or non-boolean declaration.
+fn check_release_qualification(
+    entry: &IndexArtifact,
+    consumed: &ConsumedArtifact<'_>,
+) -> Result<(), Report<ReleaseError>> {
+    let companions = &entry.companions;
+    let documents = [
+        (&companions.build_evidence, consumed.build_evidence),
+        (&companions.build_recipe, consumed.build_recipe),
+        (&companions.rebuild_check, consumed.rebuild_check),
+    ];
+    for (record, bytes) in documents {
+        let document = parse_json(bytes, Role::Companion)?;
+        match document.get(RELEASE_QUALIFICATION) {
+            None | Some(Value::Bool(true)) => {}
+            Some(Value::Bool(false)) => {
+                return Err(evidence_error(format!(
+                    "`{}` declares `{RELEASE_QUALIFICATION}: false`; an unqualified candidate cannot be verified",
+                    record.name
+                )));
+            }
+            Some(_) => {
+                return Err(evidence_error(format!(
+                    "`{}` field `{RELEASE_QUALIFICATION}` must be a boolean",
+                    record.name
+                )));
+            }
+        }
+    }
+    Ok(())
+}
+
+/// Index → executable and companions: exact actual lengths and digests.
+fn check_companion_bytes(
+    entry: &IndexArtifact,
+    consumed: &ConsumedArtifact<'_>,
+) -> Result<(), Report<ReleaseError>> {
+    let executable = FileRecord {
+        name: entry.name.clone(),
+        size: entry.size,
+        sha256: entry.sha256.clone(),
+    };
+    let companions = &entry.companions;
+    let pairs = [
+        (&executable, consumed.executable.clone()),
+        (&companions.sbom, AssetMeasurement::of_bytes(consumed.spdx)),
+        (
+            &companions.build_evidence,
+            AssetMeasurement::of_bytes(consumed.build_evidence),
+        ),
+        (
+            &companions.build_recipe,
+            AssetMeasurement::of_bytes(consumed.build_recipe),
+        ),
+        (
+            &companions.rebuild_check,
+            AssetMeasurement::of_bytes(consumed.rebuild_check),
+        ),
+        (&companions.provenance, consumed.provenance_bundle.clone()),
+        (&companions.sbom_attestation, consumed.sbom_bundle.clone()),
+    ];
+    pairs
+        .iter()
+        .try_for_each(|(record, actual)| check_measurement(record, actual))
+}
+
+/// Artifact provenance subjects: executable, SBOM, build evidence, recipe and
+/// rebuild check, exactly.
+fn provenance_subjects(entry: &IndexArtifact) -> BTreeMap<&str, &str> {
+    let companions = &entry.companions;
+    [
+        (entry.name.as_str(), entry.sha256.as_str()),
+        (
+            companions.sbom.name.as_str(),
+            companions.sbom.sha256.as_str(),
+        ),
+        (
+            companions.build_evidence.name.as_str(),
+            companions.build_evidence.sha256.as_str(),
+        ),
+        (
+            companions.build_recipe.name.as_str(),
+            companions.build_recipe.sha256.as_str(),
+        ),
+        (
+            companions.rebuild_check.name.as_str(),
+            companions.rebuild_check.sha256.as_str(),
+        ),
+    ]
+    .into_iter()
+    .collect()
+}
+
+/// Returns the object at `value`, or an evidence error naming `what`.
+pub(super) fn object<'a>(
+    value: &'a Value,
+    what: &str,
+) -> Result<&'a Map<String, Value>, Report<ReleaseError>> {
+    value
+        .as_object()
+        .ok_or_else(|| evidence_error(format!("{what} must be a JSON object")))
+}
diff --git a/crates/trusted-server-cli/src/release/evidence/candidate_fixture_tests.rs b/crates/trusted-server-cli/src/release/evidence/candidate_fixture_tests.rs
new file mode 100644
index 0000000000..de5d300111
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/evidence/candidate_fixture_tests.rs
@@ -0,0 +1,483 @@
+//! Consumer checks over the producer's unsigned candidate index.
+//!
+//! The committed bytes are produced and golden-tested by the release tool
+//! (`trusted-server-release` `distribution::tests::golden`) and included here
+//! test-only; neither crate depends on the other. Every document join the
+//! consumer runs without signatures must accept them, while the size-0
+//! awaiting-signature bundle records must keep the candidate unverifiable.
+//! Full verification independently rejects the sentinel tag and each
+//! `"release_qualification": false` companion, even with non-empty bundles.
+//!
+//! The ignored ordinary-CI test runs the same checks over the index the
+//! release tool's collector assembled from four real candidate jobs.
+
+use std::collections::BTreeMap;
+use std::io::Read as _;
+use std::path::Path;
+
+use error_stack::Report;
+use serde_json::{Value, json};
+
+use super::{
+    BuildEvidenceVerified, ConsumedArtifact, EvidenceInputs, check_bundle_records,
+    check_release_qualification, joins, verify_build_evidence, verify_index,
+};
+use crate::release::artifact::AssetMeasurement;
+use crate::release::documents::{
+    ApprovedCommit, ApprovedRelease, FileRecord, ReleaseTag, Role, parse_json, parse_release_index,
+    sha256_hex,
+};
+use crate::release::error::ReleaseError;
+use crate::release::evidence::ComparisonOutcome;
+use crate::release::gh::{PredicateKind, VerifiedAttestation};
+use crate::release::policy::{
+    AcceptanceRules, AcceptedProducerPolicy, EMBEDDED_POLICY, accept_producer_policy,
+    embedded_policy,
+};
+use crate::release::source_policy::ApprovedSourcePolicy;
+
+/// The fixed sentinel tag of every candidate index.
+const CANDIDATE_TAG: &str = "v0.0.0-unqualified-candidate";
+/// The fixed name of every candidate index.
+const CANDIDATE_INDEX_NAME: &str = "candidate-release-index.json";
+/// The fixed name of the shared JS inventory.
+const INVENTORY_NAME: &str = "tsjs-inventory.json";
+/// The fictional source commit of the committed candidate fixture.
+const COMMIT: &str = "0123456789abcdef0123456789abcdef01234567";
+
+macro_rules! candidate_fixture {
+    ($name:literal) => {
+        (
+            $name,
+            include_bytes!(concat!(
+                "../../../../trusted-server-release/tests/fixtures/index/candidate/",
+                $name
+            ))
+            .as_slice(),
+        )
+    };
+}
+
+/// Every committed candidate file the consumer reads.
+const FIXTURES: [(&str, &[u8]); 18] = [
+    candidate_fixture!("candidate-release-index.json"),
+    candidate_fixture!("tsjs-inventory.json"),
+    candidate_fixture!("trusted-server-fastly.wasm.spdx.json"),
+    candidate_fixture!("trusted-server-fastly.wasm.build-evidence.json"),
+    candidate_fixture!("trusted-server-fastly.wasm.build-recipe.json"),
+    candidate_fixture!("trusted-server-fastly.wasm.rebuild-check.json"),
+    candidate_fixture!("ts-aarch64-apple-darwin.spdx.json"),
+    candidate_fixture!("ts-aarch64-apple-darwin.build-evidence.json"),
+    candidate_fixture!("ts-aarch64-apple-darwin.build-recipe.json"),
+    candidate_fixture!("ts-aarch64-apple-darwin.rebuild-check.json"),
+    candidate_fixture!("ts-x86_64-apple-darwin.spdx.json"),
+    candidate_fixture!("ts-x86_64-apple-darwin.build-evidence.json"),
+    candidate_fixture!("ts-x86_64-apple-darwin.build-recipe.json"),
+    candidate_fixture!("ts-x86_64-apple-darwin.rebuild-check.json"),
+    candidate_fixture!("ts-x86_64-unknown-linux-gnu.spdx.json"),
+    candidate_fixture!("ts-x86_64-unknown-linux-gnu.build-evidence.json"),
+    candidate_fixture!("ts-x86_64-unknown-linux-gnu.build-recipe.json"),
+    candidate_fixture!("ts-x86_64-unknown-linux-gnu.rebuild-check.json"),
+];
+
+/// The byte-limit role the consumer applies to the candidate file `name`.
+fn role_for(name: &str) -> Role {
+    if name == CANDIDATE_INDEX_NAME {
+        Role::Index
+    } else if name == INVENTORY_NAME {
+        Role::Inventory
+    } else if name.ends_with(".spdx.json") {
+        Role::Spdx
+    } else {
+        Role::Companion
+    }
+}
+
+/// Reads one regular file of at most `limit` bytes.
+fn read_bounded(path: &Path, limit: u64) -> Vec<u8> {
+    let metadata = std::fs::symlink_metadata(path).expect("should inspect the candidate file");
+    assert!(
+        metadata.is_file() && metadata.len() <= limit,
+        "should read a regular candidate file within its bound: {}",
+        path.display()
+    );
+    let mut bytes = Vec::new();
+    std::fs::File::open(path)
+        .expect("should open the candidate file")
+        .take(limit + 1)
+        .read_to_end(&mut bytes)
+        .expect("should read the candidate file");
+    assert!(
+        bytes.len() as u64 <= limit,
+        "should stay within the role bound: {}",
+        path.display()
+    );
+    bytes
+}
+
+/// The eighteen candidate files a consumer reads and their source commit.
+struct CandidateFiles {
+    commit: String,
+    files: BTreeMap<&'static str, Vec<u8>>,
+}
+
+impl CandidateFiles {
+    /// The committed fictional golden fixture.
+    fn committed() -> Self {
+        Self {
+            commit: COMMIT.to_owned(),
+            files: FIXTURES
+                .iter()
+                .map(|(name, bytes)| (*name, bytes.to_vec()))
+                .collect(),
+        }
+    }
+
+    /// Exactly the eighteen named files of an assembled index directory.
+    fn from_directory(root: &Path, commit: String) -> Self {
+        let present = std::fs::read_dir(root)
+            .expect("should list the assembled candidate index directory")
+            .count();
+        assert_eq!(
+            present,
+            FIXTURES.len(),
+            "should hold exactly the index, inventory and sixteen companions"
+        );
+        let files = FIXTURES
+            .iter()
+            .map(|(name, _)| {
+                (
+                    *name,
+                    read_bounded(&root.join(name), role_for(name).limit()),
+                )
+            })
+            .collect();
+        Self { commit, files }
+    }
+
+    fn bytes(&self, name: &str) -> &[u8] {
+        self.files
+            .get(name)
+            .map(Vec::as_slice)
+            .expect("should hold the named candidate file")
+    }
+
+    fn approved_commit(&self) -> ApprovedCommit {
+        ApprovedCommit::parse(&self.commit).expect("should accept the candidate commit")
+    }
+
+    fn approved(&self) -> ApprovedRelease {
+        ApprovedRelease::new(
+            ReleaseTag::parse(CANDIDATE_TAG).expect("should accept the sentinel tag pattern"),
+            self.approved_commit(),
+        )
+    }
+
+    fn present_bytes(&self, record: &FileRecord) -> &[u8] {
+        let bytes = self.bytes(&record.name);
+        assert_eq!(
+            (bytes.len() as u64, sha256_hex(bytes)),
+            (record.size, record.sha256.clone()),
+            "should match the indexed length and digest of {}",
+            record.name
+        );
+        bytes
+    }
+}
+
+/// Runs every unsigned consumer join over `candidate`.
+fn check_unsigned_consumer_joins(candidate: &CandidateFiles) {
+    let policy = embedded_policy().expect("should accept the embedded consumer policy");
+    let index = parse_release_index(
+        candidate.bytes(CANDIDATE_INDEX_NAME),
+        &policy,
+        &candidate.approved(),
+    )
+    .expect("should parse the candidate index under the consumer policy");
+    let source =
+        ApprovedSourcePolicy::for_tests(candidate.approved_commit(), EMBEDDED_POLICY.to_vec());
+    assert_eq!(
+        accept_producer_policy(&index, &source, &AcceptanceRules::compiled(&policy))
+            .expect("should accept the producer policy"),
+        AcceptedProducerPolicy::Current,
+        "should bind the producer policy to the current consumer policy"
+    );
+    let inventory = candidate.present_bytes(&index.tsjs_inventory);
+    let modules = joins::parse_inventory(inventory, &candidate.commit)
+        .expect("should parse the candidate inventory");
+    for entry in &index.artifacts {
+        let companions = &entry.companions;
+        let evidence = candidate.present_bytes(&companions.build_evidence);
+        joins::check_build_evidence(evidence, entry, &index, &modules)
+            .expect("should join build evidence to the index and inventory");
+        let spdx = candidate.present_bytes(&companions.sbom);
+        let predicate = parse_json(spdx, Role::Spdx).expect("should parse the candidate SPDX");
+        joins::check_spdx(&predicate, spdx, &entry.sha256)
+            .expect("should bind the SPDX root to the executable digest");
+        let outcome = joins::parse_comparison(candidate.present_bytes(&companions.rebuild_check))
+            .expect("should parse the rebuild outcome");
+        let expected = if entry.name == "trusted-server-fastly.wasm" {
+            ComparisonOutcome::Matched
+        } else {
+            ComparisonOutcome::Unavailable
+        };
+        assert_eq!(outcome, expected, "should record {}", entry.name);
+        let recipe = joins::parse_informational(candidate.present_bytes(&companions.build_recipe))
+            .expect("should parse the informational recipe");
+        for document in [
+            recipe,
+            parse_json(evidence, Role::Companion).expect("should parse evidence"),
+        ] {
+            assert_eq!(
+                document["release_qualification"],
+                Value::Bool(false),
+                "should state the candidate is unqualified"
+            );
+        }
+    }
+}
+
+/// Requires every bundle slot of `candidate` to be the empty-file sentinel
+/// that full verification rejects.
+fn check_empty_bundle_sentinels(candidate: &CandidateFiles) {
+    let policy = embedded_policy().expect("should accept the embedded consumer policy");
+    let index = parse_release_index(
+        candidate.bytes(CANDIDATE_INDEX_NAME),
+        &policy,
+        &candidate.approved(),
+    )
+    .expect("should parse the candidate index");
+    let empty = sha256_hex(b"");
+    for entry in &index.artifacts {
+        for record in [
+            &entry.companions.provenance,
+            &entry.companions.sbom_attestation,
+        ] {
+            assert_eq!(
+                (record.size, record.sha256.as_str()),
+                (0, empty.as_str()),
+                "should record the true empty file for {}",
+                record.name
+            );
+        }
+        let error = check_bundle_records(entry).expect_err("should reject empty bundles");
+        assert_eq!(
+            *error.current_context(),
+            ReleaseError::Evidence,
+            "should fail closed as an evidence error"
+        );
+        assert!(
+            format!("{error:?}").contains("is empty"),
+            "should name the empty bundle: {error:?}"
+        );
+    }
+}
+
+/// A placeholder proof bound to `release`; the sentinel-tag rule must reject
+/// before any proof field is read.
+fn placeholder_proof(
+    release: &ApprovedRelease,
+    predicate: PredicateKind,
+    subject: &AssetMeasurement,
+) -> VerifiedAttestation {
+    VerifiedAttestation::synthetic_for_tests(
+        json!({}),
+        release.clone(),
+        predicate,
+        subject.clone(),
+        AssetMeasurement::of_bytes(b"fictional placeholder bundle"),
+    )
+}
+
+/// Rewrites every bundle record of `index_bytes` as a non-empty record, so
+/// the empty-bundle rule alone can no longer reject the index.
+fn with_non_empty_bundle_records(index_bytes: &[u8]) -> Vec<u8> {
+    let mut index: Value =
+        serde_json::from_slice(index_bytes).expect("should parse the candidate index");
+    let bundle = b"fictional non-empty signature bundle";
+    for artifact in index["artifacts"]
+        .as_array_mut()
+        .expect("should hold candidate artifacts")
+    {
+        for slot in ["provenance", "sbom_attestation"] {
+            let record = &mut artifact["companions"][slot];
+            record["size"] = json!(bundle.len());
+            record["sha256"] = json!(sha256_hex(bundle));
+        }
+    }
+    serde_json::to_vec(&index).expect("should serialize the altered index")
+}
+
+/// Runs full build-evidence verification over `index_bytes` and the golden
+/// Fastly companions, under the sentinel tag.
+fn verify_candidate(
+    candidate: &CandidateFiles,
+    index_bytes: &[u8],
+) -> Result<BuildEvidenceVerified, Report<ReleaseError>> {
+    let release = candidate.approved();
+    let policy = embedded_policy().expect("should accept the embedded consumer policy");
+    let source =
+        ApprovedSourcePolicy::for_tests(candidate.approved_commit(), EMBEDDED_POLICY.to_vec());
+    let asset = "trusted-server-fastly.wasm";
+    let executable = AssetMeasurement::of_bytes(b"fictional candidate executable");
+    let bundle = AssetMeasurement::of_bytes(b"fictional placeholder bundle");
+    let index_measurement = AssetMeasurement::of_bytes(index_bytes);
+    let index_proof = placeholder_proof(&release, PredicateKind::Provenance, &index_measurement);
+    let provenance_proof = placeholder_proof(&release, PredicateKind::Provenance, &executable);
+    let spdx_proof = placeholder_proof(&release, PredicateKind::Spdx, &executable);
+    let artifacts = [ConsumedArtifact {
+        name: asset,
+        executable: &executable,
+        spdx: candidate.bytes(&format!("{asset}.spdx.json")),
+        build_evidence: candidate.bytes(&format!("{asset}.build-evidence.json")),
+        build_recipe: candidate.bytes(&format!("{asset}.build-recipe.json")),
+        rebuild_check: candidate.bytes(&format!("{asset}.rebuild-check.json")),
+        provenance_bundle: &bundle,
+        sbom_bundle: &bundle,
+        provenance_proof: &provenance_proof,
+        spdx_proof: &spdx_proof,
+    }];
+    verify_build_evidence(&EvidenceInputs {
+        release: &release,
+        consumer_policy: &policy,
+        source_policy: &source,
+        index_bytes,
+        index_proof: &index_proof,
+        index_bundle: &bundle,
+        inventory_bytes: candidate.bytes(INVENTORY_NAME),
+        artifacts: &artifacts,
+    })
+}
+
+/// Requires `result` to fail as the sentinel-tag policy rejection.
+fn assert_sentinel_rejection<T: core::fmt::Debug>(result: Result<T, Report<ReleaseError>>) {
+    let error = result.expect_err("should reject the candidate sentinel tag");
+    assert_eq!(
+        *error.current_context(),
+        ReleaseError::Policy,
+        "should fail closed as a policy rejection"
+    );
+    assert!(
+        format!("{error:?}").contains("unqualified candidate sentinel tag"),
+        "should name the sentinel tag: {error:?}"
+    );
+}
+
+#[test]
+fn full_verification_rejects_the_golden_candidate_for_its_sentinel_tag() {
+    let candidate = CandidateFiles::committed();
+
+    assert_sentinel_rejection(verify_candidate(
+        &candidate,
+        candidate.bytes(CANDIDATE_INDEX_NAME),
+    ));
+}
+
+#[test]
+fn full_verification_rejects_the_sentinel_tag_even_with_non_empty_bundle_records() {
+    let candidate = CandidateFiles::committed();
+    let index_bytes = with_non_empty_bundle_records(candidate.bytes(CANDIDATE_INDEX_NAME));
+    let policy = embedded_policy().expect("should accept the embedded consumer policy");
+    let index = parse_release_index(&index_bytes, &policy, &candidate.approved())
+        .expect("should parse the altered candidate index");
+    index
+        .artifacts
+        .iter()
+        .try_for_each(check_bundle_records)
+        .expect("should pass the empty-bundle rule once bundles are non-empty");
+
+    assert_sentinel_rejection(verify_candidate(&candidate, &index_bytes));
+    let release = candidate.approved();
+    let index_measurement = AssetMeasurement::of_bytes(&index_bytes);
+    assert_sentinel_rejection(verify_index(
+        &release,
+        &policy,
+        &ApprovedSourcePolicy::for_tests(candidate.approved_commit(), EMBEDDED_POLICY.to_vec()),
+        &index_bytes,
+        &placeholder_proof(&release, PredicateKind::Provenance, &index_measurement),
+        &AssetMeasurement::of_bytes(b"fictional placeholder bundle"),
+    ));
+}
+
+#[test]
+fn golden_candidate_companions_fail_the_release_qualification_rule() {
+    let candidate = CandidateFiles::committed();
+    let index_bytes = with_non_empty_bundle_records(candidate.bytes(CANDIDATE_INDEX_NAME));
+    let policy = embedded_policy().expect("should accept the embedded consumer policy");
+    let release = candidate.approved();
+    let index = parse_release_index(&index_bytes, &policy, &release)
+        .expect("should parse the altered candidate index");
+    let executable = AssetMeasurement::of_bytes(b"fictional candidate executable");
+    let bundle = AssetMeasurement::of_bytes(b"fictional placeholder bundle");
+    let proof = placeholder_proof(&release, PredicateKind::Provenance, &executable);
+    for entry in &index.artifacts {
+        let companions = &entry.companions;
+        let consumed = ConsumedArtifact {
+            name: &entry.name,
+            executable: &executable,
+            spdx: candidate.present_bytes(&companions.sbom),
+            build_evidence: candidate.present_bytes(&companions.build_evidence),
+            build_recipe: candidate.present_bytes(&companions.build_recipe),
+            rebuild_check: candidate.present_bytes(&companions.rebuild_check),
+            provenance_bundle: &bundle,
+            sbom_bundle: &bundle,
+            provenance_proof: &proof,
+            spdx_proof: &proof,
+        };
+
+        let error = check_release_qualification(entry, &consumed)
+            .expect_err("should reject the unqualified candidate companions");
+
+        assert_eq!(
+            *error.current_context(),
+            ReleaseError::Evidence,
+            "should fail closed as an evidence error for {}",
+            entry.name
+        );
+        assert!(
+            format!("{error:?}").contains("declares `release_qualification: false`"),
+            "should name the unqualified declaration: {error:?}"
+        );
+    }
+}
+
+#[test]
+fn candidate_index_passes_every_unsigned_consumer_join() {
+    check_unsigned_consumer_joins(&CandidateFiles::committed());
+}
+
+#[test]
+fn candidate_bundles_are_empty_sentinels_that_verification_rejects() {
+    check_empty_bundle_sentinels(&CandidateFiles::committed());
+}
+
+#[test]
+fn directory_reader_reads_exactly_the_eighteen_candidate_files() {
+    let scratch = tempfile::tempdir().expect("should create a scratch directory");
+    for (name, bytes) in FIXTURES {
+        std::fs::write(scratch.path().join(name), bytes).expect("should write the fixture");
+    }
+
+    let candidate = CandidateFiles::from_directory(scratch.path(), COMMIT.to_owned());
+
+    assert_eq!(
+        candidate.files,
+        CandidateFiles::committed().files,
+        "should read exactly the committed bytes back"
+    );
+    check_unsigned_consumer_joins(&candidate);
+    check_empty_bundle_sentinels(&candidate);
+}
+
+#[test]
+#[ignore = "requires the candidate index the ordinary-CI collector assembled from four real candidate jobs"]
+fn ordinary_ci_assembled_candidate_passes_unsigned_consumer_joins() {
+    let root = std::env::var_os("TS_RELEASE_CANDIDATE_INDEX_ROOT")
+        .expect("should explicitly supply the assembled candidate index directory");
+    let commit = std::env::var("TS_RELEASE_CANDIDATE_SOURCE_COMMIT")
+        .expect("should explicitly supply the candidate source commit");
+    let candidate = CandidateFiles::from_directory(Path::new(&root), commit);
+
+    check_unsigned_consumer_joins(&candidate);
+    check_empty_bundle_sentinels(&candidate);
+}
diff --git a/crates/trusted-server-cli/src/release/evidence/joins.rs b/crates/trusted-server-cli/src/release/evidence/joins.rs
new file mode 100644
index 0000000000..bd3b47db71
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/evidence/joins.rs
@@ -0,0 +1,300 @@
+//! Document joins of the evidence graph: JS inventory, build evidence, SPDX
+//! root/document equality and the informational rebuild outcome.
+//!
+//! Every document is parsed with the strict byte-first parser, so duplicate
+//! keys, BOMs, excess depth and oversize input are rejected before any join.
+//! Only the fields the joins need are read; their names follow the R-INDEX
+//! field contracts because no closed build-evidence, inventory or
+//! rebuild-check schema is retained yet.
+
+use error_stack::Report;
+use serde_json::Value;
+
+use super::{at, evidence_error, object};
+use crate::release::documents::{IndexArtifact, ReleaseIndex, Role, lower_hex, parse_json};
+use crate::release::error::ReleaseError;
+
+/// SPDX document element identifier.
+const DOCUMENT_ID: &str = "SPDXRef-DOCUMENT";
+
+/// One JS module identity shared by the inventory and build evidence.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct ModuleRecord {
+    id: String,
+    filename: String,
+    size: u64,
+    sha256: String,
+}
+
+/// Informational rebuild comparison outcome; never an authorization input.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, derive_more::Display)]
+pub(crate) enum ComparisonOutcome {
+    #[display("matched")]
+    Matched,
+    #[display("mismatched")]
+    Mismatched,
+    #[display("failed")]
+    Failed,
+    #[display("unavailable")]
+    Unavailable,
+}
+
+fn module_record(value: &Value) -> Result<ModuleRecord, Report<ReleaseError>> {
+    let text = |key: &str| value.get(key).and_then(Value::as_str);
+    let record = ModuleRecord {
+        id: text("id").unwrap_or_default().to_owned(),
+        filename: text("filename").unwrap_or_default().to_owned(),
+        size: value
+            .get("size")
+            .and_then(Value::as_u64)
+            .unwrap_or(u64::MAX),
+        sha256: text("sha256").unwrap_or_default().to_owned(),
+    };
+    if record.id.is_empty()
+        || record.filename.is_empty()
+        || record.size == u64::MAX
+        || !lower_hex(&record.sha256, 64)
+    {
+        return Err(evidence_error(
+            "JS module record needs id, filename, integer size and SHA-256",
+        ));
+    }
+    Ok(record)
+}
+
+/// Parses an array of module records and requires strictly ascending ids.
+fn sorted_modules(
+    value: Option<&Value>,
+    what: &str,
+) -> Result<Vec<ModuleRecord>, Report<ReleaseError>> {
+    let records = value
+        .and_then(Value::as_array)
+        .ok_or_else(|| evidence_error(format!("{what} must be an array")))?
+        .iter()
+        .map(module_record)
+        .collect::<Result<Vec<_>, _>>()?;
+    if records.windows(2).any(|pair| match pair {
+        [first, second] => first.id >= second.id,
+        _ => false,
+    }) {
+        return Err(evidence_error(format!(
+            "{what} must be sorted by unique module id"
+        )));
+    }
+    Ok(records)
+}
+
+fn require_version_and_source(
+    document: &Value,
+    commit: &str,
+    what: &str,
+) -> Result<(), Report<ReleaseError>> {
+    object(document, what)?;
+    if document.get("schema_version").and_then(Value::as_u64) != Some(1) {
+        return Err(evidence_error(format!("{what} schema version must be 1")));
+    }
+    if document.get("source_commit").and_then(Value::as_str) != Some(commit) {
+        return Err(evidence_error(format!(
+            "{what} source commit is not the approved commit"
+        )));
+    }
+    Ok(())
+}
+
+/// Parses the shared JS inventory and returns its module table.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Document`] for malformed JSON and
+/// [`ReleaseError::Evidence`] for another source commit or a malformed,
+/// unsorted or duplicated module table.
+pub(crate) fn parse_inventory(
+    bytes: &[u8],
+    commit: &str,
+) -> Result<Vec<ModuleRecord>, Report<ReleaseError>> {
+    let inventory = parse_json(bytes, Role::Inventory)?;
+    require_version_and_source(&inventory, commit, "JS inventory")?;
+    let modules = sorted_modules(inventory.get("modules"), "JS inventory modules")?;
+    if modules.is_empty() {
+        return Err(evidence_error("JS inventory lists no modules"));
+    }
+    Ok(modules)
+}
+
+/// Joins one artifact's build evidence to the index and shared inventory.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Evidence`] when the build evidence names another
+/// source, target, variant, executable or inventory digest, when its prepared
+/// module table differs from the inventory, or when a claimed retained module
+/// is not exactly an inventory module.
+pub(crate) fn check_build_evidence(
+    bytes: &[u8],
+    entry: &IndexArtifact,
+    index: &ReleaseIndex,
+    modules: &[ModuleRecord],
+) -> Result<(), Report<ReleaseError>> {
+    let evidence = parse_json(bytes, Role::Companion)?;
+    require_version_and_source(&evidence, &index.source_commit, "build evidence")?;
+    let joins = [
+        ("target", entry.target.as_str()),
+        ("variant", entry.variant.as_str()),
+        ("artifact_sha256", entry.sha256.as_str()),
+        ("js_inventory_sha256", index.tsjs_inventory.sha256.as_str()),
+    ];
+    for (field, wanted) in joins {
+        if evidence.get(field).and_then(Value::as_str) != Some(wanted) {
+            return Err(evidence_error(format!(
+                "build evidence `{field}` differs from the signed index"
+            )));
+        }
+    }
+    let prepared = sorted_modules(evidence.get("prepared_modules"), "prepared modules")?;
+    if prepared != modules {
+        return Err(evidence_error(
+            "prepared JS modules differ from the shared inventory",
+        ));
+    }
+    let retained = sorted_modules(evidence.get("embedded_modules"), "embedded modules")?;
+    if let Some(unknown) = retained.iter().find(|module| !modules.contains(module)) {
+        return Err(evidence_error(format!(
+            "retained JS module `{}` is not exactly an inventory module",
+            unknown.id
+        )));
+    }
+    Ok(())
+}
+
+/// Checks the SPDX predicate against the published document and executable.
+///
+/// The published document is parsed strictly (duplicate keys rejected) and
+/// compared as parsed JSON: object key order is ignored, array order is
+/// significant. File-byte digest equality is checked separately against the
+/// signed index; this comparison never substitutes for it.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Evidence`] if the predicate differs from the
+/// document or the document root checksum is not the executable digest.
+pub(crate) fn check_spdx(
+    predicate: &Value,
+    document_bytes: &[u8],
+    executable_sha256: &str,
+) -> Result<(), Report<ReleaseError>> {
+    let document = parse_json(document_bytes, Role::Spdx)?;
+    if predicate != &document {
+        return Err(evidence_error(
+            "SPDX predicate differs from the published SPDX document",
+        ));
+    }
+    if at(&document, &["spdxVersion"]).and_then(Value::as_str) != Some("SPDX-2.3")
+        || at(&document, &["SPDXID"]).and_then(Value::as_str) != Some(DOCUMENT_ID)
+    {
+        return Err(evidence_error("published SBOM is not an SPDX 2.3 document"));
+    }
+    let root = spdx_root(&document)?;
+    if root_sha256(&document, &root)? != executable_sha256 {
+        return Err(evidence_error(
+            "SPDX root package checksum differs from the executable digest",
+        ));
+    }
+    Ok(())
+}
+
+/// Returns the single element the document describes.
+fn spdx_root(document: &Value) -> Result<String, Report<ReleaseError>> {
+    let mut described: Vec<&str> = document
+        .get("documentDescribes")
+        .and_then(Value::as_array)
+        .map(|ids| ids.iter().filter_map(Value::as_str).collect())
+        .unwrap_or_default();
+    let relationships = document
+        .get("relationships")
+        .and_then(Value::as_array)
+        .map(Vec::as_slice)
+        .unwrap_or_default();
+    described.extend(relationships.iter().filter_map(|relationship| {
+        let field = |key: &str| relationship.get(key).and_then(Value::as_str);
+        (field("spdxElementId") == Some(DOCUMENT_ID)
+            && field("relationshipType") == Some("DESCRIBES"))
+        .then(|| field("relatedSpdxElement"))
+        .flatten()
+    }));
+    described.sort_unstable();
+    described.dedup();
+    match described.as_slice() {
+        [root] => Ok((*root).to_owned()),
+        _ => Err(evidence_error(
+            "SPDX document must describe exactly one root",
+        )),
+    }
+}
+
+fn root_sha256<'a>(document: &'a Value, root: &str) -> Result<&'a str, Report<ReleaseError>> {
+    let packages: Vec<&Value> = document
+        .get("packages")
+        .and_then(Value::as_array)
+        .map(|packages| {
+            packages
+                .iter()
+                .filter(|package| package.get("SPDXID").and_then(Value::as_str) == Some(root))
+                .collect()
+        })
+        .unwrap_or_default();
+    let [package] = packages.as_slice() else {
+        return Err(evidence_error("SPDX root must be exactly one package"));
+    };
+    let checksums: Vec<&str> = package
+        .get("checksums")
+        .and_then(Value::as_array)
+        .map(|checksums| {
+            checksums
+                .iter()
+                .filter(|checksum| {
+                    checksum.get("algorithm").and_then(Value::as_str) == Some("SHA256")
+                })
+                .filter_map(|checksum| checksum.get("checksumValue").and_then(Value::as_str))
+                .collect()
+        })
+        .unwrap_or_default();
+    match checksums.as_slice() {
+        [sha256] => Ok(sha256),
+        _ => Err(evidence_error(
+            "SPDX root package must carry exactly one SHA256 checksum",
+        )),
+    }
+}
+
+/// Parses the informational rebuild-check outcome.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Evidence`] for an outcome outside the closed enum.
+pub(crate) fn parse_comparison(bytes: &[u8]) -> Result<ComparisonOutcome, Report<ReleaseError>> {
+    let document = parse_informational(bytes)?;
+    match document.get("outcome").and_then(Value::as_str) {
+        Some("matched") => Ok(ComparisonOutcome::Matched),
+        Some("mismatched") => Ok(ComparisonOutcome::Mismatched),
+        Some("failed") => Ok(ComparisonOutcome::Failed),
+        Some("unavailable") => Ok(ComparisonOutcome::Unavailable),
+        _ => Err(evidence_error(
+            "rebuild check outcome must be matched, mismatched, failed or unavailable",
+        )),
+    }
+}
+
+/// Strictly parses a version-1 informational companion without executing it.
+///
+/// # Errors
+///
+/// Returns a document error for invalid JSON or an evidence error for an
+/// unsupported version.
+pub(super) fn parse_informational(bytes: &[u8]) -> Result<Value, Report<ReleaseError>> {
+    let document = parse_json(bytes, Role::Companion)?;
+    object(&document, "informational companion")?;
+    if document.get("version").and_then(Value::as_u64) != Some(1) {
+        return Err(evidence_error("informational companion version must be 1"));
+    }
+    Ok(document)
+}
diff --git a/crates/trusted-server-cli/src/release/evidence/upstream_format_tests.rs b/crates/trusted-server-cli/src/release/evidence/upstream_format_tests.rs
new file mode 100644
index 0000000000..aeec296a94
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/evidence/upstream_format_tests.rs
@@ -0,0 +1,66 @@
+//! Fictionalized format observations from separately verified upstream proofs.
+//!
+//! These JSON values contain no signatures and supply no verification authority.
+//! Actual cryptographic qualification is recorded separately under
+//! `scripts/release/qualification/`; these tests protect parser compatibility.
+
+use std::collections::BTreeMap;
+
+use serde_json::Value;
+
+use super::{Expected, check_certificate, check_subjects, statement};
+use crate::release::documents::{ApprovedCommit, ApprovedRelease, ReleaseTag, Role, parse_json};
+use crate::release::policy::{PROVENANCE_PREDICATE, SBOM_PREDICATE};
+
+const FORMATS: &[u8] = include_bytes!("../../../tests/fixtures/release/upstream-formats.json");
+
+fn observed(kind: &str) -> Value {
+    let formats = parse_json(FORMATS, Role::GhOutput)
+        .expect("should parse fictionalized upstream format observations");
+    formats[kind][0].clone()
+}
+
+#[test]
+fn pinned_upstream_provenance_and_spdx_shapes_reach_subject_checks() {
+    let digest = "a".repeat(64);
+    let expected = BTreeMap::from([("example-asset", digest.as_str())]);
+    for (kind, predicate) in [
+        ("provenance", PROVENANCE_PREDICATE),
+        ("spdx", SBOM_PREDICATE),
+    ] {
+        let proof = observed(kind);
+        let statement = statement(&proof, predicate)
+            .expect("should accept the observed pinned verification result shape");
+        check_subjects(statement, &expected)
+            .expect("should bind the observed subject shape to exact bytes");
+        let changed = BTreeMap::from([("another-asset", digest.as_str())]);
+        assert!(
+            check_subjects(statement, &changed).is_err(),
+            "should reject a subject name outside the expected set"
+        );
+    }
+}
+
+#[test]
+fn upstream_format_never_confers_official_repository_identity() {
+    let release = ApprovedRelease::new(
+        ReleaseTag::parse("v1.2.0").expect("should parse the fictional tag"),
+        ApprovedCommit::parse("0123456789abcdef0123456789abcdef01234567")
+            .expect("should parse the fictional commit"),
+    );
+    let expected = Expected::new(&release);
+    for kind in ["provenance", "spdx"] {
+        assert!(
+            check_certificate(&observed(kind), &expected).is_err(),
+            "should reject an unrelated signer despite compatible JSON"
+        );
+    }
+}
+
+#[test]
+fn observed_spdx_predicate_cannot_substitute_for_provenance() {
+    assert!(
+        statement(&observed("spdx"), PROVENANCE_PREDICATE).is_err(),
+        "should keep the observed predicate roles distinct"
+    );
+}
diff --git a/crates/trusted-server-cli/src/release/gh.rs b/crates/trusted-server-cli/src/release/gh.rs
new file mode 100644
index 0000000000..c4640471ef
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/gh.rs
@@ -0,0 +1,765 @@
+//! Bounded, isolated invocation of the pinned GitHub CLI.
+//!
+//! gh is resolved once (explicit trusted path or one trusted `PATH` lookup)
+//! to a canonical executable that every later invocation reuses. Its
+//! `--version` text must report exactly the qualified version; that is a
+//! compatibility diagnostic only, because version text never authenticates an
+//! executable.
+//!
+//! Each child gets a cleared environment carrying only the explicit token (as
+//! `GH_TOKEN`), private home/config/state/cache directories and disabled
+//! prompts. It runs in its own process group with fixed argument vectors, a
+//! per-child and per-attempt deadline, cancellation, and concurrently drained
+//! byte-capped pipes. On any limit the whole group is killed and the leader
+//! reaped; a descendant that escaped the group and still holds the pipes is
+//! reported instead of awaited. A failed exit never yields parsed claims.
+
+use std::ffi::OsString;
+use std::fs::DirBuilder;
+use std::os::unix::fs::{DirBuilderExt as _, PermissionsExt as _};
+use std::os::unix::process::CommandExt as _;
+use std::path::{Path, PathBuf};
+use std::process::{Command, Stdio};
+
+use error_stack::Report;
+use serde_json::Value;
+use tempfile::TempDir;
+
+use super::artifact::AssetMeasurement;
+use super::bounds::{self, AttemptDeadline, Cancellation, ProcessBounds};
+use super::documents::{ApprovedRelease, ReleaseTag, Role, parse_json};
+use super::environment::{CallerEnvironment, GithubToken};
+use super::error::{ReleaseError, report};
+use super::policy::{
+    GH_VERSION, GITHUB_HOST, ISSUER, PROVENANCE_PREDICATE, REPOSITORY, SBOM_PREDICATE,
+    certificate_identity,
+};
+use super::process::supervise;
+
+mod input;
+
+/// Trust context of a successfully verified build attestation.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum VerificationMode {
+    /// Uses the online verifier trust configuration.
+    Online,
+    /// Uses independently transferred, pinned roots; cannot prove publication.
+    Offline,
+}
+
+/// One successful pinned gh attestation invocation, bound to its exact inputs.
+///
+/// Only this module constructs production proofs. Callers cannot deserialize
+/// or assert a successful verifier result.
+#[derive(Debug)]
+pub(crate) struct VerifiedAttestation {
+    mode: VerificationMode,
+    result: Value,
+    release: ApprovedRelease,
+    predicate: PredicateKind,
+    subject: AssetMeasurement,
+    bundle: AssetMeasurement,
+}
+
+impl VerifiedAttestation {
+    /// Returns the immutable trust context of the verification.
+    pub(crate) fn mode(&self) -> VerificationMode {
+        self.mode
+    }
+    /// Returns verified claims only for the same approved release and bytes.
+    ///
+    /// # Errors
+    ///
+    /// Returns an evidence error when any invocation input differs.
+    pub(crate) fn for_inputs(
+        &self,
+        release: &ApprovedRelease,
+        predicate: PredicateKind,
+        subject: &AssetMeasurement,
+        bundle: &AssetMeasurement,
+    ) -> Result<&Value, Report<ReleaseError>> {
+        if !same_release(&self.release, release)
+            || self.predicate != predicate
+            || &self.subject != subject
+            || &self.bundle != bundle
+        {
+            return Err(report(
+                ReleaseError::Evidence,
+                "verified gh proof belongs to other inputs",
+            ));
+        }
+        Ok(&self.result)
+    }
+
+    /// Constructs deliberately synthetic evidence for semantic tests only.
+    #[cfg(test)]
+    pub(crate) fn synthetic_for_tests(
+        result: Value,
+        release: ApprovedRelease,
+        predicate: PredicateKind,
+        subject: AssetMeasurement,
+        bundle: AssetMeasurement,
+    ) -> Self {
+        Self {
+            mode: VerificationMode::Online,
+            result,
+            release,
+            predicate,
+            subject,
+            bundle,
+        }
+    }
+}
+
+/// Successful gh release verification, bound to independent release approval.
+#[derive(Debug)]
+pub(crate) struct VerifiedReleaseStatement {
+    result: Value,
+    release: ApprovedRelease,
+}
+
+impl VerifiedReleaseStatement {
+    /// Returns verified claims for the independently approved release.
+    ///
+    /// # Errors
+    ///
+    /// Returns a publication error for a different release.
+    pub(crate) fn for_release(
+        &self,
+        release: &ApprovedRelease,
+    ) -> Result<&Value, Report<ReleaseError>> {
+        if !same_release(&self.release, release) {
+            return Err(report(
+                ReleaseError::Publication,
+                "verified release proof belongs to another release",
+            ));
+        }
+        Ok(&self.result)
+    }
+
+    /// Constructs deliberately synthetic publication evidence for tests only.
+    #[cfg(test)]
+    pub(crate) fn synthetic_for_tests(result: Value, release: ApprovedRelease) -> Self {
+        Self { result, release }
+    }
+}
+
+fn same_release(first: &ApprovedRelease, second: &ApprovedRelease) -> bool {
+    first.tag().as_str() == second.tag().as_str()
+        && first.commit().as_str() == second.commit().as_str()
+}
+
+const MINIMAL_PATH: &str = "/usr/bin:/bin";
+const STDERR_EXCERPT_BYTES: usize = 4096;
+const VERSION_EXCERPT_CHARS: usize = 128;
+/// `gh release` subcommands take a host-qualified repository.
+fn release_repository() -> String {
+    format!("{GITHUB_HOST}/{REPOSITORY}")
+}
+
+/// Where to find the gh executable.
+#[derive(Clone, Copy, Debug)]
+pub(crate) enum GhLocation<'a> {
+    /// An absolute path from trusted installer configuration.
+    Explicit(&'a Path),
+    /// One lookup through the absolute entries of the snapshot's `PATH`.
+    SearchPath,
+}
+
+/// The attestation predicate a verification requires.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum PredicateKind {
+    /// SLSA build provenance.
+    Provenance,
+    /// SPDX SBOM.
+    Spdx,
+}
+
+impl PredicateKind {
+    fn bundle_suffix(self) -> &'static str {
+        match self {
+            Self::Provenance => ".provenance.sigstore.json",
+            Self::Spdx => ".sbom.sigstore.json",
+        }
+    }
+
+    fn uri(self) -> &'static str {
+        match self {
+            Self::Provenance => PROVENANCE_PREDICATE,
+            Self::Spdx => SBOM_PREDICATE,
+        }
+    }
+}
+
+fn absolute(path: &Path, what: &str) -> Result<OsString, Report<ReleaseError>> {
+    if !path.is_absolute() {
+        return Err(report(
+            ReleaseError::Policy,
+            format!("{what} path must be absolute"),
+        ));
+    }
+    Ok(path.as_os_str().to_owned())
+}
+
+/// Builds the fixed `gh attestation verify` argument vector.
+///
+/// `bundle` must be the retained, membership-checked companion bundle for
+/// `predicate` (`.provenance.sigstore.json` or `.sbom.sigstore.json`), so gh
+/// verifies exactly that bundle instead of fetching attestations itself.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Policy`] unless `subject` and `bundle` are absolute
+/// (so neither can be parsed as a flag) and the bundle name matches the
+/// predicate.
+pub(crate) fn attestation_verify_args(
+    subject: &Path,
+    bundle: &Path,
+    release: &ApprovedRelease,
+    predicate: PredicateKind,
+) -> Result<Vec<OsString>, Report<ReleaseError>> {
+    let subject = absolute(subject, "attestation subject")?;
+    let bundle_name = bundle.file_name().map(|name| name.to_string_lossy());
+    if !bundle_name.is_some_and(|name| name.ends_with(predicate.bundle_suffix())) {
+        return Err(report(
+            ReleaseError::Policy,
+            "attestation bundle does not match the requested predicate",
+        ));
+    }
+    let bundle = absolute(bundle, "attestation bundle")?;
+    let commit = release.commit().as_str();
+    let fixed = ["attestation".to_owned(), "verify".to_owned()].map(OsString::from);
+    let options = [
+        "-R".to_owned(),
+        REPOSITORY.to_owned(),
+        "--hostname".to_owned(),
+        GITHUB_HOST.to_owned(),
+        "--cert-identity".to_owned(),
+        certificate_identity(release.tag()),
+        "--cert-oidc-issuer".to_owned(),
+        ISSUER.to_owned(),
+        "--source-ref".to_owned(),
+        format!("refs/tags/{}", release.tag().as_str()),
+        "--source-digest".to_owned(),
+        commit.to_owned(),
+        "--signer-digest".to_owned(),
+        commit.to_owned(),
+        "--deny-self-hosted-runners".to_owned(),
+        "--predicate-type".to_owned(),
+        predicate.uri().to_owned(),
+        "--format".to_owned(),
+        "json".to_owned(),
+    ]
+    .map(OsString::from);
+    Ok(fixed
+        .into_iter()
+        .chain([subject, OsString::from("--bundle"), bundle])
+        .chain(options)
+        .collect())
+}
+
+/// Builds the fixed `gh release verify` argument vector.
+pub(crate) fn release_verify_args(tag: &ReleaseTag) -> Vec<OsString> {
+    vec![
+        OsString::from("release"),
+        OsString::from("verify"),
+        OsString::from(tag.as_str()),
+        OsString::from("-R"),
+        OsString::from(release_repository()),
+        OsString::from("--format"),
+        OsString::from("json"),
+    ]
+}
+
+/// Builds the fixed `gh release verify-asset` argument vector.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Policy`] unless `asset` is absolute.
+pub(crate) fn release_verify_asset_args(
+    tag: &ReleaseTag,
+    asset: &Path,
+) -> Result<Vec<OsString>, Report<ReleaseError>> {
+    let asset = absolute(asset, "release asset")?;
+    Ok(vec![
+        OsString::from("release"),
+        OsString::from("verify-asset"),
+        OsString::from(tag.as_str()),
+        asset,
+        OsString::from("-R"),
+        OsString::from(release_repository()),
+    ])
+}
+
+/// Captured output of a successful child.
+#[derive(Debug)]
+pub(crate) struct ChildOutput {
+    pub(crate) stdout: Vec<u8>,
+    /// Lossily decoded stderr with the credential redacted.
+    pub(crate) stderr: String,
+}
+
+/// Private directories and the reviewed non-secret variables for every gh child.
+///
+/// The credential is never stored here; it stays in [`GithubToken`] (whose
+/// `Debug` is redacted) and is injected only when a child is spawned.
+#[derive(Debug)]
+struct ChildEnvironment {
+    root: TempDir,
+    variables: Vec<(OsString, OsString)>,
+}
+
+/// Fixed non-secret settings for every gh child.
+const FIXED_VARIABLES: [(&str, &str); 8] = [
+    ("GH_PROMPT_DISABLED", "1"),
+    ("GH_NO_UPDATE_NOTIFIER", "1"),
+    ("GH_NO_EXTENSION_UPDATE_NOTIFIER", "1"),
+    ("GH_SPINNER_DISABLED", "1"),
+    ("DO_NOT_TRACK", "1"),
+    ("NO_COLOR", "1"),
+    ("LC_ALL", "C"),
+    ("PATH", MINIMAL_PATH),
+];
+
+/// Private directory variables, relative to the isolated root.
+const PRIVATE_DIRECTORIES: [(&str, &str); 7] = [
+    ("GH_CONFIG_DIR", "config/gh"),
+    ("XDG_CONFIG_HOME", "config"),
+    ("XDG_STATE_HOME", "state"),
+    ("XDG_CACHE_HOME", "cache"),
+    ("XDG_DATA_HOME", "data"),
+    ("TMPDIR", "tmp"),
+    ("HOME", "home"),
+];
+
+fn reject_loader_injection(caller: &CallerEnvironment) -> Result<(), Report<ReleaseError>> {
+    let injected = caller.names().find(|name| {
+        let name = name.to_string_lossy();
+        name.starts_with("LD_") || name.starts_with("DYLD_")
+    });
+    match injected {
+        Some(name) => Err(report(
+            ReleaseError::Environment,
+            format!(
+                "dynamic-loader variable {} is set; refusing to run gh",
+                name.to_string_lossy()
+            ),
+        )),
+        None => Ok(()),
+    }
+}
+
+impl ChildEnvironment {
+    fn isolated(caller: &CallerEnvironment) -> Result<Self, Report<ReleaseError>> {
+        reject_loader_injection(caller)?;
+        let root = tempfile::Builder::new()
+            .prefix("ts-release-gh-")
+            .tempdir()
+            .map_err(|source| report(ReleaseError::Environment, source))?;
+        let mut variables = Vec::with_capacity(PRIVATE_DIRECTORIES.len() + FIXED_VARIABLES.len());
+        for (name, relative) in PRIVATE_DIRECTORIES {
+            let path = root.path().join(relative);
+            DirBuilder::new()
+                .recursive(true)
+                .mode(0o700)
+                .create(&path)
+                .map_err(|source| report(ReleaseError::Environment, source))?;
+            variables.push((OsString::from(name), path.into_os_string()));
+        }
+        variables.extend(
+            FIXED_VARIABLES.map(|(name, value)| (OsString::from(name), OsString::from(value))),
+        );
+        Ok(Self { root, variables })
+    }
+}
+
+fn is_executable_file(path: &Path) -> bool {
+    std::fs::metadata(path)
+        .is_ok_and(|metadata| metadata.is_file() && metadata.permissions().mode() & 0o111 != 0)
+}
+
+fn locate(
+    location: GhLocation<'_>,
+    caller: &CallerEnvironment,
+) -> Result<PathBuf, Report<ReleaseError>> {
+    let candidate = match location {
+        GhLocation::Explicit(path) => {
+            if !path.is_absolute() {
+                return Err(report(
+                    ReleaseError::UnsupportedTool,
+                    "explicit gh path must be absolute",
+                ));
+            }
+            path.to_path_buf()
+        }
+        GhLocation::SearchPath => caller
+            .get("PATH")
+            .and_then(|search| {
+                std::env::split_paths(search)
+                    .filter(|directory| directory.is_absolute())
+                    .map(|directory| directory.join("gh"))
+                    .find(|candidate| is_executable_file(candidate))
+            })
+            .ok_or_else(|| {
+                report(
+                    ReleaseError::UnsupportedTool,
+                    "gh was not found in any absolute PATH entry",
+                )
+            })?,
+    };
+    let canonical = candidate
+        .canonicalize()
+        .map_err(|source| report(ReleaseError::UnsupportedTool, source))?;
+    if !is_executable_file(&canonical) {
+        return Err(report(
+            ReleaseError::UnsupportedTool,
+            "gh path is not an executable regular file",
+        ));
+    }
+    Ok(canonical)
+}
+
+fn check_version(stdout: &[u8], token: Option<&GithubToken>) -> Result<(), Report<ReleaseError>> {
+    let text = String::from_utf8_lossy(stdout);
+    let first = text.lines().next().unwrap_or_default();
+    let qualified = first.strip_prefix("gh version ").is_some_and(|rest| {
+        let (version, tail) = rest.split_once(' ').unwrap_or((rest, ""));
+        version == GH_VERSION && (tail.is_empty() || (tail.starts_with('(') && tail.ends_with(')')))
+    });
+    if qualified {
+        return Ok(());
+    }
+    let excerpt: String = token
+        .map_or_else(|| first.to_owned(), |token| token.redact(first))
+        .chars()
+        .take(VERSION_EXCERPT_CHARS)
+        .collect();
+    Err(report(
+        ReleaseError::UnsupportedTool,
+        format!(
+            "gh reported `{excerpt}`; release verification requires exactly gh {GH_VERSION}. \
+             This is a compatibility diagnostic: version text does not authenticate the executable"
+        ),
+    ))
+}
+
+/// A resolved, version-checked gh executable with an isolated environment.
+#[derive(Debug)]
+pub(crate) struct GhRunner {
+    executable: PathBuf,
+    environment: ChildEnvironment,
+    token: Option<GithubToken>,
+    offline_roots: Option<(PathBuf, AssetMeasurement)>,
+    bounds: ProcessBounds,
+}
+
+impl GhRunner {
+    /// Resolves gh once, isolates its environment and checks its version.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Environment`] for loader injection or a missing
+    /// explicit token, [`ReleaseError::UnsupportedTool`] when gh is missing or
+    /// not exactly the qualified version, or a process error from the
+    /// version check.
+    pub(crate) fn resolve(
+        location: GhLocation<'_>,
+        caller: &CallerEnvironment,
+        bounds: ProcessBounds,
+        deadline: AttemptDeadline,
+        cancellation: &Cancellation,
+    ) -> Result<Self, Report<ReleaseError>> {
+        let token = Some(GithubToken::select(caller)?);
+        let environment = ChildEnvironment::isolated(caller)?;
+        let executable = locate(location, caller)?;
+        let runner = Self {
+            executable,
+            environment,
+            token,
+            offline_roots: None,
+            bounds,
+        };
+        let output = runner.run(&[OsString::from("--version")], deadline, cancellation)?;
+        check_version(&output.stdout, runner.token.as_ref())?;
+        Ok(runner)
+    }
+
+    /// Resolves a token-free bundle verifier with independently pinned roots.
+    ///
+    /// # Errors
+    ///
+    /// Rejects unsafe environment, missing tools, changed roots or wrong pins.
+    pub(crate) fn resolve_offline(
+        location: GhLocation<'_>,
+        caller: &CallerEnvironment,
+        bounds: ProcessBounds,
+        deadline: AttemptDeadline,
+        cancellation: &Cancellation,
+        roots: &Path,
+        expected_sha256: &str,
+    ) -> Result<Self, Report<ReleaseError>> {
+        if !super::documents::lower_hex(expected_sha256, 64) {
+            return Err(report(
+                ReleaseError::Policy,
+                "independent roots pin must be lowercase SHA-256",
+            ));
+        }
+        let environment = ChildEnvironment::isolated(caller)?;
+        let executable = locate(location, caller)?;
+        let (snapshot, measurement) = input::snapshot(
+            roots,
+            environment.root.path(),
+            bounds::TRUSTED_ROOTS_BYTES,
+            deadline,
+            cancellation,
+        )?;
+        if measurement.sha256() != expected_sha256 {
+            return Err(report(
+                ReleaseError::Policy,
+                "trusted roots differ from independently approved digest",
+            ));
+        }
+        let runner = Self {
+            executable,
+            environment,
+            token: None,
+            offline_roots: Some((snapshot, measurement)),
+            bounds,
+        };
+        let output = runner.run(&[OsString::from("--version")], deadline, cancellation)?;
+        check_version(&output.stdout, None)?;
+        Ok(runner)
+    }
+
+    /// Replaces the process bounds; tests use short deadlines and caps while
+    /// production keeps [`ProcessBounds::production`].
+    #[cfg(test)]
+    pub(crate) fn with_bounds(mut self, bounds: ProcessBounds) -> Self {
+        self.bounds = bounds;
+        self
+    }
+
+    /// Returns the canonical executable every invocation uses.
+    pub(crate) fn executable(&self) -> &Path {
+        &self.executable
+    }
+
+    /// Runs gh with a fixed argument vector under all bounds.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Timeout`], [`ReleaseError::Cancelled`],
+    /// [`ReleaseError::OutputLimit`], [`ReleaseError::DescendantEscaped`],
+    /// [`ReleaseError::Process`] or [`ReleaseError::ExitFailure`]; output from
+    /// a failed child is never returned.
+    pub(crate) fn run(
+        &self,
+        args: &[OsString],
+        deadline: AttemptDeadline,
+        cancellation: &Cancellation,
+    ) -> Result<ChildOutput, Report<ReleaseError>> {
+        let mut command = Command::new(&self.executable);
+        command
+            .args(args)
+            .env_clear()
+            .envs(self.environment.variables.iter().cloned())
+            .current_dir(self.environment.root.path())
+            .stdin(Stdio::null())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .process_group(0);
+        if let Some(token) = &self.token {
+            command.env("GH_TOKEN", token.expose());
+        }
+        let completed = supervise(&mut command, &self.bounds, deadline, cancellation)?;
+        let raw_stderr = String::from_utf8_lossy(&completed.stderr);
+        let stderr = self
+            .token
+            .as_ref()
+            .map_or_else(|| raw_stderr.to_string(), |token| token.redact(&raw_stderr));
+        if !completed.status.success() {
+            let excerpt: String = stderr.chars().take(STDERR_EXCERPT_BYTES).collect();
+            return Err(report(
+                ReleaseError::ExitFailure,
+                format!("gh {}; stderr: {excerpt}", completed.status),
+            ));
+        }
+        Ok(ChildOutput {
+            stdout: completed.stdout,
+            stderr,
+        })
+    }
+
+    /// Runs one fixed `gh attestation verify` against one retained,
+    /// membership-checked bundle and returns its single result.
+    ///
+    /// # Errors
+    ///
+    /// Returns any [`Self::run`] error, [`ReleaseError::Document`] for
+    /// malformed or incomplete JSON, or [`ReleaseError::Output`] unless stdout
+    /// is an array of exactly one attestation result.
+    pub(crate) fn verify_attestation(
+        &self,
+        subject: &Path,
+        bundle: &Path,
+        release: &ApprovedRelease,
+        predicate: PredicateKind,
+        deadline: AttemptDeadline,
+        cancellation: &Cancellation,
+    ) -> Result<VerifiedAttestation, Report<ReleaseError>> {
+        attestation_verify_args(subject, bundle, release, predicate)?;
+        let private = tempfile::Builder::new()
+            .prefix("proof-")
+            .tempdir_in(self.environment.root.path())
+            .map_err(|error| report(ReleaseError::Asset, error))?;
+        let subject_limit = if subject
+            .file_name()
+            .is_some_and(|name| name == "release-index.json")
+        {
+            bounds::INDEX_BYTES
+        } else {
+            bounds::EXECUTABLE_BYTES
+        };
+        let (private_subject, subject_measurement) = input::snapshot(
+            subject,
+            private.path(),
+            subject_limit,
+            deadline,
+            cancellation,
+        )?;
+        let (private_bundle, bundle_measurement) = input::snapshot(
+            bundle,
+            private.path(),
+            bounds::BUNDLE_BYTES,
+            deadline,
+            cancellation,
+        )?;
+        let bundle_bytes =
+            std::fs::read(&private_bundle).map_err(|error| report(ReleaseError::Asset, error))?;
+        parse_json(&bundle_bytes, Role::Bundle)?;
+        let mut args =
+            attestation_verify_args(&private_subject, &private_bundle, release, predicate)?;
+        if let Some((roots, measurement)) = &self.offline_roots {
+            input::unchanged(
+                roots,
+                measurement,
+                bounds::TRUSTED_ROOTS_BYTES,
+                deadline,
+                cancellation,
+            )?;
+            args.extend([
+                OsString::from("--custom-trusted-root"),
+                roots.as_os_str().to_owned(),
+            ]);
+        }
+        let output = self.run(&args, deadline, cancellation)?;
+        input::unchanged(
+            subject,
+            &subject_measurement,
+            subject_limit,
+            deadline,
+            cancellation,
+        )?;
+        input::unchanged(
+            bundle,
+            &bundle_measurement,
+            bounds::BUNDLE_BYTES,
+            deadline,
+            cancellation,
+        )?;
+        input::unchanged(
+            &private_subject,
+            &subject_measurement,
+            subject_limit,
+            deadline,
+            cancellation,
+        )?;
+        input::unchanged(
+            &private_bundle,
+            &bundle_measurement,
+            bounds::BUNDLE_BYTES,
+            deadline,
+            cancellation,
+        )?;
+        if let Some((roots, measurement)) = &self.offline_roots {
+            input::unchanged(
+                roots,
+                measurement,
+                bounds::TRUSTED_ROOTS_BYTES,
+                deadline,
+                cancellation,
+            )?;
+        }
+        let value = parse_json(&output.stdout, Role::GhOutput)?;
+        let Value::Array(results) = value else {
+            return Err(report(
+                ReleaseError::Output,
+                "gh attestation output must be a JSON array",
+            ));
+        };
+        if results.len() != bounds::MATCHING_ATTESTATIONS_PER_BUNDLE {
+            return Err(report(
+                ReleaseError::Output,
+                format!(
+                    "gh returned {} attestation results; exactly one is required",
+                    results.len()
+                ),
+            ));
+        }
+        let result = results
+            .into_iter()
+            .next()
+            .ok_or_else(|| report(ReleaseError::Output, "gh returned no attestation result"))?;
+        Ok(VerifiedAttestation {
+            mode: if self.offline_roots.is_some() {
+                VerificationMode::Offline
+            } else {
+                VerificationMode::Online
+            },
+            result,
+            release: release.clone(),
+            predicate,
+            subject: subject_measurement,
+            bundle: bundle_measurement,
+        })
+    }
+
+    /// Verifies the official release with the pinned tool and bounded JSON.
+    ///
+    /// gh 2.97.0 `pkg/cmd/release/verify/verify.go` exports one processing
+    /// result object with `--format json`, unlike attestation verify's array.
+    ///
+    /// # Errors
+    ///
+    /// Returns runner or strict JSON errors, or an output error for a shape
+    /// outside the pinned contract. Publication semantics are checked later.
+    pub(crate) fn verify_release(
+        &self,
+        release: &ApprovedRelease,
+        deadline: AttemptDeadline,
+        cancellation: &Cancellation,
+    ) -> Result<VerifiedReleaseStatement, Report<ReleaseError>> {
+        if self.offline_roots.is_some() {
+            return Err(report(
+                ReleaseError::Publication,
+                "offline build evidence cannot verify publication",
+            ));
+        }
+        let output = self.run(&release_verify_args(release.tag()), deadline, cancellation)?;
+        let result = parse_json(&output.stdout, Role::GhOutput)?;
+        if !result.is_object()
+            || !result
+                .get("verificationResult")
+                .is_some_and(Value::is_object)
+        {
+            return Err(report(
+                ReleaseError::Output,
+                "gh release output must be one verification result object",
+            ));
+        }
+        Ok(VerifiedReleaseStatement {
+            result,
+            release: release.clone(),
+        })
+    }
+}
diff --git a/crates/trusted-server-cli/src/release/gh/input.rs b/crates/trusted-server-cli/src/release/gh/input.rs
new file mode 100644
index 0000000000..2bcf760d25
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/gh/input.rs
@@ -0,0 +1,121 @@
+//! Bounded private snapshots supplied to the verifier child.
+
+use std::fs::{File, OpenOptions};
+use std::io::{Read as _, Write as _};
+use std::os::unix::fs::{MetadataExt as _, OpenOptionsExt as _};
+use std::path::{Path, PathBuf};
+use std::time::Instant;
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256};
+
+use crate::release::artifact::AssetMeasurement;
+use crate::release::bounds::{AttemptDeadline, Cancellation};
+use crate::release::error::{ReleaseError, report};
+
+fn checked_transfer(
+    path: &Path,
+    mut destination: Option<&mut File>,
+    limit: u64,
+    deadline: AttemptDeadline,
+    cancellation: &Cancellation,
+) -> Result<AssetMeasurement, Report<ReleaseError>> {
+    let mut input = OpenOptions::new()
+        .read(true)
+        .custom_flags(libc::O_NOFOLLOW | libc::O_NONBLOCK)
+        .open(path)
+        .map_err(|error| report(ReleaseError::Asset, error))?;
+    let metadata = input
+        .metadata()
+        .map_err(|error| report(ReleaseError::Asset, error))?;
+    if !metadata.is_file() || metadata.nlink() != 1 || metadata.len() > limit {
+        return Err(report(
+            ReleaseError::Asset,
+            "gh input is not a bounded regular file",
+        ));
+    }
+    let mut hasher = Sha256::new();
+    let mut length = 0_u64;
+    let mut buffer = [0_u8; 64 * 1024];
+    loop {
+        if cancellation.is_cancelled() {
+            return Err(report(
+                ReleaseError::Cancelled,
+                "gh input snapshot cancelled",
+            ));
+        }
+        if Instant::now() >= deadline.instant() {
+            return Err(report(
+                ReleaseError::Timeout,
+                "gh input snapshot exceeded deadline",
+            ));
+        }
+        let read = input
+            .read(&mut buffer)
+            .map_err(|error| report(ReleaseError::Asset, error))?;
+        if read == 0 {
+            break;
+        }
+        length += read as u64;
+        if length > limit {
+            return Err(report(
+                ReleaseError::Asset,
+                "gh input exceeds its role limit",
+            ));
+        }
+        let chunk = &buffer[..read];
+        hasher.update(chunk);
+        if let Some(output) = destination.as_deref_mut() {
+            output
+                .write_all(chunk)
+                .map_err(|error| report(ReleaseError::Asset, error))?;
+        }
+    }
+    Ok(AssetMeasurement::declared(
+        &hex::encode(hasher.finalize()),
+        length,
+    ))
+}
+
+/// Copies a bounded file into an attempt-private directory and measures it.
+///
+/// # Errors
+///
+/// Returns an asset, cancellation or timeout error for failed snapshots.
+pub(super) fn snapshot(
+    path: &Path,
+    directory: &Path,
+    limit: u64,
+    deadline: AttemptDeadline,
+    cancellation: &Cancellation,
+) -> Result<(PathBuf, AssetMeasurement), Report<ReleaseError>> {
+    let name = path
+        .file_name()
+        .ok_or_else(|| report(ReleaseError::Asset, "gh input has no file name"))?;
+    let private = directory.join(name);
+    let mut output =
+        File::create_new(&private).map_err(|error| report(ReleaseError::Asset, error))?;
+    let measurement = checked_transfer(path, Some(&mut output), limit, deadline, cancellation)?;
+    Ok((private, measurement))
+}
+
+/// Requires the current file to match its pre-invocation snapshot.
+///
+/// # Errors
+///
+/// Returns an asset error if a substitution or read failure occurs.
+pub(super) fn unchanged(
+    path: &Path,
+    expected: &AssetMeasurement,
+    limit: u64,
+    deadline: AttemptDeadline,
+    cancellation: &Cancellation,
+) -> Result<(), Report<ReleaseError>> {
+    if &checked_transfer(path, None, limit, deadline, cancellation)? != expected {
+        return Err(report(
+            ReleaseError::Asset,
+            "gh input changed during verification",
+        ));
+    }
+    Ok(())
+}
diff --git a/crates/trusted-server-cli/src/release/github.rs b/crates/trusted-server-cli/src/release/github.rs
new file mode 100644
index 0000000000..ddd844a86c
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/github.rs
@@ -0,0 +1,477 @@
+//! R-PUBLICATION: official GitHub release, tag and release-statement checks.
+//!
+//! Requests go only to fixed official REST paths on the fixed API host with
+//! an explicit read-only credential, no redirects and bounded bodies. The
+//! checks themselves are pure functions over the fetched JSON so they are
+//! exercised without network access.
+//!
+//! Field names were confirmed from the pinned gh 2.97.0 REST models:
+//! release `tag_name`/`draft`/`prerelease`/`immutable`/`assets[].name`/
+//! `size`/`digest`/`state` in
+//! <https://github.com/cli/cli/blob/v2.97.0/pkg/cmd/release/shared/fetch.go>,
+//! the tag ref `object.sha` in the same file (`object.type` is from the
+//! GitHub git refs REST documentation), and the release attestation `tag`
+//! predicate field and release-ref subject in
+//! <https://github.com/cli/cli/blob/v2.97.0/pkg/cmd/release/shared/attestation.go>
+//! and <https://github.com/cli/cli/blob/v2.97.0/pkg/cmd/release/verify/verify.go>.
+
+use std::collections::BTreeMap;
+
+use error_stack::Report;
+use reqwest::header::{ACCEPT, AUTHORIZATION, HeaderName, HeaderValue, USER_AGENT};
+use reqwest::{Client, Method, Request, StatusCode};
+use serde_json::{Map, Value};
+use url::Url;
+
+use super::artifact::AssetMeasurement;
+use super::bounds::{self, AttemptDeadline};
+use super::documents::{ReleaseTag, Role, lower_hex, parse_json};
+use super::environment::GithubToken;
+use super::error::{ReleaseError, report};
+use super::evidence::{BuildEvidenceVerified, INDEX_NAME};
+use super::gh::{VerificationMode, VerifiedReleaseStatement};
+use super::source_policy::BoundedBody;
+
+/// Fixed official repository REST root; only the tag varies below it.
+pub(crate) const API_REPOSITORY: &str = "https://api.github.com/repos/IABTechLab/trusted-server"; // allow-domain: api.github.com
+/// Certificate SAN of GitHub's release attestation signer, enforced by gh.
+const RELEASE_SIGNER: &str = "https://dotcom.releases.github.com"; // allow-domain: dotcom.releases.github.com
+/// Name of the external index provenance bundle.
+pub(crate) const INDEX_BUNDLE_NAME: &str = "release-index.provenance.sigstore.json";
+/// Name of the convenience checksum list.
+pub(crate) const CHECKSUMS_NAME: &str = "SHA256SUMS";
+const JSON_MEDIA_TYPE: &str = "application/vnd.github+json";
+const API_VERSION: &str = "2022-11-28";
+
+fn publication_error(message: impl std::fmt::Display) -> Report<ReleaseError> {
+    report(ReleaseError::Publication, message)
+}
+
+fn rest_request(path: &str, token: &GithubToken) -> Result<Request, Report<ReleaseError>> {
+    let url = Url::parse(&format!("{API_REPOSITORY}/{path}"))
+        .map_err(|source| report(ReleaseError::Publication, source))?;
+    let mut request = Request::new(Method::GET, url);
+    let mut authorization = HeaderValue::from_str(&format!("Bearer {}", token.expose()))
+        .map_err(|_| publication_error("GitHub token is not a valid header value"))?;
+    authorization.set_sensitive(true);
+    let headers = request.headers_mut();
+    headers.insert(ACCEPT, HeaderValue::from_static(JSON_MEDIA_TYPE));
+    headers.insert(
+        HeaderName::from_static("x-github-api-version"),
+        HeaderValue::from_static(API_VERSION),
+    );
+    headers.insert(USER_AGENT, HeaderValue::from_static("trusted-server-cli"));
+    headers.insert(AUTHORIZATION, authorization);
+    Ok(request)
+}
+
+/// Builds the fixed release-by-tag request.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Publication`] if the request cannot be encoded.
+pub(crate) fn release_request(
+    tag: &ReleaseTag,
+    token: &GithubToken,
+) -> Result<Request, Report<ReleaseError>> {
+    rest_request(&format!("releases/tags/{}", tag.as_str()), token)
+}
+
+/// Builds the fixed lightweight tag ref request.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Publication`] if the request cannot be encoded.
+pub(crate) fn tag_ref_request(
+    tag: &ReleaseTag,
+    token: &GithubToken,
+) -> Result<Request, Report<ReleaseError>> {
+    rest_request(&format!("git/ref/tags/{}", tag.as_str()), token)
+}
+
+/// Executes a fixed REST request and strictly parses its bounded JSON body.
+///
+/// The client must not follow redirects (see
+/// [`super::source_policy::policy_client`]); any 3xx, non-200 status, final
+/// URL change or body over 1 MiB fails.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Publication`] for transport, status, origin or
+/// size failures and [`ReleaseError::Timeout`] after the attempt deadline.
+pub(crate) async fn fetch_json(
+    client: &Client,
+    request: Request,
+    token: &GithubToken,
+    deadline: AttemptDeadline,
+) -> Result<Value, Report<ReleaseError>> {
+    let request_url = request.url().clone();
+    let fetch = async {
+        let mut response = client
+            .execute(request)
+            .await
+            .map_err(|error| publication_error(token.redact(&error.to_string())))?;
+        if response.status() != StatusCode::OK || response.url() != &request_url {
+            return Err(publication_error(format!(
+                "official REST endpoint returned {} (redirects are rejected)",
+                response.status()
+            )));
+        }
+        let mut body = BoundedBody::new(bounds::METADATA_BYTES);
+        while let Some(chunk) = response
+            .chunk()
+            .await
+            .map_err(|error| publication_error(token.redact(&error.to_string())))?
+        {
+            body.push(&chunk).map_err(|error| {
+                error
+                    .change_context(ReleaseError::Publication)
+                    .attach("REST response exceeds 1 MiB")
+            })?;
+        }
+        parse_json(&body.into_bytes(), Role::Metadata)
+    };
+    tokio::time::timeout_at(tokio::time::Instant::from_std(deadline.instant()), fetch)
+        .await
+        .map_err(|_| report(ReleaseError::Timeout, "REST request exceeded the deadline"))?
+}
+
+/// Every asset the official release must contain, with exact length and
+/// SHA-256.
+fn expected_assets(
+    build: &BuildEvidenceVerified,
+    index_bundle: &AssetMeasurement,
+    checksums: &AssetMeasurement,
+) -> BTreeMap<String, AssetMeasurement> {
+    let index = build.index();
+    let mut assets = BTreeMap::new();
+    let mut add = |name: &str, size: u64, sha256: &str| {
+        assets.insert(name.to_owned(), AssetMeasurement::declared(sha256, size));
+    };
+    add(
+        &index.tsjs_inventory.name,
+        index.tsjs_inventory.size,
+        &index.tsjs_inventory.sha256,
+    );
+    for artifact in &index.artifacts {
+        add(&artifact.name, artifact.size, &artifact.sha256);
+        let companions = &artifact.companions;
+        for record in [
+            &companions.sbom,
+            &companions.provenance,
+            &companions.sbom_attestation,
+            &companions.build_evidence,
+            &companions.build_recipe,
+            &companions.rebuild_check,
+        ] {
+            add(&record.name, record.size, &record.sha256);
+        }
+    }
+    let measured = [
+        (INDEX_NAME, build.index_measurement()),
+        (INDEX_BUNDLE_NAME, index_bundle),
+        (CHECKSUMS_NAME, checksums),
+    ];
+    for (name, measurement) in measured {
+        add(name, measurement.length(), measurement.sha256());
+    }
+    assets
+}
+
+fn is_prerelease(tag: &ReleaseTag) -> bool {
+    let version = tag.as_str().split('+').next().unwrap_or_default();
+    version.contains('-')
+}
+
+/// Checks the release-by-tag REST object against the expected asset set.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Publication`] unless the release is the published,
+/// immutable release of `tag` with a prerelease flag matching the tag and
+/// exactly the expected assets, each uploaded with the expected REST size
+/// (and digest, when GitHub reports one).
+pub(crate) fn check_release(
+    release: &Value,
+    tag: &ReleaseTag,
+    expected: &BTreeMap<String, AssetMeasurement>,
+) -> Result<(), Report<ReleaseError>> {
+    if release.get("tag_name").and_then(Value::as_str) != Some(tag.as_str()) {
+        return Err(publication_error("REST release is for another tag"));
+    }
+    if release.get("draft") != Some(&Value::Bool(false)) {
+        return Err(publication_error("release is a draft, not published"));
+    }
+    if release.get("prerelease") != Some(&Value::Bool(is_prerelease(tag))) {
+        return Err(publication_error(
+            "release prerelease flag does not match the tag",
+        ));
+    }
+    if release.get("immutable") != Some(&Value::Bool(true)) {
+        return Err(publication_error("release is not immutable"));
+    }
+    let listed = release_assets(release)?;
+    if listed.len() != expected.len() || listed.keys().ne(expected.keys()) {
+        return Err(publication_error(
+            "release assets are not exactly the signed release asset set",
+        ));
+    }
+    for (name, (size, digest)) in &listed {
+        let wanted = expected
+            .get(*name)
+            .ok_or_else(|| publication_error(format!("unexpected release asset `{name}`")))?;
+        if *size != wanted.length() {
+            return Err(publication_error(format!(
+                "REST size of `{name}` differs from the signed and actual length"
+            )));
+        }
+        if digest.is_some_and(|digest| digest != format!("sha256:{}", wanted.sha256())) {
+            return Err(publication_error(format!(
+                "REST digest of `{name}` differs from the signed digest"
+            )));
+        }
+    }
+    Ok(())
+}
+
+type ListedAssets<'a> = BTreeMap<&'a str, (u64, Option<&'a str>)>;
+
+fn release_assets(release: &Value) -> Result<ListedAssets<'_>, Report<ReleaseError>> {
+    let assets = release
+        .get("assets")
+        .and_then(Value::as_array)
+        .ok_or_else(|| publication_error("REST release has no asset list"))?;
+    let mut listed = BTreeMap::new();
+    for asset in assets {
+        let name = asset.get("name").and_then(Value::as_str);
+        let size = asset.get("size").and_then(Value::as_u64);
+        let (Some(name), Some(size)) = (name, size) else {
+            return Err(publication_error("REST asset lacks a name or size"));
+        };
+        if asset.get("state").and_then(Value::as_str) != Some("uploaded") {
+            return Err(publication_error(format!(
+                "release asset `{name}` is not fully uploaded"
+            )));
+        }
+        let digest = asset.get("digest").and_then(Value::as_str);
+        if listed.insert(name, (size, digest)).is_some() {
+            return Err(publication_error(format!(
+                "release lists asset `{name}` twice"
+            )));
+        }
+    }
+    Ok(listed)
+}
+
+/// Checks that the tag is lightweight and targets the approved commit.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Publication`] for another ref, an annotated tag
+/// object or another commit.
+pub(crate) fn check_tag_ref(
+    tag_ref: &Value,
+    tag: &ReleaseTag,
+    commit: &str,
+) -> Result<(), Report<ReleaseError>> {
+    if tag_ref.get("ref").and_then(Value::as_str) != Some(&format!("refs/tags/{}", tag.as_str())) {
+        return Err(publication_error("REST ref is not the release tag"));
+    }
+    let object = tag_ref.get("object");
+    if object
+        .and_then(|object| object.get("type"))
+        .and_then(Value::as_str)
+        != Some("commit")
+    {
+        return Err(publication_error(
+            "release tag must be lightweight; annotated tag objects are rejected",
+        ));
+    }
+    if object
+        .and_then(|object| object.get("sha"))
+        .and_then(Value::as_str)
+        != Some(commit)
+    {
+        return Err(publication_error(
+            "release tag does not target the approved commit",
+        ));
+    }
+    Ok(())
+}
+
+/// Checks the verified GitHub release attestation (`gh release verify
+/// --format json`) binds the tag, approved commit and every asset digest.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Publication`] for another signer, tag or commit,
+/// or signed asset names/digests that differ from the expected set.
+pub(crate) fn check_release_statement(
+    verified: &Value,
+    tag: &ReleaseTag,
+    commit: &str,
+    expected: &BTreeMap<String, AssetMeasurement>,
+) -> Result<(), Report<ReleaseError>> {
+    let result = verified.get("verificationResult");
+    let field = |path: &[&str]| {
+        path.iter()
+            .try_fold(result?, |value, key| value.get(key))
+            .and_then(Value::as_str)
+    };
+    if field(&["mediaType"])
+        != Some("application/vnd.dev.sigstore.verificationresult+json;version=0.1")
+        || field(&["statement", "_type"]) != Some("https://in-toto.io/Statement/v1")
+        || field(&["statement", "predicateType"])
+            != Some("https://in-toto.io/attestation/release/v0.1")
+    {
+        return Err(publication_error(
+            "unsupported verified release statement type",
+        ));
+    }
+    let purl = format!("pkg:github/{}@{}", super::policy::REPOSITORY, tag.as_str());
+    for (key, wanted) in [
+        ("repository", super::policy::REPOSITORY),
+        ("repositoryId", super::policy::REPOSITORY_ID),
+        ("ownerId", super::policy::REPOSITORY_OWNER_ID),
+        ("purl", purl.as_str()),
+    ] {
+        if field(&["statement", "predicate", key]) != Some(wanted) {
+            return Err(publication_error(format!(
+                "signed release `{key}` differs from the official repository"
+            )));
+        }
+    }
+    if field(&["signature", "certificate", "subjectAlternativeName"]) != Some(RELEASE_SIGNER) {
+        return Err(publication_error("release statement has another signer"));
+    }
+    if field(&["statement", "predicate", "tag"]) != Some(tag.as_str()) {
+        return Err(publication_error("release statement names another tag"));
+    }
+    let subjects = result
+        .and_then(|result| result.get("statement"))
+        .and_then(|statement| statement.get("subject"))
+        .and_then(Value::as_array)
+        .ok_or_else(|| publication_error("release statement has no subjects"))?;
+    let (named, commits) = release_subjects(subjects, &purl)?;
+    if commits != [commit] {
+        return Err(publication_error(
+            "release statement does not bind exactly the approved commit",
+        ));
+    }
+    let wanted: BTreeMap<&str, &str> = expected
+        .iter()
+        .map(|(name, measurement)| (name.as_str(), measurement.sha256()))
+        .collect();
+    if named != wanted {
+        return Err(publication_error(
+            "signed release asset names or digests differ from the verified assets",
+        ));
+    }
+    Ok(())
+}
+
+type ReleaseSubjects<'a> = (BTreeMap<&'a str, &'a str>, Vec<&'a str>);
+
+fn release_subjects<'a>(
+    subjects: &'a [Value],
+    purl: &str,
+) -> Result<ReleaseSubjects<'a>, Report<ReleaseError>> {
+    let mut named = BTreeMap::new();
+    let mut commits = Vec::new();
+    for subject in subjects {
+        let digest = subject.get("digest").and_then(Value::as_object);
+        let name = subject
+            .get("name")
+            .and_then(Value::as_str)
+            .unwrap_or_default();
+        if name.is_empty() {
+            if subject.as_object().map(Map::len) != Some(2)
+                || subject.get("uri").and_then(Value::as_str) != Some(purl)
+                || digest.map(Map::len) != Some(1)
+            {
+                return Err(publication_error(
+                    "release commit subject must have exactly the official URI and SHA-1",
+                ));
+            }
+            let sha1 = digest
+                .and_then(|digest| digest.get("sha1"))
+                .and_then(Value::as_str);
+            commits.push(sha1.unwrap_or_default());
+            continue;
+        }
+        if subject.as_object().map(Map::len) != Some(2) {
+            return Err(publication_error(
+                "release asset subject must have exactly name and digest",
+            ));
+        }
+        let sha256 = digest
+            .filter(|digest| digest.len() == 1)
+            .and_then(|digest| digest.get("sha256"))
+            .and_then(Value::as_str)
+            .filter(|sha256| lower_hex(sha256, 64))
+            .ok_or_else(|| publication_error("signed release asset lacks one SHA-256"))?;
+        if named.insert(name, sha256).is_some() {
+            return Err(publication_error(format!(
+                "release statement names `{name}` twice"
+            )));
+        }
+    }
+    Ok((named, commits))
+}
+
+/// Fetched official publication data and release-wide asset measurements.
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct PublicationInputs<'a> {
+    pub(crate) release: &'a Value,
+    pub(crate) tag_ref: &'a Value,
+    pub(crate) release_statement: &'a VerifiedReleaseStatement,
+    pub(crate) index_bundle: &'a AssetMeasurement,
+    pub(crate) checksums: &'a AssetMeasurement,
+}
+
+/// Build evidence that is also the official immutable publication.
+///
+/// Only [`verify_publication`] constructs it.
+#[derive(Debug)]
+pub(crate) struct PublicationVerified {
+    build: BuildEvidenceVerified,
+}
+
+impl PublicationVerified {
+    /// Returns the verified build evidence.
+    pub(crate) fn build(&self) -> &BuildEvidenceVerified {
+        &self.build
+    }
+}
+
+/// Verifies the official immutable publication of verified build evidence.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Publication`] if the tag is annotated or targets
+/// another commit, the release is not the immutable published release with
+/// exactly the expected assets and REST lengths, or the release statement
+/// does not bind every asset name and digest.
+pub(crate) fn verify_publication(
+    build: BuildEvidenceVerified,
+    inputs: &PublicationInputs<'_>,
+) -> Result<PublicationVerified, Report<ReleaseError>> {
+    if build.mode() != VerificationMode::Online {
+        return Err(publication_error(
+            "offline build evidence cannot become official publication evidence",
+        ));
+    }
+    let tag = build.release().tag().clone();
+    let commit = build.release().commit().as_str().to_owned();
+    check_tag_ref(inputs.tag_ref, &tag, &commit)?;
+    let expected = expected_assets(&build, inputs.index_bundle, inputs.checksums);
+    check_release(inputs.release, &tag, &expected)?;
+    if inputs.index_bundle != build.index_bundle() {
+        return Err(publication_error(
+            "published index bundle differs from the verified bundle",
+        ));
+    }
+    let statement = inputs.release_statement.for_release(build.release())?;
+    check_release_statement(statement, &tag, &commit, &expected)?;
+    Ok(PublicationVerified { build })
+}
diff --git a/crates/trusted-server-cli/src/release/mod.rs b/crates/trusted-server-cli/src/release/mod.rs
new file mode 100644
index 0000000000..8e66f491f5
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/mod.rs
@@ -0,0 +1,26 @@
+//! Consumer-side verification of attested Trusted Server releases.
+//!
+//! Everything here is private to the CLI. The embedded consumer policy and the
+//! compiled constants in [`policy`] are the only verifier authority; downloaded
+//! release metadata, operator configuration and forwarded gh flags never
+//! redefine them.
+
+mod artifact;
+mod bounds;
+mod documents;
+mod environment;
+mod error;
+mod evidence;
+mod gh;
+mod github;
+mod policy;
+mod process;
+mod source_policy;
+
+#[cfg(test)]
+mod tests;
+
+mod offline;
+mod online;
+
+pub(crate) use online::verify;
diff --git a/crates/trusted-server-cli/src/release/offline.rs b/crates/trusted-server-cli/src/release/offline.rs
new file mode 100644
index 0000000000..826fa1db56
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/offline.rs
@@ -0,0 +1,191 @@
+//! Private build-evidence-only verification of securely transferred inputs.
+//!
+//! The caller supplies independently approved source, artifact and root pins.
+//! No publication proof, report or deployment authorization is produced.
+
+use std::fs::{File, OpenOptions};
+use std::io::Read as _;
+use std::os::unix::fs::OpenOptionsExt as _;
+use std::path::Path;
+use std::time::Instant;
+
+use error_stack::Report;
+use serde_json::Value;
+
+use super::artifact::{AssetRole, RetainedAsset, RetainedDownload};
+use super::bounds::{AttemptDeadline, Cancellation, ProcessBounds};
+use super::documents::{ApprovedRelease, lower_hex, safe_name};
+use super::environment::CallerEnvironment;
+use super::error::{ReleaseError, report};
+use super::evidence::BuildEvidenceVerified;
+use super::gh::{GhLocation, GhRunner};
+use super::online::{Transport, build_with};
+use super::source_policy::{ApprovedSourcePolicy, ApprovedSourceRoot, read_approved_snapshot};
+
+/// Independent trust inputs, transferred separately from untrusted evidence.
+pub(super) struct OfflineApproval<'a> {
+    pub(super) release: &'a ApprovedRelease,
+    pub(super) source: &'a ApprovedSourceRoot,
+    pub(super) asset: &'a str,
+    pub(super) artifact_sha256: &'a str,
+    pub(super) roots: &'a Path,
+    pub(super) roots_sha256: &'a str,
+    pub(super) gh: &'a Path,
+}
+
+/// Offline evidence deliberately hides its build proof from publication APIs.
+pub(super) struct OfflineBuildEvidence {
+    _build: BuildEvidenceVerified,
+    _asset: RetainedAsset,
+}
+
+struct LocalTransport<'a> {
+    directory: &'a Path,
+    source: &'a ApprovedSourceRoot,
+    cancellation: &'a Cancellation,
+}
+
+fn regular_file(path: &Path) -> Result<File, Report<ReleaseError>> {
+    let file = OpenOptions::new()
+        .read(true)
+        .custom_flags(libc::O_NOFOLLOW | libc::O_NONBLOCK)
+        .open(path)
+        .map_err(|error| report(ReleaseError::Asset, error))?;
+    if !file
+        .metadata()
+        .map_err(|error| report(ReleaseError::Asset, error))?
+        .is_file()
+    {
+        return Err(report(
+            ReleaseError::Asset,
+            "offline input must be a regular file",
+        ));
+    }
+    Ok(file)
+}
+
+impl Transport for LocalTransport<'_> {
+    async fn policy(
+        &self,
+        deadline: AttemptDeadline,
+        cancellation: &Cancellation,
+    ) -> Result<ApprovedSourcePolicy, Report<ReleaseError>> {
+        super::artifact::check_attempt(deadline, cancellation)?;
+        read_approved_snapshot(self.source)
+    }
+
+    async fn asset(
+        &self,
+        name: &str,
+        role: AssetRole,
+        deadline: AttemptDeadline,
+        cancellation: &Cancellation,
+    ) -> Result<RetainedAsset, Report<ReleaseError>> {
+        super::artifact::check_attempt(deadline, cancellation)?;
+        if !safe_name(name) {
+            return Err(report(ReleaseError::Asset, "unsafe offline input name"));
+        }
+        let mut file = regular_file(&self.directory.join(name))?;
+        let mut retained = RetainedDownload::start(name, role)?;
+        let mut buffer = [0_u8; 64 * 1024];
+        loop {
+            if self.cancellation.is_cancelled() {
+                return Err(report(ReleaseError::Cancelled, "offline input cancelled"));
+            }
+            if Instant::now() >= deadline.instant() {
+                return Err(report(
+                    ReleaseError::Timeout,
+                    "offline input deadline elapsed",
+                ));
+            }
+            let read = file
+                .read(&mut buffer)
+                .map_err(|error| report(ReleaseError::Asset, error))?;
+            if read == 0 {
+                return retained.finish();
+            }
+            retained.push(&buffer[..read])?;
+        }
+    }
+
+    async fn publication(
+        &self,
+        _tag_ref: bool,
+        deadline: AttemptDeadline,
+        cancellation: &Cancellation,
+    ) -> Result<Value, Report<ReleaseError>> {
+        super::artifact::check_attempt(deadline, cancellation)?;
+        Err(report(
+            ReleaseError::Publication,
+            "offline verification cannot acquire publication evidence",
+        ))
+    }
+}
+
+/// Verifies local build evidence with independently pinned source, roots and bytes.
+///
+/// The caller must enforce OS network denial during this operation. The gh
+/// invocation uses local bundles and custom roots, with no token or cache.
+///
+/// # Errors
+///
+/// Rejects any changed trust input, artifact pin or evidence graph edge.
+pub(super) async fn verify_build(
+    approval: &OfflineApproval<'_>,
+    evidence_directory: &Path,
+    caller: &CallerEnvironment,
+    deadline: AttemptDeadline,
+    cancellation: &Cancellation,
+) -> Result<OfflineBuildEvidence, Report<ReleaseError>> {
+    if !lower_hex(approval.artifact_sha256, 64)
+        || approval.source.commit() != approval.release.commit()
+    {
+        return Err(report(
+            ReleaseError::Policy,
+            "offline source and artifact pins must be independently approved",
+        ));
+    }
+    if super::policy::embedded_policy()?
+        .artifact(approval.asset)
+        .is_none()
+    {
+        return Err(report(
+            ReleaseError::Policy,
+            "offline asset is outside the embedded cohort",
+        ));
+    }
+    let runner = GhRunner::resolve_offline(
+        GhLocation::Explicit(approval.gh),
+        caller,
+        ProcessBounds::production(),
+        deadline,
+        cancellation,
+        approval.roots,
+        approval.roots_sha256,
+    )?;
+    let transport = LocalTransport {
+        directory: evidence_directory,
+        source: approval.source,
+        cancellation,
+    };
+    let built = build_with(
+        &transport,
+        &runner,
+        approval.release,
+        approval.asset,
+        deadline,
+        cancellation,
+    )
+    .await?;
+    if built.executable.measurement().sha256() != approval.artifact_sha256 {
+        return Err(report(
+            ReleaseError::Evidence,
+            "offline executable differs from independently approved digest",
+        ));
+    }
+    super::artifact::check_attempt(deadline, cancellation)?;
+    Ok(OfflineBuildEvidence {
+        _build: built.build,
+        _asset: built.executable,
+    })
+}
diff --git a/crates/trusted-server-cli/src/release/online.rs b/crates/trusted-server-cli/src/release/online.rs
new file mode 100644
index 0000000000..d34b4e1e4f
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/online.rs
@@ -0,0 +1,554 @@
+//! Fixed-origin online orchestration of the private consumer verifier.
+
+use std::future::Future;
+
+use error_stack::Report;
+use reqwest::{Client, StatusCode};
+use serde_json::Value;
+use url::Url;
+
+use super::artifact::{
+    AssetRole, RetainedAsset, RetainedDownload, VerificationReport, VerifiedReleaseAsset,
+    stream_into,
+};
+use super::bounds::{AttemptDeadline, Cancellation, ProcessBounds};
+use super::documents::{ApprovedCommit, ApprovedRelease, ReleaseTag, safe_name};
+use super::environment::{CallerEnvironment, GithubToken};
+use super::error::{ReleaseError, report};
+use super::evidence::{
+    BuildEvidenceVerified, ConsumedArtifact, EvidenceInputs, INDEX_NAME, verify_build_evidence,
+    verify_index,
+};
+use super::gh::{GhLocation, GhRunner, PredicateKind};
+use super::github::{self, PublicationInputs};
+use super::policy::embedded_policy;
+use super::source_policy::{self, ApprovedSourcePolicy};
+
+/// Validates all public inputs before any environment or network access.
+pub(super) fn validate_request(
+    tag: &str,
+    asset: &str,
+    commit: &str,
+) -> Result<ApprovedRelease, Report<ReleaseError>> {
+    let tag = ReleaseTag::parse(tag)?;
+    let commit = ApprovedCommit::parse(commit)?;
+    if embedded_policy()?.artifact(asset).is_none() {
+        return Err(report(
+            ReleaseError::Policy,
+            "asset is outside the embedded release cohort",
+        ));
+    }
+    Ok(ApprovedRelease::new(tag, commit))
+}
+
+/// Constructs only canonical public release URLs; no credential is attached.
+pub(super) fn approved_asset_url(
+    release: &ApprovedRelease,
+    name: &str,
+) -> Result<Url, Report<ReleaseError>> {
+    if !safe_name(name) {
+        return Err(report(ReleaseError::Asset, "release asset name is unsafe"));
+    }
+    Url::parse(&format!(
+        "https://github.com/{}/releases/download/{}/{name}",
+        super::policy::REPOSITORY,
+        release.tag().as_str()
+    ))
+    .map_err(|_| report(ReleaseError::Asset, "cannot encode official asset URL"))
+}
+
+/// Exact CDN listed by GitHub's runner networking reference under release assets.
+///
+/// <https://docs.github.com/en/actions/reference/runners/github-hosted-runners>
+pub(super) fn allowed_redirect(url: &Url) -> bool {
+    url.scheme() == "https"
+        && url.host_str() == Some("release-assets.githubusercontent.com")
+        && url.port_or_known_default() == Some(443)
+        && url.username().is_empty()
+        && url.password().is_none()
+        && url.fragment().is_none()
+}
+
+/// Internal transport seam; public dispatch always constructs [`OfficialTransport`].
+pub(super) trait Transport {
+    async fn policy(
+        &self,
+        deadline: AttemptDeadline,
+        cancellation: &Cancellation,
+    ) -> Result<ApprovedSourcePolicy, Report<ReleaseError>>;
+    async fn asset(
+        &self,
+        name: &str,
+        role: AssetRole,
+        deadline: AttemptDeadline,
+        cancellation: &Cancellation,
+    ) -> Result<RetainedAsset, Report<ReleaseError>>;
+    async fn publication(
+        &self,
+        tag_ref: bool,
+        deadline: AttemptDeadline,
+        cancellation: &Cancellation,
+    ) -> Result<Value, Report<ReleaseError>>;
+}
+
+/// Interrupts a pending HTTP send or body read when its attempt is cancelled.
+pub(super) async fn cancellable<T>(
+    future: impl Future<Output = Result<T, Report<ReleaseError>>>,
+    cancellation: &Cancellation,
+) -> Result<T, Report<ReleaseError>> {
+    tokio::select! {
+        biased;
+        () = cancellation.cancelled() => Err(report(ReleaseError::Cancelled, "release HTTP operation cancelled")),
+        result = future => result,
+    }
+}
+
+struct OfficialTransport<'a> {
+    client: Client,
+    release: &'a ApprovedRelease,
+    token: GithubToken,
+}
+
+impl Transport for OfficialTransport<'_> {
+    async fn policy(
+        &self,
+        deadline: AttemptDeadline,
+        cancellation: &Cancellation,
+    ) -> Result<ApprovedSourcePolicy, Report<ReleaseError>> {
+        super::artifact::check_attempt(deadline, cancellation)?;
+        cancellable(
+            source_policy::fetch_approved_policy(
+                &self.client,
+                self.release.commit(),
+                &self.token,
+                deadline,
+            ),
+            cancellation,
+        )
+        .await
+    }
+
+    async fn asset(
+        &self,
+        name: &str,
+        role: AssetRole,
+        deadline: AttemptDeadline,
+        cancellation: &Cancellation,
+    ) -> Result<RetainedAsset, Report<ReleaseError>> {
+        super::artifact::check_attempt(deadline, cancellation)?;
+        let transfer = async {
+            let mut url = approved_asset_url(self.release, name)?;
+            for hop in 0..=3 {
+                // No bearer, cookies, referrer or caller-controlled headers on public downloads.
+                let response = self
+                    .client
+                    .get(url.clone())
+                    .header(reqwest::header::USER_AGENT, "trusted-server-cli")
+                    .send()
+                    .await
+                    .map_err(|_| report(ReleaseError::Asset, "official asset request failed"))?;
+                if response.url() != &url {
+                    return Err(report(
+                        ReleaseError::Asset,
+                        "asset client followed an unexpected redirect",
+                    ));
+                }
+                if response.status().is_redirection() && hop < 3 {
+                    let location = response
+                        .headers()
+                        .get(reqwest::header::LOCATION)
+                        .and_then(|value| value.to_str().ok())
+                        .ok_or_else(|| {
+                            report(ReleaseError::Asset, "asset redirect has no valid location")
+                        })?;
+                    let next = url
+                        .join(location)
+                        .map_err(|_| report(ReleaseError::Asset, "invalid asset redirect"))?;
+                    if !allowed_redirect(&next) {
+                        return Err(report(
+                            ReleaseError::Asset,
+                            "asset redirect is outside the approved HTTPS host",
+                        ));
+                    }
+                    url = next;
+                    continue;
+                }
+                if response.status() != StatusCode::OK {
+                    return Err(report(
+                        ReleaseError::Asset,
+                        "official asset request did not return 200",
+                    ));
+                }
+                return stream_into(response, RetainedDownload::start(name, role)?, deadline).await;
+            }
+            Err(report(ReleaseError::Asset, "asset redirect limit exceeded"))
+        };
+        cancellable(
+            async {
+                tokio::time::timeout_at(
+                    tokio::time::Instant::from_std(deadline.instant()),
+                    transfer,
+                )
+                .await
+                .map_err(|_| {
+                    report(
+                        ReleaseError::Timeout,
+                        "asset request exceeded attempt deadline",
+                    )
+                })?
+            },
+            cancellation,
+        )
+        .await
+    }
+
+    async fn publication(
+        &self,
+        tag_ref: bool,
+        deadline: AttemptDeadline,
+        cancellation: &Cancellation,
+    ) -> Result<Value, Report<ReleaseError>> {
+        super::artifact::check_attempt(deadline, cancellation)?;
+        let request = if tag_ref {
+            github::tag_ref_request(self.release.tag(), &self.token)?
+        } else {
+            github::release_request(self.release.tag(), &self.token)?
+        };
+        cancellable(
+            github::fetch_json(&self.client, request, &self.token, deadline),
+            cancellation,
+        )
+        .await
+    }
+}
+
+/// Runs actual downloads, proofs and joins; returns only a read-only report.
+pub(super) async fn build_with(
+    transport: &impl Transport,
+    runner: &GhRunner,
+    request: &ApprovedRelease,
+    asset_name: &str,
+    deadline: AttemptDeadline,
+    cancellation: &Cancellation,
+) -> Result<BuildResult, Report<ReleaseError>> {
+    let policy = embedded_policy()?;
+    let source_policy = transport.policy(deadline, cancellation).await?;
+    let mut index = transport
+        .asset(INDEX_NAME, AssetRole::Metadata, deadline, cancellation)
+        .await?;
+    let mut index_bundle = transport
+        .asset(
+            github::INDEX_BUNDLE_NAME,
+            AssetRole::Companion,
+            deadline,
+            cancellation,
+        )
+        .await?;
+    let private = tempfile::Builder::new()
+        .prefix("ts-release-inputs-")
+        .tempdir()
+        .map_err(|error| report(ReleaseError::Asset, error))?;
+    let index_path = index.materialize(private.path(), deadline, cancellation)?;
+    let index_bundle_path = index_bundle.materialize(private.path(), deadline, cancellation)?;
+    let index_proof = runner.verify_attestation(
+        &index_path,
+        &index_bundle_path,
+        request,
+        PredicateKind::Provenance,
+        deadline,
+        cancellation,
+    )?;
+    let index_bytes = index.document_bytes()?;
+    let parsed = verify_index(
+        request,
+        &policy,
+        &source_policy,
+        &index_bytes,
+        &index_proof,
+        index_bundle.measurement(),
+    )?;
+    let selected = parsed
+        .artifacts
+        .iter()
+        .find(|artifact| artifact.name == asset_name)
+        .ok_or_else(|| {
+            report(
+                ReleaseError::Policy,
+                "selected asset is absent from signed index",
+            )
+        })?;
+    let mut executable = transport
+        .asset(asset_name, AssetRole::Executable, deadline, cancellation)
+        .await?;
+    let companions = &selected.companions;
+    let mut provenance = transport
+        .asset(
+            &companions.provenance.name,
+            AssetRole::Companion,
+            deadline,
+            cancellation,
+        )
+        .await?;
+    let mut sbom_bundle = transport
+        .asset(
+            &companions.sbom_attestation.name,
+            AssetRole::Companion,
+            deadline,
+            cancellation,
+        )
+        .await?;
+    let mut spdx = transport
+        .asset(
+            &companions.sbom.name,
+            AssetRole::Spdx,
+            deadline,
+            cancellation,
+        )
+        .await?;
+    let mut build_evidence = transport
+        .asset(
+            &companions.build_evidence.name,
+            AssetRole::Companion,
+            deadline,
+            cancellation,
+        )
+        .await?;
+    let mut build_recipe = transport
+        .asset(
+            &companions.build_recipe.name,
+            AssetRole::Companion,
+            deadline,
+            cancellation,
+        )
+        .await?;
+    let mut rebuild_check = transport
+        .asset(
+            &companions.rebuild_check.name,
+            AssetRole::Companion,
+            deadline,
+            cancellation,
+        )
+        .await?;
+    let mut inventory = transport
+        .asset(
+            &parsed.tsjs_inventory.name,
+            AssetRole::Metadata,
+            deadline,
+            cancellation,
+        )
+        .await?;
+    for (record, retained) in [
+        (&companions.provenance, &provenance),
+        (&companions.sbom_attestation, &sbom_bundle),
+        (&companions.sbom, &spdx),
+        (&companions.build_evidence, &build_evidence),
+        (&companions.build_recipe, &build_recipe),
+        (&companions.rebuild_check, &rebuild_check),
+        (&parsed.tsjs_inventory, &inventory),
+    ] {
+        if retained.name() != record.name
+            || retained.measurement().sha256() != record.sha256
+            || retained.measurement().length() != record.size
+        {
+            return Err(report(
+                ReleaseError::Evidence,
+                "download does not match signed companion membership",
+            ));
+        }
+    }
+    if executable.name() != selected.name
+        || executable.measurement().sha256() != selected.sha256
+        || executable.measurement().length() != selected.size
+    {
+        return Err(report(
+            ReleaseError::Evidence,
+            "download does not match signed executable membership",
+        ));
+    }
+    let executable_path = executable.materialize(private.path(), deadline, cancellation)?;
+    let provenance_path = provenance.materialize(private.path(), deadline, cancellation)?;
+    let sbom_path = sbom_bundle.materialize(private.path(), deadline, cancellation)?;
+    let provenance_proof = runner.verify_attestation(
+        &executable_path,
+        &provenance_path,
+        request,
+        PredicateKind::Provenance,
+        deadline,
+        cancellation,
+    )?;
+    let spdx_proof = runner.verify_attestation(
+        &executable_path,
+        &sbom_path,
+        request,
+        PredicateKind::Spdx,
+        deadline,
+        cancellation,
+    )?;
+    let spdx_bytes = spdx.document_bytes()?;
+    let build_evidence_bytes = build_evidence.document_bytes()?;
+    let build_recipe_bytes = build_recipe.document_bytes()?;
+    let rebuild_check_bytes = rebuild_check.document_bytes()?;
+    let inventory_bytes = inventory.document_bytes()?;
+    let consumed = [ConsumedArtifact {
+        name: asset_name,
+        executable: executable.measurement(),
+        spdx: &spdx_bytes,
+        build_evidence: &build_evidence_bytes,
+        build_recipe: &build_recipe_bytes,
+        rebuild_check: &rebuild_check_bytes,
+        provenance_bundle: provenance.measurement(),
+        sbom_bundle: sbom_bundle.measurement(),
+        provenance_proof: &provenance_proof,
+        spdx_proof: &spdx_proof,
+    }];
+    let build = verify_build_evidence(&EvidenceInputs {
+        release: request,
+        consumer_policy: &policy,
+        source_policy: &source_policy,
+        index_bytes: &index_bytes,
+        index_proof: &index_proof,
+        index_bundle: index_bundle.measurement(),
+        inventory_bytes: &inventory_bytes,
+        artifacts: &consumed,
+    })?;
+    Ok(BuildResult {
+        build,
+        executable,
+        index_bundle: index_bundle.measurement().clone(),
+    })
+}
+
+/// Verified build and retained executable, before online publication checks.
+pub(super) struct BuildResult {
+    pub(super) build: BuildEvidenceVerified,
+    pub(super) executable: RetainedAsset,
+    pub(super) index_bundle: super::artifact::AssetMeasurement,
+}
+
+/// Completes online publication checks and emits a read-only report.
+pub(super) async fn verify_with(
+    transport: &impl Transport,
+    runner: &GhRunner,
+    request: &ApprovedRelease,
+    asset_name: &str,
+    deadline: AttemptDeadline,
+    cancellation: &Cancellation,
+) -> Result<VerificationReport, Report<ReleaseError>> {
+    let built = build_with(
+        transport,
+        runner,
+        request,
+        asset_name,
+        deadline,
+        cancellation,
+    )
+    .await?;
+    let checksums = transport
+        .asset(
+            github::CHECKSUMS_NAME,
+            AssetRole::Metadata,
+            deadline,
+            cancellation,
+        )
+        .await?;
+    let release = transport.publication(false, deadline, cancellation).await?;
+    let tag_ref = transport.publication(true, deadline, cancellation).await?;
+    let statement = runner.verify_release(request, deadline, cancellation)?;
+    let publication = github::verify_publication(
+        built.build,
+        &PublicationInputs {
+            release: &release,
+            tag_ref: &tag_ref,
+            release_statement: &statement,
+            index_bundle: &built.index_bundle,
+            checksums: checksums.measurement(),
+        },
+    )?;
+    let mut asset = VerifiedReleaseAsset::from_publication_bounded(
+        &publication,
+        built.executable,
+        deadline,
+        cancellation,
+    )?;
+    VerificationReport::new_bounded(&publication, &mut asset, deadline, cancellation)
+}
+
+/// Entry point used only by the public command adapter.
+pub(crate) fn verify(tag: &str, asset: &str, commit: &str) -> Result<(), String> {
+    let request = validate_request(tag, asset, commit).map_err(|error| format!("{error:?}"))?;
+    let caller = CallerEnvironment::from_process();
+    let token = GithubToken::select(&caller).map_err(|error| format!("{error:?}"))?;
+    let deadline = AttemptDeadline::start();
+    let cancellation = Cancellation::default();
+    let runtime = tokio::runtime::Builder::new_multi_thread()
+        .worker_threads(1)
+        .enable_all()
+        .build()
+        .map_err(|_| "cannot create release verification runtime".to_owned())?;
+    // Register the listener synchronously before any gh child can start.
+    #[cfg(any(target_os = "macos", target_os = "linux"))]
+    let signal_task = {
+        let mut interrupt = {
+            let _entered = runtime.enter();
+            tokio::signal::unix::signal(tokio::signal::unix::SignalKind::interrupt())
+                .map_err(|_| "cannot register release cancellation signal".to_owned())?
+        };
+        let requested = cancellation.clone();
+        runtime.spawn(async move {
+            if interrupt.recv().await.is_some() {
+                requested.cancel();
+            }
+        })
+    };
+    let result = runtime
+        .block_on(async {
+            let runner = GhRunner::resolve(
+                GhLocation::SearchPath,
+                &caller,
+                ProcessBounds::production(),
+                deadline,
+                &cancellation,
+            )?;
+            let client = source_policy::policy_client()?;
+            let transport = OfficialTransport {
+                client,
+                release: &request,
+                token,
+            };
+            verify_with(
+                &transport,
+                &runner,
+                &request,
+                asset,
+                deadline,
+                &cancellation,
+            )
+            .await
+        })
+        .map_err(|error| format!("{error:?}"))?;
+    super::artifact::check_attempt(deadline, &cancellation)
+        .map_err(|error| format!("{error:?}"))?;
+    let written = crate::output::write_stdout_line(format_report(&result))
+        .map_err(|error| format!("{error:?}"));
+    #[cfg(any(target_os = "macos", target_os = "linux"))]
+    signal_task.abort();
+    written
+}
+
+fn format_report(report: &VerificationReport) -> String {
+    format!(
+        "Verified {}/{}\nSource: {}\nAsset: {}\nSHA-256: {}\nBytes: {}\nConsumer policy: {} {}\nProducer policy: {} {}\nAssurance: {}\nBuild evidence: verified\nOfficial immutable publication: verified\nRebuild comparison: {}",
+        report.repository,
+        report.tag,
+        report.source_commit,
+        report.asset,
+        report.asset_sha256,
+        report.asset_length,
+        report.consumer_policy_version,
+        report.consumer_policy_sha256,
+        report.producer_policy_version,
+        report.producer_policy_sha256,
+        report.assurance_profile,
+        report.comparison
+    )
+}
diff --git a/crates/trusted-server-cli/src/release/policy.rs b/crates/trusted-server-cli/src/release/policy.rs
new file mode 100644
index 0000000000..46a4d8ee23
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/policy.rs
@@ -0,0 +1,669 @@
+//! Embedded consumer release policy and producer-policy acceptance.
+//!
+//! The reviewed `release-policy.json` bytes are compiled in; their SHA-256 is
+//! computed at runtime and never stored inside the policy, avoiding a
+//! self-hash cycle. Parsing is closed: every field must equal the compiled
+//! constants below, so neither a downloaded index nor operator input can
+//! redefine repository identity, signer identity, supported combinations,
+//! tool pins or resource bounds.
+
+use std::collections::BTreeSet;
+
+use error_stack::Report;
+use serde::Deserialize;
+use serde_json::{Value, json};
+
+use super::bounds;
+use super::documents::{
+    Compatibility, ReleaseIndex, ReleaseTag, Role, lower_hex, parse_json, sha256_hex,
+};
+use super::error::{ReleaseError, report};
+use super::source_policy::ApprovedSourcePolicy;
+
+/// Exact reviewed consumer policy bytes.
+pub(crate) const EMBEDDED_POLICY: &[u8] = include_bytes!("../../release-policy.json");
+/// Policy version this consumer was compiled with.
+pub(crate) const CONSUMER_POLICY_VERSION: u64 = 1;
+/// Official repository slug.
+pub(crate) const REPOSITORY: &str = "IABTechLab/trusted-server";
+/// GitHub host serving the official repository.
+pub(crate) const GITHUB_HOST: &str = "github.com";
+/// Numeric repository identifier.
+pub(crate) const REPOSITORY_ID: &str = "950860906";
+/// Numeric repository owner identifier.
+pub(crate) const REPOSITORY_OWNER_ID: &str = "82903538";
+/// Fixed phase-one cohort.
+pub(crate) const COHORT: &str = "phase1-fastly-cli";
+/// Sigstore certificate OIDC issuer.
+pub(crate) const ISSUER: &str = "https://token.actions.githubusercontent.com";
+/// Certificate SAN and builder ID before the release tag.
+pub(crate) const SIGNER_WORKFLOW_PREFIX: &str =
+    "https://github.com/IABTechLab/trusted-server/.github/workflows/release-build.yml@refs/tags/";
+/// Exactly qualified GitHub CLI version.
+pub(crate) const GH_VERSION: &str = "2.97.0";
+/// Pinned `actions/attest` version.
+pub(crate) const ATTEST_VERSION: &str = "4.2.2";
+/// Pinned `actions/attest` commit.
+pub(crate) const ATTEST_REVISION: &str = "1e69f48acb82d1966a394da916b4c1698aa569d6";
+/// SLSA provenance predicate type.
+pub(crate) const PROVENANCE_PREDICATE: &str = "https://slsa.dev/provenance/v1";
+/// SPDX SBOM predicate type.
+pub(crate) const SBOM_PREDICATE: &str = "https://spdx.dev/Document/v2.3";
+/// GitHub Actions workflow build type.
+pub(crate) const BUILD_TYPE: &str = "https://actions.github.io/buildtypes/workflow/v1";
+/// The only action any artifact currently authorizes.
+pub(crate) const READONLY_VERIFY: &str = "readonly-verify";
+/// Capability that the v1 schema allows but current policy forbids.
+pub(crate) const STAGING_CAPABILITY: &str = "fastly-staging";
+/// Every capability the v1 schema can express.
+pub(crate) const KNOWN_CAPABILITIES: [&str; 3] =
+    ["fastly-production", STAGING_CAPABILITY, "cli-execute"];
+const KNOWN_KINDS: [&str; 2] = ["wasm-core", "native-executable"];
+const KNOWN_PROFILES: [&str; 2] = ["provenance-sbom-repeatable", "provenance-sbom"];
+const KNOWN_ACTIONS: [&str; 1] = [READONLY_VERIFY];
+
+/// One source-owned cohort identity; policy JSON can only restate it.
+#[derive(Debug)]
+pub(crate) struct FixedArtifact {
+    pub(crate) name: &'static str,
+    pub(crate) package: &'static str,
+    pub(crate) bin: &'static str,
+    pub(crate) kind: &'static str,
+    pub(crate) role: &'static str,
+    pub(crate) assurance_profile: &'static str,
+    pub(crate) capabilities: &'static [&'static str],
+    pub(crate) target: &'static str,
+    pub(crate) runtime: &'static str,
+    pub(crate) minimum_version: &'static str,
+    pub(crate) architecture: &'static str,
+}
+
+/// The complete phase-one cohort, in policy order.
+pub(crate) const FIXED_ARTIFACTS: [FixedArtifact; bounds::COHORT_EXECUTABLES] = [
+    FixedArtifact {
+        name: "trusted-server-fastly.wasm",
+        package: "trusted-server-adapter-fastly",
+        bin: "trusted-server-adapter-fastly",
+        kind: "wasm-core",
+        role: "server",
+        assurance_profile: "provenance-sbom-repeatable",
+        capabilities: &["fastly-production"],
+        target: "wasm32-wasip1",
+        runtime: "fastly-compute",
+        minimum_version: "wasip1",
+        architecture: "wasm32",
+    },
+    FixedArtifact {
+        name: "ts-aarch64-apple-darwin",
+        package: "trusted-server-cli",
+        bin: "ts",
+        kind: "native-executable",
+        role: "operator-cli",
+        assurance_profile: "provenance-sbom",
+        capabilities: &["cli-execute"],
+        target: "aarch64-apple-darwin",
+        runtime: "macos",
+        minimum_version: "13.0",
+        architecture: "aarch64",
+    },
+    FixedArtifact {
+        name: "ts-x86_64-apple-darwin",
+        package: "trusted-server-cli",
+        bin: "ts",
+        kind: "native-executable",
+        role: "operator-cli",
+        assurance_profile: "provenance-sbom",
+        capabilities: &["cli-execute"],
+        target: "x86_64-apple-darwin",
+        runtime: "macos",
+        minimum_version: "13.0",
+        architecture: "x86_64",
+    },
+    FixedArtifact {
+        name: "ts-x86_64-unknown-linux-gnu",
+        package: "trusted-server-cli",
+        bin: "ts",
+        kind: "native-executable",
+        role: "operator-cli",
+        assurance_profile: "provenance-sbom",
+        capabilities: &["cli-execute"],
+        target: "x86_64-unknown-linux-gnu",
+        runtime: "linux-gnu",
+        minimum_version: "glibc-2.34",
+        architecture: "x86_64",
+    },
+];
+
+/// The only artifact variant in the phase-one cohort.
+pub(crate) const FIXED_VARIANT: &str = "default";
+
+/// Declared identity fields shared by policy and index artifact entries.
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct DeclaredIdentity<'a> {
+    pub(crate) role: &'a str,
+    pub(crate) kind: &'a str,
+    pub(crate) package: &'a str,
+    pub(crate) target: &'a str,
+    pub(crate) variant: &'a str,
+    pub(crate) assurance_profile: &'a str,
+    pub(crate) capabilities: &'a [String],
+    pub(crate) compatibility: &'a Compatibility,
+}
+
+impl FixedArtifact {
+    /// Returns the declared runtime compatibility of this artifact.
+    pub(crate) fn compatibility(&self) -> Compatibility {
+        Compatibility {
+            runtime: self.runtime.to_owned(),
+            minimum_version: self.minimum_version.to_owned(),
+            architecture: self.architecture.to_owned(),
+        }
+    }
+
+    /// Returns whether a declared identity is exactly this supported
+    /// role/kind/package/target/variant/profile/capability/compatibility
+    /// combination. Capabilities compare as a set.
+    pub(crate) fn matches(&self, declared: &DeclaredIdentity<'_>) -> bool {
+        let declared_capabilities: BTreeSet<&str> =
+            declared.capabilities.iter().map(String::as_str).collect();
+        let fixed_capabilities: BTreeSet<&str> = self.capabilities.iter().copied().collect();
+        declared.role == self.role
+            && declared.kind == self.kind
+            && declared.package == self.package
+            && declared.target == self.target
+            && declared.variant == FIXED_VARIANT
+            && declared.assurance_profile == self.assurance_profile
+            && declared.capabilities.len() == fixed_capabilities.len()
+            && declared_capabilities == fixed_capabilities
+            && *declared.compatibility == self.compatibility()
+    }
+}
+
+/// A reviewed historical producer-policy identity.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) struct HistoricalPolicy<'a> {
+    pub(crate) version: u64,
+    pub(crate) sha256: &'a str,
+}
+
+/// Reviewed historical producer policies this consumer still accepts.
+///
+/// Empty for consumer v1. A new CLI policy must explicitly retain or retire
+/// each identity here; an index can never add one.
+pub(crate) const HISTORICAL_PRODUCER_POLICIES: &[HistoricalPolicy<'static>] = &[];
+
+/// Returns the exact certificate identity for a release tag.
+pub(crate) fn certificate_identity(tag: &ReleaseTag) -> String {
+    format!("{SIGNER_WORKFLOW_PREFIX}{}", tag.as_str())
+}
+
+/// The validated consumer policy and its externally computed identity.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct ConsumerPolicy {
+    version: u64,
+    sha256: String,
+}
+
+impl ConsumerPolicy {
+    /// Returns the consumer policy version.
+    pub(crate) fn version(&self) -> u64 {
+        self.version
+    }
+
+    /// Returns the SHA-256 of the exact policy bytes.
+    pub(crate) fn sha256(&self) -> &str {
+        &self.sha256
+    }
+
+    /// Returns the official repository slug.
+    pub(crate) fn repository(&self) -> &'static str {
+        REPOSITORY
+    }
+
+    /// Returns the fixed cohort name.
+    pub(crate) fn cohort(&self) -> &'static str {
+        COHORT
+    }
+
+    /// Returns the supported cohort artifacts.
+    pub(crate) fn artifacts(&self) -> &'static [FixedArtifact] {
+        &FIXED_ARTIFACTS
+    }
+
+    /// Returns the supported artifact with this exact name.
+    pub(crate) fn artifact(&self, name: &str) -> Option<&'static FixedArtifact> {
+        FIXED_ARTIFACTS
+            .iter()
+            .find(|artifact| artifact.name == name)
+    }
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct PolicyDocument {
+    artifacts: Vec<PolicyArtifact>,
+    bounds: Value,
+    cohort: String,
+    github_host: String,
+    historical_producer_policies: Vec<HistoricalDocument>,
+    identity: Value,
+    policy_version: u64,
+    predicates: Value,
+    public_actions: Vec<String>,
+    repository: String,
+    repository_id: String,
+    repository_owner_id: String,
+    tool_versions: Value,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct PolicyArtifact {
+    actions: Vec<String>,
+    assurance_profile: String,
+    bin: String,
+    capabilities: Vec<String>,
+    compatibility: Compatibility,
+    default_features: bool,
+    features: Vec<String>,
+    kind: String,
+    name: String,
+    package: String,
+    role: String,
+    target: String,
+    variant: String,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct HistoricalDocument {
+    policy_version: u64,
+    policy_sha256: String,
+}
+
+/// Parses and validates the compiled-in consumer policy.
+///
+/// # Errors
+///
+/// Returns an error if the embedded bytes violate the compiled contract,
+/// which indicates an unreviewed policy edit.
+pub(crate) fn embedded_policy() -> Result<ConsumerPolicy, Report<ReleaseError>> {
+    parse_consumer_policy(EMBEDDED_POLICY)
+}
+
+/// Parses consumer policy bytes and requires them to equal the compiled contract.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Document`] for malformed JSON and
+/// [`ReleaseError::Policy`] for unknown fields, kinds, profiles, actions or
+/// capabilities, forbidden `fastly-staging`, or any changed identity, tool pin
+/// or bound.
+pub(crate) fn parse_consumer_policy(bytes: &[u8]) -> Result<ConsumerPolicy, Report<ReleaseError>> {
+    let value = parse_json(bytes, Role::Policy)?;
+    let document = PolicyDocument::deserialize(&value)
+        .map_err(|source| report(ReleaseError::Policy, source))?;
+    check_scalars(&document)?;
+    check_structures(&document)?;
+    check_artifacts(&document.artifacts)?;
+    Ok(ConsumerPolicy {
+        version: document.policy_version,
+        sha256: sha256_hex(bytes),
+    })
+}
+
+fn check_scalars(document: &PolicyDocument) -> Result<(), Report<ReleaseError>> {
+    if document.policy_version != CONSUMER_POLICY_VERSION {
+        return Err(report(
+            ReleaseError::Policy,
+            "consumer policy version is not the compiled version",
+        ));
+    }
+    if document.repository != REPOSITORY
+        || document.github_host != GITHUB_HOST
+        || document.repository_id != REPOSITORY_ID
+        || document.repository_owner_id != REPOSITORY_OWNER_ID
+        || document.cohort != COHORT
+    {
+        return Err(report(
+            ReleaseError::Policy,
+            "policy repository, host, numeric IDs or cohort differ from compiled values",
+        ));
+    }
+    check_actions(&document.public_actions)?;
+    let historical: Vec<(u64, &str)> = document
+        .historical_producer_policies
+        .iter()
+        .map(|entry| (entry.policy_version, entry.policy_sha256.as_str()))
+        .collect();
+    let compiled: Vec<(u64, &str)> = HISTORICAL_PRODUCER_POLICIES
+        .iter()
+        .map(|entry| (entry.version, entry.sha256))
+        .collect();
+    if historical != compiled {
+        return Err(report(
+            ReleaseError::Policy,
+            "policy historical producer list differs from the compiled allowlist",
+        ));
+    }
+    Ok(())
+}
+
+fn check_structures(document: &PolicyDocument) -> Result<(), Report<ReleaseError>> {
+    if document.tool_versions
+        != json!({
+            "actions_attest": ATTEST_VERSION,
+            "actions_attest_revision": ATTEST_REVISION,
+            "gh": GH_VERSION,
+        })
+    {
+        return Err(report(
+            ReleaseError::Policy,
+            "policy tool versions differ from the qualified gh and attest pins",
+        ));
+    }
+    if document.predicates
+        != json!({
+            "build_type": BUILD_TYPE,
+            "provenance": PROVENANCE_PREDICATE,
+            "sbom": SBOM_PREDICATE,
+        })
+    {
+        return Err(report(
+            ReleaseError::Policy,
+            "policy predicates differ from compiled values",
+        ));
+    }
+    if document.identity != expected_identity() {
+        return Err(report(
+            ReleaseError::Policy,
+            "policy signer identity differs from compiled values",
+        ));
+    }
+    if document.bounds != expected_bounds() {
+        return Err(report(
+            ReleaseError::Policy,
+            "policy bounds differ from compiled R-BOUNDS",
+        ));
+    }
+    Ok(())
+}
+
+fn expected_identity() -> Value {
+    let template = format!("{SIGNER_WORKFLOW_PREFIX}<tag>");
+    json!({
+        "builder_id": template,
+        "caller_commit": "same-approved-source-commit",
+        "caller_path": ".github/workflows/release.yml",
+        "caller_repository": format!("https://{GITHUB_HOST}/{REPOSITORY}"),
+        "certificate_fields": [
+            "buildConfigDigest",
+            "buildConfigURI",
+            "buildTrigger",
+            "runInvocationURI",
+            "sourceRepositoryIdentifier",
+            "sourceRepositoryOwnerIdentifier",
+        ],
+        "certificate_san": template,
+        "event": "push",
+        "external_parameters": "exact-caller-workflow-only-no-inputs",
+        "invocation": "same-repository-run-and-attempt-across-certificate-and-provenance",
+        "issuer": ISSUER,
+        "runner": "github-hosted",
+        "signer_commit": "same-approved-source-commit",
+        "source_commit": "independently-approved-40-lowercase-hex",
+        "source_dependency": format!("git+https://{GITHUB_HOST}/{REPOSITORY}@refs/tags/<tag>"),
+        "source_ref": "refs/tags/<tag>",
+    })
+}
+
+fn expected_bounds() -> Value {
+    json!({
+        "attempt_seconds": bounds::ATTEMPT_SECONDS,
+        "bundle_bytes": bounds::BUNDLE_BYTES,
+        "child_seconds": bounds::CHILD_SECONDS,
+        "cohort_executables": bounds::COHORT_EXECUTABLES,
+        "companion_bytes": bounds::COMPANION_BYTES,
+        "executable_bytes": bounds::EXECUTABLE_BYTES,
+        "index_bytes": bounds::INDEX_BYTES,
+        "inventory_bytes": bounds::INVENTORY_BYTES,
+        "json_depth": bounds::JSON_DEPTH,
+        "matching_attestations_per_bundle": bounds::MATCHING_ATTESTATIONS_PER_BUNDLE,
+        "metadata_bytes": bounds::METADATA_BYTES,
+        "policy_bytes": bounds::POLICY_BYTES,
+        "spdx_bytes": bounds::SPDX_BYTES,
+        "stderr_bytes": bounds::STDERR_BYTES,
+        "stdout_bytes": bounds::STDOUT_BYTES,
+        "trusted_roots_bytes": bounds::TRUSTED_ROOTS_BYTES,
+    })
+}
+
+fn check_actions(actions: &[String]) -> Result<(), Report<ReleaseError>> {
+    if let Some(unknown) = actions
+        .iter()
+        .find(|action| !KNOWN_ACTIONS.contains(&action.as_str()))
+    {
+        return Err(report(
+            ReleaseError::Policy,
+            format!("unknown policy action `{unknown}`"),
+        ));
+    }
+    if actions != [READONLY_VERIFY] {
+        return Err(report(
+            ReleaseError::Policy,
+            "policy actions must be exactly [readonly-verify]",
+        ));
+    }
+    Ok(())
+}
+
+fn check_artifacts(artifacts: &[PolicyArtifact]) -> Result<(), Report<ReleaseError>> {
+    if artifacts.len() != FIXED_ARTIFACTS.len() {
+        return Err(report(
+            ReleaseError::Policy,
+            "policy must list exactly the cohort artifacts",
+        ));
+    }
+    let mut names = BTreeSet::new();
+    for artifact in artifacts {
+        if !names.insert(artifact.name.as_str()) {
+            return Err(report(
+                ReleaseError::Policy,
+                format!("policy lists `{}` more than once", artifact.name),
+            ));
+        }
+        check_policy_artifact(artifact)?;
+    }
+    Ok(())
+}
+
+fn check_policy_artifact(artifact: &PolicyArtifact) -> Result<(), Report<ReleaseError>> {
+    if !KNOWN_KINDS.contains(&artifact.kind.as_str()) {
+        return Err(report(
+            ReleaseError::Policy,
+            format!("unknown artifact kind `{}`", artifact.kind),
+        ));
+    }
+    if !KNOWN_PROFILES.contains(&artifact.assurance_profile.as_str()) {
+        return Err(report(
+            ReleaseError::Policy,
+            format!("unknown assurance profile `{}`", artifact.assurance_profile),
+        ));
+    }
+    check_actions(&artifact.actions)?;
+    check_capability_vocabulary(&artifact.capabilities)?;
+    let fixed = FIXED_ARTIFACTS
+        .iter()
+        .find(|fixed| fixed.name == artifact.name)
+        .ok_or_else(|| {
+            report(
+                ReleaseError::Policy,
+                format!("unknown policy artifact `{}`", artifact.name),
+            )
+        })?;
+    let declared = DeclaredIdentity {
+        role: &artifact.role,
+        kind: &artifact.kind,
+        package: &artifact.package,
+        target: &artifact.target,
+        variant: &artifact.variant,
+        assurance_profile: &artifact.assurance_profile,
+        capabilities: &artifact.capabilities,
+        compatibility: &artifact.compatibility,
+    };
+    if !fixed.matches(&declared)
+        || artifact.bin != fixed.bin
+        || !artifact.default_features
+        || !artifact.features.is_empty()
+    {
+        return Err(report(
+            ReleaseError::Policy,
+            format!(
+                "policy artifact `{}` differs from the supported combination",
+                artifact.name
+            ),
+        ));
+    }
+    Ok(())
+}
+
+/// Rejects capabilities the v1 schema cannot express and the
+/// structurally valid but policy-forbidden `fastly-staging`.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Policy`] for an unknown or forbidden capability.
+pub(crate) fn check_capability_vocabulary(
+    capabilities: &[String],
+) -> Result<(), Report<ReleaseError>> {
+    if let Some(unknown) = capabilities
+        .iter()
+        .find(|capability| !KNOWN_CAPABILITIES.contains(&capability.as_str()))
+    {
+        return Err(report(
+            ReleaseError::Policy,
+            format!("unknown capability `{unknown}`"),
+        ));
+    }
+    if capabilities
+        .iter()
+        .any(|capability| capability == STAGING_CAPABILITY)
+    {
+        return Err(report(
+            ReleaseError::Policy,
+            "fastly-staging is structurally valid but forbidden by current policy",
+        ));
+    }
+    Ok(())
+}
+
+/// Which accepted producer policy an index was built under.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) enum AcceptedProducerPolicy {
+    /// The producer policy is byte-identical to this consumer's policy.
+    Current,
+    /// The producer policy is a reviewed historical identity.
+    Historical { version: u64, sha256: String },
+}
+
+/// The consumer identity and allowlist that producer policies are judged by.
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct AcceptanceRules<'a> {
+    pub(crate) current_version: u64,
+    pub(crate) current_sha256: &'a str,
+    pub(crate) historical: &'a [HistoricalPolicy<'a>],
+}
+
+impl<'a> AcceptanceRules<'a> {
+    /// Returns the compiled rules for this consumer.
+    pub(crate) fn compiled(policy: &'a ConsumerPolicy) -> Self {
+        Self {
+            current_version: policy.version(),
+            current_sha256: policy.sha256(),
+            historical: HISTORICAL_PRODUCER_POLICIES,
+        }
+    }
+}
+
+/// Returns the exact-byte identity (version, SHA-256) of approved-source bytes.
+fn producer_identity(
+    approved: &ApprovedSourcePolicy,
+) -> Result<(u64, String), Report<ReleaseError>> {
+    let producer = parse_json(approved.bytes(), Role::Policy)?;
+    let version = producer
+        .get("policy_version")
+        .and_then(Value::as_u64)
+        .filter(|version| *version >= 1)
+        .ok_or_else(|| {
+            report(
+                ReleaseError::ProducerPolicy,
+                "approved source policy has no integer version",
+            )
+        })?;
+    Ok((version, sha256_hex(approved.bytes())))
+}
+
+/// Binds an index's producer-policy identity to approved-source bytes and
+/// accepts only the current policy or a reviewed historical identity.
+///
+/// The index never selects the consumer policy; acceptance only decides
+/// whether the producer contract is one this consumer has reviewed. The
+/// consumer's own compiled constraints stay in force either way.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::ProducerPolicy`] if the approved source belongs to
+/// another commit, the index identity differs from the approved-source bytes,
+/// the producer version is newer than the consumer, or the identity is neither
+/// current nor allowlisted.
+pub(crate) fn accept_producer_policy(
+    index: &ReleaseIndex,
+    approved: &ApprovedSourcePolicy,
+    rules: &AcceptanceRules<'_>,
+) -> Result<AcceptedProducerPolicy, Report<ReleaseError>> {
+    if approved.commit().as_str() != index.source_commit {
+        return Err(report(
+            ReleaseError::ProducerPolicy,
+            "approved source policy belongs to another commit",
+        ));
+    }
+    let (producer_version, producer_sha256) = producer_identity(approved)?;
+    if index.policy_version != producer_version || index.policy_sha256 != producer_sha256 {
+        return Err(report(
+            ReleaseError::ProducerPolicy,
+            "index policy identity does not match the approved source policy bytes",
+        ));
+    }
+    if !lower_hex(rules.current_sha256, 64) {
+        return Err(report(
+            ReleaseError::ProducerPolicy,
+            "consumer policy digest is malformed",
+        ));
+    }
+    if producer_version == rules.current_version && producer_sha256 == rules.current_sha256 {
+        return Ok(AcceptedProducerPolicy::Current);
+    }
+    if producer_version > rules.current_version {
+        return Err(report(
+            ReleaseError::ProducerPolicy,
+            format!(
+                "unsupported producer policy version {producer_version} under consumer policy version {}",
+                rules.current_version
+            ),
+        ));
+    }
+    if rules
+        .historical
+        .iter()
+        .any(|entry| entry.version == producer_version && entry.sha256 == producer_sha256)
+    {
+        return Ok(AcceptedProducerPolicy::Historical {
+            version: producer_version,
+            sha256: producer_sha256,
+        });
+    }
+    Err(report(
+        ReleaseError::ProducerPolicy,
+        "producer policy is neither current nor a reviewed historical identity",
+    ))
+}
diff --git a/crates/trusted-server-cli/src/release/process.rs b/crates/trusted-server-cli/src/release/process.rs
new file mode 100644
index 0000000000..a657198b9f
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/process.rs
@@ -0,0 +1,324 @@
+//! Supervision of one bounded child process group.
+//!
+//! The child leads its own process group. Its exit is observed with
+//! `waitid(WNOWAIT)`, which leaves the leader an unreaped zombie: while that
+//! zombie exists its PID, and therefore the group ID, cannot be reused, so
+//! signalling the group can never hit an unrelated process. The group is
+//! killed only in that window and the leader is reaped last.
+//!
+//! After the group `SIGKILL`, closure of both output pipes (EOF in the drain
+//! threads) is the liveness signal, not repeated `killpg` results: killed
+//! descendants become zombies that a non-reaping PID 1 (for example a
+//! container without an init) may never collect, yet zombies hold no pipes.
+//! A descendant that left the group and keeps the pipes open is reported as
+//! escaped after a bounded grace. Limitation: a descendant that escaped the
+//! group *and* closed its copies of the pipes is not observable here and may
+//! outlive verification; it never contributes output.
+
+use std::io::{self, Read};
+use std::process::{Child, Command, ExitStatus};
+use std::sync::mpsc::{self, Receiver, RecvTimeoutError, Sender};
+use std::thread::{self, JoinHandle};
+use std::time::{Duration, Instant};
+
+use error_stack::Report;
+
+use super::bounds::{AttemptDeadline, Cancellation, ProcessBounds};
+use super::error::{ReleaseError, report};
+
+const POLL_INTERVAL: Duration = Duration::from_millis(10);
+const READ_CHUNK: usize = 64 * 1024;
+
+/// Exit status and raw output of a child whose group was fully drained.
+pub(super) struct Completed {
+    pub(super) status: ExitStatus,
+    pub(super) stdout: Vec<u8>,
+    pub(super) stderr: Vec<u8>,
+}
+
+struct Drained {
+    bytes: Vec<u8>,
+    overflowed: bool,
+}
+
+/// Both drained pipes, or why draining could not complete.
+/// A drain thread collecting one pipe.
+type Reader = JoinHandle<io::Result<Drained>>;
+
+type DrainResult = Result<(Drained, Drained), Report<ReleaseError>>;
+
+/// A drain thread reached its byte cap.
+struct Overflow;
+
+enum Stop {
+    Timeout,
+    Cancelled,
+    Overflow,
+    Wait(io::Error),
+}
+
+impl Stop {
+    fn into_report(self) -> Report<ReleaseError> {
+        match self {
+            Self::Timeout => report(
+                ReleaseError::Timeout,
+                "gh child exceeded its child or attempt deadline",
+            ),
+            Self::Cancelled => report(ReleaseError::Cancelled, "gh child was cancelled"),
+            Self::Overflow => report(
+                ReleaseError::OutputLimit,
+                "gh stdout or stderr exceeded its cap",
+            ),
+            Self::Wait(source) => report(ReleaseError::Process, source),
+        }
+    }
+}
+
+/// Sends one `SIGKILL` to the whole group.
+///
+/// `ESRCH` (no members) and `EPERM` (macOS reports it when only the zombie
+/// leader remains) both mean nothing signalable is left.
+fn kill_group(process_group: libc::pid_t) -> Result<(), Report<ReleaseError>> {
+    // SAFETY: `killpg` only reads its two integer arguments; failure is
+    // reported through errno.
+    let result = unsafe { libc::killpg(process_group, libc::SIGKILL) };
+    if result == 0 {
+        return Ok(());
+    }
+    let source = io::Error::last_os_error();
+    match source.raw_os_error() {
+        Some(libc::ESRCH | libc::EPERM) => Ok(()),
+        _ => Err(report(
+            ReleaseError::Process,
+            format!("killpg failed: {source}"),
+        )),
+    }
+}
+
+/// Returns whether the leader has exited, without reaping it.
+fn leader_exited(pid: libc::pid_t) -> io::Result<bool> {
+    let id = libc::id_t::try_from(pid).map_err(io::Error::other)?;
+    // SAFETY: an all-zero `siginfo_t` is a valid value of this plain C struct.
+    let mut info: libc::siginfo_t = unsafe { std::mem::zeroed() };
+    // SAFETY: `info` is a valid, writable `siginfo_t` for the duration of the
+    // call; `WNOWAIT` leaves the child waitable so it stays unreaped.
+    let result = unsafe {
+        libc::waitid(
+            libc::P_PID,
+            id,
+            &raw mut info,
+            libc::WEXITED | libc::WNOHANG | libc::WNOWAIT,
+        )
+    };
+    if result != 0 {
+        let source = io::Error::last_os_error();
+        if source.kind() == io::ErrorKind::Interrupted {
+            return Ok(false);
+        }
+        return Err(source);
+    }
+    // SAFETY: `waitid` succeeded, so `info` is initialized; with `WNOHANG` and
+    // no state change `si_pid` stays zero.
+    Ok(unsafe { info.si_pid() } != 0)
+}
+
+fn drain<R: Read + Send + 'static>(
+    mut reader: R,
+    limit: u64,
+    overflow: Sender<Overflow>,
+) -> Reader {
+    thread::spawn(move || {
+        let mut bytes = Vec::new();
+        let mut buffer = vec![0; READ_CHUNK];
+        loop {
+            let count = match reader.read(&mut buffer) {
+                Ok(count) => count,
+                Err(source) if source.kind() == io::ErrorKind::Interrupted => continue,
+                Err(source) => return Err(source),
+            };
+            if count == 0 {
+                return Ok(Drained {
+                    bytes,
+                    overflowed: false,
+                });
+            }
+            if count as u64 > limit.saturating_sub(bytes.len() as u64) {
+                // Dropping the reader closes the pipe; the supervisor kills the group.
+                let _ = overflow.send(Overflow);
+                return Ok(Drained {
+                    bytes,
+                    overflowed: true,
+                });
+            }
+            bytes.extend_from_slice(buffer.get(..count).unwrap_or_default());
+        }
+    })
+}
+
+/// Waits until the leader exits (left unreaped) or a stop condition occurs.
+fn wait_for_leader(
+    pid: libc::pid_t,
+    overflow: &Receiver<Overflow>,
+    child_deadline: Instant,
+    cancellation: &Cancellation,
+) -> Result<(), Stop> {
+    loop {
+        match leader_exited(pid) {
+            Ok(true) => return Ok(()),
+            Ok(false) => {}
+            Err(source) => return Err(Stop::Wait(source)),
+        }
+        if cancellation.is_cancelled() {
+            return Err(Stop::Cancelled);
+        }
+        if Instant::now() >= child_deadline {
+            return Err(Stop::Timeout);
+        }
+        match overflow.recv_timeout(POLL_INTERVAL) {
+            Ok(Overflow) => return Err(Stop::Overflow),
+            Err(RecvTimeoutError::Timeout) => {}
+            Err(RecvTimeoutError::Disconnected) => thread::sleep(POLL_INTERVAL),
+        }
+    }
+}
+
+/// Waits, bounded, for a killed leader to become a zombie.
+fn await_leader_exit(pid: libc::pid_t, grace: Duration) -> Result<(), Report<ReleaseError>> {
+    let until = Instant::now() + grace;
+    loop {
+        if leader_exited(pid).map_err(|source| report(ReleaseError::Process, source))? {
+            return Ok(());
+        }
+        if Instant::now() >= until {
+            return Err(report(
+                ReleaseError::Process,
+                "gh leader did not exit after SIGKILL",
+            ));
+        }
+        thread::sleep(POLL_INTERVAL);
+    }
+}
+
+fn join_readers(
+    stdout: Reader,
+    stderr: Reader,
+    grace: Duration,
+) -> Result<(Drained, Drained), Report<ReleaseError>> {
+    let until = Instant::now() + grace;
+    while !(stdout.is_finished() && stderr.is_finished()) {
+        if Instant::now() >= until {
+            // The reader threads stay blocked until the escaped process
+            // closes its pipe ends; they hold no other resources.
+            return Err(report(
+                ReleaseError::DescendantEscaped,
+                "a gh descendant left the process group and still holds its output pipes",
+            ));
+        }
+        thread::sleep(POLL_INTERVAL);
+    }
+    let join = |handle: Reader| {
+        handle
+            .join()
+            .map_err(|_| report(ReleaseError::Process, "gh output reader panicked"))?
+            .map_err(|source| report(ReleaseError::Process, source))
+    };
+    Ok((join(stdout)?, join(stderr)?))
+}
+
+/// Kills the group while the unreaped leader pins its ID, waits for pipe
+/// closure, then reaps the leader.
+fn settle(
+    child: &mut Child,
+    process_group: libc::pid_t,
+    leader_done: bool,
+    readers: (Reader, Reader),
+    grace: Duration,
+) -> (DrainResult, io::Result<ExitStatus>) {
+    let mut cleanup = kill_group(process_group);
+    if !leader_done && cleanup.is_ok() {
+        // A second group signal while the zombie still pins the ID catches
+        // anything forked between the first signal and the leader's death.
+        cleanup = await_leader_exit(process_group, grace).and_then(|()| kill_group(process_group));
+    }
+    let drained = cleanup.and_then(|()| join_readers(readers.0, readers.1, grace));
+    if !leader_done {
+        let _ = child.kill();
+    }
+    (drained, child.wait())
+}
+
+/// Runs `command` (already configured with piped output and its own process
+/// group) under the child deadline, attempt deadline, cancellation and byte
+/// caps.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Timeout`], [`ReleaseError::Cancelled`],
+/// [`ReleaseError::OutputLimit`], [`ReleaseError::DescendantEscaped`] or
+/// [`ReleaseError::Process`]. The child is reaped on every path.
+pub(super) fn supervise(
+    command: &mut Command,
+    process_bounds: &ProcessBounds,
+    deadline: AttemptDeadline,
+    cancellation: &Cancellation,
+) -> Result<Completed, Report<ReleaseError>> {
+    let child_deadline = (Instant::now() + process_bounds.child_timeout).min(deadline.instant());
+    let mut child = command.spawn().map_err(|source| {
+        report(
+            ReleaseError::Process,
+            format!("cannot spawn gh ({:?}): {source}", source.kind()),
+        )
+    })?;
+    let process_group = libc::pid_t::try_from(child.id())
+        .map_err(|_| report(ReleaseError::Process, "gh process ID is out of range"));
+    let pipes = child.stdout.take().zip(child.stderr.take());
+    let (Ok(process_group), Some((stdout, stderr))) = (process_group, pipes) else {
+        let _ = child.kill();
+        let _ = child.wait();
+        return Err(report(
+            ReleaseError::Process,
+            "gh process ID or pipes are unavailable",
+        ));
+    };
+    let (sender, overflow) = mpsc::channel();
+    let readers = (
+        drain(stdout, process_bounds.stdout_bytes, sender.clone()),
+        drain(stderr, process_bounds.stderr_bytes, sender),
+    );
+    let stopped = wait_for_leader(process_group, &overflow, child_deadline, cancellation);
+    let settled = settle(
+        &mut child,
+        process_group,
+        stopped.is_ok(),
+        readers,
+        process_bounds.kill_grace,
+    );
+    complete(stopped, settled)
+}
+
+/// Turns a stop condition and cleanup outcome into the supervision result.
+fn complete(
+    stopped: Result<(), Stop>,
+    (drained, status): (DrainResult, io::Result<ExitStatus>),
+) -> Result<Completed, Report<ReleaseError>> {
+    if let Err(stop) = stopped {
+        let stop = stop.into_report();
+        return Err(match drained {
+            Err(failure) => stop.attach(format!(
+                "cleanup also failed: {}",
+                failure.current_context()
+            )),
+            Ok(_) => stop,
+        });
+    }
+    let (stdout, stderr) = drained?;
+    let status = status.map_err(|source| report(ReleaseError::Process, source))?;
+    if stdout.overflowed || stderr.overflowed {
+        return Err(Stop::Overflow.into_report());
+    }
+    Ok(Completed {
+        status,
+        stdout: stdout.bytes,
+        stderr: stderr.bytes,
+    })
+}
diff --git a/crates/trusted-server-cli/src/release/source_policy.rs b/crates/trusted-server-cli/src/release/source_policy.rs
new file mode 100644
index 0000000000..cf6572d965
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/source_policy.rs
@@ -0,0 +1,386 @@
+//! Producer-policy bytes from an independently approved source.
+//!
+//! [`ApprovedSourcePolicy`] can only be built from the fixed official GitHub
+//! Contents API endpoint at an approved full commit, or from an explicitly
+//! transferred approved-source snapshot. The release index never supplies the
+//! ref, host, path or bytes.
+
+use std::ffi::CString;
+use std::fs::{File, OpenOptions};
+use std::io::{self, Read as _};
+use std::os::fd::{AsRawFd as _, FromRawFd as _, OwnedFd};
+use std::os::unix::fs::OpenOptionsExt as _;
+use std::path::Path;
+
+use error_stack::Report;
+use reqwest::header::{ACCEPT, AUTHORIZATION, HeaderName, HeaderValue, USER_AGENT};
+use reqwest::{Client, ClientBuilder, Method, Request, StatusCode};
+use url::Url;
+
+use super::bounds::{self, AttemptDeadline};
+use super::documents::ApprovedCommit;
+use super::environment::GithubToken;
+use super::error::{ReleaseError, report};
+
+/// The only producer-policy endpoint; the approved commit is the sole variable.
+pub(crate) const POLICY_CONTENTS_URL: &str = "https://api.github.com/repos/IABTechLab/trusted-server/contents/crates/trusted-server-cli/release-policy.json"; // allow-domain: api.github.com
+/// Fixed source-relative directories and file name of the producer policy.
+const POLICY_DIRECTORIES: [&str; 2] = ["crates", "trusted-server-cli"];
+const POLICY_FILE: &str = "release-policy.json";
+/// Raw-content media type for the Contents API.
+const RAW_MEDIA_TYPE: &str = "application/vnd.github.raw+json";
+/// Reviewed GitHub REST API version header value.
+const API_VERSION: &str = "2022-11-28";
+
+/// Producer-policy bytes bound to an independently approved commit.
+///
+/// Only [`fetch_approved_policy`] and [`read_approved_snapshot`] construct
+/// it; neither accepts a caller-chosen URL, path or byte string.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct ApprovedSourcePolicy {
+    commit: ApprovedCommit,
+    bytes: Vec<u8>,
+}
+
+impl ApprovedSourcePolicy {
+    fn bounded(commit: ApprovedCommit, bytes: Vec<u8>) -> Result<Self, Report<ReleaseError>> {
+        if bytes.len() as u64 > bounds::POLICY_BYTES {
+            return Err(report(
+                ReleaseError::PolicyFetch,
+                "approved source policy exceeds 1 MiB",
+            ));
+        }
+        Ok(Self { commit, bytes })
+    }
+
+    /// Pairs bytes with a commit directly; test fixtures only.
+    #[cfg(test)]
+    pub(crate) fn for_tests(commit: ApprovedCommit, bytes: Vec<u8>) -> Self {
+        Self { commit, bytes }
+    }
+
+    /// Returns the approved commit these bytes belong to.
+    pub(crate) fn commit(&self) -> &ApprovedCommit {
+        &self.commit
+    }
+
+    /// Returns the exact approved-source policy bytes.
+    pub(crate) fn bytes(&self) -> &[u8] {
+        &self.bytes
+    }
+}
+
+/// The root of an independently transferred source snapshot for an explicit
+/// approved commit.
+///
+/// The root directory is opened once at construction and held, so later
+/// reads resolve relative to that descriptor rather than a re-resolved path.
+/// Offline checks establish build proof only, never official deployment.
+#[derive(Debug)]
+pub(crate) struct ApprovedSourceRoot {
+    commit: ApprovedCommit,
+    directory: OwnedFd,
+}
+
+impl ApprovedSourceRoot {
+    /// Returns the independently approved source commit.
+    pub(crate) fn commit(&self) -> &ApprovedCommit {
+        &self.commit
+    }
+
+    /// Opens an absolute snapshot root directory bound to its approved commit.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::PolicyFetch`] unless `root` is an absolute
+    /// directory that can be opened.
+    pub(crate) fn new(commit: ApprovedCommit, root: &Path) -> Result<Self, Report<ReleaseError>> {
+        if !root.is_absolute() {
+            return Err(report(
+                ReleaseError::PolicyFetch,
+                "approved source root must be absolute",
+            ));
+        }
+        let directory = OpenOptions::new()
+            .read(true)
+            .custom_flags(libc::O_DIRECTORY | libc::O_CLOEXEC)
+            .open(root)
+            .map_err(|source| {
+                report(
+                    ReleaseError::PolicyFetch,
+                    format!("cannot open approved source root: {source}"),
+                )
+            })?;
+        Ok(Self {
+            commit,
+            directory: OwnedFd::from(directory),
+        })
+    }
+}
+
+fn open_at(directory: &OwnedFd, name: &str, flags: libc::c_int) -> io::Result<OwnedFd> {
+    let name = CString::new(name).map_err(io::Error::other)?;
+    // SAFETY: `name` is a NUL-terminated string that outlives the call and
+    // `directory` is an open descriptor borrowed for its duration. No
+    // `O_CREAT` flag is passed, so no mode argument is read.
+    let descriptor = unsafe { libc::openat(directory.as_raw_fd(), name.as_ptr(), flags) };
+    if descriptor < 0 {
+        return Err(io::Error::last_os_error());
+    }
+    // SAFETY: `openat` just returned this new descriptor; nothing else owns it.
+    Ok(unsafe { OwnedFd::from_raw_fd(descriptor) })
+}
+
+/// Reads `crates/trusted-server-cli/release-policy.json` under an approved
+/// snapshot root.
+///
+/// Every component is opened with `openat` relative to the previously held
+/// descriptor using `O_NOFOLLOW` (directories also `O_DIRECTORY`), so no
+/// symlink is ever followed and no path is re-resolved; the file is then
+/// checked with `fstat` on its own descriptor.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::PolicyFetch`] for a symlinked or missing
+/// component, a non-regular or oversize policy file, or a read failure.
+pub(crate) fn read_approved_snapshot(
+    root: &ApprovedSourceRoot,
+) -> Result<ApprovedSourcePolicy, Report<ReleaseError>> {
+    let mut current = root
+        .directory
+        .try_clone()
+        .map_err(|source| report(ReleaseError::PolicyFetch, source))?;
+    for name in POLICY_DIRECTORIES {
+        current = open_at(
+            &current,
+            name,
+            libc::O_RDONLY | libc::O_DIRECTORY | libc::O_NOFOLLOW | libc::O_CLOEXEC,
+        )
+        .map_err(|source| {
+            report(
+                ReleaseError::PolicyFetch,
+                format!("approved source component `{name}` must be a real directory: {source}"),
+            )
+        })?;
+    }
+    let file = File::from(
+        open_at(
+            &current,
+            POLICY_FILE,
+            libc::O_RDONLY | libc::O_NOFOLLOW | libc::O_NONBLOCK | libc::O_CLOEXEC,
+        )
+        .map_err(|source| {
+            report(
+                ReleaseError::PolicyFetch,
+                format!("cannot open approved source policy: {source}"),
+            )
+        })?,
+    );
+    let held = file
+        .metadata()
+        .map_err(|source| report(ReleaseError::PolicyFetch, source))?;
+    if !held.is_file() || held.len() > bounds::POLICY_BYTES {
+        return Err(report(
+            ReleaseError::PolicyFetch,
+            "approved source policy must be a regular file of at most 1 MiB",
+        ));
+    }
+    let mut bytes = Vec::new();
+    file.take(bounds::POLICY_BYTES + 1)
+        .read_to_end(&mut bytes)
+        .map_err(|source| report(ReleaseError::PolicyFetch, source))?;
+    ApprovedSourcePolicy::bounded(root.commit.clone(), bytes)
+}
+
+/// Builds the fixed read-only Contents API request.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::PolicyFetch`] if the request cannot be encoded.
+pub(crate) fn policy_request(
+    commit: &ApprovedCommit,
+    token: &GithubToken,
+) -> Result<Request, Report<ReleaseError>> {
+    let url = Url::parse(&format!("{POLICY_CONTENTS_URL}?ref={}", commit.as_str()))
+        .map_err(|source| report(ReleaseError::PolicyFetch, source))?;
+    let mut request = Request::new(Method::GET, url);
+    let mut authorization =
+        HeaderValue::from_str(&format!("Bearer {}", token.expose())).map_err(|_| {
+            report(
+                ReleaseError::PolicyFetch,
+                "GitHub token is not a valid header value",
+            )
+        })?;
+    authorization.set_sensitive(true);
+    let headers = request.headers_mut();
+    headers.insert(ACCEPT, HeaderValue::from_static(RAW_MEDIA_TYPE));
+    headers.insert(
+        HeaderName::from_static("x-github-api-version"),
+        HeaderValue::from_static(API_VERSION),
+    );
+    headers.insert(USER_AGENT, HeaderValue::from_static("trusted-server-cli"));
+    headers.insert(AUTHORIZATION, authorization);
+    Ok(request)
+}
+
+/// Builds the HTTPS client used for policy acquisition.
+///
+/// Redirects are never followed, so a credential is never forwarded to a
+/// different origin or path; any 3xx is then rejected by
+/// [`check_policy_response`].
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::PolicyFetch`] if the client cannot be built.
+pub(crate) fn policy_client() -> Result<Client, Report<ReleaseError>> {
+    no_redirect_builder()
+        .https_only(true)
+        .build()
+        .map_err(|source| report(ReleaseError::PolicyFetch, source))
+}
+
+/// The shared policy-client configuration: no redirect is ever followed.
+fn no_redirect_builder() -> ClientBuilder {
+    crate::tls::install_crypto_provider();
+    Client::builder()
+        .no_proxy()
+        .redirect(reqwest::redirect::Policy::none())
+}
+
+/// Builds the production client configuration without `https_only`, so a
+/// local plain-HTTP server can prove redirects are returned, not followed.
+#[cfg(test)]
+pub(crate) fn plain_http_policy_client_for_tests() -> Result<Client, Report<ReleaseError>> {
+    no_redirect_builder()
+        .build()
+        .map_err(|source| report(ReleaseError::PolicyFetch, source))
+}
+
+/// Validates response status, final URL and declared length.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::PolicyFetch`] for redirects, non-200 statuses, a
+/// final URL differing from the request, or a declared length over 1 MiB.
+pub(crate) fn check_policy_response(
+    request_url: &Url,
+    status: StatusCode,
+    final_url: &Url,
+    content_length: Option<u64>,
+) -> Result<(), Report<ReleaseError>> {
+    if status.is_redirection() {
+        return Err(report(
+            ReleaseError::PolicyFetch,
+            format!("policy endpoint redirected ({status}); redirects are rejected"),
+        ));
+    }
+    if status != StatusCode::OK {
+        return Err(report(
+            ReleaseError::PolicyFetch,
+            format!("policy endpoint returned {status}"),
+        ));
+    }
+    if final_url != request_url {
+        return Err(report(
+            ReleaseError::PolicyFetch,
+            "policy response origin or path differs from the fixed endpoint",
+        ));
+    }
+    if content_length.is_some_and(|length| length > bounds::POLICY_BYTES) {
+        return Err(report(
+            ReleaseError::PolicyFetch,
+            "policy response declares more than 1 MiB",
+        ));
+    }
+    Ok(())
+}
+
+/// Accumulates a streamed response body, rejecting it once the total would
+/// exceed a fixed byte limit.
+#[derive(Debug)]
+pub(crate) struct BoundedBody {
+    bytes: Vec<u8>,
+    limit: u64,
+}
+
+impl BoundedBody {
+    /// Starts an empty body that accepts at most `limit` bytes in total.
+    pub(crate) fn new(limit: u64) -> Self {
+        Self {
+            bytes: Vec::new(),
+            limit,
+        }
+    }
+
+    /// Appends one chunk.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::PolicyFetch`] once the limit would be exceeded.
+    pub(crate) fn push(&mut self, chunk: &[u8]) -> Result<(), Report<ReleaseError>> {
+        if chunk.len() as u64 > self.limit.saturating_sub(self.bytes.len() as u64) {
+            return Err(report(
+                ReleaseError::PolicyFetch,
+                "policy response exceeds 1 MiB",
+            ));
+        }
+        self.bytes.extend_from_slice(chunk);
+        Ok(())
+    }
+
+    /// Returns the accumulated bytes.
+    pub(crate) fn into_bytes(self) -> Vec<u8> {
+        self.bytes
+    }
+}
+
+/// Fetches producer-policy bytes from the fixed endpoint at an approved commit.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Timeout`] when the attempt deadline elapses and
+/// [`ReleaseError::PolicyFetch`] for transport, status, redirect, origin or
+/// size failures. Diagnostics never include the credential.
+pub(crate) async fn fetch_approved_policy(
+    client: &Client,
+    commit: &ApprovedCommit,
+    token: &GithubToken,
+    deadline: AttemptDeadline,
+) -> Result<ApprovedSourcePolicy, Report<ReleaseError>> {
+    // Check first: an elapsed deadline must not start any network activity.
+    if std::time::Instant::now() >= deadline.instant() {
+        return Err(report(
+            ReleaseError::Timeout,
+            "policy acquisition deadline already elapsed",
+        ));
+    }
+    let request = policy_request(commit, token)?;
+    let request_url = request.url().clone();
+    let fetch =
+        async {
+            let mut response = client.execute(request).await.map_err(|error| {
+                report(ReleaseError::PolicyFetch, token.redact(&error.to_string()))
+            })?;
+            check_policy_response(
+                &request_url,
+                response.status(),
+                response.url(),
+                response.content_length(),
+            )?;
+            let mut body = BoundedBody::new(bounds::POLICY_BYTES);
+            while let Some(chunk) = response.chunk().await.map_err(|error| {
+                report(ReleaseError::PolicyFetch, token.redact(&error.to_string()))
+            })? {
+                body.push(&chunk)?;
+            }
+            ApprovedSourcePolicy::bounded(commit.clone(), body.into_bytes())
+        };
+    tokio::time::timeout_at(tokio::time::Instant::from_std(deadline.instant()), fetch)
+        .await
+        .map_err(|_| {
+            report(
+                ReleaseError::Timeout,
+                "policy acquisition exceeded the deadline",
+            )
+        })?
+}
diff --git a/crates/trusted-server-cli/src/release/tests/documents/mod.rs b/crates/trusted-server-cli/src/release/tests/documents/mod.rs
new file mode 100644
index 0000000000..657590dfc1
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/tests/documents/mod.rs
@@ -0,0 +1,668 @@
+//! Strict document, embedded policy, producer-policy identity and approved
+//! source policy acquisition tests.
+
+use std::fs;
+use std::io::{Read as _, Write as _};
+use std::net::TcpListener;
+use std::os::unix::fs::symlink;
+use std::path::Path;
+use std::time::{Duration, Instant};
+
+use error_stack::Report;
+use reqwest::StatusCode;
+use reqwest::header::{ACCEPT, AUTHORIZATION};
+use serde_json::{Value, json};
+use url::Url;
+
+use crate::release::bounds::{self, AttemptDeadline, ProcessBounds};
+use crate::release::documents::{
+    ApprovedCommit, ApprovedRelease, ReleaseIndex, ReleaseTag, Role, parse_json,
+    parse_release_index, schema_accepts, sha256_hex, validate_index_schema,
+};
+use crate::release::environment::{CallerEnvironment, GithubToken};
+use crate::release::error::ReleaseError;
+use crate::release::policy::{
+    AcceptanceRules, AcceptedProducerPolicy, ConsumerPolicy, EMBEDDED_POLICY, GITHUB_HOST,
+    HISTORICAL_PRODUCER_POLICIES, HistoricalPolicy, REPOSITORY, SIGNER_WORKFLOW_PREFIX,
+    accept_producer_policy, embedded_policy, parse_consumer_policy,
+};
+use crate::release::source_policy::{
+    ApprovedSourcePolicy, ApprovedSourceRoot, BoundedBody, POLICY_CONTENTS_URL,
+    check_policy_response, fetch_approved_policy, plain_http_policy_client_for_tests,
+    policy_client, policy_request, read_approved_snapshot,
+};
+
+mod producer;
+
+const INDEX_FIXTURE: &[u8] =
+    include_bytes!("../../../../tests/fixtures/release/release-index.json");
+const COMMIT: &str = "0123456789abcdef0123456789abcdef01234567";
+const OTHER_COMMIT: &str = "89abcdef0123456789abcdef0123456789abcdef";
+const TOKEN: &str = "fictional-read-only-token-0000";
+
+fn context<T: core::fmt::Debug>(result: Result<T, Report<ReleaseError>>) -> ReleaseError {
+    *result.expect_err("should reject input").current_context()
+}
+
+fn policy() -> ConsumerPolicy {
+    embedded_policy().expect("should accept the embedded consumer policy")
+}
+
+fn commit() -> ApprovedCommit {
+    ApprovedCommit::parse(COMMIT).expect("should accept fictional approved commit")
+}
+
+fn approved_release() -> ApprovedRelease {
+    ApprovedRelease::new(
+        ReleaseTag::parse("v1.2.0").expect("should accept fictional tag"),
+        commit(),
+    )
+}
+
+fn index_value() -> Value {
+    let mut value = parse_json(INDEX_FIXTURE, Role::Index).expect("should parse index fixture");
+    value["policy_sha256"] = json!(sha256_hex(EMBEDDED_POLICY));
+    value
+}
+
+fn encode(value: &Value) -> Vec<u8> {
+    serde_json::to_vec(value).expect("should encode JSON fixture")
+}
+
+fn parse_index(value: &Value) -> Result<ReleaseIndex, Report<ReleaseError>> {
+    parse_release_index(&encode(value), &policy(), &approved_release())
+}
+
+fn embedded_policy_value() -> Value {
+    parse_json(EMBEDDED_POLICY, Role::Policy).expect("should parse embedded policy")
+}
+
+fn source_policy(bytes: &[u8]) -> ApprovedSourcePolicy {
+    ApprovedSourcePolicy::for_tests(commit(), bytes.to_vec())
+}
+
+fn token() -> GithubToken {
+    GithubToken::select(&CallerEnvironment::from_pairs([("GH_TOKEN", TOKEN)]))
+        .expect("should select explicit token")
+}
+
+// Strict JSON.
+
+#[test]
+fn strict_json_rejects_duplicate_keys_at_every_depth() {
+    for text in [
+        r#"{"a":1,"a":2}"#,
+        r#"{"outer":{"inner":[{"k":1,"k":1}]}}"#,
+        r#"{"a":1,"a":2}"#,
+    ] {
+        assert_eq!(
+            context(parse_json(text.as_bytes(), Role::Index)),
+            ReleaseError::Document,
+            "should reject duplicate key in {text}"
+        );
+    }
+}
+
+#[test]
+fn strict_json_rejects_depth_beyond_sixty_four_including_root() {
+    let accepted = format!("{}{}", "[".repeat(64), "]".repeat(64));
+    let rejected = format!("{}{}", "[".repeat(65), "]".repeat(65));
+
+    assert!(
+        parse_json(accepted.as_bytes(), Role::Index).is_ok(),
+        "should accept depth 64"
+    );
+    assert_eq!(
+        context(parse_json(rejected.as_bytes(), Role::Index)),
+        ReleaseError::Document,
+        "should reject depth 65"
+    );
+}
+
+#[test]
+fn strict_json_rejects_oversize_before_parsing() {
+    let mut oversized = vec![b' '; usize::try_from(bounds::INDEX_BYTES).expect("should fit")];
+    oversized.extend_from_slice(b"{}");
+
+    assert_eq!(
+        context(parse_json(&oversized, Role::Index)),
+        ReleaseError::Document,
+        "should reject index over 1 MiB"
+    );
+    assert!(
+        parse_json(&oversized, Role::Bundle).is_ok(),
+        "should accept the same bytes under the larger bundle bound"
+    );
+}
+
+#[test]
+fn strict_json_role_limits_match_bounds() {
+    assert_eq!(Role::Index.limit(), bounds::INDEX_BYTES, "index bound");
+    assert_eq!(Role::Policy.limit(), bounds::POLICY_BYTES, "policy bound");
+    assert_eq!(
+        Role::Inventory.limit(),
+        bounds::INVENTORY_BYTES,
+        "inventory bound"
+    );
+    assert_eq!(Role::Bundle.limit(), bounds::BUNDLE_BYTES, "bundle bound");
+    assert_eq!(
+        Role::Companion.limit(),
+        bounds::COMPANION_BYTES,
+        "companion bound"
+    );
+    assert_eq!(Role::Spdx.limit(), bounds::SPDX_BYTES, "SPDX bound");
+    assert_eq!(
+        Role::GhOutput.limit(),
+        bounds::STDOUT_BYTES,
+        "gh stdout bound"
+    );
+}
+
+#[test]
+fn strict_json_rejects_bom_invalid_utf8_and_trailing_data() {
+    for bytes in [
+        b"\xef\xbb\xbf{}".as_slice(),
+        b"{\"a\":\"\xff\"}".as_slice(),
+        b"{} {}".as_slice(),
+        b"{}x".as_slice(),
+        br#"{"a":"\ud800"}"#.as_slice(),
+    ] {
+        assert_eq!(
+            context(parse_json(bytes, Role::Index)),
+            ReleaseError::Document,
+            "should reject {bytes:?}"
+        );
+    }
+}
+
+#[test]
+fn strict_json_rejects_integer_overflow_lexically() {
+    for text in [
+        "18446744073709551616",
+        "-9223372036854775809",
+        r#"{"deep":[[{"n":18446744073709551616}]]}"#,
+        "1e999",
+        "-1e999",
+    ] {
+        assert_eq!(
+            context(parse_json(text.as_bytes(), Role::Index)),
+            ReleaseError::Document,
+            "should reject out-of-range number {text}"
+        );
+    }
+    for text in [
+        "18446744073709551615",
+        "-9223372036854775808",
+        r#"{"text":"18446744073709551616 1e999 \" \\"}"#,
+    ] {
+        assert!(
+            parse_json(text.as_bytes(), Role::Index).is_ok(),
+            "should accept boundary or quoted text {text}"
+        );
+    }
+}
+
+#[test]
+fn sha256_matches_known_vector() {
+    assert_eq!(
+        sha256_hex(b"abc"),
+        "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad",
+        "should compute SHA-256 of exact bytes"
+    );
+}
+
+// Embedded consumer policy.
+
+#[test]
+fn embedded_policy_identity_is_external_exact_byte_digest() {
+    let policy = policy();
+
+    assert_eq!(policy.version(), 1, "should be consumer policy v1");
+    assert_eq!(
+        policy.sha256(),
+        sha256_hex(EMBEDDED_POLICY),
+        "should hash the exact embedded bytes"
+    );
+    assert!(
+        !String::from_utf8_lossy(EMBEDDED_POLICY).contains(policy.sha256()),
+        "should not contain its own digest"
+    );
+    assert!(
+        HISTORICAL_PRODUCER_POLICIES.is_empty(),
+        "should start with an empty reviewed historical allowlist"
+    );
+}
+
+fn reject_policy(mutate: impl FnOnce(&mut Value), reason: &str) {
+    let mut value = embedded_policy_value();
+    mutate(&mut value);
+
+    assert_eq!(
+        context(parse_consumer_policy(&encode(&value))),
+        ReleaseError::Policy,
+        "should reject policy: {reason}"
+    );
+}
+
+#[test]
+fn policy_rejects_unknown_kind() {
+    reject_policy(
+        |value| value["artifacts"][0]["kind"] = json!("archive"),
+        "unknown kind",
+    );
+}
+
+#[test]
+fn policy_rejects_kind_swapped_between_artifacts() {
+    reject_policy(
+        |value| value["artifacts"][1]["kind"] = json!("wasm-core"),
+        "native CLI declared as wasm-core",
+    );
+}
+
+#[test]
+fn policy_rejects_unknown_profile() {
+    reject_policy(
+        |value| value["artifacts"][1]["assurance_profile"] = json!("provenance-only"),
+        "unknown profile",
+    );
+}
+
+#[test]
+fn policy_rejects_profile_downgrade() {
+    reject_policy(
+        |value| value["artifacts"][0]["assurance_profile"] = json!("provenance-sbom"),
+        "server without repeatable rebuild",
+    );
+}
+
+#[test]
+fn policy_rejects_unknown_action() {
+    reject_policy(
+        |value| value["artifacts"][0]["actions"] = json!(["readonly-verify", "deploy"]),
+        "unknown action",
+    );
+    reject_policy(
+        |value| value["public_actions"] = json!(["deploy"]),
+        "unknown public action",
+    );
+}
+
+#[test]
+fn policy_rejects_fastly_staging_capability() {
+    reject_policy(
+        |value| {
+            value["artifacts"][0]["capabilities"] = json!(["fastly-production", "fastly-staging"]);
+        },
+        "structurally possible fastly-staging",
+    );
+}
+
+#[test]
+fn policy_rejects_unknown_capability_and_fields() {
+    reject_policy(
+        |value| value["artifacts"][1]["capabilities"] = json!(["cli-admin"]),
+        "unknown capability",
+    );
+    reject_policy(
+        |value| value["artifacts"][1]["extra"] = json!(true),
+        "unknown artifact field",
+    );
+    reject_policy(
+        |value| value["extra"] = json!(true),
+        "unknown top-level field",
+    );
+}
+
+#[test]
+fn policy_rejects_changed_identity_and_bounds() {
+    reject_policy(|value| value["repository_id"] = json!("1"), "repository id");
+    reject_policy(
+        |value| value["identity"]["issuer"] = json!("https://issuer.example.com"),
+        "issuer",
+    );
+    reject_policy(
+        |value| value["bounds"]["child_seconds"] = json!(121),
+        "child bound",
+    );
+    reject_policy(
+        |value| value["github_host"] = json!("ghe.example.com"),
+        "github host",
+    );
+}
+
+#[test]
+fn policy_rejects_unsupported_tool_version() {
+    reject_policy(
+        |value| value["tool_versions"]["gh"] = json!("2.98.0"),
+        "gh version",
+    );
+    reject_policy(
+        |value| value["tool_versions"]["actions_attest_revision"] = json!("0".repeat(40)),
+        "attest revision",
+    );
+}
+
+#[test]
+fn policy_rejects_nonempty_json_historical_list_not_compiled() {
+    reject_policy(
+        |value| {
+            value["historical_producer_policies"] =
+                json!([{"policy_version": 1, "policy_sha256": "d".repeat(64)}]);
+        },
+        "historical list that is not the compiled allowlist",
+    );
+}
+
+// Governing JSON Schema.
+
+#[test]
+fn governing_schema_accepts_fixture() {
+    validate_index_schema(&index_value()).expect("should accept the closed fixture");
+}
+
+/// A named mutation of the index fixture.
+type Mutation = (&'static str, fn(&mut Value));
+
+#[test]
+fn governing_schema_rejects_structural_violations() {
+    let mutations: [Mutation; 8] = [
+        ("CLI asset as server", |value| {
+            value["artifacts"][3]["role"] = json!("server");
+        }),
+        ("unknown kind", |value| {
+            value["artifacts"][0]["kind"] = json!("archive");
+        }),
+        ("fifth artifact", |value| {
+            let first = value["artifacts"][0].clone();
+            value["artifacts"]
+                .as_array_mut()
+                .expect("should hold artifacts")
+                .push(first);
+        }),
+        ("traversal companion name", |value| {
+            value["artifacts"][0]["companions"]["sbom"]["name"] = json!("../escape.spdx.json");
+        }),
+        ("uppercase digest", |value| {
+            value["artifacts"][0]["sha256"] = json!("A".repeat(64));
+        }),
+        ("oversize SBOM", |value| {
+            value["artifacts"][0]["companions"]["sbom"]["size"] = json!(bounds::SPDX_BYTES + 1);
+        }),
+        ("extra field", |value| {
+            value["artifacts"][1]["extra"] = json!(true);
+        }),
+        ("wrong compatibility pairing", |value| {
+            value["artifacts"][1]["compatibility"]["minimum_version"] = json!("glibc-2.34");
+        }),
+    ];
+
+    for (reason, mutate) in mutations {
+        let mut value = index_value();
+        mutate(&mut value);
+
+        assert_eq!(
+            context(validate_index_schema(&value)),
+            ReleaseError::Document,
+            "should reject {reason} in the schema step"
+        );
+    }
+}
+
+#[test]
+fn draft_202012_prefix_items_and_items_are_enforced() {
+    let schema = json!({
+        "type": "array",
+        "prefixItems": [{"const": "first"}, {"type": "integer"}],
+        "items": false
+    });
+
+    assert!(
+        schema_accepts(&schema, &json!(["first", 2])).expect("should compile 2020-12 schema"),
+        "should accept prefix items"
+    );
+    for value in [
+        json!(["wrong", 2]),
+        json!(["first", "wrong"]),
+        json!(["first", 2, 3]),
+    ] {
+        assert!(
+            !schema_accepts(&schema, &value).expect("should compile 2020-12 schema"),
+            "should reject invalid prefix or additional item {value}"
+        );
+    }
+}
+
+#[test]
+fn schema_evaluation_never_retrieves_remote_references() {
+    let schema = json!({"$ref": "https://schemas.example.com/remote.json"});
+
+    assert!(
+        schema_accepts(&schema, &json!({})).is_err(),
+        "should refuse to resolve an external reference offline"
+    );
+}
+
+// Release index.
+
+#[test]
+fn index_fixture_matches_closed_contract() {
+    let index = parse_index(&index_value()).expect("should accept the closed fixture");
+
+    assert_eq!(index.artifacts.len(), 4, "should keep four artifacts");
+    assert_eq!(
+        index.policy_version, 1,
+        "should keep producer policy version"
+    );
+}
+
+fn reject_index(mutate: impl FnOnce(&mut Value), expected: ReleaseError, reason: &str) {
+    let mut value = index_value();
+    mutate(&mut value);
+
+    assert_eq!(
+        context(parse_index(&value)),
+        expected,
+        "should reject index: {reason}"
+    );
+}
+
+#[test]
+fn index_rejects_unknown_schema_version_and_fields() {
+    reject_index(
+        |value| value["schema_version"] = json!(2),
+        ReleaseError::Policy,
+        "v2",
+    );
+    reject_index(
+        |value| value["extra"] = json!(1),
+        ReleaseError::Document,
+        "extra field",
+    );
+    reject_index(
+        |value| value["artifacts"][0]["companions"]["extra"] = value["tsjs_inventory"].clone(),
+        ReleaseError::Document,
+        "extra companion",
+    );
+}
+
+#[test]
+fn index_rejects_cli_as_server_substitution() {
+    reject_index(
+        |value| {
+            value["artifacts"][3]["role"] = json!("server");
+            value["artifacts"][3]["capabilities"] = json!(["fastly-production"]);
+        },
+        ReleaseError::Policy,
+        "ts asset claiming server role and fastly-production",
+    );
+    reject_index(
+        |value| value["artifacts"][3]["capabilities"] = json!(["fastly-production"]),
+        ReleaseError::Policy,
+        "ts asset claiming fastly-production",
+    );
+}
+
+#[test]
+fn index_rejects_role_only_mismatch() {
+    reject_index(
+        |value| value["artifacts"][3]["role"] = json!("server"),
+        ReleaseError::Policy,
+        "ts asset claiming server role with its own cli-execute capability",
+    );
+}
+
+#[test]
+fn index_rejects_fastly_staging_capability() {
+    reject_index(
+        |value| {
+            value["artifacts"][0]["capabilities"] = json!(["fastly-production", "fastly-staging"]);
+        },
+        ReleaseError::Policy,
+        "structurally valid but policy-forbidden fastly-staging",
+    );
+}
+
+#[test]
+fn index_rejects_unknown_kind_profile_and_capability() {
+    reject_index(
+        |value| value["artifacts"][0]["kind"] = json!("archive"),
+        ReleaseError::Policy,
+        "unknown kind",
+    );
+    reject_index(
+        |value| value["artifacts"][1]["assurance_profile"] = json!("none"),
+        ReleaseError::Policy,
+        "unknown profile",
+    );
+    reject_index(
+        |value| value["artifacts"][1]["capabilities"] = json!(["cli-admin"]),
+        ReleaseError::Policy,
+        "unknown capability",
+    );
+    reject_index(
+        |value| value["artifacts"][1]["target"] = json!("x86_64-apple-darwin"),
+        ReleaseError::Policy,
+        "target swap",
+    );
+}
+
+#[test]
+fn index_rejects_duplicate_and_unknown_artifact_names() {
+    reject_index(
+        |value| value["artifacts"][2] = value["artifacts"][1].clone(),
+        ReleaseError::Policy,
+        "duplicate artifact",
+    );
+    reject_index(
+        |value| value["artifacts"][1]["name"] = json!("ts-extra"),
+        ReleaseError::Policy,
+        "unknown artifact",
+    );
+    reject_index(
+        |value| {
+            value["artifacts"]
+                .as_array_mut()
+                .expect("should hold artifacts")
+                .pop();
+        },
+        ReleaseError::Policy,
+        "three artifacts",
+    );
+}
+
+#[test]
+fn index_rejects_unsafe_names_and_companion_naming() {
+    for name in [
+        "../escape.spdx.json",
+        "dir/name.spdx.json",
+        "dir\\name.spdx.json",
+        "line\nbreak.spdx.json",
+        ".hidden.spdx.json",
+    ] {
+        reject_index(
+            |value| value["artifacts"][0]["companions"]["sbom"]["name"] = json!(name),
+            ReleaseError::Policy,
+            "unsafe companion name",
+        );
+    }
+    reject_index(
+        |value| {
+            value["artifacts"][0]["companions"]["sbom"]["name"] =
+                json!("ts-aarch64-apple-darwin.spdx.json");
+        },
+        ReleaseError::Policy,
+        "companion naming another artifact",
+    );
+    reject_index(
+        |value| value["tsjs_inventory"]["name"] = json!("inventory.json"),
+        ReleaseError::Policy,
+        "inventory name",
+    );
+}
+
+#[test]
+fn index_rejects_bad_digests_lengths_and_commits() {
+    reject_index(
+        |value| value["artifacts"][0]["sha256"] = json!("A".repeat(64)),
+        ReleaseError::Policy,
+        "uppercase digest",
+    );
+    reject_index(
+        |value| value["artifacts"][0]["size"] = json!(-1),
+        ReleaseError::Document,
+        "negative length",
+    );
+    reject_index(
+        |value| value["artifacts"][0]["size"] = json!(1.5),
+        ReleaseError::Document,
+        "fractional length",
+    );
+    reject_index(
+        |value| value["artifacts"][0]["size"] = json!(9_007_199_254_740_992_u64),
+        ReleaseError::Document,
+        "unsafe integer",
+    );
+    reject_index(
+        |value| value["artifacts"][0]["companions"]["sbom"]["size"] = json!(bounds::SPDX_BYTES + 1),
+        ReleaseError::Policy,
+        "SBOM over 16 MiB",
+    );
+    reject_index(
+        |value| value["recipe_source_commit"] = json!(OTHER_COMMIT),
+        ReleaseError::Policy,
+        "recipe source differs",
+    );
+    reject_index(
+        |value| value["source_commit"] = json!(OTHER_COMMIT),
+        ReleaseError::Policy,
+        "source not approved",
+    );
+    reject_index(
+        |value| value["tag"] = json!("v1.2.1"),
+        ReleaseError::Policy,
+        "tag not approved",
+    );
+    reject_index(
+        |value| value["artifacts"][1]["js_inventory_sha256"] = json!("e".repeat(64)),
+        ReleaseError::Policy,
+        "mismatched JS inventory",
+    );
+}
+
+#[test]
+fn approved_inputs_reject_malformed_commit_and_tag() {
+    for commit in ["0123", &COMMIT.to_uppercase(), &format!("{COMMIT}\n")] {
+        assert!(
+            ApprovedCommit::parse(commit).is_err(),
+            "should reject commit {commit:?}"
+        );
+    }
+    for tag in ["1.2.0", "v1.2", "v01.2.0", "v1.2.0\n", "-v1.2.0"] {
+        assert!(ReleaseTag::parse(tag).is_err(), "should reject tag {tag:?}");
+    }
+    assert!(
+        ReleaseTag::parse("v1.2.0-rc.1+build.5").is_ok(),
+        "should accept SemVer tag"
+    );
+}
diff --git a/crates/trusted-server-cli/src/release/tests/documents/producer.rs b/crates/trusted-server-cli/src/release/tests/documents/producer.rs
new file mode 100644
index 0000000000..58192a9dee
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/tests/documents/producer.rs
@@ -0,0 +1,605 @@
+//! Producer-policy identity binding and approved-source policy acquisition.
+
+use super::*;
+
+// Producer policy identity.
+
+fn index_with_policy(version: u64, sha256: &str) -> ReleaseIndex {
+    let mut value = index_value();
+    value["policy_version"] = json!(version);
+    value["policy_sha256"] = json!(sha256);
+    parse_index(&value).expect("should accept structurally valid index")
+}
+
+#[test]
+fn producer_policy_accepts_current_embedded_identity() {
+    let policy = policy();
+    let index = index_with_policy(1, policy.sha256());
+
+    let accepted = accept_producer_policy(
+        &index,
+        &source_policy(EMBEDDED_POLICY),
+        &AcceptanceRules::compiled(&policy),
+    )
+    .expect("should accept current producer policy");
+
+    assert_eq!(
+        accepted,
+        AcceptedProducerPolicy::Current,
+        "should be current policy"
+    );
+}
+
+#[test]
+fn producer_policy_rejects_self_selected_policy() {
+    let policy = policy();
+    let mut shipped = embedded_policy_value();
+    shipped["bounds"]["child_seconds"] = json!(86_400);
+    let shipped = encode(&shipped);
+    let index = index_with_policy(1, &sha256_hex(&shipped));
+
+    assert_eq!(
+        context(accept_producer_policy(
+            &index,
+            &source_policy(EMBEDDED_POLICY),
+            &AcceptanceRules::compiled(&policy),
+        )),
+        ReleaseError::ProducerPolicy,
+        "should reject index digest naming a policy it ships"
+    );
+    assert_eq!(
+        context(accept_producer_policy(
+            &index,
+            &source_policy(&shipped),
+            &AcceptanceRules::compiled(&policy),
+        )),
+        ReleaseError::ProducerPolicy,
+        "should reject self-consistent policy that is neither current nor reviewed"
+    );
+}
+
+#[test]
+fn producer_policy_rejects_altered_approved_source_bytes() {
+    let policy = policy();
+    let index = index_with_policy(1, policy.sha256());
+    let mut altered = EMBEDDED_POLICY.to_vec();
+    altered.push(b'\n');
+
+    assert_eq!(
+        context(accept_producer_policy(
+            &index,
+            &source_policy(&altered),
+            &AcceptanceRules::compiled(&policy),
+        )),
+        ReleaseError::ProducerPolicy,
+        "should reject approved-source bytes that differ from the index identity"
+    );
+}
+
+#[test]
+fn producer_policy_rejects_source_commit_mismatch() {
+    let policy = policy();
+    let index = index_with_policy(1, policy.sha256());
+    let other = ApprovedSourcePolicy::for_tests(
+        ApprovedCommit::parse(OTHER_COMMIT).expect("should parse commit"),
+        EMBEDDED_POLICY.to_vec(),
+    );
+
+    assert_eq!(
+        context(accept_producer_policy(
+            &index,
+            &other,
+            &AcceptanceRules::compiled(&policy),
+        )),
+        ReleaseError::ProducerPolicy,
+        "should reject policy bytes approved for another commit"
+    );
+}
+
+fn historical_bytes() -> Vec<u8> {
+    let mut value = embedded_policy_value();
+    value["bounds"]["child_seconds"] = json!(60);
+    encode(&value)
+}
+
+#[test]
+fn producer_policy_accepts_reviewed_historical_under_newer_consumer() {
+    let historical = historical_bytes();
+    let digest = sha256_hex(&historical);
+    let allowlist = [HistoricalPolicy {
+        version: 1,
+        sha256: &digest,
+    }];
+    let newer = "f".repeat(64);
+    let rules = AcceptanceRules {
+        current_version: 2,
+        current_sha256: &newer,
+        historical: &allowlist,
+    };
+    let index = index_with_policy(1, &digest);
+
+    let accepted = accept_producer_policy(&index, &source_policy(&historical), &rules)
+        .expect("should accept reviewed historical v1");
+
+    assert_eq!(
+        accepted,
+        AcceptedProducerPolicy::Historical {
+            version: 1,
+            sha256: digest.clone(),
+        },
+        "should report the historical identity"
+    );
+}
+
+#[test]
+fn producer_policy_rejects_retired_historical_identity() {
+    let historical = historical_bytes();
+    let digest = sha256_hex(&historical);
+    let newer = "f".repeat(64);
+    let rules = AcceptanceRules {
+        current_version: 2,
+        current_sha256: &newer,
+        historical: &[],
+    };
+    let index = index_with_policy(1, &digest);
+
+    assert_eq!(
+        context(accept_producer_policy(
+            &index,
+            &source_policy(&historical),
+            &rules
+        )),
+        ReleaseError::ProducerPolicy,
+        "should reject identity retired from the allowlist"
+    );
+}
+
+#[test]
+fn producer_policy_rejects_allowlisted_digest_with_wrong_source() {
+    let historical = historical_bytes();
+    let digest = sha256_hex(&historical);
+    let allowlist = [HistoricalPolicy {
+        version: 1,
+        sha256: &digest,
+    }];
+    let newer = "f".repeat(64);
+    let rules = AcceptanceRules {
+        current_version: 2,
+        current_sha256: &newer,
+        historical: &allowlist,
+    };
+    let index = index_with_policy(1, &digest);
+
+    assert_eq!(
+        context(accept_producer_policy(
+            &index,
+            &source_policy(EMBEDDED_POLICY),
+            &rules
+        )),
+        ReleaseError::ProducerPolicy,
+        "should reject allowlisted digest when approved source bytes differ"
+    );
+}
+
+#[test]
+fn producer_policy_rejects_v2_under_consumer_v1() {
+    let policy = policy();
+    let mut producer = embedded_policy_value();
+    producer["policy_version"] = json!(2);
+    let producer = encode(&producer);
+    let index = index_with_policy(2, &sha256_hex(&producer));
+
+    let report = accept_producer_policy(
+        &index,
+        &source_policy(&producer),
+        &AcceptanceRules::compiled(&policy),
+    )
+    .expect_err("should reject producer v2");
+
+    assert_eq!(
+        *report.current_context(),
+        ReleaseError::ProducerPolicy,
+        "should be a producer policy rejection"
+    );
+    assert!(
+        format!("{report:?}").contains("unsupported producer policy version 2"),
+        "should explain the unsupported version: {report:?}"
+    );
+}
+
+// Approved-source policy acquisition.
+
+fn snapshot_root(contents: &[u8]) -> tempfile::TempDir {
+    let root = tempfile::tempdir().expect("should create snapshot root");
+    let directory = root.path().join("crates/trusted-server-cli");
+    fs::create_dir_all(&directory).expect("should create snapshot directories");
+    fs::write(directory.join("release-policy.json"), contents).expect("should write policy");
+    root
+}
+
+fn read_root(root: &Path) -> Result<ApprovedSourcePolicy, Report<ReleaseError>> {
+    let root = ApprovedSourceRoot::new(commit(), root)?;
+    read_approved_snapshot(&root)
+}
+
+#[test]
+fn approved_snapshot_reads_only_the_fixed_policy_path() {
+    let root = snapshot_root(EMBEDDED_POLICY);
+    fs::write(root.path().join("other.json"), b"{}").expect("should write decoy");
+
+    let snapshot = read_root(root.path()).expect("should read fixed policy path");
+
+    assert_eq!(snapshot.bytes(), EMBEDDED_POLICY, "should keep exact bytes");
+    assert_eq!(
+        snapshot.commit(),
+        &commit(),
+        "should bind the approved commit"
+    );
+}
+
+#[test]
+fn approved_snapshot_rejects_symlinked_policy_file() {
+    let root = snapshot_root(b"");
+    let target = root.path().join("elsewhere.json");
+    fs::write(&target, EMBEDDED_POLICY).expect("should write target");
+    let policy = root
+        .path()
+        .join("crates/trusted-server-cli/release-policy.json");
+    fs::remove_file(&policy).expect("should remove placeholder");
+    symlink(&target, &policy).expect("should create leaf symlink");
+
+    assert_eq!(
+        context(read_root(root.path())),
+        ReleaseError::PolicyFetch,
+        "should reject a symlinked policy file"
+    );
+}
+
+#[test]
+fn approved_snapshot_rejects_symlinked_directory_component() {
+    let root = tempfile::tempdir().expect("should create snapshot root");
+    let real = snapshot_root(EMBEDDED_POLICY);
+    fs::create_dir(root.path().join("crates")).expect("should create crates");
+    symlink(
+        real.path().join("crates/trusted-server-cli"),
+        root.path().join("crates/trusted-server-cli"),
+    )
+    .expect("should create directory symlink");
+
+    assert_eq!(
+        context(read_root(root.path())),
+        ReleaseError::PolicyFetch,
+        "should reject a symlinked directory component"
+    );
+}
+
+#[test]
+fn approved_snapshot_rejects_directory_at_policy_path() {
+    let root = snapshot_root(b"");
+    let policy = root
+        .path()
+        .join("crates/trusted-server-cli/release-policy.json");
+    fs::remove_file(&policy).expect("should remove placeholder");
+    fs::create_dir(&policy).expect("should create directory at policy path");
+
+    assert_eq!(
+        context(read_root(root.path())),
+        ReleaseError::PolicyFetch,
+        "should reject a non-regular policy path"
+    );
+}
+
+#[test]
+fn approved_snapshot_rejects_oversize_and_relative_root() {
+    let root = snapshot_root(&vec![b' '; 1024 * 1024 + 1]);
+
+    assert_eq!(
+        context(read_root(root.path())),
+        ReleaseError::PolicyFetch,
+        "should reject policy over 1 MiB"
+    );
+    assert!(
+        ApprovedSourceRoot::new(commit(), Path::new("relative/root")).is_err(),
+        "should require an absolute snapshot root"
+    );
+}
+
+#[test]
+fn historical_acceptance_keeps_consumer_bounds_in_force() {
+    let historical = historical_bytes();
+    let digest = sha256_hex(&historical);
+    let allowlist = [HistoricalPolicy {
+        version: 1,
+        sha256: &digest,
+    }];
+    let policy = policy();
+    let rules = AcceptanceRules {
+        historical: &allowlist,
+        ..AcceptanceRules::compiled(&policy)
+    };
+    let mut value = index_value();
+    value["policy_sha256"] = json!(digest);
+
+    let index = parse_index(&value).expect("should accept index");
+    let accepted = accept_producer_policy(&index, &source_policy(&historical), &rules)
+        .expect("should accept reviewed historical policy");
+
+    assert!(
+        matches!(accepted, AcceptedProducerPolicy::Historical { .. }),
+        "should accept the historical identity"
+    );
+    assert_eq!(
+        ProcessBounds::production().child_timeout,
+        Duration::from_secs(120),
+        "should keep the consumer's 120 s child bound, not the historical 60 s"
+    );
+    assert_eq!(
+        embedded_policy().expect("should reparse consumer policy"),
+        policy,
+        "should leave the consumer policy unchanged"
+    );
+    value["artifacts"][0]["companions"]["sbom"]["size"] = json!(bounds::SPDX_BYTES + 1);
+    assert_eq!(
+        context(parse_index(&value)),
+        ReleaseError::Policy,
+        "should keep enforcing consumer document bounds"
+    );
+}
+
+#[test]
+fn producer_policy_rejects_newer_version_even_if_allowlisted() {
+    let policy = policy();
+    let mut producer = embedded_policy_value();
+    producer["policy_version"] = json!(2);
+    let producer = encode(&producer);
+    let digest = sha256_hex(&producer);
+    let allowlist = [HistoricalPolicy {
+        version: 2,
+        sha256: &digest,
+    }];
+    let rules = AcceptanceRules {
+        historical: &allowlist,
+        ..AcceptanceRules::compiled(&policy)
+    };
+    let index = index_with_policy(2, &digest);
+
+    assert_eq!(
+        context(accept_producer_policy(
+            &index,
+            &source_policy(&producer),
+            &rules
+        )),
+        ReleaseError::ProducerPolicy,
+        "should reject a producer newer than the consumer before the allowlist"
+    );
+}
+
+#[test]
+fn policy_client_rejects_plain_http_without_connecting() {
+    let listener = TcpListener::bind("127.0.0.1:0").expect("should bind local listener");
+    listener
+        .set_nonblocking(true)
+        .expect("should make listener nonblocking");
+    let address = listener.local_addr().expect("should read local address");
+    let runtime = tokio::runtime::Builder::new_current_thread()
+        .enable_all()
+        .build()
+        .expect("should build runtime");
+    let client = policy_client().expect("should build policy client");
+
+    let result = runtime.block_on(client.get(format!("http://{address}/redirect")).send());
+
+    assert!(result.is_err(), "should refuse a plain HTTP URL");
+    assert_eq!(
+        listener.accept().map_err(|error| error.kind()).err(),
+        Some(std::io::ErrorKind::WouldBlock),
+        "should never connect to the local listener"
+    );
+}
+
+#[test]
+fn policy_fetch_respects_expired_attempt_deadline() {
+    let runtime = tokio::runtime::Builder::new_current_thread()
+        .enable_all()
+        .build()
+        .expect("should build runtime");
+    let client = policy_client().expect("should build policy client");
+    let expired = AttemptDeadline::at(Instant::now());
+
+    let result = runtime.block_on(fetch_approved_policy(&client, &commit(), &token(), expired));
+
+    assert_eq!(
+        context(result),
+        ReleaseError::Timeout,
+        "should time out before any request"
+    );
+}
+
+#[test]
+fn policy_request_targets_only_the_fixed_contents_endpoint() {
+    let request = policy_request(&commit(), &token()).expect("should build request");
+
+    assert_eq!(
+        request.url().as_str(),
+        format!(
+            "https://api.github.com/repos/IABTechLab/trusted-server/contents/crates/trusted-server-cli/release-policy.json?ref={COMMIT}" // allow-domain: api.github.com
+        ),
+        "should use the fixed endpoint and approved full commit"
+    );
+    assert_eq!(
+        request.url().as_str(),
+        format!("{POLICY_CONTENTS_URL}?ref={COMMIT}"),
+        "constant"
+    );
+    assert_eq!(request.method(), reqwest::Method::GET, "should only read");
+    assert_eq!(
+        request.headers()[ACCEPT],
+        "application/vnd.github.raw+json",
+        "should request raw media"
+    );
+    let authorization = &request.headers()[AUTHORIZATION];
+    assert!(
+        authorization.is_sensitive(),
+        "should mark credential sensitive"
+    );
+    assert_eq!(
+        authorization,
+        &format!("Bearer {TOKEN}"),
+        "should send explicit token"
+    );
+}
+
+#[test]
+fn policy_response_rejects_redirects_and_moved_origin_or_path() {
+    let request_url =
+        Url::parse(&format!("{POLICY_CONTENTS_URL}?ref={COMMIT}")).expect("should parse URL");
+    let other_host = Url::parse(&format!(
+        "https://objects.example.com/repos/IABTechLab/trusted-server/contents/crates/trusted-server-cli/release-policy.json?ref={COMMIT}"
+    ))
+    .expect("should parse URL");
+    let other_path = Url::parse(&format!(
+        "https://api.github.com/repos/IABTechLab/trusted-server/contents/README.md?ref={COMMIT}" // allow-domain: api.github.com
+    ))
+    .expect("should parse URL");
+
+    for status in [
+        StatusCode::MOVED_PERMANENTLY,
+        StatusCode::FOUND,
+        StatusCode::TEMPORARY_REDIRECT,
+        StatusCode::PERMANENT_REDIRECT,
+    ] {
+        assert_eq!(
+            context(check_policy_response(
+                &request_url,
+                status,
+                &request_url,
+                None
+            )),
+            ReleaseError::PolicyFetch,
+            "should reject redirect status {status}"
+        );
+    }
+    for final_url in [&other_host, &other_path] {
+        assert_eq!(
+            context(check_policy_response(
+                &request_url,
+                StatusCode::OK,
+                final_url,
+                None
+            )),
+            ReleaseError::PolicyFetch,
+            "should reject changed origin or path {final_url}"
+        );
+    }
+    assert_eq!(
+        context(check_policy_response(
+            &request_url,
+            StatusCode::NOT_FOUND,
+            &request_url,
+            None
+        )),
+        ReleaseError::PolicyFetch,
+        "should reject non-200"
+    );
+    assert_eq!(
+        context(check_policy_response(
+            &request_url,
+            StatusCode::OK,
+            &request_url,
+            Some(bounds::POLICY_BYTES + 1),
+        )),
+        ReleaseError::PolicyFetch,
+        "should reject declared oversize"
+    );
+    assert!(
+        check_policy_response(&request_url, StatusCode::OK, &request_url, Some(10)).is_ok(),
+        "should accept exact 200 response"
+    );
+}
+
+#[test]
+fn policy_body_stream_is_bounded() {
+    let mut body = BoundedBody::new(bounds::POLICY_BYTES);
+    let chunk = vec![b' '; 512 * 1024];
+
+    body.push(&chunk).expect("should accept first half");
+    body.push(&chunk).expect("should accept exact bound");
+
+    assert_eq!(
+        context(body.push(b"x")),
+        ReleaseError::PolicyFetch,
+        "should reject streamed byte past 1 MiB"
+    );
+}
+
+#[test]
+fn approved_source_policy_never_comes_from_index_fields() {
+    let mut value = index_value();
+    value["source_commit"] = json!(OTHER_COMMIT);
+    value["recipe_source_commit"] = json!(OTHER_COMMIT);
+    value["cohort_source_commit"] = json!(OTHER_COMMIT);
+
+    assert_eq!(
+        context(parse_index(&value)),
+        ReleaseError::Policy,
+        "should require independently approved source commit"
+    );
+}
+
+#[test]
+fn policy_client_returns_redirects_without_following() {
+    let listener = TcpListener::bind("127.0.0.1:0").expect("should bind local listener");
+    let address = listener.local_addr().expect("should read local address");
+    let server = std::thread::spawn(move || {
+        let (mut stream, _) = listener.accept().expect("should accept first request");
+        let mut request = [0_u8; 4096];
+        let _ = stream.read(&mut request);
+        let response = format!(
+            "HTTP/1.1 307 Temporary Redirect\r\nLocation: http://{address}/followed\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"
+        );
+        stream
+            .write_all(response.as_bytes())
+            .expect("should write redirect");
+        drop(stream);
+        listener
+            .set_nonblocking(true)
+            .expect("should make listener nonblocking");
+        std::thread::sleep(Duration::from_millis(300));
+        listener.accept().is_ok()
+    });
+    let runtime = tokio::runtime::Builder::new_current_thread()
+        .enable_all()
+        .build()
+        .expect("should build runtime");
+    let client = plain_http_policy_client_for_tests().expect("should build test client");
+
+    let response = runtime
+        .block_on(client.get(format!("http://{address}/policy")).send())
+        .expect("should receive the redirect response");
+    let followed = server.join().expect("should join local server");
+
+    assert_eq!(
+        response.status(),
+        StatusCode::TEMPORARY_REDIRECT,
+        "should return the 307 itself"
+    );
+    assert!(!followed, "should never request the redirect target");
+}
+
+#[test]
+fn fixed_endpoints_derive_from_policy_identity() {
+    assert_eq!(
+        POLICY_CONTENTS_URL,
+        format!(
+            "https://api.{GITHUB_HOST}/repos/{REPOSITORY}/contents/crates/trusted-server-cli/release-policy.json" // allow-domain: api
+        ),
+        "should fetch from the policy repository"
+    );
+    assert_eq!(
+        SIGNER_WORKFLOW_PREFIX,
+        format!(
+            "https://{GITHUB_HOST}/{REPOSITORY}/.github/workflows/release-build.yml@refs/tags/"
+        ),
+        "should sign from the policy repository"
+    );
+}
diff --git a/crates/trusted-server-cli/src/release/tests/gh/argv.rs b/crates/trusted-server-cli/src/release/tests/gh/argv.rs
new file mode 100644
index 0000000000..e5053f3767
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/tests/gh/argv.rs
@@ -0,0 +1,132 @@
+//! Fixed gh argument vectors.
+
+use super::*;
+
+// Fixed argument vectors.
+
+#[test]
+fn attestation_argv_is_fixed_for_both_predicates() {
+    let subject = Path::new("/verify/trusted-server-fastly.wasm");
+    let signer = "https://github.com/IABTechLab/trusted-server/.github/workflows/release-build.yml@refs/tags/v1.2.0";
+
+    for (predicate, uri, bundle) in [
+        (
+            PredicateKind::Provenance,
+            "https://slsa.dev/provenance/v1",
+            "/verify/trusted-server-fastly.wasm.provenance.sigstore.json",
+        ),
+        (
+            PredicateKind::Spdx,
+            "https://spdx.dev/Document/v2.3",
+            "/verify/trusted-server-fastly.wasm.sbom.sigstore.json",
+        ),
+    ] {
+        let argv = attestation_verify_args(subject, Path::new(bundle), &release(), predicate)
+            .expect("should build fixed argv");
+
+        assert_eq!(
+            argv,
+            args(&[
+                "attestation",
+                "verify",
+                "/verify/trusted-server-fastly.wasm",
+                "--bundle",
+                bundle,
+                "-R",
+                "IABTechLab/trusted-server",
+                "--hostname",
+                "github.com",
+                "--cert-identity",
+                signer,
+                "--cert-oidc-issuer",
+                "https://token.actions.githubusercontent.com",
+                "--source-ref",
+                "refs/tags/v1.2.0",
+                "--source-digest",
+                COMMIT,
+                "--signer-digest",
+                COMMIT,
+                "--deny-self-hosted-runners",
+                "--predicate-type",
+                uri,
+                "--format",
+                "json",
+            ]),
+            "should match the reviewed command for {uri}"
+        );
+    }
+}
+
+#[test]
+fn attestation_argv_rejects_unsafe_subject_and_bundle() {
+    let subject = Path::new("/verify/trusted-server-fastly.wasm");
+    let provenance = Path::new("/verify/trusted-server-fastly.wasm.provenance.sigstore.json");
+
+    for (subject, bundle, predicate, reason) in [
+        (
+            Path::new("--help"),
+            provenance,
+            PredicateKind::Provenance,
+            "flag-like subject",
+        ),
+        (
+            subject,
+            Path::new("relative.provenance.sigstore.json"),
+            PredicateKind::Provenance,
+            "relative bundle",
+        ),
+        (
+            subject,
+            provenance,
+            PredicateKind::Spdx,
+            "provenance bundle for SPDX predicate",
+        ),
+        (
+            subject,
+            Path::new("/verify/trusted-server-fastly.wasm.sbom.sigstore.json"),
+            PredicateKind::Provenance,
+            "SBOM bundle for provenance predicate",
+        ),
+    ] {
+        assert!(
+            attestation_verify_args(subject, bundle, &release(), predicate).is_err(),
+            "should reject {reason}"
+        );
+    }
+}
+
+#[test]
+fn release_argv_is_fixed() {
+    let tag = ReleaseTag::parse("v1.2.0").expect("should parse tag");
+
+    assert_eq!(
+        release_verify_args(&tag),
+        args(&[
+            "release",
+            "verify",
+            "v1.2.0",
+            "-R",
+            "github.com/IABTechLab/trusted-server",
+            "--format",
+            "json"
+        ]),
+        "should match reviewed release verify"
+    );
+    assert_eq!(
+        release_verify_asset_args(&tag, Path::new("/verify/release-index.json"))
+            .expect("should build verify-asset argv"),
+        args(&[
+            "release",
+            "verify-asset",
+            "v1.2.0",
+            "/verify/release-index.json",
+            "-R",
+            "github.com/IABTechLab/trusted-server",
+        ]),
+        "should match reviewed release verify-asset"
+    );
+    assert!(
+        release_verify_asset_args(&tag, Path::new("relative.json")).is_err(),
+        "should require absolute asset path"
+    );
+}
diff --git a/crates/trusted-server-cli/src/release/tests/gh/environment.rs b/crates/trusted-server-cli/src/release/tests/gh/environment.rs
new file mode 100644
index 0000000000..0cf63c9fbe
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/tests/gh/environment.rs
@@ -0,0 +1,305 @@
+//! gh resolution, version qualification, environment isolation and
+//! credential redaction.
+
+use super::*;
+
+// Resolution and version.
+
+#[test]
+fn resolves_explicit_path_to_canonical_target() {
+    let fake = Fake::script("exit 0");
+    let link = fake.file("gh-link");
+    symlink(&fake.gh, &link).expect("should create symlink");
+
+    let runner = resolve(GhLocation::Explicit(&link), &caller(&[("GH_TOKEN", TOKEN)]))
+        .expect("should resolve explicit gh");
+
+    assert_eq!(
+        runner.executable(),
+        fake.gh.canonicalize().expect("should canonicalize"),
+        "should retain the canonical executable target"
+    );
+}
+
+#[test]
+fn resolves_from_trusted_path_once_ignoring_relative_entries() {
+    let fake = Fake::script("exit 0");
+    let path = format!("relative/bin:{}", fake.directory.path().display());
+
+    let runner = resolve(
+        GhLocation::SearchPath,
+        &caller(&[("GH_TOKEN", TOKEN), ("PATH", &path)]),
+    )
+    .expect("should resolve gh from absolute PATH entry");
+
+    assert_eq!(
+        runner.executable(),
+        fake.gh.canonicalize().expect("should canonicalize"),
+        "should retain the PATH-resolved target"
+    );
+    assert_eq!(
+        context(resolve(
+            GhLocation::SearchPath,
+            &caller(&[("GH_TOKEN", TOKEN), ("PATH", "relative/bin")])
+        ))
+        .0,
+        ReleaseError::UnsupportedTool,
+        "should not resolve gh through relative PATH entries"
+    );
+    assert_eq!(
+        context(resolve(
+            GhLocation::Explicit(Path::new("gh")),
+            &caller(&[("GH_TOKEN", TOKEN)])
+        ))
+        .0,
+        ReleaseError::UnsupportedTool,
+        "should require an absolute explicit path"
+    );
+}
+
+#[test]
+fn rejects_unsupported_gh_version_with_diagnostic() {
+    for prelude in [
+        "echo 'gh version 2.96.0 (2026-01-01)'; exit 0\n",
+        "echo 'gh version 2.97.0-rc1 (2026-01-01)'; exit 0\n",
+        "echo 'gh version 2.97.00'; exit 0\n",
+        "echo 'not gh'; exit 0\n",
+        "exit 1\n",
+    ] {
+        let fake = Fake::with_version(prelude, "exit 0");
+
+        let (error, text) = context(fake.runner(test_bounds()));
+
+        assert!(
+            matches!(
+                error,
+                ReleaseError::UnsupportedTool | ReleaseError::ExitFailure
+            ),
+            "should reject {prelude:?}: {error:?}"
+        );
+        if error == ReleaseError::UnsupportedTool {
+            assert!(
+                text.contains("2.97.0") && text.contains("does not authenticate"),
+                "should explain the exact version requirement: {text}"
+            );
+        }
+    }
+}
+
+// Environment isolation.
+
+fn observed_environment(caller_pairs: &[(&str, &str)]) -> BTreeMap<String, String> {
+    let fake = Fake::empty();
+    let output = fake.file("env.txt");
+    fake.install(&format!(
+        "/usr/bin/env > '{}'\necho '[{{}}]'",
+        output.display()
+    ));
+    let runner = resolve(GhLocation::Explicit(&fake.gh), &caller(caller_pairs))
+        .expect("should resolve fake gh");
+
+    run(&runner, AttemptDeadline::start(), &Cancellation::default()).expect("should run fake gh");
+
+    fs::read_to_string(&output)
+        .expect("should read observed environment")
+        .lines()
+        .filter_map(|line| line.split_once('='))
+        .map(|(key, value)| (key.to_owned(), value.to_owned()))
+        .collect()
+}
+
+#[test]
+fn child_environment_contains_only_reviewed_keys() {
+    let environment = observed_environment(&[
+        ("GH_TOKEN", TOKEN),
+        ("GITHUB_TOKEN", FALLBACK_TOKEN),
+        ("GH_HOST", "ghe.example.com"),
+        ("GH_ENTERPRISE_TOKEN", "fictional-enterprise"),
+        ("GITHUB_ENTERPRISE_TOKEN", "fictional-enterprise"),
+        ("GH_REPO", "example/other"),
+        ("GH_CONFIG_DIR", "/tmp/attacker-config"),
+        ("GH_PATH", "/tmp/attacker-gh"),
+        ("FASTLY_API_TOKEN", "fictional-provider"),
+        ("HOME", "/home/operator"),
+        ("PATH", "/opt/attacker/bin:/usr/bin"),
+    ]);
+    let allowed = [
+        "DO_NOT_TRACK",
+        "GH_CONFIG_DIR",
+        "GH_NO_EXTENSION_UPDATE_NOTIFIER",
+        "GH_NO_UPDATE_NOTIFIER",
+        "GH_PROMPT_DISABLED",
+        "GH_SPINNER_DISABLED",
+        "GH_TOKEN",
+        "HOME",
+        "LC_ALL",
+        "NO_COLOR",
+        "PATH",
+        "TMPDIR",
+        "XDG_CACHE_HOME",
+        "XDG_CONFIG_HOME",
+        "XDG_DATA_HOME",
+        "XDG_STATE_HOME",
+        // Added by the fake's own shell, not by the runner.
+        "OLDPWD",
+        "PWD",
+        "SHLVL",
+        "_",
+    ];
+
+    for key in environment.keys() {
+        assert!(
+            allowed.contains(&key.as_str()),
+            "should not pass {key} to gh"
+        );
+    }
+    assert_eq!(
+        environment["GH_TOKEN"], TOKEN,
+        "should prefer explicit GH_TOKEN"
+    );
+    assert_eq!(
+        environment["PATH"], "/usr/bin:/bin",
+        "should use minimal PATH"
+    );
+    assert_eq!(
+        environment["GH_PROMPT_DISABLED"], "1",
+        "should disable prompts"
+    );
+    let home = &environment["HOME"];
+    assert!(
+        !home.is_empty() && home != "/home/operator",
+        "should isolate HOME"
+    );
+    for key in [
+        "GH_CONFIG_DIR",
+        "XDG_STATE_HOME",
+        "XDG_CONFIG_HOME",
+        "XDG_CACHE_HOME",
+    ] {
+        assert_ne!(
+            environment[key], "/tmp/attacker-config",
+            "should isolate {key}"
+        );
+        assert!(
+            Path::new(&environment[key]).is_absolute(),
+            "should use absolute private {key}"
+        );
+    }
+    assert!(
+        !environment
+            .values()
+            .any(|value| value.contains(FALLBACK_TOKEN)
+                || value.contains("fictional-enterprise")
+                || value.contains("fictional-provider")),
+        "should keep other credentials out of gh"
+    );
+}
+
+#[test]
+fn falls_back_to_github_token_only_as_gh_token() {
+    let environment = observed_environment(&[("GITHUB_TOKEN", FALLBACK_TOKEN)]);
+
+    assert_eq!(
+        environment["GH_TOKEN"], FALLBACK_TOKEN,
+        "should pass fallback as GH_TOKEN"
+    );
+    assert!(
+        !environment.contains_key("GITHUB_TOKEN"),
+        "should not pass GITHUB_TOKEN"
+    );
+}
+
+#[test]
+fn requires_explicit_token() {
+    let fake = Fake::script("exit 0");
+
+    for pairs in [vec![], vec![("GH_TOKEN", "")], vec![("GITHUB_TOKEN", "")]] {
+        let (error, text) = context(resolve(GhLocation::Explicit(&fake.gh), &caller(&pairs)));
+
+        assert_eq!(error, ReleaseError::Environment, "should require a token");
+        assert!(
+            text.contains("GH_TOKEN"),
+            "should explain explicit token rule: {text}"
+        );
+    }
+}
+
+#[test]
+fn rejects_loader_injection_variables() {
+    let fake = Fake::script("exit 0");
+
+    for key in [
+        "LD_PRELOAD",
+        "LD_LIBRARY_PATH",
+        "DYLD_INSERT_LIBRARIES",
+        "DYLD_LIBRARY_PATH",
+    ] {
+        let (error, text) = context(resolve(
+            GhLocation::Explicit(&fake.gh),
+            &caller(&[("GH_TOKEN", TOKEN), (key, "/tmp/evil.so")]),
+        ));
+
+        assert_eq!(error, ReleaseError::Environment, "should reject {key}");
+        assert!(
+            text.contains(key),
+            "should name the rejected variable: {text}"
+        );
+        assert!(!text.contains("/tmp/evil.so"), "should not echo the value");
+    }
+}
+
+#[test]
+fn debug_output_never_contains_token() {
+    let fake = Fake::script("echo '[{}]'");
+    let runner = fake.runner(test_bounds()).expect("should resolve fake gh");
+    let failing = Fake::script("echo \"$GH_TOKEN\" >&2\nexit 1");
+    let failing_runner = failing
+        .runner(test_bounds())
+        .expect("should resolve fake gh");
+
+    let report = run(
+        &failing_runner,
+        AttemptDeadline::start(),
+        &Cancellation::default(),
+    )
+    .expect_err("should fail");
+
+    for text in [
+        format!("{runner:?}"),
+        format!("{runner:#?}"),
+        format!("{report:?}"),
+        format!("{report}"),
+    ] {
+        assert!(!text.contains(TOKEN), "should redact token from {text}");
+    }
+}
+
+#[test]
+fn successful_stderr_is_redacted() {
+    let fake = Fake::script("echo \"warning for $GH_TOKEN\" >&2\necho '[{}]'");
+    let runner = fake.runner(test_bounds()).expect("should resolve fake gh");
+
+    let output = runner
+        .run(
+            &args(&["attestation", "verify"]),
+            AttemptDeadline::start(),
+            &Cancellation::default(),
+        )
+        .expect("should succeed");
+
+    assert_eq!(
+        output.stderr, "warning for [redacted]\n",
+        "should expose only redacted stderr"
+    );
+}
+
+#[test]
+fn process_snapshot_captures_current_environment_once() {
+    let snapshot = CallerEnvironment::from_process();
+
+    assert_eq!(
+        snapshot.get("PATH"),
+        std::env::var_os("PATH").as_deref(),
+        "should capture the process PATH"
+    );
+}
diff --git a/crates/trusted-server-cli/src/release/tests/gh/lifecycle.rs b/crates/trusted-server-cli/src/release/tests/gh/lifecycle.rs
new file mode 100644
index 0000000000..2421b82736
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/tests/gh/lifecycle.rs
@@ -0,0 +1,674 @@
+//! Deadlines, cancellation, byte caps, termination, reaping and output
+//! acceptance with real OS fake children.
+
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use super::*;
+
+#[test]
+fn successful_attestation_proof_is_bound_to_exact_measured_inputs() {
+    let fake = Fake::script("echo '[{\"verificationResult\":{}}]'");
+    let subject = fake.file("subject.wasm");
+    let bundle = fake.file("subject.wasm.provenance.sigstore.json");
+    fs::write(&subject, b"synthetic executable").expect("should create subject");
+    fs::write(&bundle, b"{}").expect("should create bundle");
+    let runner = fake.runner(test_bounds()).expect("should resolve fake gh");
+    let proof = runner
+        .verify_attestation(
+            &subject,
+            &bundle,
+            &release(),
+            PredicateKind::Provenance,
+            AttemptDeadline::start(),
+            &Cancellation::default(),
+        )
+        .expect("should obtain typed successful fake-child result");
+    let measured_subject =
+        crate::release::artifact::AssetMeasurement::of_bytes(b"synthetic executable");
+    let measured_bundle = crate::release::artifact::AssetMeasurement::of_bytes(b"{}");
+    let changed = crate::release::artifact::AssetMeasurement::of_bytes(b"changed");
+    assert!(
+        proof
+            .for_inputs(
+                &release(),
+                PredicateKind::Provenance,
+                &measured_subject,
+                &measured_bundle
+            )
+            .is_ok(),
+        "should accept matching invocation inputs"
+    );
+    for (predicate, subject, bundle) in [
+        (PredicateKind::Spdx, &measured_subject, &measured_bundle),
+        (PredicateKind::Provenance, &changed, &measured_bundle),
+        (PredicateKind::Provenance, &measured_subject, &changed),
+    ] {
+        assert!(
+            proof
+                .for_inputs(&release(), predicate, subject, bundle)
+                .is_err(),
+            "should reject changed invocation input"
+        );
+    }
+    let other_release = ApprovedRelease::new(
+        ReleaseTag::parse("v1.2.1").expect("should parse another tag"),
+        ApprovedCommit::parse(COMMIT).expect("should parse commit"),
+    );
+    assert!(
+        proof
+            .for_inputs(
+                &other_release,
+                PredicateKind::Provenance,
+                &measured_subject,
+                &measured_bundle
+            )
+            .is_err(),
+        "should reject another approved release"
+    );
+}
+
+#[test]
+fn attestation_child_reads_private_snapshot_during_transient_substitution() {
+    let fake = Fake::empty();
+    let subject = fake.file("subject.wasm");
+    let original = fake.file("original.wasm");
+    let bundle = fake.file("subject.wasm.provenance.sigstore.json");
+    fs::write(&subject, b"synthetic executable").expect("should create subject");
+    fs::write(&original, b"synthetic executable").expect("should retain original fixture bytes");
+    fs::write(&bundle, b"{}").expect("should create bundle");
+    fake.install(&format!(
+        "printf 'substituted' > '{subject}'\ncmp -s \"$3\" '{original}' || exit 1\ncp '{original}' '{subject}'\necho '[{{\"verificationResult\":{{}}}}]'",
+        subject = subject.display(), original = original.display(),
+    ));
+    let runner = fake.runner(test_bounds()).expect("should resolve fake gh");
+    assert!(
+        runner
+            .verify_attestation(
+                &subject,
+                &bundle,
+                &release(),
+                PredicateKind::Provenance,
+                AttemptDeadline::start(),
+                &Cancellation::default()
+            )
+            .is_ok(),
+        "should verify only private original bytes despite transient caller-path substitution"
+    );
+}
+
+#[test]
+fn release_verification_requires_successful_single_json_object() {
+    for (body, accepted) in [
+        ("echo '{\"verificationResult\":{}}'", true),
+        ("echo '[{\"verificationResult\":{}}]'", false),
+        ("echo '{\"verificationResult\":'", false),
+        ("echo '{\"verificationResult\":{}}'; exit 1", false),
+    ] {
+        let fake = Fake::script(body);
+        let runner = fake.runner(test_bounds()).expect("should resolve fake gh");
+        let result = runner.verify_release(
+            &release(),
+            AttemptDeadline::start(),
+            &Cancellation::default(),
+        );
+        assert_eq!(
+            result.is_ok(),
+            accepted,
+            "should enforce release output contract"
+        );
+        if let Ok(proof) = result {
+            assert!(
+                proof.for_release(&release()).is_ok(),
+                "should bind approved release"
+            );
+            let other = ApprovedRelease::new(
+                ReleaseTag::parse("v1.2.1").expect("should parse another tag"),
+                ApprovedCommit::parse(COMMIT).expect("should parse commit"),
+            );
+            assert!(
+                proof.for_release(&other).is_err(),
+                "should reject another release"
+            );
+        }
+    }
+}
+
+#[test]
+fn rejects_attestation_input_substitution_during_successful_child() {
+    for substituted in ["subject", "bundle"] {
+        let fake = Fake::empty();
+        let subject = fake.file("subject.wasm");
+        let bundle = fake.file("subject.wasm.provenance.sigstore.json");
+        fs::write(&subject, b"original executable").expect("should create subject");
+        fs::write(&bundle, b"{}").expect("should create bundle");
+        let changed = if substituted == "subject" {
+            &subject
+        } else {
+            &bundle
+        };
+        fake.install(&format!(
+            "printf 'substituted' > '{}'\necho '[{{\"verificationResult\":{{}}}}]'",
+            changed.display()
+        ));
+        let runner = fake.runner(test_bounds()).expect("should resolve fake gh");
+        let result = runner.verify_attestation(
+            &subject,
+            &bundle,
+            &release(),
+            PredicateKind::Provenance,
+            AttemptDeadline::start(),
+            &Cancellation::default(),
+        );
+        assert!(
+            result.is_err(),
+            "should reject substituted {substituted} despite child success"
+        );
+    }
+}
+
+#[test]
+fn rejects_oversize_subject_before_invoking_attestation_child() {
+    let fake = Fake::script("echo '[{\"verificationResult\":{}}]'");
+    let subject = fake.file("subject.wasm");
+    File::create(&subject)
+        .expect("should create sparse subject")
+        .set_len(crate::release::bounds::EXECUTABLE_BYTES + 1)
+        .expect("should set oversize length");
+    let bundle = fake.file("subject.wasm.provenance.sigstore.json");
+    fs::write(&bundle, b"{}").expect("should create bundle");
+    let runner = fake.runner(test_bounds()).expect("should resolve fake gh");
+    assert!(
+        runner
+            .verify_attestation(
+                &subject,
+                &bundle,
+                &release(),
+                PredicateKind::Provenance,
+                AttemptDeadline::start(),
+                &Cancellation::default()
+            )
+            .is_err(),
+        "should reject oversize subject"
+    );
+}
+
+#[test]
+fn rejects_symlinked_attestation_input_before_child() {
+    let fake = Fake::script("echo '[{\"verificationResult\":{}}]'");
+    let subject = fake.file("subject.wasm");
+    let actual = fake.file("actual.wasm");
+    fs::write(&actual, b"synthetic executable").expect("should create actual file");
+    symlink(&actual, &subject).expect("should create substituted symlink");
+    let bundle = fake.file("subject.wasm.provenance.sigstore.json");
+    fs::write(&bundle, b"{}").expect("should create bundle");
+    let runner = fake.runner(test_bounds()).expect("should resolve fake gh");
+    assert!(
+        runner
+            .verify_attestation(
+                &subject,
+                &bundle,
+                &release(),
+                PredicateKind::Provenance,
+                AttemptDeadline::start(),
+                &Cancellation::default()
+            )
+            .is_err(),
+        "should reject symlink input"
+    );
+}
+
+// Bounds, termination and reaping.
+
+#[test]
+fn child_timeout_kills_and_reaps_group() {
+    let fake = Fake::empty();
+    let script = format!(
+        "sleep 30 &\necho $! > '{}'\nsleep 30",
+        fake.file("grandchild.pid").display()
+    );
+    fake.install(&script);
+    let bounds = ProcessBounds {
+        child_timeout: Duration::from_millis(300),
+        ..test_bounds()
+    };
+    let runner = fake.runner(bounds).expect("should resolve fake gh");
+    let started = Instant::now();
+
+    let (error, _) = context(run(
+        &runner,
+        AttemptDeadline::start(),
+        &Cancellation::default(),
+    ));
+
+    assert_eq!(
+        error,
+        ReleaseError::Timeout,
+        "should report timeout outcome"
+    );
+    assert!(
+        started.elapsed() < Duration::from_secs(5),
+        "should bound wall time"
+    );
+    assert_dead(
+        read_pid(&fake.file("grandchild.pid")),
+        "same-group grandchild",
+    );
+}
+
+#[test]
+fn attempt_deadline_bounds_child_before_child_timeout() {
+    let fake = Fake::script("sleep 30");
+    let runner = fake.runner(test_bounds()).expect("should resolve fake gh");
+    let started = Instant::now();
+
+    let (error, _) = context(run(
+        &runner,
+        AttemptDeadline::at(Instant::now() + Duration::from_millis(300)),
+        &Cancellation::default(),
+    ));
+
+    assert_eq!(
+        error,
+        ReleaseError::Timeout,
+        "should honor attempt deadline"
+    );
+    assert!(
+        started.elapsed() < Duration::from_secs(5),
+        "should bound wall time"
+    );
+}
+
+#[test]
+fn cancellation_kills_child() {
+    let fake = Fake::empty();
+    let script = format!(
+        "echo $$ > '{}'\nsleep 30",
+        fake.file("leader.pid").display()
+    );
+    fake.install(&script);
+    let runner = fake.runner(test_bounds()).expect("should resolve fake gh");
+    let cancellation = Cancellation::default();
+    let trigger = cancellation.clone();
+    let leader_pid = fake.file("leader.pid");
+    let canceller = thread::spawn(move || {
+        let pid = read_pid(&leader_pid);
+        trigger.cancel();
+        pid
+    });
+    let started = Instant::now();
+
+    let (error, _) = context(run(&runner, AttemptDeadline::start(), &cancellation));
+
+    let leader = canceller.join().expect("should join canceller");
+    assert_eq!(error, ReleaseError::Cancelled, "should report cancellation");
+    assert!(
+        started.elapsed() < Duration::from_secs(5),
+        "should bound wall time"
+    );
+    assert_dead(leader, "cancelled leader");
+}
+
+#[test]
+fn simultaneous_stdout_and_stderr_saturation_is_bounded() {
+    let fake = Fake::empty();
+    let script = format!(
+        "sh -c 'echo $$ > \"$0\"; exec yes stderr-line' '{pid}' >&2 &\nwhile [ ! -s '{pid}' ]; do :; done\nexec yes stdout-line",
+        pid = fake.file("writer.pid").display()
+    );
+    fake.install(&script);
+    let runner = fake.runner(test_bounds()).expect("should resolve fake gh");
+    let started = Instant::now();
+
+    let (error, _) = context(run(
+        &runner,
+        AttemptDeadline::start(),
+        &Cancellation::default(),
+    ));
+
+    assert_eq!(
+        error,
+        ReleaseError::OutputLimit,
+        "should stop at byte bound"
+    );
+    assert!(
+        started.elapsed() < Duration::from_secs(5),
+        "should bound wall time"
+    );
+    assert_dead(read_pid(&fake.file("writer.pid")), "stderr writer");
+}
+
+#[test]
+fn stderr_saturation_alone_is_bounded() {
+    let fake = Fake::script("exec yes stderr-line >&2");
+    let bounds = ProcessBounds {
+        stdout_bytes: 1024 * 1024,
+        ..test_bounds()
+    };
+    let runner = fake.runner(bounds).expect("should resolve fake gh");
+
+    let (error, _) = context(run(
+        &runner,
+        AttemptDeadline::start(),
+        &Cancellation::default(),
+    ));
+
+    assert_eq!(error, ReleaseError::OutputLimit, "should bound stderr");
+}
+
+#[test]
+fn truncated_json_is_rejected() {
+    let fake = Fake::script("printf '[{\"verificationResult\":'");
+    let runner = fake.runner(test_bounds()).expect("should resolve fake gh");
+    let subject = fake.file("subject.wasm");
+    fs::write(&subject, b"original executable").expect("should create subject");
+    fs::write(fake.file("subject.wasm.provenance.sigstore.json"), b"{}")
+        .expect("should create provenance bundle");
+    fs::write(fake.file("subject.wasm.sbom.sigstore.json"), b"{}")
+        .expect("should create SPDX bundle");
+
+    let (error, _) = context(runner.verify_attestation(
+        &subject,
+        &fake.file("subject.wasm.provenance.sigstore.json"),
+        &release(),
+        PredicateKind::Provenance,
+        AttemptDeadline::start(),
+        &Cancellation::default(),
+    ));
+
+    assert_eq!(
+        error,
+        ReleaseError::Document,
+        "should reject incomplete JSON"
+    );
+}
+
+#[test]
+fn failed_exit_yields_no_claims_and_redacts_token() {
+    let fake = Fake::script(
+        "echo '[{\"verificationResult\":{}}]'\necho \"denied for $GH_TOKEN\" >&2\nexit 1",
+    );
+    let runner = fake.runner(test_bounds()).expect("should resolve fake gh");
+    let subject = fake.file("subject.wasm");
+    fs::write(&subject, b"original executable").expect("should create subject");
+    fs::write(fake.file("subject.wasm.provenance.sigstore.json"), b"{}")
+        .expect("should create provenance bundle");
+    fs::write(fake.file("subject.wasm.sbom.sigstore.json"), b"{}")
+        .expect("should create SPDX bundle");
+
+    let (error, text) = context(runner.verify_attestation(
+        &subject,
+        &fake.file("subject.wasm.provenance.sigstore.json"),
+        &release(),
+        PredicateKind::Provenance,
+        AttemptDeadline::start(),
+        &Cancellation::default(),
+    ));
+
+    assert_eq!(
+        error,
+        ReleaseError::ExitFailure,
+        "should fail closed on exit 1"
+    );
+    assert!(
+        text.contains("denied for [redacted]"),
+        "should keep redacted stderr: {text}"
+    );
+    assert!(
+        !text.contains(TOKEN),
+        "should never print the token: {text}"
+    );
+}
+
+#[test]
+fn requires_exactly_one_attestation_result() {
+    for (output, accepted) in [
+        ("[]", false),
+        (
+            "[{\"verificationResult\":{}},{\"verificationResult\":{}}]",
+            false,
+        ),
+        ("{\"verificationResult\":{}}", false),
+        ("[{\"verificationResult\":{}}]", true),
+    ] {
+        let fake = Fake::script(&format!("echo '{output}'"));
+        let runner = fake.runner(test_bounds()).expect("should resolve fake gh");
+        let subject = fake.file("subject.wasm");
+        fs::write(&subject, b"original executable").expect("should create subject");
+        fs::write(fake.file("subject.wasm.provenance.sigstore.json"), b"{}")
+            .expect("should create provenance bundle");
+        fs::write(fake.file("subject.wasm.sbom.sigstore.json"), b"{}")
+            .expect("should create SPDX bundle");
+
+        let result = runner.verify_attestation(
+            &subject,
+            &fake.file("subject.wasm.sbom.sigstore.json"),
+            &release(),
+            PredicateKind::Spdx,
+            AttemptDeadline::start(),
+            &Cancellation::default(),
+        );
+
+        if accepted {
+            assert!(result.is_ok(), "should accept exactly one result");
+        } else {
+            assert_eq!(
+                context(result).0,
+                ReleaseError::Output,
+                "should reject {output}"
+            );
+        }
+    }
+}
+
+#[test]
+fn successful_exit_kills_lingering_same_group_descendant() {
+    let fake = Fake::empty();
+    let script = format!(
+        "echo $$ > '{leader}'\nsleep 30 &\necho $! > '{grandchild}'\necho '[{{}}]'\nexit 0",
+        leader = fake.file("leader.pid").display(),
+        grandchild = fake.file("grandchild.pid").display()
+    );
+    fake.install(&script);
+    let runner = fake.runner(test_bounds()).expect("should resolve fake gh");
+    let started = Instant::now();
+
+    let stdout = run(&runner, AttemptDeadline::start(), &Cancellation::default())
+        .expect("should complete after killing lingering group member");
+
+    assert_eq!(stdout, b"[{}]\n", "should retain exact stdout");
+    assert!(
+        started.elapsed() < Duration::from_secs(5),
+        "should not wait for sleep"
+    );
+    assert_dead(
+        read_pid(&fake.file("grandchild.pid")),
+        "lingering grandchild",
+    );
+    assert!(
+        !process_exists(read_pid(&fake.file("leader.pid"))),
+        "should have reaped the leader before returning"
+    );
+}
+
+#[test]
+fn escaped_descendant_is_reported_not_awaited() {
+    let fake = Fake::empty();
+    let pid_file = fake.file("escaped.pid");
+    fake.install(&helper_exec("escaped", fake.directory.path()));
+    let runner = fake.runner(test_bounds()).expect("should resolve fake gh");
+    let started = Instant::now();
+
+    let result = run(&runner, AttemptDeadline::start(), &Cancellation::default());
+    let elapsed = started.elapsed();
+    let escaped = read_pid(&pid_file);
+    terminate_process(escaped);
+
+    assert_eq!(
+        context(result).0,
+        ReleaseError::DescendantEscaped,
+        "should report escaped descendant"
+    );
+    assert!(
+        elapsed < Duration::from_secs(5),
+        "should not hang on open pipes"
+    );
+}
+
+// Host-independent helper children.
+//
+// `/bin/sh` cannot leave its process group portably (dash ignores `set -m`
+// without a terminal and macOS has no `setsid` binary), so the fake gh execs
+// this test binary in a hidden helper mode that uses libc directly.
+
+/// Environment selector `<mode>:<nonce>`; absent in normal test runs.
+const HELPER_SELECTOR: &str = "TS_CLI_GH_HELPER";
+/// Environment variable carrying the nonce the selector must match.
+const HELPER_NONCE: &str = "TS_CLI_GH_HELPER_NONCE";
+/// Environment variable naming the directory where helpers record pids.
+const HELPER_PIDS: &str = "TS_CLI_GH_HELPER_PIDS";
+/// Exact libtest name of [`helper_entry`].
+const HELPER_TEST: &str = "release::tests::gh::lifecycle::helper_entry";
+/// Exit status of a helper whose fork or pipe setup failed.
+const HELPER_SETUP_FAILED: i32 = 90;
+
+/// Returns a fake gh body that execs this test binary in helper `mode`.
+fn helper_exec(mode: &str, pids: &Path) -> String {
+    static COUNTER: AtomicU64 = AtomicU64::new(0);
+    let sequence = COUNTER.fetch_add(1, Ordering::Relaxed);
+    let nanos = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|elapsed| elapsed.as_nanos())
+        .unwrap_or_default();
+    let nonce = format!("{}-{sequence}-{nanos}", std::process::id());
+    let binary = std::env::current_exe().expect("should locate the test binary");
+    let (binary, pids) = (binary.display().to_string(), pids.display().to_string());
+    assert!(
+        !binary.contains('\'') && !pids.contains('\''),
+        "should quote helper paths safely"
+    );
+    format!(
+        "{HELPER_SELECTOR}='{mode}:{nonce}' {HELPER_NONCE}='{nonce}' {HELPER_PIDS}='{pids}' \
+         exec '{binary}' --exact {HELPER_TEST} --nocapture --test-threads=1"
+    )
+}
+
+/// Returns the helper mode when the selector, nonce and argv all match a
+/// fixture-launched helper run.
+fn authorized_mode(selector: &str, nonce: Option<&str>, arguments: &[String]) -> Option<String> {
+    let (mode, selector_nonce) = selector.rsplit_once(':')?;
+    let exact = arguments.iter().any(|argument| argument == "--exact");
+    let filtered = arguments.iter().any(|argument| argument == HELPER_TEST);
+    let matched = nonce.is_some_and(|nonce| !nonce.is_empty() && nonce == selector_nonce);
+    (exact && filtered && matched).then(|| mode.to_owned())
+}
+
+/// Hidden re-exec entry point; returns immediately in normal test runs.
+///
+/// A selector present without the fixture's exact filter and nonce fails the
+/// run rather than silently acting or passing.
+#[test]
+fn helper_entry() {
+    let Some(selector) = std::env::var_os(HELPER_SELECTOR) else {
+        return;
+    };
+    let nonce = std::env::var(HELPER_NONCE).ok();
+    let arguments: Vec<String> = std::env::args().collect();
+    let mode = authorized_mode(&selector.to_string_lossy(), nonce.as_deref(), &arguments);
+    assert!(
+        mode.is_some(),
+        "should run helper mode only from a fixture-launched exact helper invocation"
+    );
+    let code = match mode.as_deref() {
+        Some("escaped") => {
+            record_helper_pid("escaped.pid", fork_escaped());
+            0
+        }
+        _ => HELPER_SETUP_FAILED,
+    };
+    // SAFETY: `_exit` ends the helper without returning to the harness.
+    unsafe { libc::_exit(code) }
+}
+
+#[test]
+fn helper_selector_fails_closed_without_exact_filter_and_nonce() {
+    let exact = [
+        "binary".to_owned(),
+        "--exact".to_owned(),
+        HELPER_TEST.to_owned(),
+    ];
+
+    assert_eq!(
+        authorized_mode("escaped:n1", Some("n1"), &exact),
+        Some("escaped".to_owned()),
+        "should authorize the exact fixture invocation"
+    );
+    assert_eq!(
+        authorized_mode("escaped:n1", Some("n2"), &exact),
+        None,
+        "should reject a mismatched nonce"
+    );
+    assert_eq!(
+        authorized_mode("escaped:n1", None, &exact),
+        None,
+        "should reject a missing nonce"
+    );
+    assert_eq!(
+        authorized_mode("escaped:n1", Some("n1"), &exact[..2]),
+        None,
+        "should reject a run without the exact helper filter"
+    );
+}
+
+fn helper_setup_failed() -> ! {
+    // SAFETY: `_exit` is async-signal-safe and ends the helper immediately.
+    unsafe { libc::_exit(HELPER_SETUP_FAILED) }
+}
+
+/// Records `pid`; a pid that could address a group or every process ends the
+/// helper instead.
+fn record_helper_pid(name: &str, pid: libc::pid_t) {
+    if pid <= 1 {
+        helper_setup_failed();
+    }
+    if let Some(directory) = std::env::var_os(HELPER_PIDS) {
+        let _ = fs::write(Path::new(&directory).join(name), pid.to_string());
+    }
+}
+
+/// Forks a child that calls `setsid()` (leaving the process group) while
+/// keeping the inherited stdout/stderr open, reports readiness and waits
+/// until killed.
+fn fork_escaped() -> libc::pid_t {
+    let mut ready = [0 as libc::c_int; 2];
+    // SAFETY: `ready` provides space for the two pipe descriptors.
+    if unsafe { libc::pipe(ready.as_mut_ptr()) } != 0 {
+        helper_setup_failed();
+    }
+    let [read_end, write_end] = ready;
+    // SAFETY: the forked child only calls async-signal-safe functions.
+    let pid = unsafe { libc::fork() };
+    if pid == 0 {
+        // SAFETY: setsid/write/close/pause are async-signal-safe and the
+        // descriptors are valid.
+        unsafe {
+            libc::setsid();
+            libc::write(write_end, b"r".as_ptr().cast(), 1);
+            libc::close(write_end);
+            loop {
+                libc::pause();
+            }
+        }
+    }
+    if pid < 0 {
+        helper_setup_failed();
+    }
+    let mut byte = [0_u8; 1];
+    // SAFETY: the descriptors come from `pipe` above and `byte` is writable.
+    unsafe {
+        libc::close(write_end);
+        libc::read(read_end, byte.as_mut_ptr().cast(), 1);
+        libc::close(read_end);
+    }
+    pid
+}
diff --git a/crates/trusted-server-cli/src/release/tests/gh/mod.rs b/crates/trusted-server-cli/src/release/tests/gh/mod.rs
new file mode 100644
index 0000000000..97dc9a51ed
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/tests/gh/mod.rs
@@ -0,0 +1,206 @@
+//! Bounded, isolated gh runner tests using real OS fake children.
+//!
+//! Each fake `gh` is a POSIX `sh` script in a private tempdir. The scripts
+//! exercise real pipes, process groups, signals and reaping rather than mocks.
+
+use std::collections::BTreeMap;
+use std::ffi::OsString;
+use std::fs::{self, File};
+use std::io::Write as _;
+use std::os::unix::fs::{PermissionsExt as _, symlink};
+use std::path::{Path, PathBuf};
+use std::thread;
+use std::time::{Duration, Instant};
+
+use error_stack::Report;
+use tempfile::TempDir;
+
+use crate::release::bounds::{AttemptDeadline, Cancellation, ProcessBounds};
+use crate::release::documents::{ApprovedCommit, ApprovedRelease, ReleaseTag};
+use crate::release::environment::CallerEnvironment;
+use crate::release::error::ReleaseError;
+use crate::release::gh::{
+    GhLocation, GhRunner, PredicateKind, attestation_verify_args, release_verify_args,
+    release_verify_asset_args,
+};
+
+mod argv;
+mod environment;
+mod lifecycle;
+
+const TOKEN: &str = "fictional-gh-token-1111";
+const FALLBACK_TOKEN: &str = "fictional-github-token-2222";
+const COMMIT: &str = "0123456789abcdef0123456789abcdef01234567";
+const VERSION_PRELUDE: &str = "if [ \"$1\" = \"--version\" ]; then\n  echo 'gh version 2.97.0 (2026-01-01)'\n  echo 'https://github.com/cli/cli/releases/tag/v2.97.0'\n  exit 0\nfi\n";
+/// Spawn attempts tolerated for Linux `ETXTBSY` on a freshly written script.
+const SPAWN_ATTEMPTS: u32 = 5;
+
+/// A fake `gh` whose script is written exactly once.
+struct Fake {
+    directory: TempDir,
+    gh: PathBuf,
+}
+
+impl Fake {
+    /// Creates the private directory; [`Self::install`] writes the script.
+    fn empty() -> Self {
+        let directory = tempfile::tempdir().expect("should create fake gh directory");
+        let gh = directory.path().join("gh");
+        Self { directory, gh }
+    }
+
+    /// Creates a fake that answers `--version` with 2.97.0, then runs `body`.
+    fn script(body: &str) -> Self {
+        let fake = Self::empty();
+        fake.install(body);
+        fake
+    }
+
+    /// Creates a fake with a custom version prelude.
+    fn with_version(prelude: &str, body: &str) -> Self {
+        let fake = Self::empty();
+        fake.install_with(prelude, body);
+        fake
+    }
+
+    fn install(&self, body: &str) {
+        self.install_with(VERSION_PRELUDE, body);
+    }
+
+    // Write under a temporary name, sync, mark executable and rename into
+    // place, so the executable path never refers to a file open for writing.
+    fn install_with(&self, prelude: &str, body: &str) {
+        let staging = self.file(".gh.staging");
+        let mut file = File::create(&staging).expect("should create staged fake gh");
+        file.write_all(format!("#!/bin/sh\n{prelude}{body}\n").as_bytes())
+            .expect("should write staged fake gh");
+        file.sync_all().expect("should sync staged fake gh");
+        drop(file);
+        fs::set_permissions(&staging, fs::Permissions::from_mode(0o755))
+            .expect("should mark fake gh executable");
+        fs::rename(&staging, &self.gh).expect("should install fake gh");
+    }
+
+    fn file(&self, name: &str) -> PathBuf {
+        self.directory.path().join(name)
+    }
+
+    fn runner(&self, bounds: ProcessBounds) -> Result<GhRunner, Report<ReleaseError>> {
+        resolve(
+            GhLocation::Explicit(&self.gh),
+            &caller(&[("GH_TOKEN", TOKEN)]),
+        )
+        .map(|runner| runner.with_bounds(bounds))
+    }
+}
+
+/// Resolves gh with test bounds, retrying only Linux `ETXTBSY`: another test
+/// thread may have forked while this script was briefly open for writing.
+fn resolve(
+    location: GhLocation<'_>,
+    caller: &CallerEnvironment,
+) -> Result<GhRunner, Report<ReleaseError>> {
+    let mut attempt = 1;
+    loop {
+        let result = GhRunner::resolve(
+            location,
+            caller,
+            test_bounds(),
+            AttemptDeadline::start(),
+            &Cancellation::default(),
+        );
+        let busy = result
+            .as_ref()
+            .err()
+            .is_some_and(|report| format!("{report:?}").contains("ExecutableFileBusy"));
+        if !busy || attempt >= SPAWN_ATTEMPTS {
+            return result;
+        }
+        attempt += 1;
+        thread::sleep(Duration::from_millis(20));
+    }
+}
+
+fn caller(pairs: &[(&str, &str)]) -> CallerEnvironment {
+    CallerEnvironment::from_pairs(pairs.iter().copied())
+}
+
+fn test_bounds() -> ProcessBounds {
+    ProcessBounds {
+        child_timeout: Duration::from_secs(10),
+        stdout_bytes: 64 * 1024,
+        stderr_bytes: 16 * 1024,
+        kill_grace: Duration::from_millis(500),
+    }
+}
+
+fn release() -> ApprovedRelease {
+    ApprovedRelease::new(
+        ReleaseTag::parse("v1.2.0").expect("should parse fictional tag"),
+        ApprovedCommit::parse(COMMIT).expect("should parse fictional commit"),
+    )
+}
+
+fn args(values: &[&str]) -> Vec<OsString> {
+    values.iter().map(OsString::from).collect()
+}
+
+fn run(
+    runner: &GhRunner,
+    deadline: AttemptDeadline,
+    cancellation: &Cancellation,
+) -> Result<Vec<u8>, Report<ReleaseError>> {
+    runner
+        .run(&args(&["attestation", "verify"]), deadline, cancellation)
+        .map(|output| output.stdout)
+}
+
+fn read_pid(path: &Path) -> libc::pid_t {
+    let started = Instant::now();
+    loop {
+        if let Some(pid) = fs::read_to_string(path)
+            .ok()
+            .and_then(|text| text.trim().parse().ok())
+            .filter(|pid: &libc::pid_t| *pid > 0)
+        {
+            return pid;
+        }
+        assert!(
+            started.elapsed() < Duration::from_secs(5),
+            "should observe child pid file {}",
+            path.display()
+        );
+        thread::sleep(Duration::from_millis(10));
+    }
+}
+
+/// Returns whether `pid` names a process, including an unreaped zombie.
+fn process_exists(pid: libc::pid_t) -> bool {
+    assert!(pid > 0, "should only probe a single positive pid");
+    // SAFETY: signal 0 performs only existence and permission checks.
+    let result = unsafe { libc::kill(pid, 0) };
+    result == 0 || std::io::Error::last_os_error().raw_os_error() == Some(libc::EPERM)
+}
+
+/// Kills one escaped test process, never a group or broadcast target.
+fn terminate_process(pid: libc::pid_t) {
+    assert!(pid > 0, "should only kill a single positive pid");
+    // SAFETY: `kill` only reads its two integer arguments.
+    let _ = unsafe { libc::kill(pid, libc::SIGKILL) };
+}
+
+fn assert_dead(pid: libc::pid_t, what: &str) {
+    let started = Instant::now();
+    while process_exists(pid) {
+        assert!(
+            started.elapsed() < Duration::from_secs(5),
+            "should kill and reap {what} (pid {pid})"
+        );
+        thread::sleep(Duration::from_millis(10));
+    }
+}
+
+fn context<T>(result: Result<T, Report<ReleaseError>>) -> (ReleaseError, String) {
+    let report = result.err().expect("should fail");
+    (*report.current_context(), format!("{report:?}"))
+}
diff --git a/crates/trusted-server-cli/src/release/tests/mod.rs b/crates/trusted-server-cli/src/release/tests/mod.rs
new file mode 100644
index 0000000000..bf17d974d9
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/tests/mod.rs
@@ -0,0 +1,10 @@
+//! Private release verification tests, registered explicitly so focused runs
+//! (`release::tests::documents`, `release::tests::gh`,
+//! `release::tests::verification`) select real cases.
+
+mod documents;
+mod gh;
+mod verification;
+
+mod offline;
+mod online;
diff --git a/crates/trusted-server-cli/src/release/tests/offline.rs b/crates/trusted-server-cli/src/release/tests/offline.rs
new file mode 100644
index 0000000000..27ba24aa5a
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/tests/offline.rs
@@ -0,0 +1,190 @@
+//! Offline build evidence uses independent roots and pins; never publication.
+
+use crate::release::bounds::{AttemptDeadline, Cancellation, ProcessBounds};
+use crate::release::documents::sha256_hex;
+use crate::release::environment::CallerEnvironment;
+use crate::release::gh::{GhLocation, GhRunner};
+use crate::release::offline::{OfflineApproval, verify_build};
+use crate::release::policy::EMBEDDED_POLICY;
+use crate::release::source_policy::ApprovedSourceRoot;
+use crate::release::tests::online::Case;
+use crate::release::tests::verification::fixture::{self, ASSET, COMMIT};
+use std::fs;
+#[cfg(target_os = "macos")]
+use std::net::{SocketAddr, TcpListener, TcpStream};
+use std::os::unix::fs::PermissionsExt as _;
+#[cfg(target_os = "macos")]
+use std::process::Command;
+#[cfg(target_os = "macos")]
+use std::time::Duration;
+
+#[test]
+fn offline_runner_requires_independent_roots_digest_without_token() {
+    let directory = tempfile::tempdir().expect("should create private directory");
+    let gh = directory.path().join("gh");
+    fs::write(&gh, "#!/bin/sh\n[ -z \"$GH_TOKEN$GITHUB_TOKEN\" ] || exit 9\necho 'gh version 2.97.0 (2026-01-01)'\n").expect("should write fake gh");
+    fs::set_permissions(&gh, fs::Permissions::from_mode(0o700)).expect("should mark executable");
+    let roots = directory.path().join("trusted_root.jsonl");
+    fs::write(&roots, b"fictional independent root snapshot\n").expect("should write roots");
+    let caller = CallerEnvironment::default();
+    let resolve = |pin: &str| {
+        GhRunner::resolve_offline(
+            GhLocation::Explicit(&gh),
+            &caller,
+            ProcessBounds::production(),
+            AttemptDeadline::start(),
+            &Cancellation::default(),
+            &roots,
+            pin,
+        )
+    };
+    assert!(
+        resolve(&"0".repeat(64)).is_err(),
+        "should reject transferred roots that do not match independent pin"
+    );
+    assert!(
+        resolve(&sha256_hex(b"fictional independent root snapshot\n")).is_ok(),
+        "should resolve offline with token absent"
+    );
+}
+
+async fn verify_case(case: &Case, pin: &str) -> bool {
+    let source_directory = case.directory.path().join("approved-source");
+    fs::create_dir_all(source_directory.join("crates/trusted-server-cli"))
+        .expect("should create approved source layout");
+    fs::write(
+        source_directory.join("crates/trusted-server-cli/release-policy.json"),
+        EMBEDDED_POLICY,
+    )
+    .expect("should write independently approved policy");
+    let release = fixture::approved(COMMIT);
+    let source = ApprovedSourceRoot::new(release.commit().clone(), &source_directory)
+        .expect("should open approved source root");
+    let roots = case.directory.path().join("trusted_root.jsonl");
+    fs::write(&roots, b"fictional independently transported roots\n")
+        .expect("should write root snapshot");
+    let roots_sha256 = sha256_hex(b"fictional independently transported roots\n");
+    let approval = OfflineApproval {
+        release: &release,
+        source: &source,
+        asset: ASSET,
+        artifact_sha256: pin,
+        roots: &roots,
+        roots_sha256: &roots_sha256,
+        gh: &case.gh,
+    };
+    verify_build(
+        &approval,
+        case.directory.path(),
+        &CallerEnvironment::default(),
+        AttemptDeadline::start(),
+        &Cancellation::default(),
+    )
+    .await
+    .is_ok()
+}
+
+#[tokio::test]
+async fn offline_complete_synthetic_graph_checks_independent_artifact_pin() {
+    let case = Case::new();
+    case.write_assets();
+    assert!(
+        verify_case(&case, &sha256_hex(&case.signed.documents.executable)).await,
+        "should verify synthetic build graph without token"
+    );
+    assert!(
+        !verify_case(&case, &"0".repeat(64)).await,
+        "should reject a substituted independently pinned artifact"
+    );
+}
+
+#[test]
+#[cfg(target_os = "macos")]
+fn offline_build_verification_runs_under_proven_os_network_denial() {
+    const CHILD: &str = "TS_INTERNAL_OFFLINE_DENIAL_TEST_CHILD";
+    if let Ok(address) = std::env::var(CHILD) {
+        let address: SocketAddr = address.parse().expect("should parse control address");
+        assert!(
+            TcpStream::connect_timeout(&address, Duration::from_secs(1)).is_err(),
+            "should deny socket inside offline verification boundary"
+        );
+        let runtime = tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .expect("should build offline runtime");
+        let case = Case::new();
+        case.write_assets();
+        assert!(
+            runtime.block_on(verify_case(
+                &case,
+                &sha256_hex(&case.signed.documents.executable)
+            )),
+            "should verify local build evidence with networking denied and tokens absent"
+        );
+        return;
+    }
+    let listener = TcpListener::bind("127.0.0.1:0").expect("should bind unconfined socket control");
+    let address = listener.local_addr().expect("should read control address");
+    let _control = TcpStream::connect_timeout(&address, Duration::from_secs(1))
+        .expect("should prove unconfined socket succeeds");
+    let output = Command::new("/usr/bin/sandbox-exec")
+        .args(["-p", "(version 1)(allow default)(deny network*)"])
+        .arg(std::env::current_exe().expect("should locate test binary"))
+        .args(["--exact", "release::tests::offline::offline_build_verification_runs_under_proven_os_network_denial", "--nocapture"])
+        .env_clear().env("PATH", "/usr/bin:/bin").env(CHILD, address.to_string())
+        .output().expect("should execute offline test under network denial");
+    assert!(
+        output.status.success(),
+        "should pass denied-network offline build test: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+}
+
+#[tokio::test]
+async fn actual_offline_proofs_cannot_upgrade_through_online_publication_composition() {
+    let case = Case::new();
+    let roots = case.directory.path().join("trusted_root.jsonl");
+    fs::write(&roots, b"fictional independently approved roots")
+        .expect("should write pinned roots");
+    let runner = GhRunner::resolve_offline(
+        GhLocation::Explicit(&case.gh),
+        &CallerEnvironment::default(),
+        ProcessBounds::production(),
+        AttemptDeadline::start(),
+        &Cancellation::default(),
+        &roots,
+        &sha256_hex(b"fictional independently approved roots"),
+    )
+    .expect("should resolve token-free offline runner");
+    let release = fixture::approved(COMMIT);
+    let built = crate::release::online::build_with(
+        &case,
+        &runner,
+        &release,
+        ASSET,
+        AttemptDeadline::start(),
+        &Cancellation::default(),
+    )
+    .await
+    .expect("should build actual offline-mode proofs through fake child");
+    let online_statement = case
+        .runner()
+        .verify_release(&release, AttemptDeadline::start(), &Cancellation::default())
+        .expect("should obtain separately successful online-mode release proof");
+    let result = crate::release::github::verify_publication(
+        built.build,
+        &crate::release::github::PublicationInputs {
+            release: &case.signed.publication.release,
+            tag_ref: &case.signed.publication.tag_ref,
+            release_statement: &online_statement,
+            index_bundle: &built.index_bundle,
+            checksums: &crate::release::artifact::AssetMeasurement::of_bytes(
+                &case.signed.publication.checksums,
+            ),
+        },
+    );
+    assert!(
+        result.is_err(),
+        "should prevent offline proofs upgrading through otherwise valid online publication data"
+    );
+}
diff --git a/crates/trusted-server-cli/src/release/tests/online.rs b/crates/trusted-server-cli/src/release/tests/online.rs
new file mode 100644
index 0000000000..a599f275f6
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/tests/online.rs
@@ -0,0 +1,532 @@
+//! Deterministic transport and retained-byte orchestration tests.
+
+use crate::release::artifact::{AssetRole, RetainedAsset, RetainedDownload};
+use crate::release::bounds::{AttemptDeadline, Cancellation, ProcessBounds};
+use crate::release::documents::ApprovedCommit;
+use crate::release::environment::CallerEnvironment;
+use crate::release::error::{ReleaseError, report};
+use crate::release::gh::{GhLocation, GhRunner};
+use crate::release::online::{Transport, verify_with};
+use crate::release::online::{allowed_redirect, approved_asset_url, validate_request};
+use crate::release::policy::EMBEDDED_POLICY;
+use crate::release::source_policy::ApprovedSourcePolicy;
+use crate::release::tests::verification::fixture::{self, ASSET, Signed};
+use error_stack::Report;
+use serde_json::{Value, json};
+use std::cell::RefCell;
+use std::collections::BTreeMap;
+use std::fs;
+use std::os::unix::fs::PermissionsExt as _;
+use std::path::PathBuf;
+use tempfile::TempDir;
+use url::Url;
+
+const COMMIT: &str = "0123456789abcdef0123456789abcdef01234567";
+
+#[test]
+fn inputs_are_validated_without_environment() {
+    assert!(
+        validate_request("v1.2.0", "ts-aarch64-apple-darwin", COMMIT).is_ok(),
+        "should accept required public path"
+    );
+    for (tag, asset, commit) in [
+        ("latest", "ts-aarch64-apple-darwin", COMMIT),
+        ("v1.2.0", "../../ts", COMMIT),
+        ("v1.2.0", "ts-aarch64-apple-darwin", "main"),
+    ] {
+        assert!(
+            validate_request(tag, asset, commit).is_err(),
+            "should reject invalid request before any I/O"
+        );
+    }
+}
+
+#[test]
+fn download_url_and_redirects_are_fixed_and_credential_free() {
+    let release = validate_request("v1.2.0", "ts-aarch64-apple-darwin", COMMIT)
+        .expect("should validate request");
+    let url =
+        approved_asset_url(&release, "release-index.json").expect("should construct canonical URL");
+    assert_eq!(
+        url.as_str(),
+        "https://github.com/IABTechLab/trusted-server/releases/download/v1.2.0/release-index.json",
+        "should use fixed official repository"
+    );
+    for value in [
+        "https://example.com/file",
+        "http://release-assets.githubusercontent.com/file", // allow-domain: release-assets.githubusercontent.com
+        "https://user:secret@release-assets.githubusercontent.com/file", // allow-domain: release-assets.githubusercontent.com
+        "https://release-assets.githubusercontent.com:444/file", // allow-domain: release-assets.githubusercontent.com
+        "https://release-assets.githubusercontent.com/file#fragment", // allow-domain: release-assets.githubusercontent.com
+        "https://github.com/other/file",
+    ] {
+        assert!(
+            !allowed_redirect(&Url::parse(value).expect("should parse URL")),
+            "should reject unapproved redirect {value}"
+        );
+    }
+    assert!(
+        allowed_redirect(
+            &Url::parse("https://release-assets.githubusercontent.com/file?signature=fictional") // allow-domain: release-assets.githubusercontent.com
+                .expect("should parse CDN URL")
+        ),
+        "should allow documented release CDN"
+    );
+    assert!(
+        approved_asset_url(&release, "../bad").is_err(),
+        "should reject traversal"
+    );
+}
+
+#[test]
+fn retained_materialization_preserves_canonical_bytes_without_overwrite() {
+    let directory = tempfile::tempdir().expect("should create private directory");
+    let mut download = RetainedDownload::start("ts-aarch64-apple-darwin", AssetRole::Executable)
+        .expect("should start retention");
+    download
+        .push(&vec![17; 128 * 1024 + 1])
+        .expect("should retain multiple chunks");
+    let mut asset = download.finish().expect("should finish retention");
+    let path = asset
+        .materialize(
+            directory.path(),
+            AttemptDeadline::start(),
+            &Cancellation::default(),
+        )
+        .expect("should materialize retained executable");
+    assert_eq!(
+        std::fs::metadata(&path).expect("should stat copy").len(),
+        asset.measurement().length(),
+        "should preserve measured length"
+    );
+    assert_eq!(
+        crate::release::artifact::AssetMeasurement::of_bytes(
+            &std::fs::read(path).expect("should read copy")
+        ),
+        *asset.measurement(),
+        "should preserve retained digest"
+    );
+    assert!(
+        asset
+            .materialize(
+                directory.path(),
+                AttemptDeadline::start(),
+                &Cancellation::default()
+            )
+            .is_err(),
+        "should never overwrite existing canonical path"
+    );
+}
+
+/// Synthetic proofs are emitted by a real bounded OS child, not a crypto fixture.
+pub(super) struct Case {
+    pub(super) directory: TempDir,
+    pub(super) gh: PathBuf,
+    pub(super) assets: BTreeMap<String, Vec<u8>>,
+    pub(super) signed: Signed,
+    pub(super) requests: RefCell<Vec<String>>,
+}
+
+impl Case {
+    pub(super) fn new() -> Self {
+        let signed = fixture::consistent();
+        let directory = tempfile::tempdir().expect("should create fake transport directory");
+        let documents = &signed.documents;
+        let mut assets = BTreeMap::from([
+            ("release-index.json".to_owned(), signed.index_bytes.clone()),
+            (
+                "release-index.provenance.sigstore.json".to_owned(),
+                signed.publication.index_bundle.clone(),
+            ),
+            (
+                "tsjs-inventory.json".to_owned(),
+                documents.inventory.clone(),
+            ),
+            (
+                "SHA256SUMS".to_owned(),
+                signed.publication.checksums.clone(),
+            ),
+            (ASSET.to_owned(), documents.executable.clone()),
+        ]);
+        for (suffix, bytes) in [
+            (".provenance.sigstore.json", &documents.provenance_bundle),
+            (".sbom.sigstore.json", &documents.sbom_bundle),
+            (".spdx.json", &documents.spdx),
+            (".build-evidence.json", &documents.build_evidence),
+            (".build-recipe.json", &documents.build_recipe),
+            (".rebuild-check.json", &documents.rebuild_check),
+        ] {
+            assets.insert(format!("{ASSET}{suffix}"), bytes.clone());
+        }
+        let gh = directory.path().join("gh");
+        let case = Self {
+            directory,
+            gh,
+            assets,
+            signed,
+            requests: RefCell::new(Vec::new()),
+        };
+        case.install_proofs();
+        case
+    }
+
+    pub(super) fn install_proofs(&self) {
+        for (name, proof) in [
+            ("index-proof", json!([self.signed.proofs.index])),
+            ("artifact-proof", json!([self.signed.proofs.provenance])),
+            ("sbom-proof", json!([self.signed.proofs.spdx])),
+            ("release-proof", self.signed.publication.statement.clone()),
+        ] {
+            fs::write(
+                self.directory.path().join(name),
+                serde_json::to_vec(&proof).expect("should encode synthetic proof"),
+            )
+            .expect("should write proof response");
+        }
+        let root = self.directory.path().display();
+        let script = format!(
+            "#!/bin/sh\nif [ \"$1\" = --version ]; then echo 'gh version 2.97.0 (2026-01-01)'; exit 0; fi\nif [ \"$1\" = release ]; then /bin/cat '{root}/release-proof'; exit 0; fi\ncase \"$*\" in *--custom-trusted-root*) [ -z \"$GH_TOKEN$GITHUB_TOKEN\" ] || exit 9;; esac\ncase \"$3\" in */release-index.json) /bin/cat '{root}/index-proof';; *) case \"$*\" in *spdx.dev*) /bin/cat '{root}/sbom-proof';; *) /bin/cat '{root}/artifact-proof';; esac;; esac\n"
+        );
+        fs::write(&self.gh, script).expect("should install fake gh");
+        fs::set_permissions(&self.gh, fs::Permissions::from_mode(0o700))
+            .expect("should mark fake gh executable");
+    }
+
+    pub(super) fn runner(&self) -> GhRunner {
+        GhRunner::resolve(
+            GhLocation::Explicit(&self.gh),
+            &CallerEnvironment::from_pairs([("GH_TOKEN", "fictional-read-only-token")]),
+            ProcessBounds::production(),
+            AttemptDeadline::start(),
+            &Cancellation::default(),
+        )
+        .expect("should resolve fake trusted gh")
+    }
+
+    pub(super) fn write_assets(&self) {
+        for (name, bytes) in &self.assets {
+            fs::write(self.directory.path().join(name), bytes)
+                .expect("should write transferred evidence");
+        }
+    }
+}
+
+impl Transport for Case {
+    async fn policy(
+        &self,
+        deadline: AttemptDeadline,
+        cancellation: &Cancellation,
+    ) -> Result<ApprovedSourcePolicy, Report<ReleaseError>> {
+        crate::release::artifact::check_attempt(deadline, cancellation)?;
+        self.requests.borrow_mut().push("policy".to_owned());
+        Ok(ApprovedSourcePolicy::for_tests(
+            ApprovedCommit::parse(COMMIT)?,
+            EMBEDDED_POLICY.to_vec(),
+        ))
+    }
+
+    async fn asset(
+        &self,
+        name: &str,
+        role: AssetRole,
+        deadline: AttemptDeadline,
+        cancellation: &Cancellation,
+    ) -> Result<RetainedAsset, Report<ReleaseError>> {
+        crate::release::artifact::check_attempt(deadline, cancellation)?;
+        self.requests.borrow_mut().push(name.to_owned());
+        if std::time::Instant::now() >= deadline.instant() {
+            return Err(report(
+                ReleaseError::Timeout,
+                "fake transport deadline elapsed",
+            ));
+        }
+        let bytes = self
+            .assets
+            .get(name)
+            .ok_or_else(|| report(ReleaseError::Asset, "fake transport asset absent"))?;
+        let mut retained = RetainedDownload::start(name, role)?;
+        for chunk in bytes.chunks(17) {
+            retained.push(chunk)?;
+        }
+        retained.finish()
+    }
+
+    async fn publication(
+        &self,
+        tag_ref: bool,
+        deadline: AttemptDeadline,
+        cancellation: &Cancellation,
+    ) -> Result<Value, Report<ReleaseError>> {
+        crate::release::artifact::check_attempt(deadline, cancellation)?;
+        self.requests.borrow_mut().push("publication".to_owned());
+        Ok(if tag_ref {
+            self.signed.publication.tag_ref.clone()
+        } else {
+            self.signed.publication.release.clone()
+        })
+    }
+}
+
+#[tokio::test]
+async fn full_online_orchestration_joins_retained_bytes_and_typed_child_proofs() {
+    let case = Case::new();
+    let report = verify_with(
+        &case,
+        &case.runner(),
+        &fixture::approved(COMMIT),
+        ASSET,
+        AttemptDeadline::start(),
+        &Cancellation::default(),
+    )
+    .await
+    .expect("should verify complete synthetic graph through bounded child");
+    assert_eq!(report.asset, ASSET, "should report selected verified asset");
+    assert_eq!(
+        report.source_commit, COMMIT,
+        "should retain independently approved commit"
+    );
+}
+
+#[tokio::test]
+async fn untrusted_index_proof_fails_before_any_index_selected_download() {
+    let mut case = Case::new();
+    case.signed.proofs.index["verificationResult"]["signature"]["certificate"]["sourceRepositoryDigest"] =
+        json!("0".repeat(40));
+    case.install_proofs();
+    assert!(
+        verify_with(
+            &case,
+            &case.runner(),
+            &fixture::approved(COMMIT),
+            ASSET,
+            AttemptDeadline::start(),
+            &Cancellation::default()
+        )
+        .await
+        .is_err(),
+        "should reject certificate mismatch"
+    );
+    assert_eq!(
+        *case.requests.borrow(),
+        [
+            "policy",
+            "release-index.json",
+            "release-index.provenance.sigstore.json"
+        ],
+        "should verify index provenance before using its fields"
+    );
+}
+
+#[tokio::test]
+async fn malformed_truncated_and_failed_proof_children_never_produce_reports() {
+    for output in [
+        "printf '[{'",
+        "printf '[{}]'; exit 7",
+        "printf '[{\"a\":1,\"a\":2}]'",
+    ] {
+        let case = Case::new();
+        fs::write(&case.gh, format!("#!/bin/sh\nif [ \"$1\" = --version ]; then echo 'gh version 2.97.0 (2026-01-01)'; exit 0; fi\n{output}\n")).expect("should install malformed proof child");
+        assert!(
+            verify_with(
+                &case,
+                &case.runner(),
+                &fixture::approved(COMMIT),
+                ASSET,
+                AttemptDeadline::start(),
+                &Cancellation::default()
+            )
+            .await
+            .is_err(),
+            "should reject incomplete, ambiguous or failed proof"
+        );
+    }
+}
+
+#[tokio::test]
+async fn changed_companion_and_publication_fail_closed() {
+    for mutation in ["companion", "publication"] {
+        let mut case = Case::new();
+        if mutation == "companion" {
+            case.assets
+                .insert(format!("{ASSET}.build-evidence.json"), b"{}".to_vec());
+        } else {
+            case.signed.publication.release["immutable"] = json!(false);
+        }
+        assert!(
+            verify_with(
+                &case,
+                &case.runner(),
+                &fixture::approved(COMMIT),
+                ASSET,
+                AttemptDeadline::start(),
+                &Cancellation::default()
+            )
+            .await
+            .is_err(),
+            "should reject {mutation} mismatch"
+        );
+    }
+}
+
+#[tokio::test]
+async fn elapsed_attempt_deadline_produces_no_verification_report() {
+    let case = Case::new();
+    assert!(
+        verify_with(
+            &case,
+            &case.runner(),
+            &fixture::approved(COMMIT),
+            ASSET,
+            AttemptDeadline::at(std::time::Instant::now()),
+            &Cancellation::default()
+        )
+        .await
+        .is_err(),
+        "should reject elapsed attempt"
+    );
+}
+
+#[tokio::test]
+async fn bounded_child_timeout_fails_full_orchestration_without_publication() {
+    let case = Case::new();
+    fs::write(&case.gh, "#!/bin/sh\nif [ \"$1\" = --version ]; then echo 'gh version 2.97.0 (2026-01-01)'; exit 0; fi\nexec /bin/sleep 10\n").expect("should install stalled proof child");
+    let mut bounds = ProcessBounds::production();
+    bounds.child_timeout = std::time::Duration::from_millis(50);
+    let runner = case.runner().with_bounds(bounds);
+    assert!(
+        verify_with(
+            &case,
+            &runner,
+            &fixture::approved(COMMIT),
+            ASSET,
+            AttemptDeadline::start(),
+            &Cancellation::default()
+        )
+        .await
+        .is_err(),
+        "should fail complete orchestration when proof child times out"
+    );
+    assert!(
+        !case.requests.borrow().contains(&"publication".to_owned()),
+        "should not acquire publication after failed build proof"
+    );
+}
+
+#[tokio::test]
+async fn stalled_http_headers_and_bodies_cancel_promptly() {
+    for headers in [false, true] {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("should bind stalled HTTP fixture");
+        let address = listener
+            .local_addr()
+            .expect("should obtain fixture address");
+        let server = tokio::spawn(async move {
+            let (mut socket, _) = listener.accept().await.expect("should accept HTTP request");
+            let mut request = [0_u8; 1024];
+            tokio::io::AsyncReadExt::read(&mut socket, &mut request)
+                .await
+                .expect("should read request");
+            if headers {
+                tokio::io::AsyncWriteExt::write_all(
+                    &mut socket,
+                    b"HTTP/1.1 200 OK\r\nContent-Length: 4096\r\n\r\n",
+                )
+                .await
+                .expect("should send stalled body headers");
+            }
+            tokio::time::sleep(std::time::Duration::from_secs(10)).await;
+        });
+        let cancellation = Cancellation::default();
+        let requested = cancellation.clone();
+        tokio::spawn(async move {
+            tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+            requested.cancel();
+        });
+        let client = crate::release::source_policy::plain_http_policy_client_for_tests()
+            .expect("should create no-redirect fixture client");
+        let transfer = async {
+            let response = client
+                .get(format!("http://{address}/fixture"))
+                .send()
+                .await
+                .map_err(|_| report(ReleaseError::Asset, "fixture request failed"))?;
+            crate::release::artifact::stream_into(
+                response,
+                RetainedDownload::start("release-index.json", AssetRole::Metadata)?,
+                AttemptDeadline::start(),
+            )
+            .await
+        };
+        let result = tokio::time::timeout(
+            std::time::Duration::from_secs(2),
+            crate::release::online::cancellable(transfer, &cancellation),
+        )
+        .await
+        .expect("should cancel stalled HTTP before normal attempt deadline");
+        assert_eq!(
+            result
+                .expect_err("should reject cancelled transfer")
+                .current_context(),
+            &ReleaseError::Cancelled,
+            "should cancel both header and chunk waits"
+        );
+        server.abort();
+    }
+}
+
+#[test]
+fn final_asset_and_report_hashes_honor_deadline_and_cancellation() {
+    let signed = fixture::consistent();
+    let publication = signed
+        .publish()
+        .expect("should verify synthetic publication");
+    let retain = || {
+        let mut download = RetainedDownload::start(ASSET, AssetRole::Executable)
+            .expect("should start retained executable");
+        download
+            .push(&signed.documents.executable)
+            .expect("should retain fixture bytes");
+        download.finish().expect("should finish retained bytes")
+    };
+    let expired = AttemptDeadline::at(std::time::Instant::now());
+    assert!(
+        crate::release::artifact::VerifiedReleaseAsset::from_publication_bounded(
+            &publication,
+            retain(),
+            expired,
+            &Cancellation::default()
+        )
+        .is_err(),
+        "should not construct final asset after deadline"
+    );
+    let mut asset = crate::release::artifact::VerifiedReleaseAsset::from_publication_bounded(
+        &publication,
+        retain(),
+        AttemptDeadline::start(),
+        &Cancellation::default(),
+    )
+    .expect("should construct bounded final asset");
+    assert!(
+        crate::release::artifact::VerificationReport::new_bounded(
+            &publication,
+            &mut asset,
+            expired,
+            &Cancellation::default()
+        )
+        .is_err(),
+        "should produce no report after final-phase deadline"
+    );
+    let cancelled = Cancellation::default();
+    cancelled.cancel();
+    assert!(
+        crate::release::artifact::VerificationReport::new_bounded(
+            &publication,
+            &mut asset,
+            AttemptDeadline::start(),
+            &cancelled
+        )
+        .is_err(),
+        "should produce no report after final-phase cancellation"
+    );
+}
diff --git a/crates/trusted-server-cli/src/release/tests/verification/fixture.rs b/crates/trusted-server-cli/src/release/tests/verification/fixture.rs
new file mode 100644
index 0000000000..741e622a76
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/tests/verification/fixture.rs
@@ -0,0 +1,561 @@
+//! A fully synthetic fictional release evidence graph, built in three
+//! mutable stages so each test alters exactly one edge:
+//!
+//! 1. [`Graph`]: companion documents and executable bytes;
+//! 2. [`Built`]: the release index derived from those exact bytes;
+//! 3. [`Signed`]: gh-shaped proofs and publication JSON derived from the
+//!    exact index and companion bytes.
+
+use error_stack::Report;
+use serde_json::{Value, json};
+
+use crate::release::artifact::AssetMeasurement;
+use crate::release::documents::{ApprovedCommit, ApprovedRelease, ReleaseTag, sha256_hex};
+use crate::release::error::ReleaseError;
+use crate::release::evidence::{
+    BuildEvidenceVerified, ConsumedArtifact, EvidenceInputs, verify_build_evidence,
+};
+use crate::release::gh::{PredicateKind, VerifiedAttestation, VerifiedReleaseStatement};
+use crate::release::github::{PublicationInputs, PublicationVerified, verify_publication};
+use crate::release::policy::{EMBEDDED_POLICY, embedded_policy};
+use crate::release::source_policy::ApprovedSourcePolicy;
+
+const INDEX_FIXTURE: &[u8] =
+    include_bytes!("../../../../tests/fixtures/release/release-index.json");
+pub(crate) const COMMIT: &str = "0123456789abcdef0123456789abcdef01234567";
+pub(crate) const OTHER_COMMIT: &str = "89abcdef0123456789abcdef0123456789abcdef";
+pub(crate) const TAG: &str = "v1.2.0";
+pub(crate) const ASSET: &str = "trusted-server-fastly.wasm";
+pub(crate) const RUN: &str =
+    "https://github.com/IABTechLab/trusted-server/actions/runs/1234567890/attempts/1";
+pub(crate) const OTHER_RUN: &str =
+    "https://github.com/IABTechLab/trusted-server/actions/runs/1234567890/attempts/2";
+pub(crate) const SAN: &str = "https://github.com/IABTechLab/trusted-server/.github/workflows/release-build.yml@refs/tags/v1.2.0";
+pub(crate) const CALLER: &str =
+    "https://github.com/IABTechLab/trusted-server/.github/workflows/release.yml@refs/tags/v1.2.0";
+const REPOSITORY_URI: &str = "https://github.com/IABTechLab/trusted-server";
+const RELEASE_SIGNER: &str = "https://dotcom.releases.github.com"; // allow-domain: dotcom.releases.github.com
+
+/// Suffixes of the five artifact provenance subjects besides the executable.
+pub(crate) const PROVENANCE_SUFFIXES: [&str; 4] = [
+    ".spdx.json",
+    ".build-evidence.json",
+    ".build-recipe.json",
+    ".rebuild-check.json",
+];
+
+pub(crate) fn approved(commit: &str) -> ApprovedRelease {
+    ApprovedRelease::new(
+        ReleaseTag::parse(TAG).expect("should accept fictional tag"),
+        ApprovedCommit::parse(commit).expect("should accept fictional commit"),
+    )
+}
+
+fn module(id: &str, body: &str) -> Value {
+    json!({
+        "id": id,
+        "filename": format!("tsjs-{id}.js"),
+        "size": body.len(),
+        "sha256": sha256_hex(body.as_bytes()),
+    })
+}
+
+/// Stage 1: companion documents and executable bytes.
+pub(crate) struct Graph {
+    pub(crate) executable: Vec<u8>,
+    pub(crate) inventory: Value,
+    pub(crate) spdx: Value,
+    pub(crate) build_evidence: Value,
+    pub(crate) build_recipe: Value,
+    pub(crate) rebuild_check: Value,
+}
+
+impl Graph {
+    pub(crate) fn new() -> Self {
+        let executable = b"fictional trusted-server-fastly wasm bytes".to_vec();
+        let executable_sha256 = sha256_hex(&executable);
+        let modules = json!([module("core", "core();"), module("prebid", "prebid();")]);
+        let mut inventory_modules = modules.clone();
+        inventory_modules[0]["contributions"] = json!([{"package": "fictional-js"}]);
+        let inventory = json!({
+            "schema_version": 1,
+            "source_commit": COMMIT,
+            "modules": inventory_modules,
+            "tools": [],
+        });
+        Self {
+            spdx: spdx_document(&executable_sha256),
+            build_evidence: json!({
+                "schema_version": 1,
+                "source_commit": COMMIT,
+                "target": "wasm32-wasip1",
+                "variant": "default",
+                "artifact_sha256": executable_sha256,
+                "js_inventory_sha256": sha256_hex(&bytes_of(&inventory)),
+                "prepared_modules": modules,
+                "embedded_modules": [modules[0].clone()],
+                "compatibility_tests": [],
+                "inputs": [],
+            }),
+            build_recipe: json!({"version": 1, "source_commit": COMMIT}),
+            rebuild_check: json!({"version": 1, "outcome": "matched"}),
+            executable,
+            inventory,
+        }
+    }
+
+    /// Serializes documents and derives the index from their exact bytes.
+    pub(crate) fn build(self) -> Built {
+        let documents = Documents {
+            inventory: bytes_of(&self.inventory),
+            spdx: bytes_of(&self.spdx),
+            build_evidence: bytes_of(&self.build_evidence),
+            build_recipe: bytes_of(&self.build_recipe),
+            rebuild_check: bytes_of(&self.rebuild_check),
+            provenance_bundle: br#"{"fictional":"artifact provenance bundle"}"#.to_vec(),
+            sbom_bundle: br#"{"fictional":"artifact sbom bundle"}"#.to_vec(),
+            executable: self.executable,
+        };
+        let index = index_for(&documents);
+        Built { documents, index }
+    }
+}
+
+fn spdx_document(executable_sha256: &str) -> Value {
+    json!({
+        "spdxVersion": "SPDX-2.3",
+        "SPDXID": "SPDXRef-DOCUMENT",
+        "name": ASSET,
+        "dataLicense": "CC0-1.0",
+        "documentNamespace": "https://example.com/spdx/trusted-server-fastly",
+        "creationInfo": {"creators": ["Tool: fictional"], "created": "2026-01-01T00:00:00Z"},
+        "packages": [
+            {
+                "SPDXID": "SPDXRef-Package-root",
+                "name": ASSET,
+                "checksums": [{"algorithm": "SHA256", "checksumValue": executable_sha256}],
+            },
+            {"SPDXID": "SPDXRef-Package-dependency", "name": "fictional-crate"},
+        ],
+        "relationships": [
+            {
+                "spdxElementId": "SPDXRef-DOCUMENT",
+                "relationshipType": "DESCRIBES",
+                "relatedSpdxElement": "SPDXRef-Package-root",
+            },
+            {
+                "spdxElementId": "SPDXRef-Package-root",
+                "relationshipType": "CONTAINS",
+                "relatedSpdxElement": "SPDXRef-Package-dependency",
+            },
+        ],
+    })
+}
+
+pub(crate) fn bytes_of(value: &Value) -> Vec<u8> {
+    serde_json::to_vec_pretty(value).expect("should serialize fixture JSON")
+}
+
+/// Exact serialized companion and executable bytes.
+pub(crate) struct Documents {
+    pub(crate) executable: Vec<u8>,
+    pub(crate) inventory: Vec<u8>,
+    pub(crate) spdx: Vec<u8>,
+    pub(crate) build_evidence: Vec<u8>,
+    pub(crate) build_recipe: Vec<u8>,
+    pub(crate) rebuild_check: Vec<u8>,
+    pub(crate) provenance_bundle: Vec<u8>,
+    pub(crate) sbom_bundle: Vec<u8>,
+}
+
+fn record(name: &str, bytes: &[u8]) -> Value {
+    json!({"name": name, "size": bytes.len(), "sha256": sha256_hex(bytes)})
+}
+
+fn index_for(documents: &Documents) -> Value {
+    let mut index: Value =
+        serde_json::from_slice(INDEX_FIXTURE).expect("should parse index fixture");
+    index["policy_sha256"] = json!(sha256_hex(EMBEDDED_POLICY));
+    index["tsjs_inventory"] = record("tsjs-inventory.json", &documents.inventory);
+    let inventory_sha256 = sha256_hex(&documents.inventory);
+    for artifact in index["artifacts"]
+        .as_array_mut()
+        .expect("should hold artifacts")
+    {
+        artifact["js_inventory_sha256"] = json!(inventory_sha256);
+        if artifact["name"] != ASSET {
+            continue;
+        }
+        artifact["size"] = json!(documents.executable.len());
+        artifact["sha256"] = json!(sha256_hex(&documents.executable));
+        let companions = &mut artifact["companions"];
+        companions["sbom"] = record(&format!("{ASSET}.spdx.json"), &documents.spdx);
+        companions["build_evidence"] = record(
+            &format!("{ASSET}.build-evidence.json"),
+            &documents.build_evidence,
+        );
+        companions["build_recipe"] = record(
+            &format!("{ASSET}.build-recipe.json"),
+            &documents.build_recipe,
+        );
+        companions["rebuild_check"] = record(
+            &format!("{ASSET}.rebuild-check.json"),
+            &documents.rebuild_check,
+        );
+        companions["provenance"] = record(
+            &format!("{ASSET}.provenance.sigstore.json"),
+            &documents.provenance_bundle,
+        );
+        companions["sbom_attestation"] = record(
+            &format!("{ASSET}.sbom.sigstore.json"),
+            &documents.sbom_bundle,
+        );
+    }
+    index
+}
+
+/// Stage 2: documents plus the release index value.
+pub(crate) struct Built {
+    pub(crate) documents: Documents,
+    pub(crate) index: Value,
+}
+
+/// gh-shaped verified proofs for every collected bundle.
+pub(crate) struct Proofs {
+    pub(crate) index: Value,
+    pub(crate) provenance: Value,
+    pub(crate) spdx: Value,
+}
+
+/// Official publication JSON for the release.
+pub(crate) struct Publication {
+    pub(crate) release: Value,
+    pub(crate) tag_ref: Value,
+    pub(crate) statement: Value,
+    pub(crate) index_bundle: Vec<u8>,
+    pub(crate) checksums: Vec<u8>,
+}
+
+impl Built {
+    /// Re-derives the index after directly altering serialized documents.
+    pub(crate) fn reindex(&mut self) {
+        self.index = index_for(&self.documents);
+    }
+
+    /// Serializes the index and signs proofs/publication over exact bytes.
+    pub(crate) fn sign(self) -> Signed {
+        let index_bytes = bytes_of(&self.index);
+        let documents = &self.documents;
+        let mut provenance_subjects = vec![(ASSET.to_owned(), sha256_hex(&documents.executable))];
+        let companions = [
+            &documents.spdx,
+            &documents.build_evidence,
+            &documents.build_recipe,
+            &documents.rebuild_check,
+        ];
+        for (suffix, bytes) in PROVENANCE_SUFFIXES.iter().zip(companions) {
+            provenance_subjects.push((format!("{ASSET}{suffix}"), sha256_hex(bytes)));
+        }
+        let spdx_value: Value =
+            serde_json::from_slice(&documents.spdx).expect("should parse fixture SPDX");
+        let proofs = Proofs {
+            index: proof(
+                PROVENANCE,
+                &[("release-index.json".to_owned(), sha256_hex(&index_bytes))],
+                &provenance_predicate(RUN),
+                RUN,
+            ),
+            provenance: proof(
+                PROVENANCE,
+                &provenance_subjects,
+                &provenance_predicate(RUN),
+                RUN,
+            ),
+            spdx: proof(
+                SPDX,
+                &[(ASSET.to_owned(), sha256_hex(&documents.executable))],
+                &spdx_value,
+                RUN,
+            ),
+        };
+        let publication = publication_for(&self.index, &index_bytes);
+        Signed {
+            commit: COMMIT.to_owned(),
+            documents: self.documents,
+            index_bytes,
+            proofs,
+            publication,
+        }
+    }
+}
+
+const PROVENANCE: &str = "https://slsa.dev/provenance/v1";
+const SPDX: &str = "https://spdx.dev/Document/v2.3";
+
+pub(crate) fn certificate(run: &str) -> Value {
+    json!({
+        "certificateIssuer": "CN=fictional-intermediate,O=example.com",
+        "subjectAlternativeName": SAN,
+        "issuer": "https://token.actions.githubusercontent.com",
+        "githubWorkflowTrigger": "push",
+        "githubWorkflowSHA": COMMIT,
+        "githubWorkflowName": "Release",
+        "githubWorkflowRepository": "IABTechLab/trusted-server",
+        "githubWorkflowRef": "refs/tags/v1.2.0",
+        "buildSignerURI": SAN,
+        "buildSignerDigest": COMMIT,
+        "runnerEnvironment": "github-hosted",
+        "sourceRepositoryURI": REPOSITORY_URI,
+        "sourceRepositoryDigest": COMMIT,
+        "sourceRepositoryRef": "refs/tags/v1.2.0",
+        "sourceRepositoryIdentifier": "950860906",
+        "sourceRepositoryOwnerURI": "https://github.com/IABTechLab",
+        "sourceRepositoryOwnerIdentifier": "82903538",
+        "buildConfigURI": CALLER,
+        "buildConfigDigest": COMMIT,
+        "buildTrigger": "push",
+        "runInvocationURI": run,
+        "sourceRepositoryVisibilityAtSigning": "public",
+    })
+}
+
+pub(crate) fn provenance_predicate(run: &str) -> Value {
+    json!({
+        "buildDefinition": {
+            "buildType": "https://actions.github.io/buildtypes/workflow/v1",
+            "externalParameters": {
+                "workflow": {
+                    "ref": "refs/tags/v1.2.0",
+                    "repository": REPOSITORY_URI,
+                    "path": ".github/workflows/release.yml",
+                }
+            },
+            "internalParameters": {
+                "github": {
+                    "event_name": "push",
+                    "repository_id": "950860906",
+                    "repository_owner_id": "82903538",
+                    "runner_environment": "github-hosted",
+                }
+            },
+            "resolvedDependencies": [{
+                "uri": "git+https://github.com/IABTechLab/trusted-server@refs/tags/v1.2.0",
+                "digest": {"gitCommit": COMMIT},
+            }],
+        },
+        "runDetails": {
+            "builder": {"id": SAN},
+            "metadata": {"invocationId": run},
+        },
+    })
+}
+
+fn proof(
+    predicate_type: &str,
+    subjects: &[(String, String)],
+    predicate: &Value,
+    run: &str,
+) -> Value {
+    let subjects: Vec<Value> = subjects
+        .iter()
+        .map(|(name, sha256)| json!({"name": name, "digest": {"sha256": sha256}}))
+        .collect();
+    json!({
+        "attestation": {
+            "bundle": {"mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json"},
+            "bundle_url": "",
+        },
+        "verificationResult": {
+            "mediaType": "application/vnd.dev.sigstore.verificationresult+json;version=0.1",
+            "signature": {"certificate": certificate(run)},
+            "statement": {
+                "_type": "https://in-toto.io/Statement/v1",
+                "subject": subjects,
+                "predicateType": predicate_type,
+                "predicate": predicate,
+            },
+            "verifiedTimestamps": [],
+        },
+    })
+}
+
+/// Every release asset (name, size, SHA-256) for a signed index.
+fn release_assets(index: &Value, index_bytes: &[u8], extra: &[(&str, &[u8])]) -> Vec<Value> {
+    let mut assets = vec![index["tsjs_inventory"].clone()];
+    for artifact in index["artifacts"]
+        .as_array()
+        .expect("should hold artifacts")
+    {
+        assets.push(json!({
+            "name": artifact["name"],
+            "size": artifact["size"],
+            "sha256": artifact["sha256"],
+        }));
+        for companion in artifact["companions"]
+            .as_object()
+            .expect("should hold companions")
+            .values()
+        {
+            assets.push(companion.clone());
+        }
+    }
+    assets.push(record("release-index.json", index_bytes));
+    for (name, bytes) in extra {
+        assets.push(record(name, bytes));
+    }
+    assets
+}
+
+fn publication_for(index: &Value, index_bytes: &[u8]) -> Publication {
+    let index_bundle = br#"{"fictional":"index provenance bundle"}"#.to_vec();
+    let checksums = b"fictional checksum list\n".to_vec();
+    let assets = release_assets(
+        index,
+        index_bytes,
+        &[
+            ("release-index.provenance.sigstore.json", &index_bundle),
+            ("SHA256SUMS", &checksums),
+        ],
+    );
+    let rest_assets: Vec<Value> = assets
+        .iter()
+        .map(|asset| {
+            json!({
+                "name": asset["name"],
+                "size": asset["size"],
+                "state": "uploaded",
+                "digest": format!("sha256:{}", asset["sha256"].as_str().unwrap_or_default()),
+            })
+        })
+        .collect();
+    let mut subjects = vec![
+        json!({"uri": format!("pkg:github/IABTechLab/trusted-server@{TAG}"), "digest": {"sha1": COMMIT}}),
+    ];
+    subjects.extend(
+        assets
+            .iter()
+            .map(|asset| json!({"name": asset["name"], "digest": {"sha256": asset["sha256"]}})),
+    );
+    Publication {
+        release: json!({
+            "tag_name": TAG,
+            "draft": false,
+            "prerelease": false,
+            "immutable": true,
+            "assets": rest_assets,
+        }),
+        tag_ref: json!({
+            "ref": "refs/tags/v1.2.0",
+            "object": {"sha": COMMIT, "type": "commit"},
+        }),
+        statement: json!({
+            "attestation": {"bundle": {}, "bundle_url": ""},
+            "verificationResult": {
+                "mediaType": "application/vnd.dev.sigstore.verificationresult+json;version=0.1",
+                "signature": {"certificate": {"subjectAlternativeName": RELEASE_SIGNER}},
+                "statement": {
+                    "_type": "https://in-toto.io/Statement/v1",
+                    "predicateType": "https://in-toto.io/attestation/release/v0.1",
+                    "subject": subjects,
+                    "predicate": {"tag": TAG, "repository": "IABTechLab/trusted-server", "repositoryId": "950860906", "ownerId": "82903538", "purl": format!("pkg:github/IABTechLab/trusted-server@{TAG}")},
+                },
+            },
+        }),
+        index_bundle,
+        checksums,
+    }
+}
+
+/// Stage 3: exact bytes, proofs and publication data.
+pub(crate) struct Signed {
+    pub(crate) commit: String,
+    pub(crate) documents: Documents,
+    pub(crate) index_bytes: Vec<u8>,
+    pub(crate) proofs: Proofs,
+    pub(crate) publication: Publication,
+}
+
+impl Signed {
+    /// Runs the evidence-graph verifier over this graph.
+    pub(crate) fn verify(&self) -> Result<BuildEvidenceVerified, Report<ReleaseError>> {
+        let policy = embedded_policy().expect("should accept embedded policy");
+        let release = approved(&self.commit);
+        let source_policy = ApprovedSourcePolicy::for_tests(
+            ApprovedCommit::parse(COMMIT).expect("should accept fictional commit"),
+            EMBEDDED_POLICY.to_vec(),
+        );
+        let documents = &self.documents;
+        let executable = AssetMeasurement::of_bytes(&documents.executable);
+        let provenance_bundle = AssetMeasurement::of_bytes(&documents.provenance_bundle);
+        let sbom_bundle = AssetMeasurement::of_bytes(&documents.sbom_bundle);
+        let index_bundle = AssetMeasurement::of_bytes(&self.publication.index_bundle);
+        let index_proof = VerifiedAttestation::synthetic_for_tests(
+            self.proofs.index.clone(),
+            release.clone(),
+            PredicateKind::Provenance,
+            AssetMeasurement::of_bytes(&self.index_bytes),
+            index_bundle.clone(),
+        );
+        let provenance_proof = VerifiedAttestation::synthetic_for_tests(
+            self.proofs.provenance.clone(),
+            release.clone(),
+            PredicateKind::Provenance,
+            executable.clone(),
+            provenance_bundle.clone(),
+        );
+        let spdx_proof = VerifiedAttestation::synthetic_for_tests(
+            self.proofs.spdx.clone(),
+            release.clone(),
+            PredicateKind::Spdx,
+            executable.clone(),
+            sbom_bundle.clone(),
+        );
+        let artifacts = [ConsumedArtifact {
+            name: ASSET,
+            executable: &executable,
+            spdx: &documents.spdx,
+            build_evidence: &documents.build_evidence,
+            build_recipe: &documents.build_recipe,
+            rebuild_check: &documents.rebuild_check,
+            provenance_bundle: &provenance_bundle,
+            sbom_bundle: &sbom_bundle,
+            provenance_proof: &provenance_proof,
+            spdx_proof: &spdx_proof,
+        }];
+        verify_build_evidence(&EvidenceInputs {
+            release: &release,
+            consumer_policy: &policy,
+            source_policy: &source_policy,
+            index_bytes: &self.index_bytes,
+            index_proof: &index_proof,
+            index_bundle: &index_bundle,
+            inventory_bytes: &documents.inventory,
+            artifacts: &artifacts,
+        })
+    }
+
+    /// Runs evidence then publication verification.
+    pub(crate) fn publish(&self) -> Result<PublicationVerified, Report<ReleaseError>> {
+        let build = self.verify()?;
+        let publication = &self.publication;
+        let release_proof = VerifiedReleaseStatement::synthetic_for_tests(
+            publication.statement.clone(),
+            approved(&self.commit),
+        );
+        verify_publication(
+            build,
+            &PublicationInputs {
+                release: &publication.release,
+                tag_ref: &publication.tag_ref,
+                release_statement: &release_proof,
+                index_bundle: &AssetMeasurement::of_bytes(&publication.index_bundle),
+                checksums: &AssetMeasurement::of_bytes(&publication.checksums),
+            },
+        )
+    }
+}
+
+/// Builds and signs an unmodified, fully consistent graph.
+pub(crate) fn consistent() -> Signed {
+    Graph::new().build().sign()
+}
diff --git a/crates/trusted-server-cli/src/release/tests/verification/mod.rs b/crates/trusted-server-cli/src/release/tests/verification/mod.rs
new file mode 100644
index 0000000000..952fd43a87
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/tests/verification/mod.rs
@@ -0,0 +1,596 @@
+//! Evidence-graph verification: a fully synthetic fictional graph passes and
+//! each independently altered edge fails closed.
+//!
+//! These semantic tests do not qualify a cryptographic verifier or action.
+//! The gh runner is exercised separately with real OS fixture children.
+
+use error_stack::Report;
+use serde_json::{Value, json};
+
+use crate::release::error::ReleaseError;
+use crate::release::evidence::ComparisonOutcome;
+
+use self::fixture::{
+    ASSET, Graph, OTHER_COMMIT, OTHER_RUN, PROVENANCE_SUFFIXES, RUN, Signed, consistent,
+};
+
+pub(super) mod fixture;
+mod publication;
+
+#[test]
+fn synthetic_graph_rejects_malformed_or_duplicate_key_recipe() {
+    for recipe in [b"not JSON".as_slice(), br#"{"version":1,"version":1}"#] {
+        let mut built = Graph::new().build();
+        built.documents.build_recipe = recipe.to_vec();
+        built.reindex();
+        assert_eq!(
+            context(built.sign().verify()),
+            ReleaseError::Document,
+            "should strictly parse authenticated recipe bytes"
+        );
+    }
+}
+
+#[test]
+fn synthetic_graph_rejects_unsupported_informational_versions() {
+    for field in ["recipe", "comparison"] {
+        let mut graph = Graph::new();
+        if field == "recipe" {
+            graph.build_recipe["version"] = json!(2);
+        } else {
+            graph.rebuild_check["version"] = json!(2);
+        }
+        assert!(
+            graph.build().sign().verify().is_err(),
+            "should reject unsupported {field} version"
+        );
+    }
+}
+
+const ZERO_DIGEST: &str = "0000000000000000000000000000000000000000000000000000000000000000";
+
+/// A named in-place edit of one proof section.
+type Mutation = (&'static str, fn(&mut Value));
+
+fn context<T: core::fmt::Debug>(result: Result<T, Report<ReleaseError>>) -> ReleaseError {
+    *result
+        .expect_err("should reject the altered edge")
+        .current_context()
+}
+
+fn rejects_evidence(signed: &Signed, why: &str) {
+    assert_eq!(
+        context(signed.verify()),
+        ReleaseError::Evidence,
+        "should reject: {why}"
+    );
+}
+
+fn certificate_mut(proof: &mut Value) -> &mut Value {
+    &mut proof["verificationResult"]["signature"]["certificate"]
+}
+
+fn statement_mut(proof: &mut Value) -> &mut Value {
+    &mut proof["verificationResult"]["statement"]
+}
+
+#[test]
+fn consistent_graph_verifies() {
+    let build = consistent()
+        .verify()
+        .expect("should verify the consistent fictional graph");
+
+    assert_eq!(build.run_invocation(), RUN, "should keep the shared run");
+    assert_eq!(build.consumed().len(), 1, "should verify one artifact");
+    let consumed = &build.consumed()[0];
+    assert_eq!(consumed.name(), ASSET, "should name the consumed asset");
+    assert_eq!(
+        consumed.assurance_profile(),
+        "provenance-sbom-repeatable",
+        "should carry the index profile"
+    );
+    assert_eq!(
+        consumed.comparison(),
+        ComparisonOutcome::Matched,
+        "should report the rebuild outcome"
+    );
+}
+
+#[test]
+fn rejects_empty_signature_bundle_records() {
+    for bundle in ["provenance", "sbom"] {
+        let mut built = Graph::new().build();
+        if bundle == "provenance" {
+            built.documents.provenance_bundle.clear();
+        } else {
+            built.documents.sbom_bundle.clear();
+        }
+        built.reindex();
+        let error = built
+            .sign()
+            .verify()
+            .expect_err("should reject a size-0 signature bundle record");
+        assert_eq!(
+            *error.current_context(),
+            ReleaseError::Evidence,
+            "should fail closed for an empty {bundle} bundle"
+        );
+        assert!(
+            format!("{error:?}").contains("is empty"),
+            "should name the empty {bundle} bundle: {error:?}"
+        );
+    }
+}
+
+/// Name suffix and graph accessor of one companion document.
+type CompanionDocument = (&'static str, fn(&mut Graph) -> &mut Value);
+
+/// The three consumed companion kinds that may carry `release_qualification`.
+const QUALIFIED_COMPANIONS: [CompanionDocument; 3] = [
+    ("build-evidence", |graph| &mut graph.build_evidence),
+    ("build-recipe", |graph| &mut graph.build_recipe),
+    ("rebuild-check", |graph| &mut graph.rebuild_check),
+];
+
+fn graph_with_qualification(document: fn(&mut Graph) -> &mut Value, value: Value) -> Graph {
+    let mut graph = Graph::new();
+    document(&mut graph)["release_qualification"] = value;
+    graph
+}
+
+#[test]
+fn rejects_each_companion_declaring_release_qualification_false() {
+    for (companion, document) in QUALIFIED_COMPANIONS {
+        let signed = graph_with_qualification(document, json!(false))
+            .build()
+            .sign();
+
+        let error = signed
+            .verify()
+            .expect_err("should reject an unqualified companion with signed, non-empty bundles");
+
+        assert_eq!(
+            *error.current_context(),
+            ReleaseError::Evidence,
+            "should fail closed for an unqualified {companion}"
+        );
+        assert!(
+            format!("{error:?}").contains(&format!(
+                "{ASSET}.{companion}.json` declares `release_qualification: false`"
+            )),
+            "should name the unqualified {companion}: {error:?}"
+        );
+    }
+}
+
+#[test]
+fn rejects_each_companion_with_non_boolean_release_qualification() {
+    for (companion, document) in QUALIFIED_COMPANIONS {
+        for value in [json!(null), json!("false"), json!(0)] {
+            let signed = graph_with_qualification(document, value.clone())
+                .build()
+                .sign();
+
+            let error = signed
+                .verify()
+                .expect_err("should reject a non-boolean qualification declaration");
+
+            assert_eq!(
+                *error.current_context(),
+                ReleaseError::Evidence,
+                "should fail closed for {companion} release_qualification {value}"
+            );
+            assert!(
+                format!("{error:?}").contains("must be a boolean"),
+                "should name the malformed declaration: {error:?}"
+            );
+        }
+    }
+}
+
+#[test]
+fn accepts_companions_declaring_release_qualification_true() {
+    let mut graph = Graph::new();
+    for (_, document) in QUALIFIED_COMPANIONS {
+        document(&mut graph)["release_qualification"] = json!(true);
+    }
+
+    graph
+        .build()
+        .sign()
+        .verify()
+        .expect("should verify companions declaring qualification");
+}
+
+#[test]
+fn rejects_empty_bundle_records_of_an_unconsumed_index_artifact() {
+    let mut built = Graph::new().build();
+    let other = built.index["artifacts"]
+        .as_array_mut()
+        .expect("should hold artifacts")
+        .iter_mut()
+        .find(|artifact| artifact["name"] != ASSET)
+        .expect("should index another cohort artifact");
+    other["companions"]["sbom_attestation"]["size"] = json!(0);
+    let error = built
+        .sign()
+        .verify()
+        .expect_err("should reject an index naming an empty bundle");
+    assert_eq!(
+        *error.current_context(),
+        ReleaseError::Evidence,
+        "should fail closed before consuming any artifact"
+    );
+    assert!(
+        format!("{error:?}").contains(".sbom.sigstore.json` is empty"),
+        "should name the unconsumed artifact's empty bundle: {error:?}"
+    );
+}
+
+#[test]
+fn rejects_index_subject_digest() {
+    let mut signed = consistent();
+    statement_mut(&mut signed.proofs.index)["subject"][0]["digest"]["sha256"] = json!(ZERO_DIGEST);
+
+    rejects_evidence(&signed, "index provenance subject digest differs");
+}
+
+#[test]
+fn rejects_index_bytes_altered_after_signing() {
+    let mut signed = consistent();
+    signed.index_bytes.push(b'\n');
+
+    rejects_evidence(&signed, "index bytes no longer match the signed subject");
+}
+
+#[test]
+fn rejects_each_altered_provenance_subject_digest() {
+    for position in 0..=PROVENANCE_SUFFIXES.len() {
+        let mut signed = consistent();
+        statement_mut(&mut signed.proofs.provenance)["subject"][position]["digest"]["sha256"] =
+            json!(ZERO_DIGEST);
+
+        rejects_evidence(&signed, &format!("provenance subject {position} digest"));
+    }
+}
+
+#[test]
+fn rejects_missing_and_extra_provenance_subjects() {
+    let mut missing = consistent();
+    statement_mut(&mut missing.proofs.provenance)["subject"]
+        .as_array_mut()
+        .expect("should hold subjects")
+        .pop();
+    rejects_evidence(&missing, "provenance lacks the rebuild-check subject");
+
+    let mut extra = consistent();
+    statement_mut(&mut extra.proofs.provenance)["subject"]
+        .as_array_mut()
+        .expect("should hold subjects")
+        .push(json!({"name": "unapproved.bin", "digest": {"sha256": ZERO_DIGEST}}));
+    rejects_evidence(&extra, "provenance carries an unapproved subject");
+}
+
+#[test]
+fn rejects_renamed_signed_subject() {
+    let mut signed = consistent();
+    statement_mut(&mut signed.proofs.provenance)["subject"][3]["name"] =
+        json!("ts-x86_64-unknown-linux-gnu.build-recipe.json");
+
+    rejects_evidence(&signed, "signed subject names another asset");
+}
+
+#[test]
+fn rejects_spdx_subject() {
+    let mut signed = consistent();
+    statement_mut(&mut signed.proofs.spdx)["subject"][0]["digest"]["sha256"] = json!(ZERO_DIGEST);
+
+    rejects_evidence(&signed, "SPDX attestation subject is not the executable");
+}
+
+#[test]
+fn rejects_spdx_root_checksum() {
+    let mut graph = Graph::new();
+    graph.spdx["packages"][0]["checksums"][0]["checksumValue"] = json!(ZERO_DIGEST);
+
+    rejects_evidence(
+        &graph.build().sign(),
+        "SPDX root checksum is not the executable digest",
+    );
+}
+
+#[test]
+fn rejects_ambiguous_spdx_root() {
+    let mut graph = Graph::new();
+    graph.spdx["documentDescribes"] = json!(["SPDXRef-Package-dependency"]);
+
+    rejects_evidence(&graph.build().sign(), "SPDX describes two roots");
+}
+
+#[test]
+fn rejects_spdx_predicate_differing_from_document() {
+    let mut signed = consistent();
+    statement_mut(&mut signed.proofs.spdx)["predicate"]["packages"][1]["name"] =
+        json!("substituted-crate");
+
+    rejects_evidence(
+        &signed,
+        "SPDX predicate differs from the published document",
+    );
+}
+
+#[test]
+fn spdx_comparison_ignores_key_order_but_not_array_order() {
+    let mut reordered = consistent();
+    let predicate = &mut statement_mut(&mut reordered.proofs.spdx)["predicate"];
+    let packages = predicate["packages"].clone();
+    predicate
+        .as_object_mut()
+        .expect("should hold predicate object")
+        .remove("packages");
+    predicate["packages"] = packages;
+    reordered
+        .verify()
+        .expect("should ignore object key order in the SPDX comparison");
+
+    let mut swapped = consistent();
+    statement_mut(&mut swapped.proofs.spdx)["predicate"]["packages"]
+        .as_array_mut()
+        .expect("should hold packages")
+        .reverse();
+    rejects_evidence(&swapped, "SPDX array order is significant");
+}
+
+#[test]
+fn rejects_duplicate_keys_in_published_spdx() {
+    let mut built = Graph::new().build();
+    let text = String::from_utf8(built.documents.spdx.clone()).expect("should be UTF-8");
+    built.documents.spdx = text
+        .replacen("\"name\":", "\"name\": \"shadow\",\n  \"name\":", 1)
+        .into_bytes();
+    built.reindex();
+
+    assert_eq!(
+        context(built.sign().verify()),
+        ReleaseError::Document,
+        "should reject a signed but duplicate-key SPDX document"
+    );
+}
+
+#[test]
+fn rejects_js_inventory_digest() {
+    let mut graph = Graph::new();
+    graph.build_evidence["js_inventory_sha256"] = json!(ZERO_DIGEST);
+
+    rejects_evidence(
+        &graph.build().sign(),
+        "build evidence names another inventory",
+    );
+}
+
+#[test]
+fn rejects_index_inventory_record() {
+    let mut built = Graph::new().build();
+    built.index["tsjs_inventory"]["sha256"] = json!(ZERO_DIGEST);
+    for artifact in built.index["artifacts"]
+        .as_array_mut()
+        .expect("should hold artifacts")
+    {
+        artifact["js_inventory_sha256"] = json!(ZERO_DIGEST);
+    }
+
+    rejects_evidence(
+        &built.sign(),
+        "index inventory digest differs from its bytes",
+    );
+}
+
+#[test]
+fn rejects_prepared_module_table() {
+    let mut graph = Graph::new();
+    graph.build_evidence["prepared_modules"][1]["size"] = json!(1);
+
+    rejects_evidence(
+        &graph.build().sign(),
+        "prepared modules differ from inventory",
+    );
+}
+
+#[test]
+fn rejects_retained_module_outside_inventory() {
+    let mut graph = Graph::new();
+    graph.build_evidence["embedded_modules"][0]["sha256"] = json!(ZERO_DIGEST);
+
+    rejects_evidence(
+        &graph.build().sign(),
+        "retained module is not an inventory module",
+    );
+}
+
+#[test]
+fn rejects_build_evidence_for_another_executable() {
+    let mut graph = Graph::new();
+    graph.build_evidence["artifact_sha256"] = json!(ZERO_DIGEST);
+
+    rejects_evidence(
+        &graph.build().sign(),
+        "build evidence names another executable",
+    );
+}
+
+#[test]
+fn rejects_unknown_rebuild_outcome() {
+    let mut graph = Graph::new();
+    graph.rebuild_check["outcome"] = json!("assumed");
+
+    rejects_evidence(
+        &graph.build().sign(),
+        "rebuild outcome outside the closed enum",
+    );
+}
+
+#[test]
+fn rejects_altered_companion_bytes() {
+    let mut signed = consistent();
+    signed.documents.build_recipe.push(b' ');
+
+    rejects_evidence(&signed, "companion bytes differ from the signed index");
+}
+
+#[test]
+fn rejects_policy_version_and_digest() {
+    let mut digest = Graph::new().build();
+    digest.index["policy_sha256"] = json!(ZERO_DIGEST);
+    assert_eq!(
+        context(digest.sign().verify()),
+        ReleaseError::ProducerPolicy,
+        "should reject a producer policy digest not matching approved-source bytes"
+    );
+
+    let mut version = Graph::new().build();
+    version.index["policy_version"] = json!(2);
+    assert_eq!(
+        context(version.sign().verify()),
+        ReleaseError::ProducerPolicy,
+        "should reject a producer policy version not matching approved-source bytes"
+    );
+}
+
+#[test]
+fn rejects_another_approved_source_commit() {
+    let mut signed = consistent();
+    signed.commit = OTHER_COMMIT.to_owned();
+
+    rejects_evidence(&signed, "proofs are not for the approved commit");
+}
+
+#[test]
+fn rejects_certificate_source_digest_and_resolved_commit() {
+    let mut certificate = consistent();
+    certificate_mut(&mut certificate.proofs.provenance)["sourceRepositoryDigest"] =
+        json!(OTHER_COMMIT);
+    rejects_evidence(&certificate, "certificate source digest differs");
+
+    let mut resolved = consistent();
+    statement_mut(&mut resolved.proofs.index)["predicate"]["buildDefinition"]["resolvedDependencies"]
+        [0]["digest"]["gitCommit"] = json!(OTHER_COMMIT);
+    rejects_evidence(&resolved, "resolved source commit differs");
+}
+
+#[test]
+fn rejects_run_uri_mismatch_between_proofs() {
+    let mut spdx = consistent();
+    certificate_mut(&mut spdx.proofs.spdx)["runInvocationURI"] = json!(OTHER_RUN);
+    rejects_evidence(&spdx, "SPDX proof comes from another run attempt");
+
+    let mut provenance = consistent();
+    certificate_mut(&mut provenance.proofs.provenance)["runInvocationURI"] = json!(OTHER_RUN);
+    statement_mut(&mut provenance.proofs.provenance)["predicate"]["runDetails"]["metadata"]["invocationId"] =
+        json!(OTHER_RUN);
+    rejects_evidence(&provenance, "artifact provenance comes from another run");
+}
+
+#[test]
+fn rejects_invocation_id_differing_from_certificate_run() {
+    let mut signed = consistent();
+    statement_mut(&mut signed.proofs.index)["predicate"]["runDetails"]["metadata"]["invocationId"] =
+        json!(OTHER_RUN);
+
+    rejects_evidence(&signed, "invocationId differs from the certificate run URI");
+}
+
+#[test]
+fn rejects_foreign_run_uri() {
+    let mut signed = consistent();
+    let foreign = "https://github.com/IABTechLab/trusted-server-fork/actions/runs/1/attempts/1";
+    for proof in [
+        &mut signed.proofs.index,
+        &mut signed.proofs.provenance,
+        &mut signed.proofs.spdx,
+    ] {
+        certificate_mut(proof)["runInvocationURI"] = json!(foreign);
+    }
+
+    rejects_evidence(&signed, "run URI is outside the official repository");
+}
+
+#[test]
+fn rejects_caller_build_config_uri() {
+    let mut certificate = consistent();
+    certificate_mut(&mut certificate.proofs.spdx)["buildConfigURI"] = json!(
+        "https://github.com/IABTechLab/trusted-server/.github/workflows/other.yml@refs/tags/v1.2.0"
+    );
+    rejects_evidence(&certificate, "certificate caller is another workflow");
+
+    let mut external = consistent();
+    statement_mut(&mut external.proofs.provenance)["predicate"]["buildDefinition"]["externalParameters"]
+        ["workflow"]["path"] = json!(".github/workflows/other.yml");
+    rejects_evidence(&external, "provenance caller path differs");
+
+    let mut inputs = consistent();
+    statement_mut(&mut inputs.proofs.provenance)["predicate"]["buildDefinition"]["externalParameters"]
+        ["inputs"] = json!({"command": "fictional"});
+    rejects_evidence(&inputs, "external parameters carry arbitrary inputs");
+}
+
+#[test]
+fn rejects_signer_san_workflow() {
+    let mut signed = consistent();
+    certificate_mut(&mut signed.proofs.index)["subjectAlternativeName"] = json!(
+        "https://github.com/IABTechLab/trusted-server/.github/workflows/release.yml@refs/tags/v1.2.0"
+    );
+
+    rejects_evidence(&signed, "SAN names the caller instead of release-build.yml");
+}
+
+#[test]
+fn rejects_certificate_identity_fields() {
+    let fields = [
+        ("issuer", json!("https://issuer.example.com")),
+        ("sourceRepositoryIdentifier", json!("1")),
+        ("sourceRepositoryOwnerIdentifier", json!("2")),
+        ("buildTrigger", json!("workflow_dispatch")),
+        ("runnerEnvironment", json!("self-hosted")),
+        ("buildConfigDigest", json!(OTHER_COMMIT)),
+    ];
+    for (field, value) in fields {
+        let mut signed = consistent();
+        certificate_mut(&mut signed.proofs.provenance)[field] = value;
+
+        rejects_evidence(&signed, &format!("certificate `{field}` differs"));
+    }
+}
+
+#[test]
+fn rejects_provenance_predicate_structure() {
+    let mutations: [Mutation; 4] = [
+        ("build type", |predicate| {
+            predicate["buildDefinition"]["buildType"] = json!("https://example.com/build/v1");
+        }),
+        ("runner", |predicate| {
+            predicate["buildDefinition"]["internalParameters"]["github"]["runner_environment"] =
+                json!("self-hosted");
+        }),
+        ("builder id", |predicate| {
+            predicate["runDetails"]["builder"]["id"] = json!("https://example.com/builder");
+        }),
+        ("unexpected structure", |predicate| {
+            predicate["extra"] = json!(true);
+        }),
+    ];
+    for (why, mutate) in mutations {
+        let mut signed = consistent();
+        mutate(&mut statement_mut(&mut signed.proofs.provenance)["predicate"]);
+
+        rejects_evidence(&signed, why);
+    }
+}
+
+#[test]
+fn rejects_wrong_predicate_type() {
+    let mut signed = consistent();
+    statement_mut(&mut signed.proofs.spdx)["predicateType"] =
+        json!("https://slsa.dev/provenance/v1");
+
+    rejects_evidence(&signed, "SPDX proof carries a provenance predicate type");
+}
diff --git a/crates/trusted-server-cli/src/release/tests/verification/publication.rs b/crates/trusted-server-cli/src/release/tests/verification/publication.rs
new file mode 100644
index 0000000000..c4641743a4
--- /dev/null
+++ b/crates/trusted-server-cli/src/release/tests/verification/publication.rs
@@ -0,0 +1,524 @@
+//! Official publication checks, retained asset streaming and the read-only
+//! verification report.
+//!
+//! Publication and signature claims here are synthetic semantic fixtures;
+//! they do not qualify the pinned verifier or GitHub signing service.
+
+use std::io::{Read as _, Write as _};
+use std::net::TcpListener;
+use std::time::{Duration, Instant};
+
+use reqwest::header::{ACCEPT, AUTHORIZATION};
+use serde_json::json;
+
+use super::fixture::{ASSET, COMMIT, RUN, Signed, TAG, consistent};
+use super::{ZERO_DIGEST, context};
+use crate::release::artifact::{
+    AssetRole, RetainedDownload, VerificationReport, VerifiedReleaseAsset, stream_into,
+};
+use crate::release::bounds::{self, AttemptDeadline};
+use crate::release::documents::ReleaseTag;
+use crate::release::environment::{CallerEnvironment, GithubToken};
+use crate::release::error::ReleaseError;
+use crate::release::evidence::ComparisonOutcome;
+use crate::release::github::{API_REPOSITORY, fetch_json, release_request, tag_ref_request};
+use crate::release::policy::AcceptedProducerPolicy;
+use crate::release::source_policy::plain_http_policy_client_for_tests;
+
+const MIB: usize = 1024 * 1024;
+
+#[test]
+fn synthetic_publication_rejects_wrong_repository_and_statement_types() {
+    for (path, replacement) in [
+        (vec!["predicate", "repository"], json!("fictional/other")),
+        (vec!["_type"], json!("https://example.com/Statement/v1")),
+        (vec!["predicateType"], json!("https://example.com/release")),
+    ] {
+        let mut signed = consistent();
+        let mut value = &mut signed.publication.statement["verificationResult"]["statement"];
+        for key in path {
+            value = &mut value[key];
+        }
+        *value = replacement;
+        rejects_publication(&signed, "wrong repository or statement type");
+    }
+}
+
+#[test]
+fn synthetic_publication_rejects_ambiguous_commit_subjects() {
+    for replacement in [
+        json!({"digest": {"sha1": COMMIT}}),
+        json!({"uri": "pkg:github/fictional/other@v1.2.0", "digest": {"sha1": COMMIT}}),
+        json!({"uri": format!("pkg:github/IABTechLab/trusted-server@{TAG}"), "digest": {"sha1": COMMIT, "sha256": ZERO_DIGEST}}),
+        json!({"uri": format!("pkg:github/IABTechLab/trusted-server@{TAG}"), "name": "", "digest": {"sha1": COMMIT}}),
+    ] {
+        let mut signed = consistent();
+        signed.publication.statement["verificationResult"]["statement"]["subject"][0] = replacement;
+        rejects_publication(&signed, "ambiguous commit subject");
+    }
+}
+
+#[test]
+fn synthetic_report_rejects_asset_from_another_publication() {
+    let first = consistent();
+    let publication = first
+        .publish()
+        .expect("should verify synthetic publication");
+    let executable = retained(ASSET, AssetRole::Executable, &first.documents.executable);
+    let mut asset = VerifiedReleaseAsset::from_publication(&publication, executable)
+        .expect("should bind synthetic executable");
+    let mut other = super::fixture::Graph::new();
+    other.executable = b"different synthetic executable".to_vec();
+    other.spdx["packages"][0]["checksums"][0]["checksumValue"] =
+        json!(crate::release::documents::sha256_hex(&other.executable));
+    other.build_evidence["artifact_sha256"] =
+        json!(crate::release::documents::sha256_hex(&other.executable));
+    let other_publication = other
+        .build()
+        .sign()
+        .publish()
+        .expect("should verify second synthetic publication");
+    assert!(
+        VerificationReport::new(&other_publication, &mut asset).is_err(),
+        "should reject cross-publication report"
+    );
+}
+
+fn rejects_publication(signed: &Signed, why: &str) {
+    assert_eq!(
+        context(signed.publish()),
+        ReleaseError::Publication,
+        "should reject: {why}"
+    );
+}
+
+fn retained(name: &str, role: AssetRole, bytes: &[u8]) -> crate::release::artifact::RetainedAsset {
+    let mut download = RetainedDownload::start(name, role).expect("should create retained file");
+    download
+        .push(bytes)
+        .expect("should accept bytes within the limit");
+    download.finish().expect("should finish the download")
+}
+
+#[test]
+fn consistent_publication_verifies_and_reports() {
+    let signed = consistent();
+    let publication = signed
+        .publish()
+        .expect("should verify the consistent official publication");
+    let executable = retained(ASSET, AssetRole::Executable, &signed.documents.executable);
+    assert_eq!(executable.name(), ASSET, "should keep the retained name");
+    let mut asset = VerifiedReleaseAsset::from_publication(&publication, executable)
+        .expect("should bind the retained executable to verified evidence");
+    assert_eq!(asset.name(), ASSET, "should keep the verified asset name");
+    assert_eq!(
+        publication.build().producer_policy(),
+        &AcceptedProducerPolicy::Current,
+        "should accept the current producer policy"
+    );
+
+    let report = VerificationReport::new(&publication, &mut asset)
+        .expect("should summarize the verified asset");
+
+    assert_eq!(report.tag, TAG, "should report the approved tag");
+    assert_eq!(report.source_commit, COMMIT, "should report the source");
+    assert_eq!(report.asset, ASSET, "should report the asset");
+    assert_eq!(
+        report.asset_length,
+        signed.documents.executable.len() as u64,
+        "should report the actual length"
+    );
+    assert_eq!(report.consumer_policy_version, 1, "should report policy v1");
+    assert_eq!(
+        report.consumer_policy_sha256, report.producer_policy_sha256,
+        "should report the current producer policy"
+    );
+    assert_eq!(report.run_invocation, RUN, "should report the shared run");
+    assert_eq!(
+        report.comparison,
+        ComparisonOutcome::Matched,
+        "should report the informational comparison"
+    );
+}
+
+#[test]
+fn rejects_substituted_retained_executable() {
+    let signed = consistent();
+    let publication = signed.publish().expect("should verify publication");
+    let substituted = retained(
+        ASSET,
+        AssetRole::Executable,
+        b"substituted executable bytes",
+    );
+
+    let result = VerifiedReleaseAsset::from_publication(&publication, substituted);
+
+    assert_eq!(
+        context(result),
+        ReleaseError::Asset,
+        "should reject retained bytes that differ from verified evidence"
+    );
+}
+
+#[test]
+fn rejects_unconsumed_or_companion_asset() {
+    let signed = consistent();
+    let publication = signed.publish().expect("should verify publication");
+    let other = retained(
+        "ts-x86_64-unknown-linux-gnu",
+        AssetRole::Executable,
+        &signed.documents.executable,
+    );
+    assert_eq!(
+        context(VerifiedReleaseAsset::from_publication(&publication, other)),
+        ReleaseError::Asset,
+        "should reject an asset that verification did not consume"
+    );
+
+    let companion = retained(ASSET, AssetRole::Companion, &signed.documents.executable);
+    assert_eq!(
+        context(VerifiedReleaseAsset::from_publication(
+            &publication,
+            companion
+        )),
+        ReleaseError::Asset,
+        "should reject a non-executable retained role"
+    );
+}
+
+#[test]
+fn rejects_rest_length() {
+    let mut signed = consistent();
+    signed.publication.release["assets"][0]["size"] = json!(1);
+
+    rejects_publication(&signed, "REST size differs from the signed length");
+}
+
+#[test]
+fn rejects_rest_digest() {
+    let mut signed = consistent();
+    signed.publication.release["assets"][3]["digest"] = json!(format!("sha256:{ZERO_DIGEST}"));
+
+    rejects_publication(&signed, "REST digest differs from the signed digest");
+}
+
+#[test]
+fn rejects_mutable_draft_or_prerelease_release() {
+    let edits = [
+        ("immutable", json!(false)),
+        ("immutable", json!(null)),
+        ("draft", json!(true)),
+        ("prerelease", json!(true)),
+        ("tag_name", json!("v1.2.1")),
+    ];
+    for (field, value) in edits {
+        let mut signed = consistent();
+        signed.publication.release[field] = value;
+
+        rejects_publication(&signed, &format!("release `{field}` is not acceptable"));
+    }
+}
+
+#[test]
+fn rejects_annotated_or_retargeted_tag() {
+    let mut annotated = consistent();
+    annotated.publication.tag_ref["object"]["type"] = json!("tag");
+    rejects_publication(&annotated, "annotated tag object");
+
+    let mut retargeted = consistent();
+    retargeted.publication.tag_ref["object"]["sha"] =
+        json!("89abcdef0123456789abcdef0123456789abcdef");
+    rejects_publication(&retargeted, "tag targets another commit");
+}
+
+#[test]
+fn rejects_extra_missing_and_partial_release_assets() {
+    let mut extra = consistent();
+    extra.publication.release["assets"]
+        .as_array_mut()
+        .expect("should hold assets")
+        .push(json!({"name": "unlisted.bin", "size": 1, "state": "uploaded"}));
+    rejects_publication(&extra, "release carries an unlisted asset");
+
+    let mut missing = consistent();
+    missing.publication.release["assets"]
+        .as_array_mut()
+        .expect("should hold assets")
+        .pop();
+    rejects_publication(&missing, "release lacks SHA256SUMS");
+
+    let mut partial = consistent();
+    partial.publication.release["assets"][1]["state"] = json!("starter");
+    rejects_publication(&partial, "release asset is not fully uploaded");
+}
+
+#[test]
+fn rejects_release_statement_edges() {
+    let mut digest = consistent();
+    digest.publication.statement["verificationResult"]["statement"]["subject"][2]["digest"]["sha256"] =
+        json!(ZERO_DIGEST);
+    rejects_publication(&digest, "signed release asset digest differs");
+
+    let mut name = consistent();
+    name.publication.statement["verificationResult"]["statement"]["subject"][2]["name"] =
+        json!("renamed.bin");
+    rejects_publication(&name, "signed release asset name differs");
+
+    let mut tag = consistent();
+    tag.publication.statement["verificationResult"]["statement"]["predicate"]["tag"] =
+        json!("v1.2.1");
+    rejects_publication(&tag, "release statement names another tag");
+
+    let mut commit = consistent();
+    commit.publication.statement["verificationResult"]["statement"]["subject"][0]["digest"]["sha1"] =
+        json!("89abcdef0123456789abcdef0123456789abcdef");
+    rejects_publication(&commit, "release statement binds another commit");
+
+    let mut signer = consistent();
+    signer.publication.statement["verificationResult"]["signature"]["certificate"]["subjectAlternativeName"] =
+        json!("https://releases.example.com");
+    rejects_publication(&signer, "release statement has another signer");
+}
+
+#[test]
+fn rejects_altered_index_bundle_or_checksums() {
+    let mut bundle = consistent();
+    bundle.publication.index_bundle.push(b' ');
+    rejects_publication(
+        &bundle,
+        "index bundle bytes differ from REST and signed membership",
+    );
+
+    let mut checksums = consistent();
+    checksums.publication.checksums.push(b' ');
+    rejects_publication(&checksums, "checksum list differs from signed membership");
+}
+
+#[test]
+fn oversized_stream_is_aborted_mid_download() {
+    let mut download =
+        RetainedDownload::start(ASSET, AssetRole::Spdx).expect("should create retained file");
+    let chunk = vec![b'x'; MIB];
+    for _ in 0..16 {
+        download
+            .push(&chunk)
+            .expect("should accept bytes up to 16 MiB");
+    }
+
+    let result = download.push(b"y");
+
+    assert_eq!(
+        context(result),
+        ReleaseError::Asset,
+        "should abort the transfer at the first byte past the SPDX limit"
+    );
+}
+
+#[test]
+fn role_limits_match_r_bounds() {
+    assert_eq!(
+        AssetRole::Executable.limit(),
+        bounds::EXECUTABLE_BYTES,
+        "512 MiB"
+    );
+    assert_eq!(
+        AssetRole::Companion.limit(),
+        bounds::COMPANION_BYTES,
+        "32 MiB"
+    );
+    assert_eq!(AssetRole::Spdx.limit(), bounds::SPDX_BYTES, "16 MiB");
+    assert_eq!(AssetRole::Metadata.limit(), bounds::METADATA_BYTES, "1 MiB");
+}
+
+/// Serves one chunked response of `total` bytes, ignoring client aborts.
+fn serve_chunked(total: usize) -> String {
+    let listener = TcpListener::bind("127.0.0.1:0").expect("should bind loopback");
+    let address = listener.local_addr().expect("should have address");
+    std::thread::spawn(move || {
+        let Ok((mut stream, _)) = listener.accept() else {
+            return;
+        };
+        let mut request = [0_u8; 4096];
+        let _ = stream.read(&mut request);
+        let _ = stream.write_all(b"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n");
+        let chunk = vec![b'z'; 64 * 1024];
+        let mut sent = 0;
+        while sent < total {
+            let header = format!("{:x}\r\n", chunk.len());
+            let written = stream
+                .write_all(header.as_bytes())
+                .and_then(|()| stream.write_all(&chunk))
+                .and_then(|()| stream.write_all(b"\r\n"));
+            if written.is_err() {
+                return;
+            }
+            sent += chunk.len();
+        }
+        let _ = stream.write_all(b"0\r\n\r\n");
+    });
+    format!("http://{address}/asset")
+}
+
+#[tokio::test]
+async fn streamed_download_aborts_past_role_limit() {
+    let url = serve_chunked(4 * MIB);
+    let client = plain_http_policy_client_for_tests().expect("should build client");
+    let response = client.get(url).send().await.expect("should connect");
+    let download =
+        RetainedDownload::start("SHA256SUMS", AssetRole::Metadata).expect("should create file");
+    let deadline = AttemptDeadline::at(Instant::now() + Duration::from_secs(30));
+
+    let result = stream_into(response, download, deadline).await;
+
+    assert_eq!(
+        context(result),
+        ReleaseError::Asset,
+        "should abort a chunked body once it passes the 1 MiB metadata limit"
+    );
+}
+
+#[tokio::test]
+async fn streamed_download_within_limit_is_measured() {
+    let url = serve_chunked(256 * 1024);
+    let client = plain_http_policy_client_for_tests().expect("should build client");
+    let response = client.get(url).send().await.expect("should connect");
+    let download =
+        RetainedDownload::start("SHA256SUMS", AssetRole::Metadata).expect("should create file");
+    let deadline = AttemptDeadline::at(Instant::now() + Duration::from_secs(30));
+
+    let mut asset = stream_into(response, download, deadline)
+        .await
+        .expect("should retain a body within the limit");
+
+    assert_eq!(
+        asset.measurement().length(),
+        256 * 1024,
+        "should count bytes"
+    );
+    let bytes = asset
+        .document_bytes()
+        .expect("should reread retained bytes");
+    assert_eq!(bytes, vec![b'z'; 256 * 1024], "should retain exact bytes");
+}
+
+#[test]
+fn rest_requests_use_fixed_official_paths_and_explicit_token() {
+    let tag = ReleaseTag::parse(TAG).expect("should accept fictional tag");
+    let environment = CallerEnvironment::from_pairs([("GH_TOKEN", "fictional-read-only-token")]);
+    let token = GithubToken::select(&environment).expect("should select explicit token");
+
+    let release = release_request(&tag, &token).expect("should build release request");
+    let tag_ref = tag_ref_request(&tag, &token).expect("should build ref request");
+
+    assert_eq!(
+        release.url().as_str(),
+        format!("{API_REPOSITORY}/releases/tags/v1.2.0"),
+        "should target the fixed release-by-tag path"
+    );
+    assert_eq!(
+        tag_ref.url().as_str(),
+        format!("{API_REPOSITORY}/git/ref/tags/v1.2.0"),
+        "should target the fixed tag ref path"
+    );
+    for request in [&release, &tag_ref] {
+        assert_eq!(
+            request.url().host_str(),
+            Some("api.github.com"),
+            "should use the fixed API host"
+        );
+        assert_eq!(
+            request
+                .headers()
+                .get(ACCEPT)
+                .map(reqwest::header::HeaderValue::as_bytes),
+            Some(&b"application/vnd.github+json"[..]),
+            "should request JSON"
+        );
+        let authorization = request
+            .headers()
+            .get(AUTHORIZATION)
+            .expect("should carry the explicit token");
+        assert!(
+            authorization.is_sensitive(),
+            "should mark the token sensitive"
+        );
+    }
+}
+
+/// Serves one fixed raw HTTP response.
+fn serve_once(response: Vec<u8>) -> String {
+    let listener = TcpListener::bind("127.0.0.1:0").expect("should bind loopback");
+    let address = listener.local_addr().expect("should have address");
+    std::thread::spawn(move || {
+        let Ok((mut stream, _)) = listener.accept() else {
+            return;
+        };
+        let mut request = [0_u8; 4096];
+        let _ = stream.read(&mut request);
+        let _ = stream.write_all(&response);
+    });
+    format!("http://{address}/repos/release")
+}
+
+async fn fetch_loopback(response: Vec<u8>) -> Result<serde_json::Value, ReleaseError> {
+    let url = serve_once(response);
+    let client = plain_http_policy_client_for_tests().expect("should build client");
+    let environment = CallerEnvironment::from_pairs([("GH_TOKEN", "fictional-read-only-token")]);
+    let token = GithubToken::select(&environment).expect("should select explicit token");
+    let request = client.get(url).build().expect("should build request");
+    let deadline = AttemptDeadline::at(Instant::now() + Duration::from_secs(30));
+    fetch_json(&client, request, &token, deadline)
+        .await
+        .map_err(|report| *report.current_context())
+}
+
+fn http(status: &str, headers: &str, body: &[u8]) -> Vec<u8> {
+    let mut response = format!(
+        "HTTP/1.1 {status}\r\n{headers}Content-Length: {}\r\nConnection: close\r\n\r\n",
+        body.len()
+    )
+    .into_bytes();
+    response.extend_from_slice(body);
+    response
+}
+
+#[tokio::test]
+async fn fetch_json_parses_bounded_strict_json() {
+    let value = fetch_loopback(http("200 OK", "", br#"{"immutable":true}"#))
+        .await
+        .expect("should parse a bounded JSON body");
+
+    assert_eq!(
+        value,
+        json!({"immutable": true}),
+        "should return parsed JSON"
+    );
+}
+
+#[tokio::test]
+async fn fetch_json_rejects_redirect_oversize_and_duplicates() {
+    let redirect = http(
+        "302 Found",
+        "Location: https://example.com/elsewhere\r\n",
+        b"",
+    );
+    assert_eq!(
+        fetch_loopback(redirect).await.expect_err("should reject"),
+        ReleaseError::Publication,
+        "should reject a redirect instead of following it"
+    );
+
+    let oversize = http("200 OK", "", &vec![b' '; MIB + 1]);
+    assert_eq!(
+        fetch_loopback(oversize).await.expect_err("should reject"),
+        ReleaseError::Publication,
+        "should reject a body over 1 MiB"
+    );
+
+    let duplicate = http("200 OK", "", br#"{"immutable":false,"immutable":true}"#);
+    assert_eq!(
+        fetch_loopback(duplicate).await.expect_err("should reject"),
+        ReleaseError::Document,
+        "should reject duplicate keys in REST JSON"
+    );
+}
diff --git a/crates/trusted-server-cli/src/run.rs b/crates/trusted-server-cli/src/run.rs
index 05b4779f8f..a4327fc767 100644
--- a/crates/trusted-server-cli/src/run.rs
+++ b/crates/trusted-server-cli/src/run.rs
@@ -1,10 +1,12 @@
 use std::process;
+use std::sync::LazyLock;
 
 use clap::{Parser, Subcommand};
 use edgezero_cli::args::{
     ActiveVersionArgs, AuthArgs, BuildArgs, ConfigDiffArgs, ConfigGcArgs, ConfigPushArgs,
     ConfigValidateArgs, DeployArgs, HealthcheckArgs, ProvisionArgs, RollbackArgs, ServeArgs,
 };
+use trusted_server_core::build_info::{BuildInfo, BuildVariant};
 use trusted_server_core::config::TrustedServerAppConfig;
 
 use crate::commands::audit::{AuditArgs, run_audit};
@@ -13,8 +15,25 @@ use crate::commands::config::init::{ConfigInitArgs, run_config_init};
 use crate::commands::pbs::{self, PbsArgs};
 use crate::prebid_bundle::{NpmPrebidBundleGenerator, PrebidBundleArgs, run_bundle};
 
+/// Immutable facts compiled into the owning CLI product.
+pub const BUILD_INFO: BuildInfo = BuildInfo::new(
+    env!("CARGO_PKG_VERSION"),
+    env!("TRUSTED_SERVER__BUILD_TARGET"),
+    BuildVariant::Default,
+);
+
+static VERSION_TEXT: LazyLock<String> = LazyLock::new(|| {
+    format!(
+        "package={} source={} target={} variant={}",
+        BUILD_INFO.package_version(),
+        BUILD_INFO.source().unwrap_or("unknown"),
+        BUILD_INFO.target(),
+        BUILD_INFO.variant()
+    )
+});
+
 #[derive(Debug, Parser)]
-#[command(name = "ts", version, about = "Trusted Server CLI")]
+#[command(name = "ts", version = VERSION_TEXT.as_str(), about = "Trusted Server CLI")]
 struct Args {
     #[command(subcommand)]
     command: Command,
@@ -22,6 +41,10 @@ struct Args {
 
 #[derive(Debug, Subcommand)]
 enum Command {
+    /// Verify official release assets without deployment.
+    #[cfg(unix)]
+    #[command(subcommand)]
+    Release(crate::commands::release::ReleaseCommand),
     /// Print the currently active deployment version for a target adapter.
     ActiveVersion(ActiveVersionArgs),
     /// Browser-backed page and ad-template audits.
@@ -119,6 +142,10 @@ pub fn run_from_env() -> Result<RunOutcome, String> {
 
 fn dispatch(args: Args) -> Result<RunOutcome, String> {
     match args.command {
+        #[cfg(unix)]
+        Command::Release(command) => {
+            crate::commands::release::run(command).map(|()| RunOutcome::Success)
+        }
         Command::ActiveVersion(args) => {
             edgezero_cli::run_active_version(&args).map(|()| RunOutcome::Success)
         }
@@ -204,6 +231,16 @@ mod tests {
             clap::error::ErrorKind::DisplayVersion,
             "should print the version rather than fail to parse"
         );
+        assert_eq!(
+            err.to_string(),
+            format!(
+                "ts package={} source={} target={} variant=default\n",
+                env!("CARGO_PKG_VERSION"),
+                trusted_server_core::constants::TS_GIT_VERSION.unwrap_or("unknown"),
+                env!("TRUSTED_SERVER__BUILD_TARGET")
+            ),
+            "should print all four labeled owning build facts"
+        );
     }
 
     #[test]
diff --git a/crates/trusted-server-cli/tests/fixtures/release/release-index.json b/crates/trusted-server-cli/tests/fixtures/release/release-index.json
new file mode 100644
index 0000000000..c7b6d9b897
--- /dev/null
+++ b/crates/trusted-server-cli/tests/fixtures/release/release-index.json
@@ -0,0 +1,218 @@
+{
+  "artifacts": [
+    {
+      "assurance_profile": "provenance-sbom-repeatable",
+      "capabilities": ["fastly-production"],
+      "companions": {
+        "build_evidence": {
+          "name": "trusted-server-fastly.wasm.build-evidence.json",
+          "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "size": 2048
+        },
+        "build_recipe": {
+          "name": "trusted-server-fastly.wasm.build-recipe.json",
+          "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "size": 1024
+        },
+        "provenance": {
+          "name": "trusted-server-fastly.wasm.provenance.sigstore.json",
+          "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "size": 8192
+        },
+        "rebuild_check": {
+          "name": "trusted-server-fastly.wasm.rebuild-check.json",
+          "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "size": 512
+        },
+        "sbom": {
+          "name": "trusted-server-fastly.wasm.spdx.json",
+          "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "size": 4096
+        },
+        "sbom_attestation": {
+          "name": "trusted-server-fastly.wasm.sbom.sigstore.json",
+          "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "size": 8192
+        }
+      },
+      "compatibility": {
+        "architecture": "wasm32",
+        "minimum_version": "wasip1",
+        "runtime": "fastly-compute"
+      },
+      "js_inventory_sha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+      "kind": "wasm-core",
+      "name": "trusted-server-fastly.wasm",
+      "package": "trusted-server-adapter-fastly",
+      "role": "server",
+      "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "size": 1048576,
+      "target": "wasm32-wasip1",
+      "variant": "default"
+    },
+    {
+      "assurance_profile": "provenance-sbom",
+      "capabilities": ["cli-execute"],
+      "companions": {
+        "build_evidence": {
+          "name": "ts-aarch64-apple-darwin.build-evidence.json",
+          "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "size": 2048
+        },
+        "build_recipe": {
+          "name": "ts-aarch64-apple-darwin.build-recipe.json",
+          "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "size": 1024
+        },
+        "provenance": {
+          "name": "ts-aarch64-apple-darwin.provenance.sigstore.json",
+          "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "size": 8192
+        },
+        "rebuild_check": {
+          "name": "ts-aarch64-apple-darwin.rebuild-check.json",
+          "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "size": 512
+        },
+        "sbom": {
+          "name": "ts-aarch64-apple-darwin.spdx.json",
+          "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "size": 4096
+        },
+        "sbom_attestation": {
+          "name": "ts-aarch64-apple-darwin.sbom.sigstore.json",
+          "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "size": 8192
+        }
+      },
+      "compatibility": {
+        "architecture": "aarch64",
+        "minimum_version": "13.0",
+        "runtime": "macos"
+      },
+      "js_inventory_sha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+      "kind": "native-executable",
+      "name": "ts-aarch64-apple-darwin",
+      "package": "trusted-server-cli",
+      "role": "operator-cli",
+      "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "size": 1048576,
+      "target": "aarch64-apple-darwin",
+      "variant": "default"
+    },
+    {
+      "assurance_profile": "provenance-sbom",
+      "capabilities": ["cli-execute"],
+      "companions": {
+        "build_evidence": {
+          "name": "ts-x86_64-apple-darwin.build-evidence.json",
+          "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "size": 2048
+        },
+        "build_recipe": {
+          "name": "ts-x86_64-apple-darwin.build-recipe.json",
+          "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "size": 1024
+        },
+        "provenance": {
+          "name": "ts-x86_64-apple-darwin.provenance.sigstore.json",
+          "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "size": 8192
+        },
+        "rebuild_check": {
+          "name": "ts-x86_64-apple-darwin.rebuild-check.json",
+          "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "size": 512
+        },
+        "sbom": {
+          "name": "ts-x86_64-apple-darwin.spdx.json",
+          "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "size": 4096
+        },
+        "sbom_attestation": {
+          "name": "ts-x86_64-apple-darwin.sbom.sigstore.json",
+          "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "size": 8192
+        }
+      },
+      "compatibility": {
+        "architecture": "x86_64",
+        "minimum_version": "13.0",
+        "runtime": "macos"
+      },
+      "js_inventory_sha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+      "kind": "native-executable",
+      "name": "ts-x86_64-apple-darwin",
+      "package": "trusted-server-cli",
+      "role": "operator-cli",
+      "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "size": 1048576,
+      "target": "x86_64-apple-darwin",
+      "variant": "default"
+    },
+    {
+      "assurance_profile": "provenance-sbom",
+      "capabilities": ["cli-execute"],
+      "companions": {
+        "build_evidence": {
+          "name": "ts-x86_64-unknown-linux-gnu.build-evidence.json",
+          "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "size": 2048
+        },
+        "build_recipe": {
+          "name": "ts-x86_64-unknown-linux-gnu.build-recipe.json",
+          "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "size": 1024
+        },
+        "provenance": {
+          "name": "ts-x86_64-unknown-linux-gnu.provenance.sigstore.json",
+          "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "size": 8192
+        },
+        "rebuild_check": {
+          "name": "ts-x86_64-unknown-linux-gnu.rebuild-check.json",
+          "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "size": 512
+        },
+        "sbom": {
+          "name": "ts-x86_64-unknown-linux-gnu.spdx.json",
+          "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "size": 4096
+        },
+        "sbom_attestation": {
+          "name": "ts-x86_64-unknown-linux-gnu.sbom.sigstore.json",
+          "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "size": 8192
+        }
+      },
+      "compatibility": {
+        "architecture": "x86_64",
+        "minimum_version": "glibc-2.34",
+        "runtime": "linux-gnu"
+      },
+      "js_inventory_sha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+      "kind": "native-executable",
+      "name": "ts-x86_64-unknown-linux-gnu",
+      "package": "trusted-server-cli",
+      "role": "operator-cli",
+      "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "size": 1048576,
+      "target": "x86_64-unknown-linux-gnu",
+      "variant": "default"
+    }
+  ],
+  "cohort": "phase1-fastly-cli",
+  "cohort_source_commit": "0123456789abcdef0123456789abcdef01234567",
+  "policy_sha256": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+  "policy_version": 1,
+  "recipe_source_commit": "0123456789abcdef0123456789abcdef01234567",
+  "repository": "IABTechLab/trusted-server",
+  "schema_version": 1,
+  "source_commit": "0123456789abcdef0123456789abcdef01234567",
+  "tag": "v1.2.0",
+  "tsjs_inventory": {
+    "name": "tsjs-inventory.json",
+    "sha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+    "size": 4096
+  }
+}
diff --git a/crates/trusted-server-cli/tests/fixtures/release/upstream-formats.json b/crates/trusted-server-cli/tests/fixtures/release/upstream-formats.json
new file mode 100644
index 0000000000..456900b6df
--- /dev/null
+++ b/crates/trusted-server-cli/tests/fixtures/release/upstream-formats.json
@@ -0,0 +1,174 @@
+{
+  "provenance": [
+    {
+      "verificationResult": {
+        "mediaType": "application/vnd.dev.sigstore.verificationresult+json;version=0.1",
+        "signature": {
+          "certificate": {
+            "certificateIssuer": "CN=example-intermediate,O=example.com",
+            "subjectAlternativeName": "https://example.com/example/project/.github/workflows/release-archives.yml@refs/tags/v1.2.0",
+            "issuer": "https://example.com/issuer",
+            "githubWorkflowTrigger": "push",
+            "githubWorkflowSHA": "0123456789abcdef0123456789abcdef01234567",
+            "githubWorkflowName": "Release archives",
+            "githubWorkflowRepository": "example/project",
+            "githubWorkflowRef": "refs/tags/v1.2.0",
+            "buildSignerURI": "https://example.com/example/project/.github/workflows/release-archives.yml@refs/tags/v1.2.0",
+            "buildSignerDigest": "0123456789abcdef0123456789abcdef01234567",
+            "runnerEnvironment": "github-hosted",
+            "sourceRepositoryURI": "https://example.com/example/project",
+            "sourceRepositoryDigest": "0123456789abcdef0123456789abcdef01234567",
+            "sourceRepositoryRef": "refs/tags/v1.2.0",
+            "sourceRepositoryIdentifier": "123456",
+            "sourceRepositoryOwnerURI": "https://example.com/example",
+            "sourceRepositoryOwnerIdentifier": "654321",
+            "buildConfigURI": "https://example.com/example/project/.github/workflows/release-archives.yml@refs/tags/v1.2.0",
+            "buildConfigDigest": "0123456789abcdef0123456789abcdef01234567",
+            "buildTrigger": "push",
+            "runInvocationURI": "https://example.com/example/project/actions/runs/1234567890/attempts/1",
+            "sourceRepositoryVisibilityAtSigning": "public"
+          }
+        },
+        "verifiedTimestamps": [
+          {
+            "type": "Tlog",
+            "uri": "https://example.com/transparency-log",
+            "timestamp": "2026-01-01T00:00:00Z"
+          }
+        ],
+        "verifiedIdentity": {
+          "subjectAlternativeName": {
+            "subjectAlternativeName": "https://example.com/example/project/.github/workflows/release-archives.yml@refs/tags/v1.2.0"
+          },
+          "issuer": {
+            "issuer": "",
+            "regexp": ".*"
+          },
+          "runnerEnvironment": "github-hosted"
+        },
+        "statement": {
+          "_type": "https://in-toto.io/Statement/v1",
+          "subject": [
+            {
+              "name": "example-asset",
+              "digest": {
+                "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+              }
+            }
+          ],
+          "predicateType": "https://slsa.dev/provenance/v1",
+          "predicate": {
+            "buildDefinition": {
+              "buildType": "https://actions.github.io/buildtypes/workflow/v1",
+              "externalParameters": {
+                "workflow": {
+                  "path": ".github/workflows/release-archives.yml",
+                  "ref": "refs/tags/v1.2.0",
+                  "repository": "https://example.com/example/project"
+                }
+              },
+              "internalParameters": {
+                "github": {
+                  "event_name": "push",
+                  "repository_id": "123456",
+                  "repository_owner_id": "654321",
+                  "runner_environment": "github-hosted"
+                }
+              },
+              "resolvedDependencies": [
+                {
+                  "digest": {
+                    "gitCommit": "0123456789abcdef0123456789abcdef01234567"
+                  },
+                  "uri": "git+https://example.com/example/project@refs/tags/v1.2.0"
+                }
+              ]
+            },
+            "runDetails": {
+              "builder": {
+                "id": "https://example.com/example/project/.github/workflows/release-archives.yml@refs/tags/v1.2.0"
+              },
+              "metadata": {
+                "invocationId": "https://example.com/example/project/actions/runs/1234567890/attempts/1"
+              }
+            }
+          }
+        }
+      }
+    }
+  ],
+  "spdx": [
+    {
+      "verificationResult": {
+        "mediaType": "application/vnd.dev.sigstore.verificationresult+json;version=0.1",
+        "signature": {
+          "certificate": {
+            "certificateIssuer": "CN=example-intermediate,O=example.com",
+            "subjectAlternativeName": "https://example.com/example/project/.github/workflows/release-archives.yml@refs/tags/v1.2.0",
+            "issuer": "https://example.com/issuer",
+            "githubWorkflowTrigger": "push",
+            "githubWorkflowSHA": "0123456789abcdef0123456789abcdef01234567",
+            "githubWorkflowName": "Release archives",
+            "githubWorkflowRepository": "example/project",
+            "githubWorkflowRef": "refs/tags/v1.2.0",
+            "buildSignerURI": "https://example.com/example/project/.github/workflows/release-archives.yml@refs/tags/v1.2.0",
+            "buildSignerDigest": "0123456789abcdef0123456789abcdef01234567",
+            "runnerEnvironment": "github-hosted",
+            "sourceRepositoryURI": "https://example.com/example/project",
+            "sourceRepositoryDigest": "0123456789abcdef0123456789abcdef01234567",
+            "sourceRepositoryRef": "refs/tags/v1.2.0",
+            "sourceRepositoryIdentifier": "123456",
+            "sourceRepositoryOwnerURI": "https://example.com/example",
+            "sourceRepositoryOwnerIdentifier": "654321",
+            "buildConfigURI": "https://example.com/example/project/.github/workflows/release-archives.yml@refs/tags/v1.2.0",
+            "buildConfigDigest": "0123456789abcdef0123456789abcdef01234567",
+            "buildTrigger": "push",
+            "runInvocationURI": "https://example.com/example/project/actions/runs/1234567890/attempts/1",
+            "sourceRepositoryVisibilityAtSigning": "public"
+          }
+        },
+        "verifiedTimestamps": [
+          {
+            "type": "Tlog",
+            "uri": "https://example.com/transparency-log",
+            "timestamp": "2026-01-01T00:00:00Z"
+          }
+        ],
+        "verifiedIdentity": {
+          "subjectAlternativeName": {
+            "subjectAlternativeName": "https://example.com/example/project/.github/workflows/release-archives.yml@refs/tags/v1.2.0"
+          },
+          "issuer": {
+            "issuer": "",
+            "regexp": ".*"
+          },
+          "runnerEnvironment": "github-hosted"
+        },
+        "statement": {
+          "_type": "https://in-toto.io/Statement/v1",
+          "subject": [
+            {
+              "name": "example-asset",
+              "digest": {
+                "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+              }
+            }
+          ],
+          "predicateType": "https://spdx.dev/Document/v2.3",
+          "predicate": {
+            "spdxVersion": "SPDX-2.3",
+            "dataLicense": "CC0-1.0",
+            "SPDXID": "SPDXRef-DOCUMENT",
+            "name": "example-document",
+            "documentNamespace": "https://example.com/spdx/example",
+            "creationInfo": {
+              "created": "2026-01-01T00:00:00Z",
+              "creators": ["Tool: example-generator"]
+            },
+            "packages": []
+          }
+        }
+      }
+    }
+  ]
+}
diff --git a/crates/trusted-server-cli/tests/release_build_facts.rs b/crates/trusted-server-cli/tests/release_build_facts.rs
new file mode 100644
index 0000000000..d9aac5c94b
--- /dev/null
+++ b/crates/trusted-server-cli/tests/release_build_facts.rs
@@ -0,0 +1,261 @@
+//! Host checks of actual owning build scripts and the compiled CLI binary.
+
+#![cfg(not(target_arch = "wasm32"))]
+
+use std::ffi::OsStr;
+use std::fs;
+#[cfg(unix)]
+use std::os::unix::ffi::OsStrExt as _;
+use std::path::{Path, PathBuf};
+use std::process::Command;
+
+use tempfile::TempDir;
+use trusted_server_cli::BUILD_INFO;
+use trusted_server_core::build_info::BuildVariant;
+
+const SOURCE: &str = "abcdef0123456789abcdef0123456789abcdef01";
+
+fn workspace() -> &'static Path {
+    Path::new(env!("CARGO_MANIFEST_DIR"))
+        .parent()
+        .expect("should resolve crates")
+        .parent()
+        .expect("should resolve workspace")
+}
+
+fn compile_build_script(owner: &str, directory: &TempDir) -> PathBuf {
+    let output = directory.path().join(format!("{owner}-build"));
+    let compiled = Command::new("rustc")
+        .args(["--edition=2024"])
+        .arg(workspace().join("crates").join(owner).join("build.rs"))
+        .arg("-o")
+        .arg(&output)
+        .output()
+        .expect("should run rustc");
+    assert!(
+        compiled.status.success(),
+        "should compile actual owner script: {}",
+        String::from_utf8_lossy(&compiled.stderr)
+    );
+    output
+}
+
+fn owner_command(script: &Path) -> Command {
+    let mut command = Command::new(script);
+    command
+        .env("TARGET", "example-target")
+        .env_remove("TRUSTED_SERVER__RELEASE_BUILD")
+        .env_remove("TRUSTED_SERVER__GIT_VERSION")
+        .env_remove("CARGO_FEATURE_REUSABLE_SANDBOX");
+    command
+}
+
+#[cfg(unix)]
+#[test]
+fn actual_owner_scripts_reject_invalid_release_controls_and_sources() {
+    let directory = tempfile::tempdir().expect("should create fixture");
+    for owner in ["trusted-server-cli", "trusted-server-adapter-fastly"] {
+        let script = compile_build_script(owner, &directory);
+        for control in [
+            OsStr::new(""),
+            OsStr::new("0"),
+            OsStr::new(" 1"),
+            OsStr::new("1\n"),
+            OsStr::from_bytes(b"\xff"),
+        ] {
+            let output = owner_command(&script)
+                .env("TRUSTED_SERVER__RELEASE_BUILD", control)
+                .env("TRUSTED_SERVER__GIT_VERSION", SOURCE)
+                .output()
+                .expect("should run actual owner script");
+            assert!(
+                !output.status.success(),
+                "should reject control for {owner}: {control:?}"
+            );
+            assert!(
+                String::from_utf8_lossy(&output.stderr)
+                    .contains("TRUSTED_SERVER__RELEASE_BUILD must be exactly 1"),
+                "should identify malformed release control"
+            );
+        }
+        for source in [
+            None,
+            Some(OsStr::new("main")),
+            Some(OsStr::new("v1.2.3")),
+            Some(OsStr::new("abcdef")),
+            Some(OsStr::new("ABCDEF0123456789abcdef0123456789abcdef01")),
+            Some(OsStr::new(" abcdef0123456789abcdef0123456789abcdef01")),
+            Some(OsStr::new("abcdef0123456789abcdef0123456789abcdef01\n")),
+            Some(OsStr::from_bytes(b"\xff")),
+        ] {
+            let mut command = owner_command(&script);
+            command.env("TRUSTED_SERVER__RELEASE_BUILD", "1");
+            if let Some(source) = source {
+                command.env("TRUSTED_SERVER__GIT_VERSION", source);
+            }
+            let output = command.output().expect("should run actual owner script");
+            assert!(
+                !output.status.success(),
+                "should reject source for {owner}: {source:?}"
+            );
+            let diagnostic = if source.and_then(OsStr::to_str).is_none() {
+                "release builds require TRUSTED_SERVER__GIT_VERSION"
+            } else {
+                "release source must be exactly 40 lowercase ASCII hexadecimal bytes"
+            };
+            assert!(
+                String::from_utf8_lossy(&output.stderr).contains(diagnostic),
+                "should identify malformed release source: {diagnostic}"
+            );
+        }
+    }
+}
+
+#[test]
+fn actual_owner_scripts_emit_only_own_target_and_cli_release_cfg() {
+    let directory = tempfile::tempdir().expect("should create fixture");
+    for owner in ["trusted-server-cli", "trusted-server-adapter-fastly"] {
+        let script = compile_build_script(owner, &directory);
+        let mut outputs = Vec::new();
+        for tag in ["v1.2.3", "v1.2.4"] {
+            let output = owner_command(&script)
+                .env("TRUSTED_SERVER__RELEASE_BUILD", "1")
+                .env("TRUSTED_SERVER__GIT_VERSION", SOURCE)
+                .env("GITHUB_REF_NAME", tag)
+                .env("GITHUB_RUN_ID", tag)
+                .output()
+                .expect("should run release owner script");
+            assert!(
+                output.status.success(),
+                "should accept valid release source"
+            );
+            let directives =
+                String::from_utf8(output.stdout).expect("should emit UTF-8 directives");
+            assert!(
+                directives.contains("cargo:rustc-env=TRUSTED_SERVER__BUILD_TARGET=example-target"),
+                "should emit the target owned by Cargo TARGET"
+            );
+            assert!(
+                !directives.contains("cargo:rustc-env=TRUSTED_SERVER__GIT_VERSION="),
+                "should consume the source fact owned by core"
+            );
+            assert!(
+                !directives.contains("BUILD_VARIANT"),
+                "should derive variant from owning feature cfg"
+            );
+            if owner == "trusted-server-cli" {
+                assert!(
+                    directives.contains("cargo:rustc-cfg=trusted_server_release_build"),
+                    "should compile out the developer checkout fallback in release mode"
+                );
+            }
+            outputs.push(directives);
+        }
+        assert_eq!(
+            outputs[0], outputs[1],
+            "should exclude external tags and run IDs from compiled facts"
+        );
+        let output = owner_command(&script)
+            .output()
+            .expect("should run development script");
+        assert!(
+            output.status.success(),
+            "should preserve development builds"
+        );
+        assert!(
+            !String::from_utf8_lossy(&output.stdout)
+                .contains("cargo:rustc-cfg=trusted_server_release_build"),
+            "should retain development resource discovery"
+        );
+    }
+}
+
+#[test]
+fn actual_cli_version_reads_all_owning_facts_and_ignores_external_tags() {
+    assert_eq!(
+        BUILD_INFO.package_version(),
+        env!("CARGO_PKG_VERSION"),
+        "should own package version"
+    );
+    assert_eq!(
+        BUILD_INFO.source(),
+        trusted_server_core::constants::TS_GIT_VERSION,
+        "should consume the source owned by core"
+    );
+    assert_eq!(
+        BUILD_INFO.target(),
+        env!("TRUSTED_SERVER__BUILD_TARGET"),
+        "should own Cargo target"
+    );
+    assert_eq!(
+        BUILD_INFO.variant(),
+        BuildVariant::Default,
+        "should use CLI default variant"
+    );
+    if cfg!(trusted_server_release_build) {
+        let source = BUILD_INFO
+            .source()
+            .expect("should compile release source into the actual CLI");
+        assert_eq!(source.len(), 40, "should preserve complete release source");
+        assert!(
+            source
+                .bytes()
+                .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte)),
+            "should use lowercase source SHA in release facts"
+        );
+    }
+    let directory = tempfile::tempdir().expect("should create outside-checkout fixture");
+    for tag in ["v1.2.3", "v1.2.4"] {
+        let output = Command::new(env!("CARGO_BIN_EXE_ts"))
+            .current_dir(directory.path())
+            .arg("--version")
+            .env("GITHUB_REF_NAME", tag)
+            .env("GITHUB_RUN_ID", tag)
+            .output()
+            .expect("should run actual CLI binary");
+        assert!(
+            output.status.success(),
+            "should print version outside checkout"
+        );
+        assert_eq!(
+            String::from_utf8_lossy(&output.stdout),
+            format!(
+                "ts package={} source={} target={} variant=default\n",
+                BUILD_INFO.package_version(),
+                BUILD_INFO.source().unwrap_or("unknown"),
+                BUILD_INFO.target()
+            ),
+            "should label all four actual immutable facts"
+        );
+    }
+}
+
+#[test]
+fn help_and_config_init_work_outside_the_checkout() {
+    let directory = tempfile::tempdir().expect("should create outside-checkout fixture");
+    let binary = env!("CARGO_BIN_EXE_ts");
+    let output = Command::new(binary)
+        .current_dir(directory.path())
+        .arg("--help")
+        .output()
+        .expect("should run portable CLI");
+    assert!(
+        output.status.success(),
+        "should print help outside checkout"
+    );
+    let output = Command::new(binary)
+        .current_dir(directory.path())
+        .args(["config", "init"])
+        .output()
+        .expect("should initialize scaffold outside checkout");
+    assert!(
+        output.status.success(),
+        "should initialize embedded example config"
+    );
+    assert_eq!(
+        fs::read_to_string(directory.path().join("trusted-server.toml"))
+            .expect("should read config scaffold"),
+        include_str!("../../../trusted-server.example.toml"),
+        "should use tracked fictional scaffold"
+    );
+}
diff --git a/crates/trusted-server-cli/tests/release_cli.rs b/crates/trusted-server-cli/tests/release_cli.rs
new file mode 100644
index 0000000000..af50f2af61
--- /dev/null
+++ b/crates/trusted-server-cli/tests/release_cli.rs
@@ -0,0 +1,282 @@
+//! Public release verification dispatch, without provider configuration.
+#![cfg(unix)]
+
+use std::os::unix::fs::PermissionsExt as _;
+
+use assert_cmd::Command;
+use predicates::str::contains;
+
+const COMMIT: &str = "0123456789abcdef0123456789abcdef01234567";
+
+fn command() -> Command {
+    let mut command = Command::new(assert_cmd::cargo::cargo_bin!("ts"));
+    command.env_clear().env("PATH", "/usr/bin:/bin");
+    command
+}
+
+#[test]
+fn required_verify_path_reaches_explicit_token_requirement() {
+    command()
+        .args([
+            "release",
+            "verify",
+            "v1.2.0",
+            "--asset",
+            "ts-aarch64-apple-darwin",
+            "--expected-source-commit",
+            COMMIT,
+        ])
+        .assert()
+        .failure()
+        .stderr(contains("explicit"));
+}
+
+#[test]
+fn invalid_inputs_fail_before_environment_or_provider_configuration() {
+    for (tag, asset, commit, diagnostic) in [
+        ("latest", "ts-aarch64-apple-darwin", COMMIT, "tag"),
+        ("v1.2.0", "../../ts", COMMIT, "asset"),
+        ("v1.2.0", "ts-aarch64-apple-darwin", "main", "commit"),
+    ] {
+        let output = command()
+            .args([
+                "release",
+                "verify",
+                tag,
+                "--asset",
+                asset,
+                "--expected-source-commit",
+                commit,
+            ])
+            .output()
+            .expect("should run verifier");
+        assert!(!output.status.success(), "should reject invalid input");
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        assert!(
+            stderr.contains(diagnostic),
+            "should identify invalid {diagnostic}: {stderr}"
+        );
+        assert!(
+            !stderr.contains("token"),
+            "should validate before token lookup: {stderr}"
+        );
+        assert!(
+            !stderr.contains("configuration"),
+            "should not load provider configuration"
+        );
+    }
+}
+
+#[test]
+fn unsupported_public_surfaces_are_rejected() {
+    for flag in [
+        "--offline",
+        "--offline-deploy",
+        "--deploy",
+        "--cache",
+        "--output",
+        "--export",
+    ] {
+        command()
+            .args([
+                "release",
+                "verify",
+                "v1.2.0",
+                "--asset",
+                "ts-aarch64-apple-darwin",
+                "--expected-source-commit",
+                COMMIT,
+                flag,
+            ])
+            .assert()
+            .failure()
+            .stderr(contains("unexpected argument"));
+    }
+}
+
+#[test]
+fn invalid_inputs_cannot_invoke_build_provider_or_gh_hooks() {
+    let directory = tempfile::tempdir().expect("should create isolated caller directory");
+    let marker = directory.path().join("hook-invoked");
+    let script = format!("#!/bin/sh\necho invoked > '{}'\nexit 9\n", marker.display());
+    for name in ["gh", "cargo", "fastly", "edgezero"] {
+        let path = directory.path().join(name);
+        std::fs::write(&path, &script).expect("should write forbidden hook");
+        std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o700))
+            .expect("should mark hook executable");
+    }
+    for name in ["edgezero.toml", "trusted-server.toml"] {
+        std::fs::write(
+            directory.path().join(name),
+            "invalid configuration sentinel {{{",
+        )
+        .expect("should write unreadable configuration sentinel");
+    }
+    for args in [
+        vec![
+            "release",
+            "verify",
+            "v1.2.0",
+            "--asset",
+            "../../ts",
+            "--expected-source-commit",
+            COMMIT,
+        ],
+        vec![
+            "release",
+            "verify",
+            "v1.2.0",
+            "--asset",
+            "ts-aarch64-apple-darwin",
+            "--expected-source-commit",
+            "main",
+        ],
+        vec![
+            "release",
+            "verify",
+            "v1.2.0",
+            "--asset",
+            "ts-aarch64-apple-darwin",
+            "--expected-source-commit",
+            COMMIT,
+            "--offline-deploy",
+        ],
+    ] {
+        command()
+            .current_dir(directory.path())
+            .env("PATH", directory.path())
+            .env("GH_TOKEN", "fictional-token")
+            .args(args)
+            .assert()
+            .failure();
+        assert!(
+            !marker.exists(),
+            "should invoke zero provider, build or verification hooks for invalid input"
+        );
+    }
+}
+
+struct OwnedVerifier {
+    child: std::process::Child,
+    gh_group: Option<i32>,
+}
+
+impl Drop for OwnedVerifier {
+    fn drop(&mut self) {
+        if let Some(group) = self.gh_group {
+            // The PID belongs to the fake gh process spawned by this test.
+            unsafe {
+                libc::kill(-group, libc::SIGKILL);
+            }
+        }
+        let _ = self.child.kill();
+        let _ = self.child.wait();
+    }
+}
+
+#[test]
+fn interrupt_during_first_gh_child_cancels_and_reaps_it() {
+    let directory = tempfile::tempdir().expect("should create isolated fake gh installation");
+    let pid_path = directory.path().join("owned-gh.pid");
+    let gh = directory.path().join("gh");
+    std::fs::write(
+        &gh,
+        format!(
+            "#!/bin/sh\necho $$ > '{}'\nexec /bin/sleep 30\n",
+            pid_path.display()
+        ),
+    )
+    .expect("should write stalled fake gh");
+    std::fs::set_permissions(&gh, std::fs::Permissions::from_mode(0o700))
+        .expect("should mark fake gh executable");
+    let child = std::process::Command::new(assert_cmd::cargo::cargo_bin!("ts"))
+        .args([
+            "release",
+            "verify",
+            "v1.2.0",
+            "--asset",
+            "ts-aarch64-apple-darwin",
+            "--expected-source-commit",
+            COMMIT,
+        ])
+        .env_clear()
+        .env("PATH", directory.path())
+        .env("GH_TOKEN", "fictional-read-only-token")
+        .stdout(std::process::Stdio::null())
+        .stderr(std::process::Stdio::piped())
+        .spawn()
+        .expect("should spawn verifier process");
+    let mut owned = OwnedVerifier {
+        child,
+        gh_group: None,
+    };
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(5);
+    while !pid_path.exists() && std::time::Instant::now() < deadline {
+        assert!(
+            owned
+                .child
+                .try_wait()
+                .expect("should inspect verifier process")
+                .is_none(),
+            "should reach initial gh child before exiting"
+        );
+        std::thread::sleep(std::time::Duration::from_millis(10));
+    }
+    if !pid_path.exists() {
+        let _ = owned.child.kill();
+        let _ = owned.child.wait();
+        let diagnostic =
+            std::io::read_to_string(owned.child.stderr.take().expect("should own stderr pipe"))
+                .expect("should collect early diagnostic");
+        panic!("should reach owned gh child before deadline: {diagnostic}");
+    }
+    let gh_pid: i32 = std::fs::read_to_string(pid_path)
+        .expect("should observe test-owned gh PID")
+        .trim()
+        .parse()
+        .expect("should parse owned PID");
+    owned.gh_group = Some(gh_pid);
+    // Signal only this test-owned verifier, after its listener and child exist.
+    let signalled = unsafe { libc::kill(owned.child.id() as i32, libc::SIGINT) };
+    assert_eq!(signalled, 0, "should send interrupt to owned verifier");
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(5);
+    let status = loop {
+        if let Some(status) = owned
+            .child
+            .try_wait()
+            .expect("should inspect interrupted verifier")
+        {
+            break status;
+        }
+        assert!(
+            std::time::Instant::now() < deadline,
+            "should cancel verifier promptly"
+        );
+        std::thread::sleep(std::time::Duration::from_millis(10));
+    };
+    assert!(!status.success(), "should return nonzero on interrupt");
+    let stderr = std::io::read_to_string(
+        owned
+            .child
+            .stderr
+            .take()
+            .expect("should retain diagnostic pipe"),
+    )
+    .expect("should read bounded diagnostic");
+    assert!(
+        stderr.contains("cancelled"),
+        "should report controlled cancellation: {stderr}"
+    );
+    // The supervised leader must have been killed and reaped, rather than orphaned.
+    assert_eq!(
+        unsafe { libc::kill(gh_pid, 0) },
+        -1,
+        "should reap initial gh process before returning"
+    );
+    assert_eq!(
+        std::io::Error::last_os_error().raw_os_error(),
+        Some(libc::ESRCH),
+        "should leave no gh process alive"
+    );
+    owned.gh_group = None;
+}
diff --git a/crates/trusted-server-core/build.rs b/crates/trusted-server-core/build.rs
index db9c31d27c..552e5bb116 100644
--- a/crates/trusted-server-core/build.rs
+++ b/crates/trusted-server-core/build.rs
@@ -17,7 +17,7 @@ use std::path::{Path, PathBuf};
 use std::process::Command;
 
 use edgezero_core::manifest::ManifestLoader;
-use git_version::{Candidates, is_usable, resolve_git_version};
+use git_version::{Candidates, is_usable, resolve_build_source, resolve_git_version};
 use sha2::{Digest as _, Sha256};
 
 /// Crate-relative build inputs that are both watched and hashed besides `src/`.
@@ -160,24 +160,29 @@ fn main() {
 fn emit_git_version() {
     println!("cargo:rerun-if-env-changed={OVERRIDE_ENV}");
 
-    let override_value = std::env::var(OVERRIDE_ENV).ok();
-    let resolved = match override_value.as_deref() {
-        Some(value) if is_usable(value) => resolve_git_version(&Candidates {
-            override_value: Some(value),
-            exact_tag: None,
-            branch: None,
-            commit: None,
-        }),
-        Some(value) => {
-            if !value.trim().is_empty() {
-                println!(
-                    "cargo:warning={OVERRIDE_ENV}={value:?} is not visible ASCII; \
-                     falling back to local git for x-ts-version"
-                );
-            }
-            resolve_from_local_git()
+    println!("cargo:rerun-if-env-changed=TRUSTED_SERVER__RELEASE_BUILD");
+    let control = env::var_os("TRUSTED_SERVER__RELEASE_BUILD");
+    let source = env::var_os(OVERRIDE_ENV);
+    if control.is_none()
+        && let Some(value) = source.as_deref().and_then(std::ffi::OsStr::to_str)
+        && !is_usable(value)
+        && !value.trim().is_empty()
+    {
+        println!(
+            "cargo:warning={OVERRIDE_ENV}={value:?} is not visible ASCII; \
+             falling back to local git for x-ts-version"
+        );
+    }
+    let resolved = match resolve_build_source(
+        control.as_deref(),
+        source.as_deref(),
+        resolve_from_local_git,
+    ) {
+        Ok(source) => source,
+        Err(message) => {
+            println!("cargo::error={message}");
+            std::process::exit(1);
         }
-        None => resolve_from_local_git(),
     };
 
     // Always emitted, even when empty, so the raw pipeline value never reaches
diff --git a/crates/trusted-server-core/build_support/git_version.rs b/crates/trusted-server-core/build_support/git_version.rs
index f4cf2d3688..36f426372a 100644
--- a/crates/trusted-server-core/build_support/git_version.rs
+++ b/crates/trusted-server-core/build_support/git_version.rs
@@ -3,6 +3,62 @@
 //! Shared by `build.rs` and `tests/git_version_resolve.rs` via `#[path]`, so it
 //! must stay dependency-free.
 
+use std::ffi::OsStr;
+
+/// Returns the exact source commit in release mode, or `None` in development.
+///
+/// # Errors
+///
+/// Rejects any present release control except `1`, and release sources other
+/// than exactly 40 lowercase ASCII hexadecimal bytes.
+pub fn release_source(
+    control: Option<&OsStr>,
+    source: Option<&OsStr>,
+) -> Result<Option<String>, &'static str> {
+    match control {
+        None => return Ok(None),
+        Some(value) if value == OsStr::new("1") => {}
+        Some(_) => return Err("TRUSTED_SERVER__RELEASE_BUILD must be exactly 1 when present"),
+    }
+    let source = source
+        .and_then(OsStr::to_str)
+        .ok_or("release builds require TRUSTED_SERVER__GIT_VERSION as a full lowercase commit")?;
+    if source.len() != 40
+        || !source
+            .bytes()
+            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+    {
+        return Err("release source must be exactly 40 lowercase ASCII hexadecimal bytes");
+    }
+    Ok(Some(source.to_owned()))
+}
+
+/// Resolve the actual build source, calling local Git only in development.
+///
+/// # Errors
+///
+/// Returns release input errors before invoking the fallback.
+pub fn resolve_build_source(
+    control: Option<&OsStr>,
+    source: Option<&OsStr>,
+    local_git: impl FnOnce() -> Option<String>,
+) -> Result<Option<String>, &'static str> {
+    if let Some(commit) = release_source(control, source)? {
+        return Ok(Some(commit));
+    }
+    let override_value = source.and_then(OsStr::to_str);
+    if override_value.is_some_and(is_usable) {
+        Ok(resolve_git_version(&Candidates {
+            override_value,
+            exact_tag: None,
+            branch: None,
+            commit: None,
+        }))
+    } else {
+        Ok(local_git())
+    }
+}
+
 /// Raw candidates for the deployed git version, in priority order.
 pub struct Candidates<'a> {
     /// `TRUSTED_SERVER__GIT_VERSION`, supplied by the deploy pipeline.
diff --git a/crates/trusted-server-core/src/build_info.rs b/crates/trusted-server-core/src/build_info.rs
new file mode 100644
index 0000000000..2809ded936
--- /dev/null
+++ b/crates/trusted-server-core/src/build_info.rs
@@ -0,0 +1,101 @@
+//! Immutable facts compiled into an owning product.
+//!
+//! These facts identify build inputs. They do not establish release provenance
+//! or publishing authority; release tags, run IDs and artifact checksums remain
+//! external to the compiled product.
+
+use crate::constants::TS_GIT_VERSION;
+
+/// The owning product's compile-time feature variant.
+#[derive(Debug, Clone, Copy, Eq, PartialEq, derive_more::Display)]
+pub enum BuildVariant {
+    /// The product's default feature set.
+    #[display("default")]
+    Default,
+    /// Fastly's opt-in reusable sandbox feature.
+    #[display("reusable-sandbox")]
+    ReusableSandbox,
+}
+
+/// Immutable package, source, target and variant facts for an owning product.
+#[derive(Debug, Clone, Copy, Eq, PartialEq)]
+pub struct BuildInfo {
+    package_version: &'static str,
+    source: Option<&'static str>,
+    target: &'static str,
+    variant: BuildVariant,
+}
+
+impl BuildInfo {
+    /// Defines owning product facts using the source compiled into core.
+    ///
+    /// Call this in an owning constant with Cargo's package version, its build
+    /// script's target and its own feature variant.
+    ///
+    /// # Examples
+    ///
+    /// ```
+    /// use trusted_server_core::build_info::{BuildInfo, BuildVariant};
+    /// const FACTS: BuildInfo = BuildInfo::new("1.2.3", "example-target", BuildVariant::Default);
+    /// assert_eq!(FACTS.package_version(), "1.2.3");
+    /// ```
+    #[must_use]
+    pub const fn new(
+        package_version: &'static str,
+        target: &'static str,
+        variant: BuildVariant,
+    ) -> Self {
+        Self {
+            package_version,
+            source: TS_GIT_VERSION,
+            target,
+            variant,
+        }
+    }
+
+    /// Returns the owning product's Cargo package version.
+    #[must_use]
+    pub const fn package_version(&self) -> &'static str {
+        self.package_version
+    }
+
+    /// Returns the compiled source identity, when known.
+    ///
+    /// Release builds require a complete commit. Development builds retain
+    /// the existing tag, branch and abbreviated commit resolution.
+    #[must_use]
+    pub const fn source(&self) -> Option<&'static str> {
+        self.source
+    }
+
+    /// Returns the owning product's Cargo target triple.
+    #[must_use]
+    pub const fn target(&self) -> &'static str {
+        self.target
+    }
+
+    /// Returns the owning product's feature variant.
+    #[must_use]
+    pub const fn variant(&self) -> BuildVariant {
+        self.variant
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn variants_display_canonical_product_labels() {
+        assert_eq!(
+            BuildVariant::Default.to_string(),
+            "default",
+            "should label the default product variant"
+        );
+        assert_eq!(
+            BuildVariant::ReusableSandbox.to_string(),
+            "reusable-sandbox",
+            "should label the reusable sandbox product variant"
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/constants.rs b/crates/trusted-server-core/src/constants.rs
index 1fd3c2382c..f2a5e89a33 100644
--- a/crates/trusted-server-core/src/constants.rs
+++ b/crates/trusted-server-core/src/constants.rs
@@ -32,14 +32,17 @@ pub const HEADER_X_COMPRESS_HINT: HeaderName = HeaderName::from_static("x-compre
 pub const HEADER_X_DEBUG_FASTLY_POP: HeaderName = HeaderName::from_static("x-debug-fastly-pop");
 
 // Staging / version identification headers
-/// Deployed git version: tag, else branch, else 6-char commit (see [`TS_GIT_VERSION`]).
+/// Release source commit or development identity (see [`TS_GIT_VERSION`]).
 pub const HEADER_X_TS_VERSION: HeaderName = HeaderName::from_static("x-ts-version");
 /// Fastly service version (`FASTLY_SERVICE_VERSION`), formerly sent as `x-ts-version`.
 pub const HEADER_X_TS_FASTLY_VERSION: HeaderName = HeaderName::from_static("x-ts-fastly-version");
 pub const HEADER_X_TS_ENV: HeaderName = HeaderName::from_static("x-ts-env");
 
-/// Deployed git version compiled in by `build.rs`, from the deploy pipeline's
-/// `TRUSTED_SERVER__GIT_VERSION` or local git. `None` when unknown.
+/// Source identity compiled in by `build.rs`.
+///
+/// Release builds use the full source commit SHA. Development builds use the
+/// pipeline override, exact Git tag, branch, or six-character commit fallback.
+/// `None` when unknown.
 pub const TS_GIT_VERSION: Option<&str> = match option_env!("TRUSTED_SERVER__GIT_VERSION") {
     Some(version) if !version.is_empty() => Some(version),
     _ => None,
diff --git a/crates/trusted-server-core/src/lib.rs b/crates/trusted-server-core/src/lib.rs
index 357660ea0d..4cab6fcdde 100644
--- a/crates/trusted-server-core/src/lib.rs
+++ b/crates/trusted-server-core/src/lib.rs
@@ -35,6 +35,7 @@ pub(crate) mod asset_image_optimizer;
 pub mod auction;
 pub mod auction_config_types;
 pub mod auth;
+pub mod build_info;
 pub mod cache_policy;
 pub mod cache_purge;
 pub mod config;
diff --git a/crates/trusted-server-core/tests/git_version_resolve.rs b/crates/trusted-server-core/tests/git_version_resolve.rs
index 9fb77a2b54..c1dbbd58f7 100644
--- a/crates/trusted-server-core/tests/git_version_resolve.rs
+++ b/crates/trusted-server-core/tests/git_version_resolve.rs
@@ -4,6 +4,9 @@
 mod git_version;
 
 use git_version::{Candidates, resolve_git_version};
+use std::ffi::OsStr;
+#[cfg(unix)]
+use std::os::unix::ffi::OsStrExt as _;
 
 const COMMIT: &str = "abcdef0123456789abcdef0123456789abcdef01";
 
@@ -139,3 +142,113 @@ fn is_usable_accepts_only_visible_ascii() {
     );
     assert!(!git_version::is_usable("v1-été"), "should reject non-ASCII");
 }
+
+#[test]
+fn release_source_requires_an_exact_full_lowercase_commit() {
+    let commit = "abcdef0123456789abcdef0123456789abcdef01";
+    assert_eq!(
+        git_version::release_source(Some(OsStr::new("1")), Some(OsStr::new(commit))),
+        Ok(Some(commit.to_owned())),
+        "should preserve the complete release source"
+    );
+    for source in [
+        None,
+        Some(""),
+        Some("main"),
+        Some("v1.2.3"),
+        Some("abcdef"),
+        Some("ABCDEF0123456789abcdef0123456789abcdef01"),
+        Some(" abcdef0123456789abcdef0123456789abcdef01"),
+        Some("abcdef0123456789abcdef0123456789abcdef01\n"),
+        Some("abcdef0123456789abcdef0123456789abcdef0g"),
+    ] {
+        assert!(
+            git_version::release_source(Some(OsStr::new("1")), source.map(OsStr::new)).is_err(),
+            "should reject malformed release source {source:?}"
+        );
+    }
+}
+
+#[test]
+fn release_control_accepts_only_absence_or_exact_one() {
+    assert_eq!(
+        git_version::release_source(None, Some(OsStr::new("main"))),
+        Ok(None),
+        "should retain development resolution when release control is absent"
+    );
+    for control in ["", "0", "true", " 1", "1\n"] {
+        assert!(
+            git_version::release_source(
+                Some(OsStr::new(control)),
+                Some(OsStr::new("abcdef0123456789abcdef0123456789abcdef01"))
+            )
+            .is_err(),
+            "should reject invalid control even with valid source"
+        );
+    }
+}
+
+#[cfg(unix)]
+#[test]
+fn non_unicode_release_inputs_fail_closed() {
+    let non_unicode = OsStr::from_bytes(b"\xff");
+    assert!(
+        git_version::release_source(Some(non_unicode), None).is_err(),
+        "should recognize non-Unicode control as present and invalid"
+    );
+    assert!(
+        git_version::release_source(Some(OsStr::new("1")), Some(non_unicode)).is_err(),
+        "should reject non-Unicode source"
+    );
+}
+
+#[test]
+fn actual_build_source_resolution_never_calls_git_in_release_mode() {
+    let source =
+        git_version::resolve_build_source(Some(OsStr::new("1")), Some(OsStr::new(COMMIT)), || {
+            panic!("should not call Git in release mode")
+        })
+        .expect("should resolve valid release source");
+    assert_eq!(
+        source.as_deref(),
+        Some(COMMIT),
+        "should retain the complete release commit"
+    );
+    let result =
+        git_version::resolve_build_source(Some(OsStr::new("1")), Some(OsStr::new("main")), || {
+            panic!("should not fall back after invalid release source")
+        });
+    assert!(
+        result.is_err(),
+        "should reject malformed release source without Git fallback"
+    );
+}
+
+#[test]
+fn actual_build_source_resolution_preserves_development_override_and_fallback() {
+    for identity in ["main", " v1.2.3 ", COMMIT] {
+        let source = git_version::resolve_build_source(None, Some(OsStr::new(identity)), || {
+            panic!("should not call Git with a usable development override")
+        })
+        .expect("should resolve development override");
+        assert_eq!(
+            source.as_deref(),
+            Some(identity.trim()),
+            "should preserve development override"
+        );
+    }
+    for identity in [None, Some(OsStr::new("")), Some(OsStr::new("bad identity"))] {
+        let mut called = false;
+        let source = git_version::resolve_build_source(None, identity, || {
+            called = true;
+            Some("local-branch".to_owned())
+        })
+        .expect("should resolve development fallback");
+        assert!(called, "should call actual fallback for unusable override");
+        assert_eq!(
+            source.as_deref(),
+            Some("local-branch"),
+            "should use fallback result"
+        );
+    }
+}
diff --git a/crates/trusted-server-integration-tests/browser/helpers/infra.ts b/crates/trusted-server-integration-tests/browser/helpers/infra.ts
index 0402bb266e..8e16560c96 100644
--- a/crates/trusted-server-integration-tests/browser/helpers/infra.ts
+++ b/crates/trusted-server-integration-tests/browser/helpers/infra.ts
@@ -32,8 +32,8 @@ export async function findAvailablePort(): Promise<number> {
  * Start a Docker container for the given framework.
  *
  * Uses `docker run -d` (detached) with `--rm` for auto-cleanup on stop.
- * The container is mapped to the fixed origin port so the WASM binary
- * (which has this port baked in) can proxy to it.
+ * The container is mapped to the fixed origin port expected by the runtime
+ * application configuration so the server can proxy to it.
  *
  * @returns The container ID.
  */
diff --git a/crates/trusted-server-integration-tests/tests/common/runtime.rs b/crates/trusted-server-integration-tests/tests/common/runtime.rs
index 048c76d44b..756e021315 100644
--- a/crates/trusted-server-integration-tests/tests/common/runtime.rs
+++ b/crates/trusted-server-integration-tests/tests/common/runtime.rs
@@ -81,10 +81,9 @@ pub trait RuntimeProcessHandle: Send + Sync {}
 
 /// Trait defining how to run the trusted-server on different platforms.
 ///
-/// The application configuration (origin URL, integrations, etc.) is baked
-/// into the WASM binary at build time via `build.rs`. The runtime environment
-/// only needs the WASM binary path and its own platform-specific config
-/// (e.g. Viceroy's `fastly.toml` for KV stores and secret stores).
+/// Runtime fixtures supply application configuration (origin URL, integrations,
+/// etc.) separately from the WASM binary, alongside platform-specific resources
+/// (e.g. Viceroy's `fastly.toml` config, KV and secret stores).
 pub trait RuntimeEnvironment: Send + Sync {
     /// Platform identifier (e.g., "fastly", "cloudflare")
     fn id(&self) -> &'static str;
@@ -122,8 +121,8 @@ pub fn wasm_binary_path() -> PathBuf {
 
 /// Get the fixed origin port used for Docker container port mapping.
 ///
-/// This must match the port baked into the WASM binary via
-/// `TRUSTED_SERVER__PUBLISHER__ORIGIN_URL` at build time.
+/// This must match the origin port in the generated runtime application
+/// configuration and the container host-port mapping.
 pub fn origin_port() -> u16 {
     match std::env::var("INTEGRATION_ORIGIN_PORT") {
         Ok(value) => value
diff --git a/crates/trusted-server-integration-tests/tests/frameworks/mod.rs b/crates/trusted-server-integration-tests/tests/frameworks/mod.rs
index e77fb9b91d..14cff07b1c 100644
--- a/crates/trusted-server-integration-tests/tests/frameworks/mod.rs
+++ b/crates/trusted-server-integration-tests/tests/frameworks/mod.rs
@@ -24,8 +24,8 @@ pub trait FrontendFramework: Send + Sync {
 
     /// Build a Docker container request mapped to the given origin port.
     ///
-    /// The `origin_port` is the fixed host port that the WASM binary
-    /// expects the origin to be running on (baked in at build time).
+    /// The `origin_port` is the fixed host port where the runtime test
+    /// configuration expects the origin to be running.
     ///
     /// # Errors
     ///
diff --git a/crates/trusted-server-integration-tests/tests/parity.rs b/crates/trusted-server-integration-tests/tests/parity.rs
index 2428d7799b..d3ab71424b 100644
--- a/crates/trusted-server-integration-tests/tests/parity.rs
+++ b/crates/trusted-server-integration-tests/tests/parity.rs
@@ -25,9 +25,9 @@ use trusted_server_core::test_support::nextjs_auction;
 
 /// Shared test settings for all adapters.
 ///
-/// The settings baked into the binaries contain placeholder secrets that
-/// `get_settings()` rejects by design, so all routers are built through
-/// their `routes_with_settings` testing seams from this known-good config.
+/// All routers use their `routes_with_settings` testing seams with known-good
+/// settings so these tests do not depend on external runtime configuration
+/// or secret-store bindings.
 /// The handler regex is the production-shaped `^/_ts/admin`, matching
 /// `Settings::ADMIN_ENDPOINTS` and the default config, so the canonical
 /// `/_ts/admin/keys/*` routes are auth-gated exactly as in production.
diff --git a/crates/trusted-server-js/Cargo.toml b/crates/trusted-server-js/Cargo.toml
index 67a4ac6989..83389b8845 100644
--- a/crates/trusted-server-js/Cargo.toml
+++ b/crates/trusted-server-js/Cargo.toml
@@ -21,6 +21,17 @@ build-print = { workspace = true }
 hex = { workspace = true }
 sha2 = { workspace = true }
 which = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+libc = { workspace = true }
+
+[target.'cfg(not(target_arch = "wasm32"))'.dev-dependencies]
+build-print = { workspace = true }
+which = { workspace = true }
+serde = { workspace = true }
+libc = { workspace = true }
+serde_json = { workspace = true }
+tempfile = { workspace = true }
 
 [dependencies]
 hex = { workspace = true }
diff --git a/crates/trusted-server-js/README.md b/crates/trusted-server-js/README.md
index 254ab6f55c..64793da1ef 100644
--- a/crates/trusted-server-js/README.md
+++ b/crates/trusted-server-js/README.md
@@ -12,6 +12,40 @@ bundle is missing or empty; the `dist` directory is written only by a manual
 explicitly through `TSJS_PREBUILT_DIR`. The external Prebid.js artifact is
 built separately and is not the deferred Trusted Server Prebid shim.
 
+With `TRUSTED_SERVER__RELEASE_BUILD=1`, Rust builds require
+`TRUSTED_SERVER__GIT_VERSION` as the approved 40-character lowercase commit,
+plus absolute `TSJS_PREBUILT_DIR` and
+`TRUSTED_SERVER__TSJS_PREBUILT_INVENTORY` paths. They run no npm. Any presence
+of `TSJS_SKIP_BUILD` fails in Rust Cargo builds, including empty, `0` and `1`;
+Node development builds and Vitest allow it when release control is absent.
+Development still supports fresh Node builds and prebuilt bundles without an
+inventory. When an inventory is supplied, its source commit syntax and bytes
+are checked; matching the approved source is required only in release mode.
+The development override/tag/branch display label is not compared with the
+inventory commit.
+
+The version-1 inventory has exactly `schema_version`, `source_commit`,
+`modules`, `tools`, and `materials`. Each module has exactly `id`, `filename`,
+`size`, `sha256`, and `contributions`. Modules are sorted by safe ASCII ID and
+must match the discovered set; filenames are `tsjs-<id>.js`, sizes are positive
+integers, and digests are lowercase SHA-256. The inventory must be outside
+the bundle directory, is capped at 1 MiB, and uses strict UTF-8 JSON with
+unique keys, finite numbers, and at most 64 container levels. Integer-valued
+numbers, including exponent notation and numbers inside opaque arrays, must
+stay within the JavaScript safe-integer range; lexical integer overflow also
+fails. Producers must honor the 32 MiB input limit per module. The required contribution, tool, and
+material arrays contain strictly parsed, opaque JSON here; composition
+validation belongs to the release producer.
+
+Inventory-backed copying checks the exact source set through held file handles,
+rejects links, hard links and nonregular files, and checks source identities and
+private copied bytes before generating Rust. Inventory-absent development
+keeps the existing prebuilt path, including unrelated non-bundle extras and
+supported directory/file aliases. Cargo build-script messages expose
+`TRUSTED_SERVER__TSJS_INVENTORY_SHA256` through `cargo:rustc-env`, hashing the exact raw
+inventory bytes for later build evidence. These are prepared input checks;
+they do not establish which modules survive linking into a final executable.
+
 Run the JavaScript checks from `crates/trusted-server-js/lib`:
 
 ```bash
@@ -22,7 +56,27 @@ npm run format
 npm run build
 ```
 
-Rust target checks include this crate through `cargo test-fastly`. See
+The default development suite skips only the two slow Git collector fixtures.
+Run the full registered suite and type checks, as CI does, with
+`TRUSTED_SERVER__RELEASE_JS_TESTS=1 npx vitest run`. Both future release JS A/B
+test processes must receive that opt-in unconditionally.
+
+`cargo test-fastly` covers WASM tests but selects zero native prebuilt tests.
+Run those checks from the repository root with the actual host target:
+
+```bash
+set -eu
+HOST_TARGET=$(rustc -vV | sed -n 's/^host: //p')
+test -n "$HOST_TARGET"
+TEST_LIST=$(mktemp)
+trap 'rm -f "$TEST_LIST"' EXIT
+cargo test -p trusted-server-js --target "$HOST_TARGET" --test release_prebuilt -- --list > "$TEST_LIST"
+awk '/: test$/ { count++ } END { if (count == 0) { print "No native prebuilt tests selected"; exit 1 } }' "$TEST_LIST"
+cargo test -p trusted-server-js --target "$HOST_TARGET" --test release_prebuilt
+cargo clippy -p trusted-server-js --target "$HOST_TARGET" --all-targets --all-features -- -D warnings
+```
+
+These source-built tests do not establish release qualification. See
 [Trusted Server JavaScript](../../docs/guide/tsjs.md) for the 12 integration
 entries, 13 emitted bundles, and immediate, deferred, and standalone loading
 modes.
diff --git a/crates/trusted-server-js/build.rs b/crates/trusted-server-js/build.rs
index a9148c8d93..779a632641 100644
--- a/crates/trusted-server-js/build.rs
+++ b/crates/trusted-server-js/build.rs
@@ -1,11 +1,20 @@
 #![allow(
     clippy::expect_used,
     clippy::panic,
-    reason = "build script failures should stop Cargo with a clear diagnostic"
+    clippy::print_stdout,
+    reason = "Cargo directives require stdout and build script failures must stop the build"
 )]
 
 #[path = "build/bundle_set.rs"]
 mod bundle_set;
+#[allow(dead_code, reason = "only the shared release guard is needed here")]
+#[path = "../trusted-server-core/build_support/git_version.rs"]
+mod git_version;
+#[path = "build/inventory.rs"]
+mod inventory;
+#[cfg(any(target_os = "linux", target_os = "macos"))]
+#[path = "build/prebuilt.rs"]
+mod prebuilt;
 
 use std::env;
 use std::fmt::Write as _;
@@ -16,20 +25,31 @@ use std::process::{Command, ExitStatus};
 use build_print::info;
 use sha2::{Digest as _, Sha256};
 
-use crate::bundle_set::{bundle_file_name, check_bundle_set, expected_module_ids, scan_bundle_dir};
+use self::bundle_set::{bundle_file_name, check_bundle_set, expected_module_ids, scan_bundle_dir};
 
 const PREBUILT_DIR_VAR: &str = "TSJS_PREBUILT_DIR";
+const INVENTORY_VAR: &str = "TRUSTED_SERVER__TSJS_PREBUILT_INVENTORY";
+const RELEASE_VAR: &str = "TRUSTED_SERVER__RELEASE_BUILD";
+const SOURCE_VAR: &str = "TRUSTED_SERVER__GIT_VERSION";
 const SKIP_BUILD_VAR: &str = "TSJS_SKIP_BUILD";
 const TEST_VAR: &str = "TSJS_TEST";
 
 fn main() {
+    run_with_hook(|_, _| {});
+}
+
+/// Run the actual build script with a crate-private post-copy race fixture.
+pub(crate) fn run_with_hook(hook: impl FnMut(&Path, &Path)) {
     // Cargo scans directories recursively, so these cover every TS source.
     // Every path must exist: a missing entry makes Cargo rerun this script on
     // every build, the opposite of the intent.
     for path in [
         "lib/src",
         "lib/build-all.mjs",
+        "lib/build-module-options.mjs",
         "lib/build-prebid-external.mjs",
+        "lib/release-composition.mjs",
+        "lib/vitest.config.ts",
         "lib/package.json",
         "lib/package-lock.json",
         "lib/tsconfig.json",
@@ -37,10 +57,49 @@ fn main() {
     ] {
         println!("cargo:rerun-if-changed={path}");
     }
-    for var in [PREBUILT_DIR_VAR, SKIP_BUILD_VAR, TEST_VAR] {
+    for var in [
+        PREBUILT_DIR_VAR,
+        INVENTORY_VAR,
+        SKIP_BUILD_VAR,
+        TEST_VAR,
+        RELEASE_VAR,
+        SOURCE_VAR,
+    ] {
         println!("cargo:rerun-if-env-changed={var}");
     }
 
+    assert!(
+        env::var_os(SKIP_BUILD_VAR).is_none(),
+        "tsjs: {SKIP_BUILD_VAR} is no longer supported whenever present"
+    );
+    let source = env::var_os(SOURCE_VAR);
+    let release =
+        git_version::release_source(env::var_os(RELEASE_VAR).as_deref(), source.as_deref())
+            .unwrap_or_else(|error| panic!("tsjs: {error}"));
+    let prebuilt_dir = env::var_os(PREBUILT_DIR_VAR).map(PathBuf::from);
+    let inventory_path = env::var_os(INVENTORY_VAR).map(PathBuf::from);
+    if release.is_some() {
+        assert!(
+            prebuilt_dir.is_some(),
+            "tsjs: release builds require {PREBUILT_DIR_VAR}"
+        );
+        assert!(
+            inventory_path.is_some(),
+            "tsjs: release builds require {INVENTORY_VAR}"
+        );
+    }
+    assert!(
+        inventory_path.is_none() || prebuilt_dir.is_some(),
+        "tsjs: {INVENTORY_VAR} requires {PREBUILT_DIR_VAR}"
+    );
+    if let Some(path) = &inventory_path {
+        assert!(
+            path.is_absolute(),
+            "tsjs: {INVENTORY_VAR} must be an absolute path"
+        );
+        println!("cargo:rerun-if-changed={}", path.display());
+    }
+
     let crate_dir = PathBuf::from(
         env::var("CARGO_MANIFEST_DIR").expect("should set CARGO_MANIFEST_DIR for build script"),
     );
@@ -52,7 +111,7 @@ fn main() {
     let expected = expected_module_ids(&ts_dir.join("src"))
         .unwrap_or_else(|err| panic!("tsjs: failed to discover modules: {err}"));
 
-    if let Some(prebuilt_dir) = env::var_os(PREBUILT_DIR_VAR).map(PathBuf::from) {
+    if let Some(prebuilt_dir) = prebuilt_dir {
         assert!(
             prebuilt_dir.is_absolute(),
             "tsjs: {PREBUILT_DIR_VAR} must be an absolute path because Cargo runs build \
@@ -64,8 +123,41 @@ fn main() {
             "tsjs: Using prebuilt bundles from {}",
             prebuilt_dir.display()
         );
-        validate_bundle_dir(&expected, &prebuilt_dir);
-        copy_prebuilt_bundles(&expected, &prebuilt_dir, &bundle_dir);
+        if let Some(path) = inventory_path {
+            #[cfg(any(target_os = "linux", target_os = "macos"))]
+            {
+                prebuilt::inventory_outside(&prebuilt_dir, &path).unwrap_or_else(|error| {
+                    panic!("tsjs: invalid inventory path {}: {error}", path.display())
+                });
+                let inventory = inventory::read_inventory(&path, &expected, release.as_deref())
+                    .unwrap_or_else(|error| {
+                        panic!("tsjs: invalid inventory {}: {error}", path.display())
+                    });
+                prebuilt::copy_checked(
+                    &expected,
+                    &prebuilt_dir,
+                    &bundle_dir,
+                    &inventory.inventory,
+                    hook,
+                )
+                .unwrap_or_else(|error| {
+                    panic!(
+                        "tsjs: invalid prebuilt inventory inputs in {}: {error}",
+                        prebuilt_dir.display()
+                    )
+                });
+                // Cargo JSON build-script messages expose the prepared input
+                // identity to the later release evidence collector.
+                println!(
+                    "cargo:rustc-env=TRUSTED_SERVER__TSJS_INVENTORY_SHA256={}",
+                    inventory.raw_sha256
+                );
+            }
+            #[cfg(not(any(target_os = "linux", target_os = "macos")))]
+            panic!("tsjs: checked prebuilt copying requires a supported Linux or macOS build host");
+        } else {
+            copy_prebuilt(&expected, &prebuilt_dir, &bundle_dir);
+        }
     } else {
         build_bundles(&ts_dir, &bundle_dir);
     }
@@ -80,6 +172,22 @@ fn main() {
     write_module_table(&expected, &bundle_dir, &out_dir);
 }
 
+fn copy_prebuilt(expected: &[String], source: &Path, destination: &Path) {
+    let found =
+        bundle_set::scan_legacy_bundle_dir(source).unwrap_or_else(|error| panic!("tsjs: {error}"));
+    check_bundle_set(expected, &found)
+        .unwrap_or_else(|error| panic!("tsjs: invalid prebuilt bundle set: {error}"));
+    if destination.exists() {
+        fs::remove_dir_all(destination).expect("should clear private prebuilt destination");
+    }
+    fs::create_dir_all(destination).expect("should create private prebuilt destination");
+    for id in expected {
+        let filename = bundle_file_name(id);
+        fs::copy(source.join(&filename), destination.join(&filename))
+            .unwrap_or_else(|error| panic!("tsjs: failed to copy {filename}: {error}"));
+    }
+}
+
 fn build_bundles(ts_dir: &Path, bundle_dir: &Path) {
     let how_to_prebuild = format!(
         "To embed prebuilt bundles instead, run `npm run build` in {} and set \
@@ -88,11 +196,6 @@ fn build_bundles(ts_dir: &Path, bundle_dir: &Path) {
         ts_dir.with_file_name("dist").display()
     );
 
-    assert!(
-        !env::var(SKIP_BUILD_VAR).is_ok_and(|value| value == "1"),
-        "tsjs: {SKIP_BUILD_VAR} is no longer supported because it embedded whatever \
-         dist/ held. {how_to_prebuild}"
-    );
     assert!(
         ts_dir.join("package.json").is_file(),
         "tsjs: {} not found. {how_to_prebuild}",
@@ -212,27 +315,6 @@ fn validate_bundle_dir(expected: &[String], dir: &Path) {
     }
 }
 
-fn copy_prebuilt_bundles(expected: &[String], prebuilt_dir: &Path, bundle_dir: &Path) {
-    if bundle_dir.exists() {
-        fs::remove_dir_all(bundle_dir)
-            .unwrap_or_else(|err| panic!("tsjs: failed to clean {}: {err}", bundle_dir.display()));
-    }
-    fs::create_dir_all(bundle_dir)
-        .unwrap_or_else(|err| panic!("tsjs: failed to create {}: {err}", bundle_dir.display()));
-    for id in expected {
-        let file_name = bundle_file_name(id);
-        let source = prebuilt_dir.join(&file_name);
-        let target = bundle_dir.join(&file_name);
-        fs::copy(&source, &target).unwrap_or_else(|err| {
-            panic!(
-                "tsjs: failed to copy {} to {}: {err}",
-                source.display(),
-                target.display()
-            )
-        });
-    }
-}
-
 fn write_module_table(expected: &[String], bundle_dir: &Path, out_dir: &Path) {
     let mut codegen = String::new();
     codegen.push_str("// Auto-generated by build.rs - DO NOT EDIT\n\n");
diff --git a/crates/trusted-server-js/build/bundle_set.rs b/crates/trusted-server-js/build/bundle_set.rs
index ec9b52ab34..acb6edd805 100644
--- a/crates/trusted-server-js/build/bundle_set.rs
+++ b/crates/trusted-server-js/build/bundle_set.rs
@@ -14,6 +14,14 @@ pub(crate) fn bundle_file_name(id: &str) -> String {
     format!("tsjs-{id}.js")
 }
 
+/// Whether the ID is an ASCII identifier safe in a file and generated Rust.
+pub(crate) fn safe_module_id(id: &str) -> bool {
+    !id.is_empty()
+        && id
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'_' | b'-'))
+}
+
 /// Return the module IDs `build-all.mjs` builds from `lib_src`.
 ///
 /// Mirrors the discovery in `build-all.mjs`: `core` plus every
@@ -51,6 +59,17 @@ pub(crate) fn expected_module_ids(lib_src: &Path) -> Result<Vec<String>, String>
     let mut ids = Vec::with_capacity(integrations.len() + 1);
     ids.push(CORE_MODULE_ID.to_owned());
     ids.extend(integrations);
+    if let Some(id) = ids.iter().find(|id| !safe_module_id(id)) {
+        return Err(format!("module ID {id} must be a safe ASCII identifier"));
+    }
+    if ids
+        .iter()
+        .filter(|id| id.as_str() == CORE_MODULE_ID)
+        .count()
+        != 1
+    {
+        return Err("duplicate core module ID".to_owned());
+    }
     Ok(ids)
 }
 
@@ -60,6 +79,19 @@ pub(crate) fn expected_module_ids(lib_src: &Path) -> Result<Vec<String>, String>
 ///
 /// Returns a message when the directory or a bundle's metadata cannot be read.
 pub(crate) fn scan_bundle_dir(dir: &Path) -> Result<Vec<(String, u64)>, String> {
+    scan(dir, true)
+}
+
+/// Scan development prebuilt bundles, ignoring legacy nonbundle output.
+///
+/// # Errors
+///
+/// Returns a message when the directory or a bundle's metadata cannot be read.
+pub(crate) fn scan_legacy_bundle_dir(dir: &Path) -> Result<Vec<(String, u64)>, String> {
+    scan(dir, false)
+}
+
+fn scan(dir: &Path, checked: bool) -> Result<Vec<(String, u64)>, String> {
     let entries = fs::read_dir(dir)
         .map_err(|err| format!("failed to read bundle directory {}: {err}", dir.display()))?;
     let mut found = Vec::new();
@@ -71,12 +103,21 @@ pub(crate) fn scan_bundle_dir(dir: &Path) -> Result<Vec<(String, u64)>, String>
             .strip_prefix("tsjs-")
             .and_then(|stem| stem.strip_suffix(".js"))
         else {
+            if checked {
+                return Err(format!("unexpected file in bundle directory: {file_name}"));
+            }
             continue;
         };
-        let len = entry
-            .metadata()
-            .map_err(|err| format!("failed to read metadata for {file_name}: {err}"))?
-            .len();
+        let metadata = if checked {
+            fs::symlink_metadata(entry.path())
+        } else {
+            fs::metadata(entry.path())
+        }
+        .map_err(|err| format!("failed to read metadata for {file_name}: {err}"))?;
+        if !safe_module_id(id) || !metadata.is_file() {
+            return Err(format!("unsafe or nonregular bundle: {file_name}"));
+        }
+        let len = metadata.len();
         found.push((id.to_owned(), len));
     }
     Ok(found)
@@ -106,6 +147,10 @@ pub(crate) fn check_bundle_set(expected: &[String], found: &[(String, u64)]) ->
     unexpected.sort_unstable();
 
     let mut problems = Vec::new();
+    let mut ids = std::collections::BTreeSet::new();
+    if found.iter().any(|(id, _)| !ids.insert(id)) {
+        problems.push("duplicate bundle IDs".to_owned());
+    }
     if !missing.is_empty() {
         problems.push(format!("missing bundles: {missing:?}"));
     }
@@ -138,6 +183,30 @@ mod tests {
             .collect()
     }
 
+    #[test]
+    fn module_identifiers_accept_only_safe_ascii() {
+        for id in ["core", "example_1", "example-2", "UPPER"] {
+            assert!(safe_module_id(id), "should accept safe ID {id}");
+        }
+        for id in ["", "../core", "has space", "quote\"", "é", "a/b", "a\\b"] {
+            assert!(!safe_module_id(id), "should reject unsafe ID {id:?}");
+        }
+    }
+
+    #[test]
+    fn rejects_duplicate_found_ids_including_core() {
+        for id in ["core", "gpt"] {
+            let mut entries = found(&[("core", 10), ("gpt", 20), ("prebid", 30)]);
+            entries.push((id.to_owned(), 10));
+            let error = check_bundle_set(&expected(), &entries)
+                .expect_err("should reject duplicate found ID");
+            assert!(
+                error.contains("duplicate bundle IDs"),
+                "should explain duplicate: {error}"
+            );
+        }
+    }
+
     fn found(entries: &[(&str, u64)]) -> Vec<(String, u64)> {
         entries
             .iter()
diff --git a/crates/trusted-server-js/build/inventory.rs b/crates/trusted-server-js/build/inventory.rs
new file mode 100644
index 0000000000..0b5b5ad587
--- /dev/null
+++ b/crates/trusted-server-js/build/inventory.rs
@@ -0,0 +1,337 @@
+//! Strict, bounded parsing of the prebuilt input inventory.
+//!
+//! Contribution, tool and material values are opaque here: composition joins
+//! belong to the release producer, rather than the Rust input consumer.
+
+use std::collections::BTreeSet;
+use std::fmt;
+#[cfg(not(unix))]
+use std::fs::File;
+#[cfg(unix)]
+use std::fs::OpenOptions;
+use std::io::{self, Read as _};
+#[cfg(unix)]
+use std::os::unix::fs::{MetadataExt as _, OpenOptionsExt as _};
+use std::path::Path;
+
+use serde::Deserialize;
+use serde::de::{DeserializeSeed, MapAccess, SeqAccess, Visitor};
+use serde_json::{Map, Number, Value};
+use sha2::{Digest as _, Sha256};
+
+use super::bundle_set::{bundle_file_name, check_bundle_set, safe_module_id};
+
+const MAX_INVENTORY: u64 = 1024 * 1024;
+// Release producers must enforce the same per-module input budget.
+pub(crate) const MAX_BUNDLE: u64 = 32 * 1024 * 1024;
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+pub(crate) struct Inventory {
+    schema_version: u64,
+    source_commit: String,
+    pub(crate) modules: Vec<Module>,
+    tools: Vec<Value>,
+    materials: Vec<Value>,
+}
+
+/// Parsed input and the digest of its exact bounded raw bytes.
+pub(crate) struct CheckedInventory {
+    pub(crate) inventory: Inventory,
+    pub(crate) raw_sha256: String,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+pub(crate) struct Module {
+    pub(crate) id: String,
+    pub(crate) filename: String,
+    pub(crate) size: u64,
+    pub(crate) sha256: String,
+    contributions: Vec<Value>,
+}
+
+pub(crate) fn invalid(message: impl fmt::Display) -> io::Error {
+    io::Error::new(io::ErrorKind::InvalidData, message.to_string())
+}
+
+pub(crate) fn read_inventory(
+    path: &Path,
+    expected: &[String],
+    source: Option<&str>,
+) -> io::Result<CheckedInventory> {
+    let leaf_path = path.components().collect::<std::path::PathBuf>();
+    #[cfg(unix)]
+    let file = OpenOptions::new()
+        .read(true)
+        .custom_flags(libc::O_NOFOLLOW | libc::O_CLOEXEC | libc::O_NONBLOCK)
+        .open(&leaf_path)
+        .map_err(|error| invalid(format!("cannot open inventory {}: {error}", path.display())))?;
+    #[cfg(not(unix))]
+    let file = File::open(&leaf_path)?;
+    let metadata = file.metadata()?;
+    if !metadata.is_file() {
+        return Err(invalid("inventory must be a regular file"));
+    }
+    #[cfg(unix)]
+    if metadata.nlink() != 1 {
+        return Err(invalid("inventory must have exactly one hard link"));
+    }
+    let mut bytes = Vec::new();
+    (&file).take(MAX_INVENTORY + 1).read_to_end(&mut bytes)?;
+    #[cfg(unix)]
+    {
+        let after = file.metadata()?;
+        if (
+            metadata.len(),
+            metadata.mtime(),
+            metadata.mtime_nsec(),
+            metadata.ctime(),
+            metadata.ctime_nsec(),
+            metadata.nlink(),
+        ) != (
+            after.len(),
+            after.mtime(),
+            after.mtime_nsec(),
+            after.ctime(),
+            after.ctime_nsec(),
+            after.nlink(),
+        ) {
+            return Err(invalid("inventory changed while reading"));
+        }
+    }
+    if bytes.len() as u64 > MAX_INVENTORY {
+        return Err(invalid("inventory exceeds 1 MiB"));
+    }
+    let text = std::str::from_utf8(&bytes).map_err(|_| invalid("inventory must be UTF-8"))?;
+    validate_numbers(text)?;
+    let mut parser = serde_json::Deserializer::from_str(text);
+    let value = StrictValue(0).deserialize(&mut parser).map_err(invalid)?;
+    parser.end().map_err(invalid)?;
+    let inventory: Inventory = serde_json::from_value(value).map_err(invalid)?;
+    if inventory.schema_version != 1
+        || !lower_hex(&inventory.source_commit, 40)
+        || source.is_some_and(|source| source != inventory.source_commit)
+    {
+        return Err(invalid("inventory schema version or source does not match"));
+    }
+    let mut previous: Option<&str> = None;
+    let mut filenames = BTreeSet::new();
+    for module in &inventory.modules {
+        if !safe_module_id(&module.id)
+            || module.filename != bundle_file_name(&module.id)
+            || !filenames.insert(&module.filename)
+            || previous.is_some_and(|id| id >= module.id.as_str())
+            || module.size == 0
+            || module.size > MAX_BUNDLE
+            || !lower_hex(&module.sha256, 64)
+        {
+            return Err(invalid(
+                "inventory module identity, order, size or digest is invalid",
+            ));
+        }
+        previous = Some(&module.id);
+    }
+    let found = inventory
+        .modules
+        .iter()
+        .map(|module| (module.id.clone(), module.size))
+        .collect::<Vec<_>>();
+    check_bundle_set(expected, &found).map_err(invalid)?;
+    // Required arrays were parsed strictly, but are not composition evidence.
+    let _ = (&inventory.tools, &inventory.materials);
+    for module in &inventory.modules {
+        let _ = &module.contributions;
+    }
+    Ok(CheckedInventory {
+        inventory,
+        raw_sha256: hex::encode(Sha256::digest(&bytes)),
+    })
+}
+
+fn lower_hex(value: &str, length: usize) -> bool {
+    value.len() == length
+        && value
+            .bytes()
+            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+}
+
+// serde_json normally converts overflowing integer literals into floats.
+// Reject those before parsing, including numbers in otherwise opaque values.
+fn validate_numbers(text: &str) -> io::Result<()> {
+    let bytes = text.as_bytes();
+    let mut index = 0;
+    while index < bytes.len() {
+        match bytes[index] {
+            b'"' => {
+                index += 1;
+                while index < bytes.len() && bytes[index] != b'"' {
+                    if bytes[index] == b'\\' {
+                        index += 1;
+                    }
+                    index += 1;
+                }
+            }
+            b'-' | b'0'..=b'9' => {
+                let start = index;
+                while index < bytes.len()
+                    && matches!(bytes[index], b'-' | b'+' | b'.' | b'e' | b'E' | b'0'..=b'9')
+                {
+                    index += 1;
+                }
+                let number = &text[start..index];
+                let value = number
+                    .parse::<f64>()
+                    .map_err(|_| invalid("invalid inventory number"))?;
+                if !value.is_finite() {
+                    return Err(invalid("inventory number overflows"));
+                }
+                if value.fract() == 0.0 && value.abs() > 9_007_199_254_740_991.0 {
+                    return Err(invalid("inventory contains an unsafe integer"));
+                }
+                if !number.contains(['.', 'e', 'E'])
+                    && ((number.starts_with('-') && number.parse::<i64>().is_err())
+                        || (!number.starts_with('-') && number.parse::<u64>().is_err()))
+                {
+                    return Err(invalid("inventory integer overflows"));
+                }
+                continue;
+            }
+            _ => {}
+        }
+        index += 1;
+    }
+    Ok(())
+}
+
+struct StrictValue(usize);
+
+impl<'de> DeserializeSeed<'de> for StrictValue {
+    type Value = Value;
+
+    fn deserialize<D: serde::Deserializer<'de>>(self, deserializer: D) -> Result<Value, D::Error> {
+        deserializer.deserialize_any(self)
+    }
+}
+
+impl<'de> Visitor<'de> for StrictValue {
+    type Value = Value;
+
+    fn expecting(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("strict JSON with unique keys and depth at most 64")
+    }
+
+    fn visit_bool<E: serde::de::Error>(self, value: bool) -> Result<Value, E> {
+        Ok(Value::Bool(value))
+    }
+    fn visit_unit<E: serde::de::Error>(self) -> Result<Value, E> {
+        Ok(Value::Null)
+    }
+    fn visit_str<E: serde::de::Error>(self, value: &str) -> Result<Value, E> {
+        Ok(Value::String(value.to_owned()))
+    }
+    fn visit_i64<E: serde::de::Error>(self, value: i64) -> Result<Value, E> {
+        Ok(Value::Number(Number::from(value)))
+    }
+    fn visit_u64<E: serde::de::Error>(self, value: u64) -> Result<Value, E> {
+        Ok(Value::Number(Number::from(value)))
+    }
+    fn visit_f64<E: serde::de::Error>(self, value: f64) -> Result<Value, E> {
+        Number::from_f64(value)
+            .map(Value::Number)
+            .ok_or_else(|| E::custom("nonfinite number"))
+    }
+
+    fn visit_seq<A: SeqAccess<'de>>(self, mut sequence: A) -> Result<Value, A::Error> {
+        if self.0 >= 64 {
+            return Err(serde::de::Error::custom("JSON depth exceeds 64"));
+        }
+        let mut values = Vec::new();
+        while let Some(value) = sequence.next_element_seed(StrictValue(self.0 + 1))? {
+            values.push(value);
+        }
+        Ok(Value::Array(values))
+    }
+
+    fn visit_map<A: MapAccess<'de>>(self, mut object: A) -> Result<Value, A::Error> {
+        if self.0 >= 64 {
+            return Err(serde::de::Error::custom("JSON depth exceeds 64"));
+        }
+        let mut values = Map::new();
+        while let Some(key) = object.next_key::<String>()? {
+            if values.contains_key(&key) {
+                return Err(serde::de::Error::custom("duplicate JSON key"));
+            }
+            let value = object.next_value_seed(StrictValue(self.0 + 1))?;
+            values.insert(key, value);
+        }
+        Ok(Value::Object(values))
+    }
+}
+
+#[cfg(all(test, unix))]
+mod tests {
+    use std::fs;
+    use std::os::unix::fs::symlink;
+
+    use serde_json::json;
+    use tempfile::tempdir;
+
+    use super::*;
+
+    #[test]
+    fn rejects_inventory_leaf_links_even_when_pointing_at_valid_bytes() {
+        let root = tempdir().expect("should create inventory fixture");
+        let real = root.path().join("real.json");
+        let link = root.path().join("inventory.json");
+        fs::write(
+            &real,
+            serde_json::to_vec(&json!({
+                "schema_version": 1, "source_commit": "a".repeat(40),
+                "modules": [], "tools": [], "materials": []
+            }))
+            .expect("should serialize inventory"),
+        )
+        .expect("should write inventory");
+        symlink(&real, &link).expect("should link inventory");
+
+        let result = read_inventory(&link, &[], None);
+
+        assert!(
+            result.is_err(),
+            "should reject links at the actual inventory read"
+        );
+    }
+
+    #[test]
+    fn declared_bundle_cap_is_enforced_by_inventory_parser() {
+        let root = tempdir().expect("should create inventory fixture");
+        let path = root.path().join("inventory.json");
+        const CONTRACT_LIMIT: u64 = 32 * 1024 * 1024;
+        for (size, accepted) in [(CONTRACT_LIMIT, true), (CONTRACT_LIMIT + 1, false)] {
+            fs::write(
+                &path,
+                serde_json::to_vec(&json!({
+                    "schema_version": 1, "source_commit": "a".repeat(40),
+                    "modules": [{"id": "core", "filename": "tsjs-core.js", "size": size,
+                        "sha256": "a".repeat(64), "contributions": []}],
+                    "tools": [], "materials": []
+                }))
+                .expect("should serialize inventory"),
+            )
+            .expect("should write inventory");
+            let result = read_inventory(&path, &["core".to_owned()], None);
+            if accepted {
+                assert!(result.is_ok(), "should accept exact declared bundle cap");
+            } else {
+                let error = result
+                    .err()
+                    .expect("should reject oversized declared bundle");
+                assert!(
+                    error.to_string().contains("size"),
+                    "should explain inventory size rejection: {error}"
+                );
+            }
+        }
+    }
+}
diff --git a/crates/trusted-server-js/build/prebuilt.rs b/crates/trusted-server-js/build/prebuilt.rs
new file mode 100644
index 0000000000..80cac5c6fd
--- /dev/null
+++ b/crates/trusted-server-js/build/prebuilt.rs
@@ -0,0 +1,299 @@
+//! Copy checked prebuilt inputs through held directory handles.
+//!
+//! Cargo owns `OUT_DIR` and its parents. Other processes able to write that
+//! private build directory are outside this input-validation trust boundary.
+//! Source parents may contain links; a held directory descriptor anchors all
+//! reads, and reopening the path after copying must resolve to the same inode.
+
+use std::collections::BTreeMap;
+use std::ffi::{CStr, CString};
+use std::fs::{self, File, OpenOptions};
+use std::io::{self, Read as _, Write as _};
+use std::os::fd::{AsRawFd as _, FromRawFd as _};
+use std::os::unix::ffi::OsStrExt as _;
+use std::os::unix::fs::{DirBuilderExt as _, MetadataExt as _, OpenOptionsExt as _};
+use std::path::Path;
+
+use sha2::{Digest as _, Sha256};
+
+use super::bundle_set::{bundle_file_name, check_bundle_set, safe_module_id};
+use super::inventory::{Inventory, MAX_BUNDLE, invalid};
+
+#[derive(Debug, Eq, PartialEq)]
+struct Identity {
+    device: u64,
+    inode: u64,
+    size: u64,
+    modified: (i64, i64),
+    changed: (i64, i64),
+    links: u64,
+}
+
+fn identity(file: &File) -> io::Result<Identity> {
+    let metadata = file.metadata()?;
+    Ok(Identity {
+        device: metadata.dev(),
+        inode: metadata.ino(),
+        size: metadata.len(),
+        modified: (metadata.mtime(), metadata.mtime_nsec()),
+        changed: (metadata.ctime(), metadata.ctime_nsec()),
+        links: metadata.nlink(),
+    })
+}
+
+fn open_directory(path: &Path) -> io::Result<File> {
+    // Components remove trailing separators and '.' without following links.
+    let leaf_path = path.components().collect::<std::path::PathBuf>();
+    OpenOptions::new()
+        .read(true)
+        .custom_flags(libc::O_DIRECTORY | libc::O_NOFOLLOW | libc::O_CLOEXEC)
+        .open(&leaf_path)
+        .map_err(|error| invalid(format!("cannot open directory {}: {error}", path.display())))
+}
+
+fn open_file(directory: &File, name: &str) -> io::Result<File> {
+    let name = CString::new(name).map_err(|_| invalid("unsafe bundle filename"))?;
+    // SAFETY: the descriptor and C string remain alive for the syscall; a
+    // successful descriptor is immediately transferred into an owning File.
+    let descriptor = unsafe {
+        libc::openat(
+            directory.as_raw_fd(),
+            name.as_ptr(),
+            libc::O_RDONLY | libc::O_NOFOLLOW | libc::O_CLOEXEC | libc::O_NONBLOCK,
+        )
+    };
+    if descriptor < 0 {
+        return Err(invalid(format!(
+            "cannot open bundle {name:?}: {}",
+            io::Error::last_os_error()
+        )));
+    }
+    // SAFETY: openat returned a fresh descriptor owned solely by this File.
+    let file = unsafe { File::from_raw_fd(descriptor) };
+    let metadata = file.metadata()?;
+    if !metadata.is_file() || metadata.nlink() != 1 {
+        return Err(invalid(format!(
+            "bundle {name:?} must be a regular file with exactly one hard link"
+        )));
+    }
+    Ok(file)
+}
+
+struct DirectoryStream(*mut libc::DIR);
+
+impl Drop for DirectoryStream {
+    fn drop(&mut self) {
+        // SAFETY: this stream owns the successful fdopendir result.
+        unsafe {
+            libc::closedir(self.0);
+        }
+    }
+}
+
+fn names(directory: &File, maximum: usize) -> io::Result<Vec<String>> {
+    // Opening '.' creates a separate enumeration offset for every scan.
+    let dot = c".";
+    // SAFETY: the descriptor and static C string are valid for this syscall.
+    let descriptor = unsafe {
+        libc::openat(
+            directory.as_raw_fd(),
+            dot.as_ptr(),
+            libc::O_RDONLY | libc::O_DIRECTORY | libc::O_CLOEXEC,
+        )
+    };
+    if descriptor < 0 {
+        return Err(io::Error::last_os_error());
+    }
+    // SAFETY: descriptor is fresh; ownership passes to the stream on success.
+    let stream = unsafe { libc::fdopendir(descriptor) };
+    if stream.is_null() {
+        let error = io::Error::last_os_error();
+        // SAFETY: fdopendir failed and did not take ownership.
+        unsafe {
+            libc::close(descriptor);
+        }
+        return Err(error);
+    }
+    let stream = DirectoryStream(stream);
+    let mut result = Vec::new();
+    loop {
+        clear_errno();
+        // SAFETY: the stream is owned, live, and used on this thread only.
+        let entry = unsafe { libc::readdir(stream.0) };
+        if entry.is_null() {
+            let error = io::Error::last_os_error();
+            if error.raw_os_error() != Some(0) {
+                return Err(error);
+            }
+            break;
+        }
+        // SAFETY: readdir supplies a NUL-terminated name valid until next call.
+        let name = unsafe { CStr::from_ptr((*entry).d_name.as_ptr()) };
+        let name = name
+            .to_str()
+            .map_err(|_| invalid("bundle filename must be UTF-8"))?;
+        if name != "." && name != ".." {
+            if result.len() >= maximum {
+                return Err(invalid(format!(
+                    "unexpected extra bundle directory entry: {name}"
+                )));
+            }
+            result.push(name.to_owned());
+        }
+    }
+    result.sort();
+    Ok(result)
+}
+
+fn clear_errno() {
+    // SAFETY: these functions return the current thread's errno storage.
+    #[cfg(target_os = "macos")]
+    unsafe {
+        *libc::__error() = 0;
+    }
+    #[cfg(target_os = "linux")]
+    unsafe {
+        *libc::__errno_location() = 0;
+    }
+}
+
+fn snapshot(directory: &File, expected: &[String]) -> io::Result<BTreeMap<String, Identity>> {
+    let mut snapshot = BTreeMap::new();
+    let mut found = Vec::new();
+    for name in names(directory, expected.len())? {
+        let id = name
+            .strip_prefix("tsjs-")
+            .and_then(|stem| stem.strip_suffix(".js"))
+            .filter(|id| safe_module_id(id))
+            .ok_or_else(|| invalid(format!("unexpected or unsafe bundle filename: {name}")))?;
+        let file = open_file(directory, &name)?;
+        let identity = identity(&file)?;
+        found.push((id.to_owned(), identity.size));
+        snapshot.insert(name, identity);
+    }
+    check_bundle_set(expected, &found).map_err(invalid)?;
+    Ok(snapshot)
+}
+
+fn prepare_private(path: &Path) -> io::Result<()> {
+    match fs::symlink_metadata(path) {
+        Ok(metadata) if metadata.is_dir() => fs::remove_dir_all(path)?,
+        Ok(_) => {
+            return Err(invalid(
+                "private bundle destination must be a directory, never a link",
+            ));
+        }
+        Err(error) if error.kind() == io::ErrorKind::NotFound => {}
+        Err(error) => return Err(error),
+    }
+    fs::DirBuilder::new().mode(0o700).create(path)
+}
+
+fn copy_one(source: &mut File, destination: &Path, size: u64) -> io::Result<String> {
+    let mut target = OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .mode(0o600)
+        .open(destination)?;
+    let mut hasher = Sha256::new();
+    let mut reader = source.take(size + 1);
+    let mut buffer = [0; 64 * 1024];
+    let mut length = 0u64;
+    loop {
+        let count = reader.read(&mut buffer)?;
+        if count == 0 {
+            break;
+        }
+        length += count as u64;
+        if length > size {
+            return Err(invalid("inventory bundle size mismatch during copy"));
+        }
+        hasher.update(&buffer[..count]);
+        target.write_all(&buffer[..count])?;
+    }
+    if length != size {
+        return Err(invalid("inventory bundle size mismatch during copy"));
+    }
+    target.flush()?;
+    Ok(hex::encode(hasher.finalize()))
+}
+
+pub(crate) fn copy_checked(
+    expected: &[String],
+    source_path: &Path,
+    destination: &Path,
+    inventory: &Inventory,
+    mut hook: impl FnMut(&Path, &Path),
+) -> io::Result<()> {
+    let source = open_directory(source_path)?;
+    let source_identity = identity(&source)?;
+    let before = snapshot(&source, expected)?;
+    prepare_private(destination)?;
+    let mut digests = BTreeMap::new();
+    for id in expected {
+        let name = bundle_file_name(id);
+        let mut file = open_file(&source, &name)?;
+        if before.get(&name) != Some(&identity(&file)?) {
+            return Err(invalid("source bundle identity changed before copy"));
+        }
+        let module = inventory
+            .modules
+            .iter()
+            .find(|module| module.id == *id)
+            .ok_or_else(|| invalid(format!("inventory missing bundle {name}")))?;
+        let size = module.size;
+        if size > MAX_BUNDLE {
+            return Err(invalid("bundle exceeds 32 MiB"));
+        }
+        let digest = copy_one(&mut file, &destination.join(&name), size)?;
+        if module.sha256 != digest {
+            return Err(invalid(format!("inventory bundle digest mismatch: {name}")));
+        }
+        if before.get(&name) != Some(&identity(&file)?) {
+            return Err(invalid("source bundle changed during copy"));
+        }
+        digests.insert(name, (size, digest));
+    }
+    // Crate-private deterministic race injection; production supplies a no-op.
+    hook(source_path, destination);
+    if snapshot(&source, expected)? != before
+        || identity(&source)? != source_identity
+        || identity(&open_directory(source_path)?)? != source_identity
+    {
+        return Err(invalid(
+            "source directory or bundle identity changed during copy",
+        ));
+    }
+    let private = open_directory(destination)?;
+    snapshot(&private, expected)?;
+    for (name, (size, digest)) in digests {
+        let mut file = open_file(&private, &name)?;
+        let mut bytes = Vec::new();
+        (&mut file).take(size + 1).read_to_end(&mut bytes)?;
+        if bytes.len() as u64 != size || hex::encode(Sha256::digest(&bytes)) != digest {
+            return Err(invalid(
+                "private copied bundle does not match inventory input bytes",
+            ));
+        }
+    }
+    Ok(())
+}
+
+pub(crate) fn inventory_outside(source: &Path, inventory: &Path) -> io::Result<()> {
+    // Comparing canonical paths prevents aliases from placing metadata inside
+    // the exact bundle-only directory. The bytes are read separately once.
+    if inventory
+        .canonicalize()?
+        .starts_with(source.canonicalize()?)
+    {
+        return Err(invalid(
+            "inventory must be outside the exact bundle directory",
+        ));
+    }
+    // Reject a link at the inventory leaf as well as nonregular metadata.
+    let metadata = fs::symlink_metadata(inventory)?;
+    if !metadata.is_file() || metadata.nlink() != 1 || inventory.as_os_str().as_bytes().is_empty() {
+        return Err(invalid("inventory must be a regular single-link file"));
+    }
+    Ok(())
+}
diff --git a/crates/trusted-server-js/lib/.gitignore b/crates/trusted-server-js/lib/.gitignore
index 56c5a23dd6..faf0d13fbd 100644
--- a/crates/trusted-server-js/lib/.gitignore
+++ b/crates/trusted-server-js/lib/.gitignore
@@ -4,3 +4,4 @@ src/integrations/prebid/.external-generated-*
 
 # Serializes `npm ci` across concurrent cargo build scripts
 .tsjs-npm-ci.lock
+.release-test-*/
diff --git a/crates/trusted-server-js/lib/.prettierignore b/crates/trusted-server-js/lib/.prettierignore
index 72274829b1..27cbce6205 100644
--- a/crates/trusted-server-js/lib/.prettierignore
+++ b/crates/trusted-server-js/lib/.prettierignore
@@ -1,4 +1,5 @@
 node_modules
 dist
 coverage
+.release-test-*/
 
diff --git a/crates/trusted-server-js/lib/build-all.mjs b/crates/trusted-server-js/lib/build-all.mjs
index 24f842e764..e6f341a810 100644
--- a/crates/trusted-server-js/lib/build-all.mjs
+++ b/crates/trusted-server-js/lib/build-all.mjs
@@ -20,15 +20,12 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import { build } from 'vite';
 
 import { moduleBuildOptions } from './build-module-options.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const srcDir = path.resolve(__dirname, 'src');
-const distDir = resolveOutDir(process.argv.slice(2));
-const integrationsDir = path.join(srcDir, 'integrations');
 
 /** Resolve `--out-dir <dir>` (relative to the cwd), defaulting to ../dist. */
 function resolveOutDir(args) {
@@ -43,52 +40,82 @@ function resolveOutDir(args) {
   return path.resolve(value);
 }
 
-// Remove only the bundles this script writes, so a wrong --out-dir cannot
-// delete unrelated files.
-fs.mkdirSync(distDir, { recursive: true });
-for (const name of fs.readdirSync(distDir)) {
-  if (name.startsWith('tsjs-') && name.endsWith('.js')) {
-    fs.rmSync(path.join(distDir, name));
+/** Build the discovered modules; recording is opt-in and cannot change bundle bytes. */
+export async function buildAll({
+  outDir,
+  composition,
+  sourceDir = path.resolve(__dirname, 'src'),
+}) {
+  const srcDir = sourceDir;
+  const distDir = path.resolve(outDir);
+  const integrationsDir = path.join(srcDir, 'integrations');
+  const records = [];
+
+  // Remove only the bundles this script writes, so a wrong --out-dir cannot
+  // delete unrelated files.
+  fs.mkdirSync(distDir, { recursive: true });
+  for (const name of fs.readdirSync(distDir)) {
+    if (name.startsWith('tsjs-') && name.endsWith('.js')) {
+      fs.rmSync(path.join(distDir, name));
+    }
   }
-}
 
-// Discover integration modules: directories in src/integrations/ with index.ts
-const integrationModules = fs.existsSync(integrationsDir)
-  ? fs
-      .readdirSync(integrationsDir)
-      .filter((name) => {
-        const fullPath = path.join(integrationsDir, name);
-        return (
-          fs.statSync(fullPath).isDirectory() && fs.existsSync(path.join(fullPath, 'index.ts'))
-        );
-      })
-      .sort()
-  : [];
-
-console.log('[build-all] Discovered integrations:', integrationModules);
-
-/** Build a single module as a self-contained IIFE. */
-async function buildModule(name, entryPath) {
-  const outFile = `tsjs-${name}.js`;
-  console.log(`[build-all] Building ${outFile} from ${path.relative(__dirname, entryPath)}`);
-
-  await build(moduleBuildOptions({ name, entryPath, outDir: distDir }));
-
-  console.log(`[build-all] Built ${outFile}`);
-}
+  // Discover integration modules: directories in src/integrations/ with index.ts
+  const integrationModules = fs.existsSync(integrationsDir)
+    ? fs
+        .readdirSync(integrationsDir)
+        .filter((name) => {
+          const fullPath = path.join(integrationsDir, name);
+          return (
+            fs.statSync(fullPath).isDirectory() && fs.existsSync(path.join(fullPath, 'index.ts'))
+          );
+        })
+        .sort()
+    : [];
+
+  console.log('[build-all] Discovered integrations:', integrationModules);
+
+  /** Build a single module as a self-contained IIFE. */
+  async function buildModule(name, entryPath) {
+    const outFile = `tsjs-${name}.js`;
+    console.log(`[build-all] Building ${outFile} from ${path.relative(__dirname, entryPath)}`);
+
+    let contributions;
+    const recording = composition
+      ? {
+          ...composition,
+          onContributions: (rows) => {
+            contributions = rows;
+          },
+        }
+      : undefined;
+    await build(moduleBuildOptions({ name, entryPath, outDir: distDir, composition: recording }));
+    records.push({ id: name, filename: outFile, contributions });
 
-// Build core first (synchronously), then all integrations in parallel
-await buildModule('core', path.join(srcDir, 'core', 'index.ts'));
+    console.log(`[build-all] Built ${outFile}`);
+  }
+
+  // Build core first (synchronously), then all integrations in parallel
+  await buildModule('core', path.join(srcDir, 'core', 'index.ts'));
+
+  await Promise.all(
+    integrationModules.map((name) =>
+      buildModule(name, path.join(integrationsDir, name, 'index.ts'))
+    )
+  );
 
-await Promise.all(
-  integrationModules.map((name) => buildModule(name, path.join(integrationsDir, name, 'index.ts')))
-);
+  // List all built files
+  const builtFiles = fs
+    .readdirSync(distDir)
+    .filter((f) => f.startsWith('tsjs-') && f.endsWith('.js'))
+    .sort();
 
-// List all built files
-const builtFiles = fs
-  .readdirSync(distDir)
-  .filter((f) => f.startsWith('tsjs-') && f.endsWith('.js'))
-  .sort();
+  console.log('[build-all] Built files:', builtFiles);
+  console.log(`[build-all] Total: ${builtFiles.length} modules`);
 
-console.log('[build-all] Built files:', builtFiles);
-console.log(`[build-all] Total: ${builtFiles.length} modules`);
+  return records.sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(fs.realpathSync(process.argv[1])).href) {
+  await buildAll({ outDir: resolveOutDir(process.argv.slice(2)) });
+}
diff --git a/crates/trusted-server-js/lib/build-module-options.mjs b/crates/trusted-server-js/lib/build-module-options.mjs
index 64b78a3fb7..be8b667871 100644
--- a/crates/trusted-server-js/lib/build-module-options.mjs
+++ b/crates/trusted-server-js/lib/build-module-options.mjs
@@ -1,12 +1,17 @@
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
+import { compositionPlugin, releaseBuild } from './release-composition.mjs';
+
 const libDir = path.dirname(fileURLToPath(import.meta.url));
 
 /** Production Vite options for one independently bundled tsjs IIFE. */
-export function moduleBuildOptions({ name, entryPath, outDir }) {
+export function moduleBuildOptions({ name, entryPath, outDir, composition }) {
+  const release = releaseBuild();
   return {
     configFile: false,
+    ...(release ? { mode: 'production', envDir: false } : {}),
+    ...(composition ? { plugins: [compositionPlugin({ name, ...composition })] } : {}),
     root: libDir,
     build: {
       emptyOutDir: false,
diff --git a/crates/trusted-server-js/lib/eslint.config.js b/crates/trusted-server-js/lib/eslint.config.js
index 2720ba3a04..725a5b6816 100644
--- a/crates/trusted-server-js/lib/eslint.config.js
+++ b/crates/trusted-server-js/lib/eslint.config.js
@@ -9,7 +9,7 @@ import unicorn from 'eslint-plugin-unicorn';
 export default [
   // Files/folders to ignore
   {
-    ignores: ['node_modules', 'dist', 'coverage'],
+    ignores: ['node_modules', 'dist', 'coverage', '.release-test-*/'],
   },
   // Base JS recommended
   js.configs.recommended,
diff --git a/crates/trusted-server-js/lib/package.json b/crates/trusted-server-js/lib/package.json
index 427fef1e1f..c34b9f80d6 100644
--- a/crates/trusted-server-js/lib/package.json
+++ b/crates/trusted-server-js/lib/package.json
@@ -12,8 +12,8 @@
     "test:watch": "vitest",
     "lint": "eslint . --max-warnings=0",
     "lint:fix": "eslint --fix . --max-warnings=0",
-    "format": "prettier --check \"**/*.{ts,tsx,js,json,css,md}\"",
-    "format:write": "prettier --write \"**/*.{ts,tsx,js,json,css,md}\""
+    "format": "prettier --check \"**/*.{ts,tsx,js,mjs,json,css,md}\"",
+    "format:write": "prettier --write \"**/*.{ts,tsx,js,mjs,json,css,md}\""
   },
   "dependencies": {
     "prebid.js": "^10.26.0"
diff --git a/crates/trusted-server-js/lib/release-composition.mjs b/crates/trusted-server-js/lib/release-composition.mjs
new file mode 100644
index 0000000000..7af052b226
--- /dev/null
+++ b/crates/trusted-server-js/lib/release-composition.mjs
@@ -0,0 +1,661 @@
+/** Conservative Rollup evidence; rendered modules can lose more code in esbuild. */
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+
+export const sha256 = (bytes) => crypto.createHash('sha256').update(bytes).digest('hex');
+const compare = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+const relative = (root, file) => path.relative(root, file).split(path.sep).join('/');
+const inside = (root, file) => file === root || file.startsWith(`${root}${path.sep}`);
+const MAX_JSON = 1024 * 1024;
+
+/** Parse bounded UTF-8 JSON without duplicate keys or non-finite numbers. */
+export function strictJson(bytes) {
+  if (bytes.length > MAX_JSON) throw new Error('JSON exceeds 1 MiB');
+  const text = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(bytes);
+  let offset = 0;
+  const space = () => {
+    while (/[\t\n\r ]/.test(text[offset] ?? '\0')) offset++;
+  };
+  const string = () => {
+    const start = offset++;
+    while (offset < text.length) {
+      const character = text[offset++];
+      if (character === '\\') offset++;
+      else if (character === '"') {
+        const parsed = JSON.parse(text.slice(start, offset));
+        if (/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/u.test(parsed))
+          throw new Error('Unpaired JSON surrogate');
+        return parsed;
+      }
+    }
+    throw new Error('Unterminated JSON string');
+  };
+  const value = (depth) => {
+    if (depth > 64) throw new Error('JSON nesting exceeds 64');
+    space();
+    const character = text[offset];
+    if (character === '"') return string();
+    if (character === '{' || character === '[') {
+      if (depth >= 64) throw new Error('JSON nesting exceeds 64');
+      offset++;
+      const object = character === '{';
+      const result = object ? Object.create(null) : [];
+      const end = object ? '}' : ']';
+      space();
+      if (text[offset] === end) {
+        offset++;
+        return result;
+      }
+      for (;;) {
+        space();
+        let key;
+        if (object) {
+          if (text[offset] !== '"') throw new Error('Expected JSON key');
+          key = string();
+          if (Object.hasOwn(result, key)) throw new Error(`Duplicate JSON key: ${key}`);
+          space();
+          if (text[offset++] !== ':') throw new Error('Expected JSON colon');
+        }
+        const parsed = value(depth + 1);
+        if (object) result[key] = parsed;
+        else result.push(parsed);
+        space();
+        const delimiter = text[offset++];
+        if (delimiter === end) return result;
+        if (delimiter !== ',') throw new Error('Expected JSON delimiter');
+      }
+    }
+    const token = /^(?:true|false|null|-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?)/.exec(
+      text.slice(offset)
+    )?.[0];
+    if (!token) throw new Error('Invalid JSON value');
+    offset += token.length;
+    const parsed = JSON.parse(token);
+    if (
+      typeof parsed === 'number' &&
+      (!Number.isFinite(parsed) || (Number.isInteger(parsed) && !Number.isSafeInteger(parsed)))
+    )
+      throw new Error('Non-finite JSON number');
+    return parsed;
+  };
+  const result = value(0);
+  space();
+  if (offset !== text.length) throw new Error('Trailing JSON data');
+  return result;
+}
+
+/** Derive release settings from the existing build control only. */
+export function releaseBuild(env = process.env) {
+  if (!Object.hasOwn(env, 'TRUSTED_SERVER__RELEASE_BUILD')) return false;
+  if (Object.hasOwn(env, 'TSJS_SKIP_BUILD')) throw new Error('TSJS_SKIP_BUILD is forbidden');
+  if (env.TRUSTED_SERVER__RELEASE_BUILD !== '1')
+    throw new Error('Release build control must be exactly 1');
+  if (!/^[a-f0-9]{40}$/.test(env.TRUSTED_SERVER__GIT_VERSION ?? ''))
+    throw new Error('Release requires full source commit');
+  return true;
+}
+
+/** Join real installed locations to exact package-lock package identities. */
+export function installedOrigins({ repoRoot, lockFile, installRoot = path.dirname(lockFile) }) {
+  repoRoot = fs.realpathSync(repoRoot);
+  installRoot = fs.realpathSync(installRoot);
+  const lock = strictJson(readBounded(lockFile));
+  if (
+    lock.lockfileVersion !== 3 ||
+    !lock.packages ||
+    typeof lock.packages !== 'object' ||
+    Array.isArray(lock.packages)
+  )
+    throw new Error('Expected package-lock v3 packages');
+  const packages = new Map();
+  const realRoots = new Map();
+  for (const [lockPath, record] of Object.entries(lock.packages)) {
+    if (lockPath === '') continue;
+    if (
+      !/^(?:node_modules\/(?:@[a-zA-Z0-9._-]+\/)?[a-zA-Z0-9._-]+)(?:\/node_modules\/(?:@[a-zA-Z0-9._-]+\/)?[a-zA-Z0-9._-]+)*$/.test(
+        lockPath
+      )
+    )
+      throw new Error(`Unknown lock source: ${lockPath}`);
+    const root = path.join(installRoot, lockPath);
+    if (!fs.existsSync(root)) continue;
+    const real = fs.realpathSync(root);
+    if (real !== root || !inside(repoRoot, real))
+      throw new Error(`Installed package symlink escape or alias: ${lockPath}`);
+    if (realRoots.has(real)) throw new Error(`Duplicate installed identity: ${lockPath}`);
+    realRoots.set(real, lockPath);
+    packages.set(lockPath, { root, record });
+  }
+  function packageIdentity(lockPath) {
+    const installed = packages.get(lockPath);
+    if (!installed) throw new Error(`Missing installed package: ${lockPath}`);
+    const { root, record } = installed;
+    if (Object.hasOwn(record, 'link') || typeof record.resolved !== 'string')
+      throw new Error(`Unsupported lock archive source: ${lockPath}`);
+    let archive;
+    try {
+      archive = new URL(record.resolved);
+    } catch {
+      throw new Error(`Unsupported lock archive source: ${lockPath}`);
+    }
+    if (
+      archive.protocol !== 'https:' ||
+      archive.hostname !== 'registry.npmjs.org' ||
+      archive.port ||
+      archive.username ||
+      archive.password ||
+      archive.search ||
+      archive.hash ||
+      archive.href !== record.resolved ||
+      !archive.pathname.endsWith('.tgz')
+    )
+      throw new Error(`Unsupported lock archive source: ${lockPath}`);
+    const manifest = strictJson(readBounded(path.join(root, 'package.json')));
+    const name = lockPath.slice(lockPath.lastIndexOf('node_modules/') + 'node_modules/'.length);
+    if (manifest.name !== name || (record.name && record.name !== name))
+      throw new Error(`Package name mismatch: ${lockPath}`);
+    if (!record.version || manifest.version !== record.version)
+      throw new Error(`Package version mismatch: ${lockPath}`);
+    if (!/^sha512-[A-Za-z0-9+/]{86}==$/.test(record.integrity ?? ''))
+      throw new Error(`Missing or unsupported package integrity: ${lockPath}`);
+    return {
+      kind: 'npm',
+      lock_path: lockPath,
+      package_name: name,
+      package_version: manifest.version,
+      integrity: record.integrity,
+    };
+  }
+  function origin(id) {
+    const [file, ...queries] = id.split('?');
+    const transform =
+      queries.length === 0
+        ? 'identity'
+        : queries.length === 1 && ['raw', 'inline'].includes(queries[0])
+          ? queries[0]
+          : null;
+    if (!transform) throw new Error(`Unknown module query: ${id}`);
+    if (!path.isAbsolute(file)) throw new Error(`Unknown module source: ${id}`);
+    const real = fs.realpathSync(file);
+    if (!inside(repoRoot, real)) throw new Error(`Source symlink escape: ${id}`);
+    const bytes = readBounded(real, 32 * 1024 * 1024);
+    if (bytes.length > 32 * 1024 * 1024) throw new Error('Source exceeds 32 MiB');
+    let directory = path.dirname(real);
+    while (inside(installRoot, directory)) {
+      const lockPath = relative(installRoot, directory);
+      if (packages.has(lockPath)) {
+        if (!inside(directory, real)) throw new Error(`Package source symlink escape: ${id}`);
+        return {
+          ...packageIdentity(lockPath),
+          path: relative(directory, real),
+          transform,
+          sha256: sha256(bytes),
+        };
+      }
+      if (
+        fs.existsSync(path.join(directory, 'package.json')) &&
+        /(?:^|\/)node_modules\/(?:@[^/]+\/)?[^/]+$/.test(lockPath)
+      )
+        throw new Error(`Unmapped installed ownership: ${id}`);
+      if (directory === installRoot) break;
+      directory = path.dirname(directory);
+    }
+    if (relative(repoRoot, real).split('/').includes('node_modules'))
+      throw new Error(`Unmapped installed ownership: ${id}`);
+    return { kind: 'source', path: relative(repoRoot, real), transform, sha256: sha256(bytes) };
+  }
+  return { repoRoot, installRoot, packages, packageIdentity, origin };
+}
+
+/** Observe exactly one IIFE's rendered modules without altering emitted output. */
+export function compositionPlugin({ name, owners: checkedOwners, ...settings }) {
+  const owners = checkedOwners ?? installedOrigins(settings);
+  return {
+    name: 'trusted-server-release-composition',
+    generateBundle(options, bundle) {
+      const outputs = Object.values(bundle);
+      if (
+        options.format !== 'iife' ||
+        outputs.length !== 1 ||
+        outputs[0].type !== 'chunk' ||
+        !outputs[0].isEntry ||
+        outputs[0].fileName !== `tsjs-${name}.js`
+      )
+        throw new Error('Expected exactly one IIFE chunk with no assets');
+      const contributions = [];
+      for (const [id, rendered] of Object.entries(outputs[0].modules)) {
+        if (rendered.renderedLength === 0) continue;
+        let contribution;
+        if (!id.startsWith('\0')) contribution = owners.origin(id);
+        else {
+          let plugin;
+          let input;
+          let stableId = id;
+          if (id === '\0commonjsHelpers.js') plugin = 'commonjs';
+          else if (id.startsWith('\0') && id.endsWith('?commonjs-es-import')) {
+            plugin = 'commonjs';
+            input = owners.origin(id.slice(1, -'?commonjs-es-import'.length));
+            stableId = `\0${input.kind === 'npm' ? `${input.lock_path}/` : ''}${input.path}?commonjs-es-import`;
+          } else if (id === '\0vite/preload-helper.js') plugin = 'vite:build-import-analysis';
+          else throw new Error(`Unknown virtual producer: ${id}`);
+          owners.packageIdentity('node_modules/vite');
+          const code = this.getModuleInfo(id)?.code;
+          if (typeof code !== 'string') throw new Error(`Missing generated code: ${id}`);
+          contribution = {
+            kind: 'generated',
+            id: stableId,
+            plugin,
+            owner_lock_path: 'node_modules/vite',
+            generated_sha256: sha256(code),
+            ...(input ? { input } : {}),
+          };
+        }
+        contributions.push({
+          ...contribution,
+          stage: 'rollup-rendered',
+          rendered_length: rendered.renderedLength,
+        });
+      }
+      contributions.sort((a, b) => compare(JSON.stringify(a), JSON.stringify(b)));
+      settings.onContributions(contributions);
+    },
+  };
+}
+
+function stableFile(file, consume) {
+  const descriptor = fs.openSync(
+    file,
+    fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK
+  );
+  try {
+    const before = fs.fstatSync(descriptor);
+    if (!before.isFile()) throw new Error(`Expected regular file: ${file}`);
+    const result = consume(descriptor, before.size, before.mode);
+    const after = fs.fstatSync(descriptor);
+    const current = fs.lstatSync(file);
+    if (
+      before.dev !== current.dev ||
+      before.ino !== current.ino ||
+      before.size !== after.size ||
+      before.size !== current.size ||
+      before.mode !== after.mode ||
+      before.mode !== current.mode ||
+      before.mtimeMs !== after.mtimeMs ||
+      before.mtimeMs !== current.mtimeMs ||
+      before.ctimeMs !== after.ctimeMs ||
+      before.ctimeMs !== current.ctimeMs
+    )
+      throw new Error(`File changed while measured: ${file}`);
+    return result;
+  } finally {
+    fs.closeSync(descriptor);
+  }
+}
+
+/** Read at most the specified input budget through a held regular-file descriptor. */
+export function readBounded(file, maximum = MAX_JSON) {
+  return stableFile(file, (descriptor, size) => {
+    if (size > maximum) throw new Error(`File exceeds size budget: ${file}`);
+    const bytes = Buffer.alloc(size + 1);
+    let count = 0;
+    while (count < bytes.length) {
+      const read = fs.readSync(descriptor, bytes, count, bytes.length - count, null);
+      if (!read) break;
+      count += read;
+    }
+    if (count !== size) throw new Error(`File changed or exceeds size budget: ${file}`);
+    return bytes.subarray(0, count);
+  });
+}
+
+/** Hash file bytes with fixed-size buffers, preserving the held-file identity. */
+export function fileDigest(file) {
+  return stableFile(file, (descriptor, size) => {
+    const digest = crypto.createHash('sha256');
+    const buffer = Buffer.alloc(64 * 1024);
+    let count = 0;
+    for (;;) {
+      const read = fs.readSync(descriptor, buffer, 0, buffer.length, null);
+      if (!read) break;
+      count += read;
+      if (count > size) throw new Error(`File grew while measured: ${file}`);
+      digest.update(buffer.subarray(0, read));
+    }
+    if (count !== size) throw new Error(`File changed while measured: ${file}`);
+    return digest.digest('hex');
+  });
+}
+
+/** Hash sorted relative paths, types, lengths, bytes and normalized executable modes. */
+export function installedTreeHash(root, excludedRoots = new Set()) {
+  const digest = crypto.createHash('sha256');
+  digest.update('trusted-server-installed-tree-v1\n');
+  function visit(directory) {
+    for (const name of fs.readdirSync(directory).sort(compare)) {
+      const file = path.join(directory, name);
+      if (excludedRoots.has(file)) continue;
+      const stat = fs.lstatSync(file);
+      const filename = relative(root, file);
+      if (stat.isDirectory()) {
+        digest.update(`${JSON.stringify([filename, 'directory'])}\n`);
+        visit(file);
+      } else if (stat.isFile()) {
+        stableFile(file, (descriptor, size, mode) => {
+          digest.update(`${JSON.stringify([filename, 'file', size, Boolean(mode & 0o111)])}\n`);
+          const buffer = Buffer.alloc(64 * 1024);
+          let count = 0;
+          for (;;) {
+            const read = fs.readSync(descriptor, buffer, 0, buffer.length, null);
+            if (!read) break;
+            count += read;
+            if (count > size) throw new Error(`Tree file grew: ${file}`);
+            digest.update(buffer.subarray(0, read));
+          }
+          if (count !== size || size !== stat.size) throw new Error(`Tree file changed: ${file}`);
+        });
+        digest.update('\n');
+      } else if (stat.isSymbolicLink()) {
+        const target = fs.readlinkSync(file);
+        if (path.isAbsolute(target) || !inside(root, fs.realpathSync(file)))
+          throw new Error(`Installed tree symlink escape: ${file}`);
+        digest.update(`${JSON.stringify([filename, 'symlink', target])}\n`);
+      } else throw new Error(`Unsupported installed tree entry: ${file}`);
+    }
+  }
+  visit(root);
+  return digest.digest('hex');
+}
+
+/** Measure installed packages independently of their lockfile archive integrity. */
+export function installedMaterials(owners) {
+  const excluded = new Set([...owners.packages.values()].map(({ root }) => root));
+  return [...owners.packages.keys()].sort(compare).map((lockPath) => {
+    const identity = owners.packageIdentity(lockPath);
+    return {
+      kind: 'npm-package',
+      id: `npm:${lockPath}`,
+      lock_path: lockPath,
+      name: identity.package_name,
+      version: identity.package_version,
+      integrity: identity.integrity,
+      installed_tree_sha256: installedTreeHash(owners.packages.get(lockPath).root, excluded),
+    };
+  });
+}
+
+const hashPattern = /^[a-f0-9]{64}$/;
+function fields(record, keys) {
+  if (
+    !record ||
+    typeof record !== 'object' ||
+    Array.isArray(record) ||
+    Object.keys(record).sort().join(',') !== [...keys].sort().join(',')
+  )
+    throw new Error('Unexpected preparation fields');
+}
+function digest(value) {
+  if (typeof value !== 'string' || !hashPattern.test(value))
+    throw new Error('Invalid preparation digest');
+}
+function safePath(value) {
+  if (
+    typeof value !== 'string' ||
+    value.length === 0 ||
+    value.includes('\\') ||
+    value.includes('\0') ||
+    value.startsWith('/') ||
+    value.split('/').some((part) => part === '.' || part === '..' || part === '')
+  )
+    throw new Error('Unsafe preparation path');
+}
+
+/** Declare expected registry-install hooks; these declarations are not execution observations. */
+export function expectedLifecycleEvents({ installRoot, packages }) {
+  const events = [];
+  for (const material of packages) {
+    const root = path.join(installRoot, material.lock_path);
+    const manifest = strictJson(readBounded(path.join(root, 'package.json')));
+    if (
+      fs.existsSync(path.join(root, 'binding.gyp')) &&
+      !manifest.scripts?.install &&
+      !manifest.scripts?.preinstall
+    )
+      throw new Error(`Unsupported implicit lifecycle install: ${material.lock_path}`);
+    for (const event of ['preinstall', 'install', 'postinstall']) {
+      const script = manifest.scripts?.[event];
+      if (script === undefined) continue;
+      if (typeof script !== 'string' || !script)
+        throw new Error('Invalid declared lifecycle script');
+      events.push({
+        kind: 'lifecycle-event',
+        id: `lifecycle:${material.lock_path}:${event}`,
+        package_material_id: material.id,
+        event,
+        script_sha256: sha256(script),
+      });
+    }
+  }
+  return events;
+}
+
+/** Check preparation observations; this does not authenticate acquisition or lifecycle execution. */
+export function validatePreparation(prepared, { installRoot, packages }) {
+  fields(prepared, [
+    'schema_version',
+    'tools',
+    'distributions',
+    'packages',
+    'lifecycle_events',
+    'lifecycle_outputs',
+  ]);
+  if (
+    prepared.schema_version !== 1 ||
+    !['tools', 'distributions', 'packages', 'lifecycle_events', 'lifecycle_outputs'].every((key) =>
+      Array.isArray(prepared[key])
+    )
+  )
+    throw new Error('Expected preparation version 1 arrays');
+  const materials = [];
+  const identities = new Set();
+  function add(material) {
+    if (typeof material.id !== 'string' || !material.id || identities.has(material.id))
+      throw new Error('Duplicate or invalid preparation identity');
+    identities.add(material.id);
+    materials.push(material);
+  }
+  const measured = new Map(packages.map((record) => [record.id, record]));
+  for (const material of prepared.packages) {
+    fields(material, [
+      'kind',
+      'id',
+      'lock_path',
+      'name',
+      'version',
+      'integrity',
+      'installed_tree_sha256',
+    ]);
+    if (material.kind !== 'npm-package' || material.id !== `npm:${material.lock_path}`)
+      throw new Error('Invalid package material identity');
+    const actual = measured.get(material.id);
+    if (!actual || Object.keys(material).some((key) => material[key] !== actual[key]))
+      throw new Error(`Installed package material mismatch: ${material.id}`);
+    add(material);
+  }
+  if (prepared.packages.length !== packages.length)
+    throw new Error('Incomplete prepared package set');
+  for (const distribution of prepared.distributions) {
+    fields(distribution, ['material', 'path']);
+    const { material, path: file } = distribution;
+    fields(material, ['kind', 'id', 'name', 'version', 'sha256']);
+    if (
+      material.kind !== 'tool-distribution' ||
+      typeof material.name !== 'string' ||
+      !material.name ||
+      typeof material.version !== 'string' ||
+      !material.version
+    )
+      throw new Error('Invalid tool distribution');
+    digest(material.sha256);
+    if (fileDigest(file) !== material.sha256)
+      throw new Error(`Tool distribution digest mismatch: ${material.id}`);
+    add(material);
+  }
+  const expectedEvents = new Set(
+    expectedLifecycleEvents({ installRoot, packages }).map((event) =>
+      JSON.stringify([event.package_material_id, event.event, event.script_sha256])
+    )
+  );
+  const events = new Set();
+  for (const event of prepared.lifecycle_events) {
+    fields(event, ['kind', 'id', 'package_material_id', 'event', 'script_sha256']);
+    const owner = measured.get(event.package_material_id);
+    if (
+      event.kind !== 'lifecycle-event' ||
+      !owner ||
+      !['preinstall', 'install', 'postinstall', 'prepare'].includes(event.event)
+    )
+      throw new Error('Invalid lifecycle event join');
+    digest(event.script_sha256);
+    const manifest = strictJson(
+      readBounded(path.join(installRoot, owner.lock_path, 'package.json'))
+    );
+    const script = manifest.scripts?.[event.event];
+    if (typeof script !== 'string' || sha256(script) !== event.script_sha256)
+      throw new Error('Lifecycle script digest mismatch');
+    const identity = JSON.stringify([event.package_material_id, event.event, event.script_sha256]);
+    if (events.has(identity)) throw new Error('Duplicate lifecycle event');
+    if (!expectedEvents.has(identity)) throw new Error('Unexpected lifecycle event');
+    events.add(identity);
+    add(event);
+  }
+  if (events.size !== expectedEvents.size)
+    throw new Error('Missing expected lifecycle observations');
+  const packageRoots = packages
+    .map((material) => ({
+      id: material.id,
+      root: fs.realpathSync(path.join(installRoot, material.lock_path)),
+    }))
+    .sort((first, second) => second.root.length - first.root.length);
+  for (const output of prepared.lifecycle_outputs) {
+    fields(output, [
+      'kind',
+      'id',
+      'package_material_id',
+      'event',
+      'script_sha256',
+      'path',
+      'size',
+      'sha256',
+    ]);
+    if (
+      output.kind !== 'lifecycle-output' ||
+      !measured.has(output.package_material_id) ||
+      !['preinstall', 'install', 'postinstall', 'prepare'].includes(output.event)
+    )
+      throw new Error('Invalid lifecycle output join');
+    digest(output.script_sha256);
+    digest(output.sha256);
+    safePath(output.path);
+    if (!Number.isSafeInteger(output.size) || output.size < 0 || output.size > 32 * 1024 * 1024)
+      throw new Error('Invalid lifecycle size');
+    const owner = measured.get(output.package_material_id);
+    const ownerRoot = path.join(installRoot, owner.lock_path);
+    const manifest = strictJson(readBounded(path.join(ownerRoot, 'package.json')));
+    const script = manifest.scripts?.[output.event];
+    if (typeof script !== 'string' || sha256(script) !== output.script_sha256)
+      throw new Error('Lifecycle script digest mismatch');
+    const file = path.join(installRoot, output.path);
+    if (!inside(ownerRoot, file)) throw new Error('Lifecycle output owner mismatch');
+    const realFile = fs.realpathSync(file);
+    if (!inside(fs.realpathSync(installRoot), realFile)) throw new Error('Lifecycle output escape');
+    if (
+      !inside(fs.realpathSync(ownerRoot), realFile) ||
+      packageRoots.find(({ root }) => inside(root, realFile))?.id !== output.package_material_id
+    )
+      throw new Error('Lifecycle output owner mismatch');
+    if (
+      !events.has(JSON.stringify([output.package_material_id, output.event, output.script_sha256]))
+    )
+      throw new Error('Lifecycle output has no observed event');
+    const bytes = readBounded(file, 32 * 1024 * 1024);
+    if (bytes.length !== output.size || sha256(bytes) !== output.sha256)
+      throw new Error('Lifecycle output digest mismatch');
+    add(output);
+  }
+  const tools = [];
+  const names = new Set();
+  for (const tool of prepared.tools) {
+    fields(tool, ['name', 'version', 'role', 'material_id']);
+    const material = materials.find((record) => record.id === tool.material_id);
+    if (
+      !material ||
+      material.kind !== 'tool-distribution' ||
+      material.name !== tool.name ||
+      material.version !== tool.version ||
+      !['runtime', 'package-manager', 'bundler', 'minifier', 'test-runner'].includes(tool.role) ||
+      names.has(tool.name)
+    )
+      throw new Error('Invalid or duplicate tool material join');
+    names.add(tool.name);
+    tools.push(tool);
+  }
+  return {
+    materials: materials.sort((a, b) => compare(a.id, b.id)),
+    tools: tools.sort((a, b) => compare(a.name, b.name)),
+  };
+}
+
+/** Measure the actual tool entry files and native executables; no host authentication is claimed. */
+export function actualToolFiles({ installRoot }) {
+  const npmRoot = path.resolve(path.dirname(process.execPath), '../lib/node_modules/npm');
+  const tools = [
+    { name: 'node', role: 'runtime', version: process.versions.node, path: process.execPath },
+    {
+      name: 'npm',
+      role: 'package-manager',
+      version: strictJson(readBounded(path.join(npmRoot, 'package.json'))).version,
+      path: path.join(npmRoot, 'bin/npm-cli.js'),
+    },
+  ];
+  const modules = [
+    ['vite', 'bundler', 'dist/node/index.js'],
+    ['rollup', 'bundler', 'dist/es/rollup.js'],
+    ['esbuild', 'minifier', 'lib/main.js'],
+    ['vitest', 'test-runner', 'vitest.mjs'],
+  ];
+  for (const [name, role, entry] of modules) {
+    const root = path.join(installRoot, 'node_modules', name);
+    tools.push({
+      name,
+      role,
+      version: strictJson(readBounded(path.join(root, 'package.json'))).version,
+      path: path.join(root, entry),
+    });
+  }
+  if (!['darwin', 'linux'].includes(process.platform) || !['arm64', 'x64'].includes(process.arch))
+    throw new Error('Unsupported native tool platform');
+  const platform = `${process.platform}-${process.arch}`;
+  const esbuildRoot = path.join(installRoot, 'node_modules/@esbuild', platform);
+  const rollupSuffix =
+    process.platform === 'linux'
+      ? process.report.getReport().header.glibcVersionRuntime
+        ? '-gnu'
+        : '-musl'
+      : '';
+  const rollupPlatform = `${platform}${rollupSuffix}`;
+  const rollupRoot = path.join(installRoot, 'node_modules/@rollup', `rollup-${rollupPlatform}`);
+  tools.push({
+    name: `esbuild:${platform}`,
+    role: 'minifier',
+    version: strictJson(readBounded(path.join(esbuildRoot, 'package.json'))).version,
+    path: path.join(esbuildRoot, 'bin/esbuild'),
+  });
+  tools.push({
+    name: `rollup:${platform}`,
+    role: 'bundler',
+    version: strictJson(readBounded(path.join(rollupRoot, 'package.json'))).version,
+    path: path.join(rollupRoot, `rollup.${rollupPlatform}.node`),
+  });
+  return tools.map((tool) => ({ ...tool, sha256: fileDigest(tool.path) }));
+}
diff --git a/crates/trusted-server-js/lib/test/observe-npm.test.mjs b/crates/trusted-server-js/lib/test/observe-npm.test.mjs
new file mode 100644
index 0000000000..f81572096d
--- /dev/null
+++ b/crates/trusted-server-js/lib/test/observe-npm.test.mjs
@@ -0,0 +1,426 @@
+// @vitest-environment node
+import crypto from 'node:crypto';
+import { execFileSync, spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { afterEach, describe, expect, it } from 'vitest';
+import {
+  normalizeEsbuildHardlink,
+  parseRequest,
+  sealObservation,
+  snapshotTree,
+} from '../../../../scripts/release/observe-npm.mjs';
+
+const observer = pathToFileURL(
+  path.resolve(
+    path.dirname(fileURLToPath(import.meta.url)),
+    '../../../../scripts/release/observe-npm.mjs'
+  )
+).href;
+const npmRoot = path.resolve(path.dirname(process.execPath), '../lib/node_modules/npm');
+const temporary = [];
+function fixture(name = 'esbuild') {
+  const root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'ts-observer-')));
+  temporary.push(root);
+  const install = path.join(root, 'installation');
+  const owner = path.join(install, 'node_modules', name);
+  fs.mkdirSync(owner, { recursive: true });
+  const version = name === 'esbuild' ? '0.27.3' : '3.48.0';
+  const command =
+    name === 'esbuild' ? 'node install.js' : 'node -e "try{require(\'./postinstall\')}catch(e){}"';
+  fs.writeFileSync(
+    path.join(install, 'package.json'),
+    JSON.stringify({ name: 'example-root', version: '1.0.0' })
+  );
+  fs.writeFileSync(
+    path.join(install, 'package-lock.json'),
+    JSON.stringify({
+      lockfileVersion: 3,
+      packages: { '': {}, [`node_modules/${name}`]: { version } },
+    })
+  );
+  const pkg = { name, version, scripts: { postinstall: command } };
+  fs.writeFileSync(path.join(owner, 'package.json'), JSON.stringify(pkg));
+  return { root, install, owner, pkg };
+}
+function executeHook(value, body, { second = false, shadow = false, native } = {}) {
+  fs.writeFileSync(
+    path.join(value.owner, value.pkg.name === 'esbuild' ? 'install.js' : 'postinstall.js'),
+    body
+  );
+  if (shadow) {
+    const bin = path.join(value.owner, 'node_modules', '.bin');
+    fs.mkdirSync(bin, { recursive: true });
+    fs.writeFileSync(path.join(bin, 'node'), '#!/bin/sh\nexit 91\n', { mode: 0o755 });
+  }
+  const script = `
+    import { createRequire } from 'node:module';
+    import { installLifecycleObserver } from ${JSON.stringify(observer)};
+    const require = createRequire(import.meta.url);
+    const [npmRoot, installRoot, owner, second, native] = process.argv.slice(1);
+    const state = installLifecycleObserver({ npmRoot, installRoot, nodePath: process.execPath, nativeEsbuild: JSON.parse(native) });
+    const run = require(npmRoot + '/node_modules/@npmcli/run-script/lib/run-script.js');
+    const pkg = require(owner + '/package.json');
+    let caught = false;
+    for (let index = 0; index < (second === 'true' ? 2 : 1); index++) {
+      try { await run({ event: 'postinstall', path: owner, pkg, stdio: 'inherit' }); } catch { caught = true; }
+    }
+    console.log('OBSERVER_TEST_RESULT ' + JSON.stringify({ caught, failed: state.failed(), events: state.events, normalizations: state.normalizations }));
+  `;
+  const child = spawnSync(
+    process.execPath,
+    [
+      '--input-type=module',
+      '-e',
+      script,
+      npmRoot,
+      value.install,
+      value.owner,
+      String(second),
+      JSON.stringify(native ?? null),
+    ],
+    {
+      env: {
+        PATH: `${path.dirname(process.execPath)}:/usr/bin:/bin`,
+        HOME: value.root,
+        TMPDIR: value.root,
+      },
+      encoding: 'utf8',
+      input: 'private parent input',
+      timeout: 15000,
+      maxBuffer: 1024 * 1024,
+    }
+  );
+  expect(child.status, child.stderr).toBe(0);
+  const result = child.stdout.split('\n').find((line) => line.startsWith('OBSERVER_TEST_RESULT '));
+  expect(result, child.stderr).toBeTruthy();
+  return JSON.parse(result.slice('OBSERVER_TEST_RESULT '.length));
+}
+
+function executeFreshCi({ optional, failHook }) {
+  const value = fixture();
+  const original = path.join(value.root, 'original');
+  const packaged = path.join(original, 'package');
+  fs.mkdirSync(packaged, { recursive: true });
+  fs.copyFileSync(path.join(value.owner, 'package.json'), path.join(packaged, 'package.json'));
+  fs.writeFileSync(path.join(packaged, 'install.js'), failHook ? 'process.exit(7);' : '');
+  const archive = path.join(value.root, 'original.tgz');
+  execFileSync('tar', ['czf', archive, '-C', original, 'package']);
+  const integrity = `sha512-${crypto.createHash('sha512').update(fs.readFileSync(archive)).digest('base64')}`;
+  const pkg = {
+    name: 'example-root',
+    version: '1.0.0',
+    [optional ? 'optionalDependencies' : 'dependencies']: { esbuild: '0.27.3' },
+  };
+  fs.writeFileSync(path.join(value.install, 'package.json'), JSON.stringify(pkg));
+  fs.writeFileSync(
+    path.join(value.install, 'package-lock.json'),
+    JSON.stringify({
+      name: pkg.name,
+      version: pkg.version,
+      lockfileVersion: 3,
+      requires: true,
+      packages: {
+        '': pkg,
+        'node_modules/esbuild': {
+          version: '0.27.3',
+          resolved: 'https://registry.example.com/esbuild/-/esbuild-0.27.3.tgz',
+          integrity,
+          hasInstallScript: true,
+          ...(optional ? { optional: true } : {}),
+        },
+      },
+    })
+  );
+  fs.rmSync(path.join(value.install, 'node_modules'), { recursive: true });
+  const cache = path.join(value.root, 'cache');
+  fs.mkdirSync(cache);
+  const env = {
+    PATH: `${path.dirname(process.execPath)}:/usr/bin:/bin`,
+    HOME: value.root,
+    TMPDIR: value.root,
+  };
+  const seeded = spawnSync(
+    process.execPath,
+    [
+      path.join(npmRoot, 'bin/npm-cli.js'),
+      'cache',
+      'add',
+      archive,
+      '--offline',
+      '--ignore-scripts',
+      '--no-audit',
+      '--no-fund',
+      '--userconfig=/dev/null',
+      `--globalconfig=${path.join(cache, 'release-disabled-global.npmrc')}`,
+      '--cache',
+      cache,
+    ],
+    { env, encoding: 'utf8', timeout: 15000 }
+  );
+  expect(seeded.status, seeded.stderr).toBe(0);
+  const script = `
+    import { createRequire } from 'node:module';
+    import { installLifecycleObserver } from ${JSON.stringify(observer)};
+    const require = createRequire(import.meta.url);
+    const [npmRoot, installRoot, cache] = process.argv.slice(1);
+    const state = installLifecycleObserver({ npmRoot, installRoot, nodePath: process.execPath });
+    process.once('exit', code => console.log('OBSERVER_TEST_RESULT ' + JSON.stringify({ code, failed: state.failed(), events: state.events })));
+    process.argv = [process.execPath, npmRoot + '/bin/npm-cli.js', 'ci', '--offline', '--include=dev', '--no-audit', '--no-fund', '--foreground-scripts', '--ignore-scripts=false', '--userconfig=/dev/null', '--globalconfig=' + cache + '/release-disabled-global.npmrc', '--script-shell=/bin/sh', '--cache', cache];
+    require(npmRoot + '/bin/npm-cli.js');
+  `;
+  const child = spawnSync(
+    process.execPath,
+    ['--input-type=module', '-e', script, npmRoot, value.install, cache],
+    { cwd: value.install, env, encoding: 'utf8', timeout: 15000, maxBuffer: 1024 * 1024 }
+  );
+  expect(child.status, child.stderr).toBe(0);
+  const result = child.stdout.split('\n').find((line) => line.startsWith('OBSERVER_TEST_RESULT '));
+  expect(result, child.stderr).toBeTruthy();
+  return JSON.parse(result.slice('OBSERVER_TEST_RESULT '.length));
+}
+afterEach(() => {
+  for (const root of temporary.splice(0)) fs.rmSync(root, { recursive: true, force: true });
+});
+
+describe('release npm lifecycle observer', () => {
+  it('rejects requests without a private full-length signing key', () => {
+    expect(() => parseRequest(Buffer.from('{}'))).toThrow();
+  });
+  it('binds closed requests to disjoint canonical roots and exact original identities', () => {
+    const first = fixture();
+    const cache = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'ts-cache-')));
+    temporary.push(cache);
+    const request = {
+      schema_version: 1,
+      key: 'a'.repeat(64),
+      nonce: 'b'.repeat(64),
+      source_commit: 'c'.repeat(40),
+      repo_root: first.root,
+      cache,
+      guard_path: fs.realpathSync(process.execPath),
+      native_esbuild: {
+        lock_path: 'node_modules/@esbuild/linux-x64',
+        sha256: 'd'.repeat(64),
+        size: 4,
+        mode: 0o755,
+      },
+    };
+    expect(parseRequest(Buffer.from(JSON.stringify(request)))).toEqual(request);
+    for (const change of [
+      { key: 'a' },
+      { nonce: 'b' },
+      { source_commit: 'HEAD' },
+      { cache: first.install },
+      { command: 'other' },
+    ]) {
+      expect(() => parseRequest(Buffer.from(JSON.stringify({ ...request, ...change })))).toThrow();
+    }
+    expect(() =>
+      parseRequest(
+        Buffer.from(
+          JSON.stringify(request).replace(
+            '"schema_version":1',
+            '"schema_version":1,"schema_version":1'
+          )
+        )
+      )
+    ).toThrow();
+  });
+  it('observes a genuine no-output hook start and successful completion', () => {
+    const value = fixture('core-js');
+    const result = executeHook(value, '');
+    expect(result.failed).toBe(false);
+    expect(result.events.map((event) => event.stage)).toEqual(['start', 'success']);
+    expect(result.events[1].changes).toEqual([]);
+    expect(result.events[0].script_sha256).toBe(
+      crypto.createHash('sha256').update(value.pkg.scripts.postinstall).digest('hex')
+    );
+  });
+  it('records actual changed owned files and pins node after package bin shadowing', () => {
+    const value = fixture();
+    const result = executeHook(
+      value,
+      "require('node:fs').writeFileSync('observed.txt', process.execPath);",
+      { shadow: true }
+    );
+    expect(result.failed).toBe(false);
+    expect(fs.readFileSync(path.join(value.owner, 'observed.txt'), 'utf8')).toBe(process.execPath);
+    expect(result.events[1].changes).toEqual([
+      {
+        path: 'node_modules/esbuild/observed.txt',
+        before: null,
+        after: {
+          kind: 'file',
+          executable: false,
+          size: Buffer.byteLength(process.execPath),
+          sha256: crypto.createHash('sha256').update(process.execPath).digest('hex'),
+        },
+      },
+    ]);
+  });
+  it('retains a failed event even when its caller swallows the optional failure', () => {
+    const result = executeHook(fixture(), 'process.exit(7);');
+    expect(result.caught).toBe(true);
+    expect(result.failed).toBe(true);
+    expect(result.events.map((event) => event.stage)).toEqual(['start', 'failure']);
+    expect(result.events.at(-1).exit_code).toBe(7);
+  });
+  it('runs real fresh offline npm ci including its absent root lifecycle calls', () => {
+    const result = executeFreshCi({ optional: false, failHook: false });
+    expect(result.code).toBe(0);
+    expect(result.failed).toBe(false);
+    expect(result.events.map((event) => event.stage)).toEqual(['start', 'success']);
+  });
+  it('detects an optional hook failure swallowed by actual npm ci and Arborist', () => {
+    const result = executeFreshCi({ optional: true, failHook: true });
+    expect(result.code).toBe(0);
+    expect(result.failed).toBe(true);
+    expect(result.events.map((event) => event.stage)).toEqual(['start', 'failure']);
+    expect(result.events.at(-1).exit_code).toBe(7);
+  });
+  it('does not pass the parent input pipe to the lifecycle child', () => {
+    const value = fixture();
+    const result = executeHook(
+      value,
+      "require('node:fs').writeFileSync('stdin.txt', require('node:fs').readFileSync(0, 'utf8'));"
+    );
+    expect(result.failed).toBe(false);
+    expect(fs.readFileSync(path.join(value.owner, 'stdin.txt'), 'utf8')).toBe('');
+  });
+  it('rejects writes outside the lifecycle owner and duplicate executions', () => {
+    const outside = executeHook(
+      fixture(),
+      "require('node:fs').writeFileSync('../../unexpected.txt', 'changed');"
+    );
+    expect(outside.failed).toBe(true);
+    expect(outside.events.at(-1).stage).toBe('failure');
+    const repeated = executeHook(fixture(), '', { second: true });
+    expect(repeated.failed).toBe(true);
+    expect(repeated.events.map((event) => event.stage)).toEqual(['start', 'success']);
+  });
+  it('rejects an unreviewed script before executing it', () => {
+    const value = fixture();
+    value.pkg.scripts.postinstall = 'node unreviewed.js';
+    fs.writeFileSync(path.join(value.owner, 'package.json'), JSON.stringify(value.pkg));
+    const result = executeHook(
+      value,
+      "require('node:fs').writeFileSync('unwanted.txt', 'changed');"
+    );
+    expect(result.failed).toBe(true);
+    expect(result.events).toEqual([]);
+    expect(fs.existsSync(path.join(value.owner, 'unwanted.txt'))).toBe(false);
+  });
+  it('rejects hard links and escaping aliases during owned file measurement', () => {
+    const value = fixture();
+    fs.writeFileSync(path.join(value.root, 'outside'), 'example');
+    fs.linkSync(path.join(value.root, 'outside'), path.join(value.install, 'linked'));
+    expect(() => snapshotTree(value.install)).toThrow();
+    fs.unlinkSync(path.join(value.install, 'linked'));
+    fs.symlinkSync('../outside', path.join(value.install, 'alias'));
+    expect(() => snapshotTree(value.install)).toThrow();
+  });
+  it('normalizes only the original-matched esbuild native hard-link pair after its real hook', () => {
+    const value = fixture();
+    const lockPath = 'node_modules/@esbuild/linux-x64';
+    const binary = path.join(value.install, lockPath, 'bin/esbuild');
+    fs.mkdirSync(path.dirname(binary), { recursive: true });
+    const bytes = Buffer.from('example native executable bytes');
+    fs.writeFileSync(binary, bytes, { mode: 0o755 });
+    const owned = path.join(value.owner, 'bin/esbuild');
+    fs.mkdirSync(path.dirname(owned), { recursive: true });
+    fs.writeFileSync(owned, 'example wrapper', { mode: 0o755 });
+    const lock = JSON.parse(fs.readFileSync(path.join(value.install, 'package-lock.json')));
+    lock.packages[lockPath] = { version: '0.27.3' };
+    fs.writeFileSync(path.join(value.install, 'package-lock.json'), JSON.stringify(lock));
+    const native = {
+      lock_path: lockPath,
+      sha256: crypto.createHash('sha256').update(bytes).digest('hex'),
+      size: bytes.length,
+      mode: 0o755,
+    };
+    const result = executeHook(
+      value,
+      "const fs = require('node:fs'); fs.unlinkSync('bin/esbuild'); fs.linkSync('../@esbuild/linux-x64/bin/esbuild', 'bin/esbuild');",
+      { native }
+    );
+    expect(result.failed).toBe(false);
+    expect(result.normalizations).toEqual([
+      {
+        kind: 'esbuild-hardlink-copy-v1',
+        path: 'node_modules/esbuild/bin/esbuild',
+        native_path: `${lockPath}/bin/esbuild`,
+        sha256: native.sha256,
+        size: bytes.length,
+        mode: 0o755,
+      },
+    ]);
+    expect(fs.lstatSync(binary).nlink).toBe(1);
+    expect(fs.lstatSync(owned).nlink).toBe(1);
+    expect(fs.lstatSync(binary).ino).not.toBe(fs.lstatSync(owned).ino);
+    expect(fs.readFileSync(binary)).toEqual(bytes);
+    expect(fs.readFileSync(owned)).toEqual(bytes);
+    expect(result.events.at(-1).changes.map((change) => change.path)).toEqual([
+      'node_modules/esbuild/bin/esbuild',
+    ]);
+    expect(() =>
+      normalizeEsbuildHardlink({
+        installRoot: value.install,
+        native: { ...native, sha256: '0'.repeat(64) },
+      })
+    ).toThrow();
+    fs.unlinkSync(owned);
+    fs.linkSync(binary, owned);
+    fs.linkSync(binary, path.join(value.owner, 'extra-link'));
+    expect(() => normalizeEsbuildHardlink({ installRoot: value.install, native })).toThrow();
+  });
+  it('authenticates exact summary bytes with a key absent from the encoded payload', () => {
+    const key = crypto.randomBytes(32).toString('hex');
+    const value = { schema_version: 1, nonce: 'b'.repeat(64), success: true, events: [] };
+    const sealed = sealObservation(value, key);
+    const [prefix, encoded, signature] = sealed.trim().split(' ');
+    expect(prefix).toBe('TS_RELEASE_NPM_OBSERVATION_V1');
+    const bytes = Buffer.from(encoded, 'base64');
+    expect(JSON.parse(bytes)).toEqual(value);
+    expect(bytes.includes(Buffer.from(key))).toBe(false);
+    expect(signature).toBe(
+      crypto.createHmac('sha256', Buffer.from(key, 'hex')).update(bytes).digest('hex')
+    );
+    expect(signature).not.toBe(
+      crypto
+        .createHmac('sha256', Buffer.from(key, 'hex'))
+        .update(Buffer.from(JSON.stringify({ ...value, success: false })))
+        .digest('hex')
+    );
+  });
+});
+
+describe('parent-derived source context', () => {
+  it('discovers selected module identities without a Git store in the fresh checkout', async () => {
+    const { expectedModuleIds } = await import('../../../../scripts/release/collect-js.mjs');
+    const value = fixture();
+    const contextRoot = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'ts-context-')));
+    temporary.push(contextRoot);
+    const context = path.join(contextRoot, 'source.json');
+    const source = 'c'.repeat(40);
+    const record = { schema_version: 1, source_commit: source, module_ids: ['core', 'example'] };
+    fs.writeFileSync(context, JSON.stringify(record));
+    expect(expectedModuleIds(value.install, source, context)).toEqual(['core', 'example']);
+    for (const change of [
+      { source_commit: 'd'.repeat(40) },
+      { module_ids: ['example'] },
+      { module_ids: ['example', 'core'] },
+      { module_ids: ['core', 'core'] },
+      { module_ids: ['core', '../example'] },
+      { extra: true },
+    ]) {
+      fs.writeFileSync(context, JSON.stringify({ ...record, ...change }));
+      expect(() => expectedModuleIds(value.install, source, context)).toThrow();
+    }
+    const writable = path.join(value.install, 'source.json');
+    fs.writeFileSync(writable, JSON.stringify(record));
+    expect(() => expectedModuleIds(value.install, source, writable)).toThrow(/outside/);
+  });
+});
diff --git a/crates/trusted-server-js/lib/test/release-composition.test.mjs b/crates/trusted-server-js/lib/test/release-composition.test.mjs
new file mode 100644
index 0000000000..c2c9988cdd
--- /dev/null
+++ b/crates/trusted-server-js/lib/test/release-composition.test.mjs
@@ -0,0 +1,1280 @@
+// @vitest-environment node
+import crypto from 'node:crypto';
+import { execFileSync, spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { build } from 'vite';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { buildAll } from '../build-all.mjs';
+import { moduleBuildOptions } from '../build-module-options.mjs';
+
+const libDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const repoRoot = path.resolve(libDir, '../../..');
+const lockFile = path.join(libDir, 'package-lock.json');
+const archiveSource = JSON.parse(fs.readFileSync(lockFile, 'utf8')).packages['node_modules/dlv']
+  .resolved;
+const temporary = [];
+const sha256 = (bytes) => crypto.createHash('sha256').update(bytes).digest('hex');
+function fixture() {
+  const root = fs.mkdtempSync(path.join(libDir, '.release-test-'));
+  temporary.push(root);
+  return root;
+}
+afterEach(() => {
+  vi.unstubAllEnvs();
+  for (const root of temporary.splice(0)) {
+    if (fs.lstatSync(root, { throwIfNoEntry: false })?.isSymbolicLink()) fs.unlinkSync(root);
+    else fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+async function bundle(root, entry, composition, plugins = []) {
+  const outDir = path.join(root, composition ? 'recorded' : 'plain');
+  const options = moduleBuildOptions({ name: 'fixture', entryPath: entry, outDir, composition });
+  options.plugins = [...(options.plugins ?? []), ...plugins];
+  await build(options);
+  return fs.readFileSync(path.join(outDir, 'tsjs-fixture.js'));
+}
+function recorder(onContributions, overrides = {}) {
+  return { repoRoot, lockFile, onContributions, ...overrides };
+}
+
+describe('release Rollup composition', () => {
+  it('reuses checked installed ownership for recorded module builds', async () => {
+    const { installedOrigins } = await import('../release-composition.mjs');
+    const owners = installedOrigins({ repoRoot, lockFile });
+    const root = fixture();
+    const entry = path.join(root, 'index.ts');
+    fs.writeFileSync(entry, 'globalThis.exampleResult = 7;');
+    let rows;
+    const recorded = await bundle(
+      root,
+      entry,
+      recorder(
+        (value) => {
+          rows = value;
+        },
+        {
+          owners,
+          lockFile: path.join(root, 'unused-lock.json'),
+        }
+      )
+    );
+    expect(recorded).toEqual(await bundle(root, entry));
+    expect(rows).toHaveLength(1);
+  });
+  it('omits a rendered zero-length namespace module without changing bundle bytes', async () => {
+    const root = fixture();
+    const empty = path.join(root, 'empty.ts');
+    const entry = path.join(root, 'index.ts');
+    fs.writeFileSync(empty, 'export {};');
+    fs.writeFileSync(entry, "import * as empty from './empty'; globalThis.exampleResult = empty;");
+    let rows;
+    let renderedLength;
+    const observe = {
+      name: 'example-rendered-module-observer',
+      generateBundle(_options, output) {
+        renderedLength = Object.values(output)[0].modules[empty].renderedLength;
+      },
+    };
+    const recorded = await bundle(
+      root,
+      entry,
+      recorder((value) => {
+        rows = value;
+      }),
+      [observe]
+    );
+    expect(renderedLength).toBe(0);
+    expect(rows.some((row) => row.path?.endsWith('/empty.ts'))).toBe(false);
+    expect(recorded).toEqual(await bundle(root, entry));
+  });
+  it('records retained source and transitive npm helpers without changing final bytes', async () => {
+    const root = fixture();
+    const entry = path.join(root, 'index.ts');
+    fs.writeFileSync(path.join(root, 'unused.ts'), 'export const discarded = 42;');
+    fs.writeFileSync(path.join(root, 'retained.ts'), 'export const retained = "example-retained";');
+    fs.writeFileSync(
+      entry,
+      `import type { BidRequest } from 'prebid.js';
+      import { discarded } from './unused';
+      import { retained } from './retained';
+      import dlv from 'dlv/dist/dlv.js';
+      const request: BidRequest | undefined = undefined;
+      globalThis.exampleResult = [retained, dlv({ x: 7 }, 'x'), request];`
+    );
+    let contributions;
+    const plain = await bundle(root, entry);
+    const recorded = await bundle(
+      root,
+      entry,
+      recorder((rows) => {
+        contributions = rows;
+      })
+    );
+    expect(recorded).toEqual(plain);
+    expect(contributions).toBeDefined();
+    expect(contributions.some((row) => row.path?.endsWith('/retained.ts'))).toBe(true);
+    expect(contributions.some((row) => row.path?.endsWith('/unused.ts'))).toBe(false);
+    expect(contributions.some((row) => row.package_name === 'prebid.js')).toBe(false);
+    const npm = contributions.find((row) => row.package_name === 'dlv');
+    expect(npm).toMatchObject({
+      kind: 'npm',
+      lock_path: 'node_modules/dlv',
+      path: 'dist/dlv.js',
+      stage: 'rollup-rendered',
+    });
+    expect(npm.sha256).toBe(
+      sha256(fs.readFileSync(path.join(libDir, 'node_modules/dlv/dist/dlv.js')))
+    );
+    expect(contributions.find((row) => row.id === '\0commonjsHelpers.js')).toMatchObject({
+      kind: 'generated',
+      plugin: 'commonjs',
+      owner_lock_path: 'node_modules/vite',
+    });
+    expect(contributions.every((row) => row.rendered_length > 0)).toBe(true);
+  });
+
+  it('preserves the actual core and Prebid bundle bytes', async () => {
+    for (const name of ['core', 'prebid']) {
+      const root = fixture();
+      const entry = path.join(
+        libDir,
+        'src',
+        name === 'core' ? 'core' : 'integrations/prebid',
+        'index.ts'
+      );
+      let rows;
+      expect(
+        await bundle(
+          root,
+          entry,
+          recorder((value) => {
+            rows = value;
+          })
+        )
+      ).toEqual(await bundle(root, entry));
+      expect(rows).toBeDefined();
+      expect(rows.some((row) => row.package_name === 'prebid.js')).toBe(false);
+    }
+  });
+
+  it('records original raw HTML and inline CSS hashes with their transformations', async () => {
+    const root = fixture();
+    fs.writeFileSync(path.join(root, 'example.html'), '<div>example</div>');
+    fs.writeFileSync(path.join(root, 'example.css'), '.example { color: red; }');
+    const entry = path.join(root, 'index.ts');
+    fs.writeFileSync(
+      entry,
+      `import html from './example.html?raw'; import css from './example.css?inline'; globalThis.exampleResult = [html, css];`
+    );
+    let rows;
+    const bytes = await bundle(
+      root,
+      entry,
+      recorder((value) => {
+        rows = value;
+      })
+    );
+    expect(bytes).toEqual(await bundle(root, entry));
+    expect(rows.find((row) => row.path?.endsWith('/example.html'))).toMatchObject({
+      transform: 'raw',
+      sha256: sha256(fs.readFileSync(path.join(root, 'example.html'))),
+    });
+    expect(rows.find((row) => row.path?.endsWith('/example.css'))).toMatchObject({
+      transform: 'inline',
+    });
+  });
+
+  it('rejects an unrecognized virtual producer rather than assigning it to Vite', async () => {
+    const root = fixture();
+    const entry = path.join(root, 'index.ts');
+    fs.writeFileSync(
+      entry,
+      `import value from 'virtual:example'; globalThis.exampleResult = value;`
+    );
+    const plugin = {
+      name: 'example-unreviewed',
+      resolveId(id) {
+        if (id === 'virtual:example') return '\0example-unreviewed';
+      },
+      load(id) {
+        if (id === '\0example-unreviewed') return 'export default 42;';
+      },
+    };
+    await expect(
+      bundle(
+        root,
+        entry,
+        recorder(() => {}),
+        [plugin]
+      )
+    ).rejects.toThrow(/unknown virtual/i);
+  });
+
+  it.each(['version', 'integrity'])(
+    'rejects contributing installed package %s ambiguity',
+    async (field) => {
+      const root = fixture();
+      const lock = JSON.parse(fs.readFileSync(lockFile, 'utf8'));
+      if (field === 'version') lock.packages['node_modules/dlv'].version = '0.0.0';
+      else delete lock.packages['node_modules/dlv'].integrity;
+      const changedLock = path.join(root, 'package-lock.json');
+      fs.writeFileSync(changedLock, JSON.stringify(lock));
+      const entry = path.join(root, 'index.ts');
+      fs.writeFileSync(
+        entry,
+        `import dlv from 'dlv/dist/dlv.js'; globalThis.exampleResult = dlv({ x: 7 }, 'x');`
+      );
+      await expect(
+        bundle(
+          root,
+          entry,
+          recorder(() => {}, { lockFile: changedLock, installRoot: libDir })
+        )
+      ).rejects.toThrow(/version|integrity/i);
+    }
+  );
+});
+
+describe('release collector boundaries', () => {
+  it('accepts only absent or exact 1 for the optional full collector test control', async () => {
+    for (const value of ['', '0', 'true']) {
+      vi.stubEnv('TRUSTED_SERVER__RELEASE_JS_TESTS', value);
+      vi.resetModules();
+      await expect(import('../vitest.config.ts')).rejects.toThrow(/RELEASE_JS_TESTS.*exactly 1/);
+    }
+    for (const value of [undefined, '1']) {
+      vi.stubEnv('TRUSTED_SERVER__RELEASE_JS_TESTS', value);
+      vi.resetModules();
+      await expect(import('../vitest.config.ts')).resolves.toHaveProperty('default.test');
+    }
+  });
+  it('runs symlinked build and collector CLIs while imported entry points stay inert', async () => {
+    const root = fixture();
+    const direct = path.join(root, 'direct');
+    const linked = path.join(root, 'linked');
+    const buildScript = path.join(libDir, 'build-all.mjs');
+    const buildLink = path.join(root, 'build-link.mjs');
+    fs.symlinkSync(buildScript, buildLink);
+    const env = { ...process.env, TSJS_SKIP_BUILD: '1' };
+    delete env.TRUSTED_SERVER__RELEASE_BUILD;
+    const run = (script, output) =>
+      spawnSync(process.execPath, [script, '--out-dir', output], { env, encoding: 'utf8' });
+    expect(run(buildScript, direct).status).toBe(0);
+    expect(run(buildLink, linked).status).toBe(0);
+    const files = fs.readdirSync(direct).sort();
+    expect(files).toContain('tsjs-core.js');
+    expect(files.length).toBeGreaterThan(1);
+    expect(fs.readdirSync(linked).sort()).toEqual(files);
+    for (const file of files)
+      expect(fs.readFileSync(path.join(linked, file))).toEqual(
+        fs.readFileSync(path.join(direct, file))
+      );
+    const collector = path.join(repoRoot, 'scripts/release/collect-js.mjs');
+    const collectorLink = path.join(root, 'collector-link.mjs');
+    fs.symlinkSync(collector, collectorLink);
+    const invalid = spawnSync(process.execPath, [collectorLink], { env, encoding: 'utf8' });
+    expect(invalid.status).not.toBe(0);
+    expect(invalid.stderr).toMatch(/Usage: collect-js/);
+    const imported = spawnSync(
+      process.execPath,
+      [
+        '--input-type=module',
+        '-e',
+        `import ${JSON.stringify(pathToFileURL(buildScript).href)}; import ${JSON.stringify(pathToFileURL(collector).href)};`,
+      ],
+      { env, encoding: 'utf8' }
+    );
+    expect(imported.status).toBe(0);
+    expect(imported.stdout).toBe('');
+  }, 30_000);
+  it('reaches bootstrap refusal from absolute, relative and own-directory shell invocation', () => {
+    const directory = path.join(repoRoot, 'scripts/release');
+    for (const file of ['build.sh', 'build-js.sh']) {
+      for (const [cwd, script] of [
+        [repoRoot, path.join(directory, file)],
+        [repoRoot, `scripts/release/${file}`],
+        [directory, file],
+      ]) {
+        const result = spawnSync('/bin/sh', [script], { cwd, encoding: 'utf8' });
+        expect(result.status).toBe(1);
+        expect(result.stderr.trim()).toBe(
+          'Release bootstrap is pending the reviewed Rust tooling replacement'
+        );
+      }
+    }
+  });
+  it.each([
+    '{"a":1,"a":2}',
+    '{"a":{"b":1,"b":2}}',
+    '[1e999]',
+    '['.repeat(66) + '0' + ']'.repeat(66),
+  ])('rejects ambiguous JSON %s', async (text) => {
+    const { strictJson } = await import('../release-composition.mjs');
+    expect(() => strictJson(Buffer.from(text))).toThrow();
+  });
+  it('rejects invalid UTF-8 and oversized preparation JSON', async () => {
+    const { strictJson } = await import('../release-composition.mjs');
+    expect(() => strictJson(Buffer.from([0xff]))).toThrow();
+    expect(() => strictJson(Buffer.alloc(1024 * 1024 + 1, 32))).toThrow();
+  });
+  it('validates the existing release controls, including any skip presence', async () => {
+    const { releaseBuild } = await import('../release-composition.mjs');
+    for (const control of ['', '0', 'true'])
+      expect(() => releaseBuild({ TRUSTED_SERVER__RELEASE_BUILD: control })).toThrow();
+    for (const skip of ['', '0', '1']) {
+      expect(releaseBuild({ TSJS_SKIP_BUILD: skip })).toBe(false);
+      expect(() =>
+        releaseBuild({
+          TSJS_SKIP_BUILD: skip,
+          TRUSTED_SERVER__RELEASE_BUILD: '1',
+          TRUSTED_SERVER__GIT_VERSION: 'a'.repeat(40),
+        })
+      ).toThrow(/skip/i);
+    }
+    expect(() => releaseBuild({ TRUSTED_SERVER__RELEASE_BUILD: '1' })).toThrow();
+    expect(
+      releaseBuild({
+        TRUSTED_SERVER__RELEASE_BUILD: '1',
+        TRUSTED_SERVER__GIT_VERSION: 'a'.repeat(40),
+      })
+    ).toBe(true);
+  });
+  it('suppresses all four ambient env files in release build and Vitest options', async () => {
+    const root = fixture();
+    const entry = path.join(root, 'index.ts');
+    fs.writeFileSync(entry, 'globalThis.exampleResult = import.meta.env.VITE_EXAMPLE;');
+    vi.stubEnv('TRUSTED_SERVER__RELEASE_BUILD', '1');
+    vi.stubEnv('TRUSTED_SERVER__GIT_VERSION', 'a'.repeat(40));
+    vi.stubEnv('TSJS_SKIP_BUILD', undefined);
+    try {
+      const options = moduleBuildOptions({
+        name: 'fixture',
+        entryPath: entry,
+        outDir: path.join(root, 'out'),
+      });
+      expect(options.envDir).toBe(false);
+      expect(options.mode).toBe('production');
+      options.root = root;
+      await build(options);
+      const expected = fs.readFileSync(path.join(root, 'out/tsjs-fixture.js'));
+      for (const file of ['.env', '.env.local', '.env.production', '.env.production.local'])
+        fs.writeFileSync(path.join(root, file), 'VITE_EXAMPLE=fictional-environment-value');
+      await build(options);
+      expect(fs.readFileSync(path.join(root, 'out/tsjs-fixture.js'))).toEqual(expected);
+      vi.resetModules();
+      const config = (await import('../vitest.config.ts')).default;
+      expect(config.envDir).toBe(false);
+      expect(config.mode).toBe('production');
+      expect(config.server.host).toBe('127.0.0.1');
+      const nativeImports = config.plugins.find(
+        (plugin) => plugin.name === 'release-test-node-builtins'
+      );
+      expect(nativeImports.resolveId('node:fs')).toEqual({ id: 'node:fs', external: true });
+      expect(nativeImports.resolveId('dlv')).toBeUndefined();
+      vi.stubEnv('TRUSTED_SERVER__RELEASE_BUILD', undefined);
+      vi.resetModules();
+      const ordinary = (await import('../vitest.config.ts')).default;
+      expect(ordinary.server).toBeUndefined();
+      expect(ordinary.plugins).toBeUndefined();
+      expect(ordinary.envDir).toBeUndefined();
+      expect(ordinary.mode).toBeUndefined();
+    } finally {
+      vi.unstubAllEnvs();
+    }
+  });
+  it('rejects source symlink escape and unknown transform queries', async () => {
+    const { installedOrigins } = await import('../release-composition.mjs');
+    const root = fixture();
+    const source = path.join(root, 'source');
+    const external = path.join(root, 'external');
+    fs.mkdirSync(source);
+    fs.mkdirSync(external);
+    const sourceLock = path.join(source, 'package-lock.json');
+    fs.writeFileSync(sourceLock, JSON.stringify({ lockfileVersion: 3, packages: { '': {} } }));
+    fs.writeFileSync(path.join(external, 'outside.ts'), 'export const example = 7;');
+    const link = path.join(source, 'alias.ts');
+    fs.symlinkSync(path.join(external, 'outside.ts'), link);
+    expect(path.relative(fs.realpathSync(source), fs.realpathSync(link))).toMatch(/^\.\.[/\\]/);
+    const origins = installedOrigins({ repoRoot: source, lockFile: sourceLock });
+    expect(() => origins.origin(link)).toThrow(/escape/i);
+    expect(() => origins.origin(path.join(source, 'entry.ts?unknown'))).toThrow(/query/i);
+  });
+  it('requires checked preparation records rather than inventing lifecycle observations', async () => {
+    const collector = await import(path.join(repoRoot, 'scripts/release/collect-js.mjs'));
+    await expect(
+      collector.collectJs({
+        repoRoot,
+        outDir: path.join(fixture(), 'bundles'),
+        inventoryPath: path.join(fixture(), 'inventory.json'),
+      })
+    ).rejects.toThrow(/preparation/i);
+  });
+});
+
+describe('prepared evidence and installed trees', () => {
+  it('hashes normalized executable modes and excludes separately owned nested packages', async () => {
+    const { installedTreeHash } = await import('../release-composition.mjs');
+    const root = fixture();
+    fs.writeFileSync(path.join(root, 'example.js'), 'example bytes');
+    const nested = path.join(root, 'node_modules/example-dependency');
+    fs.mkdirSync(nested, { recursive: true });
+    fs.writeFileSync(path.join(nested, 'example.js'), 'nested bytes');
+    const exclusions = new Set([nested]);
+    const first = installedTreeHash(root, exclusions);
+    fs.writeFileSync(path.join(nested, 'example.js'), 'changed nested bytes');
+    expect(installedTreeHash(root, exclusions)).toBe(first);
+    fs.chmodSync(path.join(root, 'example.js'), 0o755);
+    expect(installedTreeHash(root, exclusions)).not.toBe(first);
+  });
+  it('checks preparation distribution file and lifecycle output hashes', async () => {
+    const { validatePreparation } = await import('../release-composition.mjs');
+    const root = fixture();
+    const file = path.join(root, 'tool');
+    fs.writeFileSync(file, 'fictional distribution bytes');
+    const packageRoot = path.join(root, 'node_modules/example');
+    fs.mkdirSync(packageRoot, { recursive: true });
+    fs.writeFileSync(
+      path.join(packageRoot, 'package.json'),
+      JSON.stringify({ scripts: { install: 'example install command' } })
+    );
+    const output = path.join(packageRoot, 'generated.js');
+    fs.writeFileSync(output, 'fictional lifecycle output');
+    const npm = {
+      kind: 'npm-package',
+      id: 'npm:node_modules/example',
+      lock_path: 'node_modules/example',
+      name: 'example',
+      version: '1.0.0',
+      integrity: `sha512-${Buffer.alloc(64).toString('base64')}`,
+      installed_tree_sha256: 'a'.repeat(64),
+    };
+    const material = {
+      kind: 'tool-distribution',
+      id: 'tool:example',
+      name: 'example',
+      version: '1.0.0',
+      sha256: sha256(fs.readFileSync(file)),
+    };
+    const prepared = {
+      schema_version: 1,
+      tools: [{ name: 'example', version: '1.0.0', role: 'bundler', material_id: material.id }],
+      distributions: [{ material, path: file }],
+      packages: [npm],
+      lifecycle_events: [
+        {
+          kind: 'lifecycle-event',
+          id: 'event:example',
+          package_material_id: npm.id,
+          event: 'install',
+          script_sha256: sha256('example install command'),
+        },
+      ],
+      lifecycle_outputs: [
+        {
+          kind: 'lifecycle-output',
+          id: 'lifecycle:example',
+          package_material_id: npm.id,
+          event: 'install',
+          script_sha256: sha256('example install command'),
+          path: 'node_modules/example/generated.js',
+          size: fs.statSync(output).size,
+          sha256: sha256(fs.readFileSync(output)),
+        },
+      ],
+    };
+    const checked = validatePreparation(prepared, { installRoot: root, packages: [npm] });
+    expect(checked.materials).toContainEqual(material);
+    expect(checked.materials.some((record) => record.kind === 'lifecycle-output')).toBe(true);
+    const broken = structuredClone(prepared);
+    broken.distributions[0].material.sha256 = 'b'.repeat(64);
+    expect(() => validatePreparation(broken, { installRoot: root, packages: [npm] })).toThrow(
+      /digest/i
+    );
+    const duplicate = structuredClone(prepared);
+    duplicate.packages.push(npm);
+    expect(() => validatePreparation(duplicate, { installRoot: root, packages: [npm] })).toThrow(
+      /duplicate/i
+    );
+  });
+});
+
+describe('complete inventory producer', () => {
+  it('binds measured bundler native files separately from npm archive integrity', async () => {
+    const { actualToolFiles } = await import('../release-composition.mjs');
+    const tools = actualToolFiles({ installRoot: libDir });
+    expect(tools.map((tool) => tool.name)).toEqual(
+      expect.arrayContaining([
+        'node',
+        'npm',
+        'vite',
+        'rollup',
+        'esbuild',
+        'vitest',
+        `esbuild:${process.platform}-${process.arch}`,
+        `rollup:${process.platform}-${process.arch}`,
+      ])
+    );
+    for (const tool of tools) {
+      expect(tool.sha256).toMatch(/^[a-f0-9]{64}$/);
+      expect(tool.path).toBeTruthy();
+      expect(tool.version).toBeTruthy();
+    }
+  });
+
+  it('rejects lifecycle records that are not bound to the package install script', async () => {
+    const { validatePreparation } = await import('../release-composition.mjs');
+    const root = fixture();
+    const packageRoot = path.join(root, 'node_modules/example');
+    fs.mkdirSync(packageRoot, { recursive: true });
+    fs.writeFileSync(
+      path.join(packageRoot, 'package.json'),
+      JSON.stringify({
+        name: 'example',
+        version: '1.0.0',
+        scripts: { install: 'example observed command' },
+      })
+    );
+    fs.writeFileSync(path.join(packageRoot, 'generated.js'), 'example output');
+    const npm = {
+      kind: 'npm-package',
+      id: 'npm:node_modules/example',
+      lock_path: 'node_modules/example',
+      name: 'example',
+      version: '1.0.0',
+      integrity: `sha512-${Buffer.alloc(64).toString('base64')}`,
+      installed_tree_sha256: 'a'.repeat(64),
+    };
+    const preparation = {
+      schema_version: 1,
+      tools: [],
+      distributions: [],
+      packages: [npm],
+      lifecycle_events: [
+        {
+          kind: 'lifecycle-event',
+          id: 'event:example',
+          package_material_id: npm.id,
+          event: 'install',
+          script_sha256: sha256('example install command'),
+        },
+      ],
+      lifecycle_outputs: [
+        {
+          kind: 'lifecycle-output',
+          id: 'lifecycle:example',
+          package_material_id: npm.id,
+          event: 'install',
+          script_sha256: sha256('unrelated command'),
+          path: 'node_modules/example/generated.js',
+          size: 14,
+          sha256: sha256('example output'),
+        },
+      ],
+    };
+    expect(() => validatePreparation(preparation, { installRoot: root, packages: [npm] })).toThrow(
+      /script/i
+    );
+  });
+
+  it('joins a nested transitive package by its exact installation location', async () => {
+    const { installedOrigins } = await import('../release-composition.mjs');
+    const root = fixture();
+    const installed = path.join(root, 'node_modules/example-parent/node_modules/example-child');
+    fs.mkdirSync(installed, { recursive: true });
+    fs.writeFileSync(
+      path.join(installed, 'package.json'),
+      JSON.stringify({ name: 'example-child', version: '1.2.3' })
+    );
+    fs.writeFileSync(path.join(installed, 'index.js'), 'export default 7;');
+    const key = 'node_modules/example-parent/node_modules/example-child';
+    const lock = path.join(root, 'package-lock.json');
+    fs.writeFileSync(
+      lock,
+      JSON.stringify({
+        lockfileVersion: 3,
+        packages: {
+          [key]: {
+            version: '1.2.3',
+            resolved: archiveSource,
+            integrity: `sha512-${Buffer.alloc(64).toString('base64')}`,
+          },
+        },
+      })
+    );
+    const alias = `${root}-alias`;
+    fs.symlinkSync(root, alias);
+    temporary.push(alias);
+    expect(
+      installedOrigins({ repoRoot, lockFile: lock, installRoot: alias }).origin(
+        path.join(alias, key, 'index.js')
+      )
+    ).toMatchObject({ lock_path: key, package_name: 'example-child' });
+    expect(
+      installedOrigins({ repoRoot, lockFile: lock }).origin(path.join(installed, 'index.js'))
+    ).toMatchObject({ lock_path: key, package_name: 'example-child', path: 'index.js' });
+  });
+
+  it.runIf(process.env.TRUSTED_SERVER__RELEASE_JS_TESTS === '1')(
+    'writes deterministic closed inventory records after final Vite/esbuild output',
+    async () => {
+      const { actualToolFiles, expectedLifecycleEvents, installedOrigins, installedMaterials } =
+        await import('../release-composition.mjs');
+      const { collectJs } = await import(path.join(repoRoot, 'scripts/release/collect-js.mjs'));
+      const root = fixture();
+      const packages = installedMaterials(installedOrigins({ repoRoot, lockFile }));
+      const measured = actualToolFiles({ installRoot: libDir });
+      const distributions = measured.map(({ name, version, sha256: hash, path: file }) => ({
+        material: { kind: 'tool-distribution', id: `tool:${name}`, name, version, sha256: hash },
+        path: file,
+      }));
+      const tools = measured.map(({ name, version, role }) => ({
+        name,
+        version,
+        role,
+        material_id: `tool:${name}`,
+      }));
+      const preparationPath = path.join(root, 'preparation.json');
+      fs.writeFileSync(
+        preparationPath,
+        JSON.stringify({
+          schema_version: 1,
+          packages,
+          distributions,
+          tools,
+          // Synthetic observations exercise joins; no preparation actually runs in this fixture.
+          lifecycle_events: expectedLifecycleEvents({ installRoot: libDir, packages }),
+          lifecycle_outputs: [],
+        })
+      );
+      // This is the fixture's source identity, not release approval.
+      const sourceContextPath = process.env.TRUSTED_SERVER__RELEASE_JS_SOURCE_CONTEXT;
+      const sourceCommit = sourceContextPath
+        ? JSON.parse(fs.readFileSync(sourceContextPath, 'utf8')).source_commit
+        : execFileSync('git', ['rev-parse', 'HEAD'], {
+            cwd: repoRoot,
+            encoding: 'utf8',
+          }).trim();
+      vi.stubEnv('TRUSTED_SERVER__RELEASE_BUILD', '1');
+      vi.stubEnv('TRUSTED_SERVER__GIT_VERSION', sourceCommit);
+      vi.stubEnv('TSJS_SKIP_BUILD', undefined);
+      try {
+        const inventoryPath = path.join(root, 'inventory.json');
+        const outDir = path.join(root, 'bundles');
+        const inventory = await collectJs({
+          repoRoot,
+          outDir,
+          inventoryPath,
+          preparationPath,
+          sourceContextPath,
+        });
+        expect(Object.keys(inventory).sort()).toEqual([
+          'materials',
+          'modules',
+          'schema_version',
+          'source_commit',
+          'tools',
+        ]);
+        expect(inventory.modules.map((row) => row.id)).toEqual(
+          [...inventory.modules.map((row) => row.id)].sort()
+        );
+        const plainDirectory = path.join(root, 'plain-bundles');
+        await buildAll({ outDir: plainDirectory });
+        for (const module of inventory.modules) {
+          const bytes = fs.readFileSync(path.join(outDir, module.filename));
+          expect(bytes).toEqual(fs.readFileSync(path.join(plainDirectory, module.filename)));
+          expect(module.size).toBe(bytes.length);
+          expect(module.sha256).toBe(sha256(bytes));
+          expect(Object.keys(module).sort()).toEqual([
+            'contributions',
+            'filename',
+            'id',
+            'sha256',
+            'size',
+          ]);
+        }
+        expect(inventory.materials.some((row) => row.kind === 'lifecycle-output')).toBe(false);
+        expect(inventory.materials.some((row) => row.kind === 'lifecycle-event')).toBe(true);
+        for (const source of [
+          'crates/trusted-server-js/lib/tsconfig.json',
+          'scripts/release/bootstrap.sh',
+        ]) {
+          expect(inventory.materials.find((row) => row.id === `source:${source}`)).toMatchObject({
+            kind: 'source',
+            path: source,
+            sha256: sha256(fs.readFileSync(path.join(repoRoot, source))),
+          });
+        }
+        expect(fs.readFileSync(inventoryPath, 'utf8')).toBe(`${JSON.stringify(inventory)}\n`);
+        const alias = path.join(root, 'bundle-alias');
+        fs.symlinkSync(outDir, alias);
+        await expect(
+          collectJs({
+            repoRoot,
+            outDir: alias,
+            inventoryPath: path.join(outDir, 'inside.json'),
+            preparationPath,
+            sourceContextPath,
+          })
+        ).rejects.toThrow(/outside.*bundle/i);
+        await expect(
+          collectJs({
+            repoRoot: fixture(),
+            outDir,
+            inventoryPath: path.join(root, 'wrong-checkout.json'),
+            preparationPath,
+            sourceContextPath,
+          })
+        ).rejects.toThrow(/collector.*checkout/i);
+        const originalPreparation = fs.readFileSync(preparationPath);
+        const colliding = JSON.parse(originalPreparation);
+        const collision = 'source:crates/trusted-server-js/lib/package.json';
+        colliding.distributions.find((row) => row.material.name === 'node').material.id = collision;
+        colliding.tools.find((row) => row.name === 'node').material_id = collision;
+        fs.writeFileSync(preparationPath, JSON.stringify(colliding));
+        await expect(
+          collectJs({
+            repoRoot,
+            outDir,
+            inventoryPath: path.join(root, 'collision.json'),
+            preparationPath,
+            sourceContextPath,
+          })
+        ).rejects.toThrow(/duplicate.*material|material.*identity/i);
+        expect(fs.existsSync(path.join(root, 'collision.json'))).toBe(false);
+        fs.writeFileSync(preparationPath, originalPreparation);
+        const bad = JSON.parse(fs.readFileSync(preparationPath, 'utf8'));
+        bad.distributions.find((row) => row.material.name === 'vite').path = path.join(
+          root,
+          'fictional-tool'
+        );
+        const actualVite = measured.find((row) => row.name === 'vite');
+        fs.copyFileSync(actualVite.path, path.join(root, 'fictional-tool'));
+        expect(sha256(fs.readFileSync(path.join(root, 'fictional-tool')))).toBe(actualVite.sha256);
+        fs.writeFileSync(preparationPath, JSON.stringify(bad));
+        await expect(
+          collectJs({
+            repoRoot,
+            outDir,
+            inventoryPath: path.join(root, 'bad.json'),
+            preparationPath,
+            sourceContextPath,
+          })
+        ).rejects.toThrow(/actual.*tool.*identity/i);
+      } finally {
+        vi.unstubAllEnvs();
+      }
+    },
+    120_000
+  );
+});
+
+describe('strict parser parity', () => {
+  it.each([
+    Buffer.from('\ufeff{}'),
+    Buffer.from('"\\ud800"'),
+    Buffer.from('{"\\ud800":0}'),
+    Buffer.from('9007199254740993'),
+    Buffer.from('['.repeat(65) + ']'.repeat(65)),
+  ])('rejects ambiguous Unicode, integer or container input %#', async (bytes) => {
+    const { strictJson } = await import('../release-composition.mjs');
+    expect(() => strictJson(bytes)).toThrow();
+  });
+  it('accepts exactly 64 containers and paired Unicode', async () => {
+    const { strictJson } = await import('../release-composition.mjs');
+    expect(() => strictJson(Buffer.from('['.repeat(64) + ']'.repeat(64)))).not.toThrow();
+    expect(strictJson(Buffer.from('"\\ud83d\\ude00"'))).toBe('😀');
+  });
+});
+
+describe('observed lifecycle events', () => {
+  it('records an executed lifecycle event even when it produced no output file', async () => {
+    const { validatePreparation } = await import('../release-composition.mjs');
+    const root = fixture();
+    const packageRoot = path.join(root, 'node_modules/example');
+    fs.mkdirSync(packageRoot, { recursive: true });
+    fs.writeFileSync(
+      path.join(packageRoot, 'package.json'),
+      JSON.stringify({ scripts: { postinstall: 'example observed command' } })
+    );
+    const npm = {
+      kind: 'npm-package',
+      id: 'npm:node_modules/example',
+      lock_path: 'node_modules/example',
+      name: 'example',
+      version: '1.0.0',
+      integrity: `sha512-${Buffer.alloc(64).toString('base64')}`,
+      installed_tree_sha256: 'a'.repeat(64),
+    };
+    const event = {
+      kind: 'lifecycle-event',
+      id: 'lifecycle:example:postinstall',
+      package_material_id: npm.id,
+      event: 'postinstall',
+      script_sha256: sha256('example observed command'),
+    };
+    const preparation = {
+      schema_version: 1,
+      tools: [],
+      distributions: [],
+      packages: [npm],
+      lifecycle_events: [event],
+      lifecycle_outputs: [],
+    };
+    const checked = validatePreparation(preparation, { installRoot: root, packages: [npm] });
+    expect(checked.materials).toContainEqual(event);
+    const changed = structuredClone(preparation);
+    changed.lifecycle_events[0].script_sha256 = 'b'.repeat(64);
+    expect(() => validatePreparation(changed, { installRoot: root, packages: [npm] })).toThrow(
+      /script/i
+    );
+  });
+});
+
+describe('observer output boundary', () => {
+  it('rejects an ES chunk even when its filename matches the IIFE contract', async () => {
+    const root = fixture();
+    const entry = path.join(root, 'index.ts');
+    fs.writeFileSync(entry, 'globalThis.exampleResult = 7;');
+    const options = moduleBuildOptions({
+      name: 'fixture',
+      entryPath: entry,
+      outDir: path.join(root, 'out'),
+      composition: recorder(() => {}),
+    });
+    options.build.rollupOptions.output.format = 'es';
+    await expect(build(options)).rejects.toThrow(/IIFE/i);
+  });
+});
+
+describe('complete preparation lifecycle coverage', () => {
+  it('rejects an omitted installed package even when it has no lifecycle hooks', async () => {
+    const { validatePreparation } = await import('../release-composition.mjs');
+    const root = fixture();
+    const packageRoot = path.join(root, 'node_modules/example');
+    fs.mkdirSync(packageRoot, { recursive: true });
+    fs.writeFileSync(
+      path.join(packageRoot, 'package.json'),
+      JSON.stringify({ name: 'example', version: '1.0.0' })
+    );
+    const npm = {
+      kind: 'npm-package',
+      id: 'npm:node_modules/example',
+      lock_path: 'node_modules/example',
+      name: 'example',
+      version: '1.0.0',
+      integrity: `sha512-${Buffer.alloc(64).toString('base64')}`,
+      installed_tree_sha256: 'a'.repeat(64),
+    };
+    const prepared = {
+      schema_version: 1,
+      tools: [],
+      distributions: [],
+      packages: [],
+      lifecycle_events: [],
+      lifecycle_outputs: [],
+    };
+    expect(() => validatePreparation(prepared, { installRoot: root, packages: [npm] })).toThrow(
+      'Incomplete prepared package set'
+    );
+  });
+  it('rejects a missing observation for an installed registry postinstall hook', async () => {
+    const { validatePreparation } = await import('../release-composition.mjs');
+    const root = fixture();
+    const packageRoot = path.join(root, 'node_modules/example');
+    fs.mkdirSync(packageRoot, { recursive: true });
+    fs.writeFileSync(
+      path.join(packageRoot, 'package.json'),
+      JSON.stringify({ scripts: { postinstall: 'example observed command' } })
+    );
+    const npm = {
+      kind: 'npm-package',
+      id: 'npm:node_modules/example',
+      lock_path: 'node_modules/example',
+      name: 'example',
+      version: '1.0.0',
+      integrity: `sha512-${Buffer.alloc(64).toString('base64')}`,
+      installed_tree_sha256: 'a'.repeat(64),
+    };
+    const preparation = {
+      schema_version: 1,
+      tools: [],
+      distributions: [],
+      packages: [npm],
+      lifecycle_events: [],
+      lifecycle_outputs: [],
+    };
+    expect(() => validatePreparation(preparation, { installRoot: root, packages: [npm] })).toThrow(
+      /missing.*lifecycle|incomplete.*lifecycle/i
+    );
+  });
+});
+
+describe('nested package contribution fixture', () => {
+  it('rejects another node_modules tree inside the repository but outside the install root', async () => {
+    const { installedOrigins } = await import('../release-composition.mjs');
+    const root = fixture();
+    const outside = path.join(root, 'node_modules/example');
+    fs.mkdirSync(outside, { recursive: true });
+    fs.writeFileSync(
+      path.join(outside, 'package.json'),
+      JSON.stringify({ name: 'example', version: '1.0.0' })
+    );
+    fs.writeFileSync(path.join(outside, 'index.js'), 'export default 7;');
+    const installRoot = path.join(root, 'install');
+    fs.mkdirSync(installRoot);
+    const fixtureLock = path.join(installRoot, 'package-lock.json');
+    fs.writeFileSync(fixtureLock, JSON.stringify({ lockfileVersion: 3, packages: {} }));
+    const origins = installedOrigins({ repoRoot, lockFile: fixtureLock });
+    expect(() => origins.origin(path.join(outside, 'index.js'))).toThrow(
+      /unmapped installed ownership/i
+    );
+  });
+  it('assigns a nested type-only format manifest to its archive package', async () => {
+    const { installedOrigins } = await import('../release-composition.mjs');
+    const root = fixture();
+    const key = 'node_modules/@example/parent';
+    const directory = path.join(root, key);
+    const format = path.join(directory, 'dist/esm');
+    fs.mkdirSync(format, { recursive: true });
+    fs.writeFileSync(
+      path.join(directory, 'package.json'),
+      JSON.stringify({ name: '@example/parent', version: '1.0.0' })
+    );
+    fs.writeFileSync(path.join(format, 'package.json'), JSON.stringify({ type: 'module' }));
+    fs.writeFileSync(path.join(format, 'index.js'), 'export default 7;');
+    const fixtureLock = path.join(root, 'package-lock.json');
+    fs.writeFileSync(
+      fixtureLock,
+      JSON.stringify({
+        lockfileVersion: 3,
+        packages: {
+          [key]: {
+            version: '1.0.0',
+            resolved: archiveSource,
+            integrity: `sha512-${Buffer.alloc(64).toString('base64')}`,
+          },
+        },
+      })
+    );
+    const origins = installedOrigins({ repoRoot, lockFile: fixtureLock });
+    expect(origins.origin(path.join(format, 'index.js'))).toMatchObject({
+      lock_path: key,
+      path: 'dist/esm/index.js',
+    });
+    const hostile = path.join(directory, 'node_modules/example-unmapped');
+    fs.mkdirSync(hostile, { recursive: true });
+    fs.writeFileSync(
+      path.join(hostile, 'package.json'),
+      JSON.stringify({ name: 'example-unmapped', version: '1.0.0' })
+    );
+    fs.writeFileSync(path.join(hostile, 'index.js'), 'export default 42;');
+    expect(() => origins.origin(path.join(hostile, 'index.js'))).toThrow(/unmapped/i);
+  });
+  it('preserves final bytes while recording the indirect nested installation identity', async () => {
+    const root = fixture();
+    const parentKey = 'node_modules/example-parent';
+    const childKey = `${parentKey}/node_modules/example-child`;
+    for (const [key, name, code] of [
+      [parentKey, 'example-parent', "import value from 'example-child'; export default value;"],
+      [childKey, 'example-child', 'export default 7;'],
+    ]) {
+      const directory = path.join(root, key);
+      fs.mkdirSync(directory, { recursive: true });
+      fs.writeFileSync(
+        path.join(directory, 'package.json'),
+        JSON.stringify({ name, version: '1.0.0', type: 'module', main: 'index.js' })
+      );
+      fs.writeFileSync(path.join(directory, 'index.js'), code);
+    }
+    const integrity = `sha512-${Buffer.alloc(64).toString('base64')}`;
+    const fixtureLock = path.join(root, 'package-lock.json');
+    fs.writeFileSync(
+      fixtureLock,
+      JSON.stringify({
+        lockfileVersion: 3,
+        packages: {
+          [parentKey]: { version: '1.0.0', resolved: archiveSource, integrity },
+          [childKey]: { version: '1.0.0', resolved: archiveSource, integrity },
+        },
+      })
+    );
+    const entry = path.join(root, 'index.ts');
+    fs.writeFileSync(
+      entry,
+      "import value from 'example-parent'; globalThis.exampleResult = value;"
+    );
+    let rows;
+    const recorded = await bundle(
+      root,
+      entry,
+      recorder(
+        (value) => {
+          rows = value;
+        },
+        { lockFile: fixtureLock }
+      )
+    );
+    expect(recorded).toEqual(await bundle(root, entry));
+    expect(rows.find((row) => row.package_name === 'example-child')).toMatchObject({
+      lock_path: childKey,
+      path: 'index.js',
+    });
+  });
+  it('rejects installed package aliases before contribution recording', async () => {
+    const { installedOrigins } = await import('../release-composition.mjs');
+    const root = fixture();
+    const real = path.join(root, 'node_modules/example');
+    fs.mkdirSync(real, { recursive: true });
+    fs.writeFileSync(
+      path.join(real, 'package.json'),
+      JSON.stringify({ name: 'example', version: '1.0.0' })
+    );
+    fs.symlinkSync(real, path.join(root, 'node_modules/example-alias'));
+    const fixtureLock = path.join(root, 'package-lock.json');
+    fs.writeFileSync(
+      fixtureLock,
+      JSON.stringify({
+        lockfileVersion: 3,
+        packages: {
+          'node_modules/example': { version: '1.0.0' },
+          'node_modules/example-alias': { version: '1.0.0' },
+        },
+      })
+    );
+    expect(() => installedOrigins({ repoRoot, lockFile: fixtureLock })).toThrow(/alias|escape/i);
+  });
+});
+
+describe('approved source module discovery', () => {
+  it.runIf(process.env.TRUSTED_SERVER__RELEASE_JS_TESTS === '1')(
+    'uses the selected commit despite index removal or an invented staged integration',
+    async () => {
+      const { expectedModuleIds } = await import(
+        path.join(repoRoot, 'scripts/release/collect-js.mjs')
+      );
+      const root = fixture();
+      const git = (args) =>
+        execFileSync(
+          'git',
+          [
+            '-c',
+            'commit.gpgsign=false',
+            '-c',
+            'user.name=Example',
+            '-c',
+            'user.email=example@example.com',
+            ...args,
+          ],
+          {
+            cwd: root,
+            encoding: 'utf8',
+            env: {
+              PATH: process.env.PATH,
+              TMPDIR: os.tmpdir(),
+              GIT_CONFIG_NOSYSTEM: '1',
+              GIT_CONFIG_GLOBAL: '/dev/null',
+              GIT_NO_REPLACE_OBJECTS: '1',
+            },
+          }
+        );
+      git(['init', '-q']);
+      for (const file of [
+        'crates/trusted-server-js/lib/src/core/index.ts',
+        'crates/trusted-server-js/lib/src/integrations/example/index.ts',
+      ]) {
+        fs.mkdirSync(path.dirname(path.join(root, file)), { recursive: true });
+        fs.writeFileSync(path.join(root, file), 'export const example = 7;');
+      }
+      git(['add', '.']);
+      git(['commit', '-qm', 'Record example source']);
+      const source = git(['rev-parse', 'HEAD']).trim();
+      git([
+        'rm',
+        '--cached',
+        '-q',
+        'crates/trusted-server-js/lib/src/integrations/example/index.ts',
+      ]);
+      const invented = path.join(
+        root,
+        'crates/trusted-server-js/lib/src/integrations/invented/index.ts'
+      );
+      fs.mkdirSync(path.dirname(invented), { recursive: true });
+      fs.writeFileSync(invented, 'export const example = 42;');
+      git(['add', invented]);
+      expect(expectedModuleIds(root, source)).toEqual(['core', 'example']);
+      expect(() => expectedModuleIds(root, 'a'.repeat(40))).toThrow();
+    }
+  );
+});
+
+describe('locked archive source policy', () => {
+  it.each(['link', 'file', 'git', 'missing'])(
+    'rejects unsupported contributing lock source %s',
+    async (variant) => {
+      const { installedOrigins } = await import('../release-composition.mjs');
+      const root = fixture();
+      const lock = JSON.parse(fs.readFileSync(lockFile, 'utf8'));
+      const record = lock.packages['node_modules/dlv'];
+      if (variant === 'link') record.link = true;
+      if (variant === 'file') record.resolved = 'file:example.tgz';
+      if (variant === 'git') record.resolved = 'git+https://example.com/example.git';
+      if (variant === 'missing') delete record.resolved;
+      const fixtureLock = path.join(root, 'package-lock.json');
+      fs.writeFileSync(fixtureLock, JSON.stringify(lock));
+      const origins = installedOrigins({ repoRoot, lockFile: fixtureLock, installRoot: libDir });
+      expect(() => origins.packageIdentity('node_modules/dlv')).toThrow(
+        /lock.*source|archive.*source/i
+      );
+    }
+  );
+});
+
+describe('bounded regular-file readers', () => {
+  it('rejects a FIFO without waiting for a writer', () => {
+    const root = fixture();
+    const fifo = path.join(root, 'example.fifo');
+    execFileSync('mkfifo', [fifo]);
+    const helper = pathToFileURL(path.join(libDir, 'release-composition.mjs')).href;
+    const code = `import { readBounded } from ${JSON.stringify(helper)}; try { readBounded(process.argv[1]); process.exit(2); } catch(error) { if (/regular file/.test(error.message)) process.exit(0); throw error; }`;
+    const result = spawnSync(process.execPath, ['--input-type=module', '-e', code, fifo], {
+      timeout: 2000,
+      encoding: 'utf8',
+    });
+    expect(result.error).toBeUndefined();
+    expect(result.status).toBe(0);
+  });
+});
+
+describe('lifecycle output package ownership', () => {
+  it.each(['nested-child', 'symlink-child'])(
+    'rejects a parent event claiming a %s package output',
+    async (variant) => {
+      const { installedMaterials, installedOrigins, validatePreparation } =
+        await import('../release-composition.mjs');
+      const root = fixture();
+      const parentKey = 'node_modules/example-parent';
+      const childKey =
+        variant === 'nested-child'
+          ? `${parentKey}/node_modules/example-child`
+          : 'node_modules/example-child';
+      for (const [key, name] of [
+        [parentKey, 'example-parent'],
+        [childKey, 'example-child'],
+      ]) {
+        const directory = path.join(root, key);
+        fs.mkdirSync(directory, { recursive: true });
+        fs.writeFileSync(
+          path.join(directory, 'package.json'),
+          JSON.stringify({
+            name,
+            version: '1.0.0',
+            ...(key === parentKey ? { scripts: { install: 'example install command' } } : {}),
+          })
+        );
+      }
+      const childOutput = path.join(root, childKey, 'output.js');
+      fs.writeFileSync(childOutput, 'fictional child output');
+      const integrity = `sha512-${Buffer.alloc(64).toString('base64')}`;
+      const fixtureLock = path.join(root, 'package-lock.json');
+      fs.writeFileSync(
+        fixtureLock,
+        JSON.stringify({
+          lockfileVersion: 3,
+          packages: {
+            [parentKey]: { version: '1.0.0', resolved: archiveSource, integrity },
+            [childKey]: { version: '1.0.0', resolved: archiveSource, integrity },
+          },
+        })
+      );
+      const packages = installedMaterials(installedOrigins({ repoRoot, lockFile: fixtureLock }));
+      const scriptHash = sha256('example install command');
+      const event = {
+        kind: 'lifecycle-event',
+        id: 'event:parent',
+        package_material_id: `npm:${parentKey}`,
+        event: 'install',
+        script_sha256: scriptHash,
+      };
+      let outputPath = `${childKey}/output.js`;
+      if (variant === 'symlink-child') {
+        // Exercise output validation independently of the prior tree measurement.
+        fs.symlinkSync(path.join(root, childKey), path.join(root, parentKey, 'linked'));
+        outputPath = `${parentKey}/linked/output.js`;
+      }
+      const prepared = {
+        schema_version: 1,
+        tools: [],
+        distributions: [],
+        packages,
+        lifecycle_events: [event],
+        lifecycle_outputs: [
+          {
+            kind: 'lifecycle-output',
+            id: 'output:parent',
+            package_material_id: event.package_material_id,
+            event: event.event,
+            script_sha256: scriptHash,
+            path: outputPath,
+            size: fs.statSync(childOutput).size,
+            sha256: sha256(fs.readFileSync(childOutput)),
+          },
+        ],
+      };
+      expect(() => validatePreparation(prepared, { installRoot: root, packages })).toThrow(
+        /owner|escape/i
+      );
+    }
+  );
+});
+
+describe('installed tree mode measurement boundaries', () => {
+  it('hashes the executable mode observed on the opened descriptor', async () => {
+    const { installedTreeHash } = await import('../release-composition.mjs');
+    const root = fixture();
+    const file = path.join(root, 'example.js');
+    fs.writeFileSync(file, 'example bytes');
+    fs.chmodSync(file, 0o644);
+    const oldHash = installedTreeHash(root);
+    const open = fs.openSync;
+    let changed = false;
+    const boundary = vi.spyOn(fs, 'openSync').mockImplementation((...args) => {
+      if (args[0] === file && !changed) {
+        changed = true;
+        fs.chmodSync(file, 0o755);
+      }
+      return open(...args);
+    });
+    let observed;
+    try {
+      observed = installedTreeHash(root);
+    } finally {
+      boundary.mockRestore();
+    }
+    expect(changed).toBe(true);
+    expect(observed).not.toBe(oldHash);
+    expect(observed).toBe(installedTreeHash(root));
+  });
+
+  it('rejects a mode change between the final descriptor and pathname checks', async () => {
+    const { installedTreeHash } = await import('../release-composition.mjs');
+    const root = fixture();
+    const file = path.join(root, 'example.js');
+    fs.writeFileSync(file, 'example bytes');
+    fs.chmodSync(file, 0o644);
+    const lstat = fs.lstatSync;
+    let observations = 0;
+    const boundary = vi.spyOn(fs, 'lstatSync').mockImplementation((...args) => {
+      if (args[0] === file && ++observations === 2) fs.chmodSync(file, 0o755);
+      return lstat(...args);
+    });
+    try {
+      expect(() => installedTreeHash(root)).toThrow(/changed/i);
+      expect(observations).toBe(2);
+    } finally {
+      boundary.mockRestore();
+    }
+  });
+});
diff --git a/crates/trusted-server-js/lib/vitest.config.ts b/crates/trusted-server-js/lib/vitest.config.ts
index acb591cdc5..becaf5204d 100644
--- a/crates/trusted-server-js/lib/vitest.config.ts
+++ b/crates/trusted-server-js/lib/vitest.config.ts
@@ -2,7 +2,33 @@ import path from 'node:path';
 
 import { defineConfig } from 'vitest/config';
 
+import { releaseBuild } from './release-composition.mjs';
+
+if (
+  Object.hasOwn(process.env, 'TRUSTED_SERVER__RELEASE_JS_TESTS') &&
+  process.env.TRUSTED_SERVER__RELEASE_JS_TESTS !== '1'
+) {
+  throw new Error('TRUSTED_SERVER__RELEASE_JS_TESTS must be exactly 1 when present');
+}
+
 export default defineConfig({
+  ...(releaseBuild()
+    ? {
+        envDir: false,
+        mode: 'production',
+        server: { host: '127.0.0.1' },
+        // Preserve native imports that Vite otherwise replaces with browser stubs in production.
+        plugins: [
+          {
+            name: 'release-test-node-builtins',
+            enforce: 'pre' as const,
+            resolveId(id: string) {
+              if (id.startsWith('node:')) return { id, external: true };
+            },
+          },
+        ],
+      }
+    : {}),
   resolve: {
     alias: {
       // prebid.js doesn't expose src/adapterManager.js via its package
diff --git a/crates/trusted-server-js/tests/release_prebuilt.rs b/crates/trusted-server-js/tests/release_prebuilt.rs
new file mode 100644
index 0000000000..7a1b7959c5
--- /dev/null
+++ b/crates/trusted-server-js/tests/release_prebuilt.rs
@@ -0,0 +1,962 @@
+#![cfg(any(target_os = "linux", target_os = "macos"))]
+#![allow(
+    dead_code,
+    reason = "actual build script is included for isolated process fixtures"
+)]
+
+#[path = "../build.rs"]
+mod build_script;
+
+use std::env;
+use std::ffi::OsString;
+use std::fs;
+use std::os::unix::ffi::OsStringExt as _;
+use std::os::unix::fs::{PermissionsExt as _, symlink};
+use std::path::PathBuf;
+use std::process::{Command, Output};
+
+use serde_json::{Value, json};
+use sha2::{Digest as _, Sha256};
+use tempfile::{TempDir, tempdir};
+
+const SOURCE: &str = "0123456789abcdef0123456789abcdef01234567";
+const BYTES: &[u8] = b"console.log('example');";
+
+struct Fixture {
+    root: TempDir,
+    inventory: Value,
+}
+
+impl Fixture {
+    fn new() -> Self {
+        let root = tempdir().expect("should create fixture root");
+        for name in ["lib/src/integrations", "bundles", "out", "bin"] {
+            fs::create_dir_all(root.path().join(name)).expect("should create fixture directory");
+        }
+        fs::write(root.path().join("bundles/tsjs-core.js"), BYTES)
+            .expect("should write core bundle");
+        let npm = root.path().join("bin/npm");
+        fs::write(
+            &npm,
+            "#!/bin/sh\n: > \"$CARGO_MANIFEST_DIR/npm-called\"\nexit 97\n",
+        )
+        .expect("should write failing npm");
+        fs::set_permissions(npm, fs::Permissions::from_mode(0o755))
+            .expect("should make npm executable");
+        Self {
+            root,
+            inventory: json!({
+                "schema_version": 1, "source_commit": SOURCE,
+                "modules": [{ "id": "core", "filename": "tsjs-core.js", "size": BYTES.len(),
+                    "sha256": hex::encode(Sha256::digest(BYTES)), "contributions": [] }],
+                "tools": [], "materials": []
+            }),
+        }
+    }
+
+    fn path(&self, name: &str) -> PathBuf {
+        self.root.path().join(name)
+    }
+
+    fn command(&self) -> Command {
+        let mut command = Command::new(env::current_exe().expect("should locate test executable"));
+        command
+            .args(["--exact", "fixture_entry", "--ignored", "--nocapture"])
+            .env_clear()
+            .env("CARGO_MANIFEST_DIR", self.root.path())
+            .env("OUT_DIR", self.path("out"))
+            .env("PATH", self.path("bin"))
+            .env("TRUSTED_SERVER__TSJS_TEST_SUBPROCESS", "1")
+            .env("TRUSTED_SERVER__RELEASE_BUILD", "1")
+            .env("TRUSTED_SERVER__GIT_VERSION", SOURCE)
+            .env("TSJS_PREBUILT_DIR", self.path("bundles"))
+            .env(
+                "TRUSTED_SERVER__TSJS_PREBUILT_INVENTORY",
+                self.path("inventory.json"),
+            );
+        command
+    }
+
+    fn write_inventory(&self) {
+        fs::write(
+            self.path("inventory.json"),
+            serde_json::to_vec(&self.inventory).expect("should serialize inventory"),
+        )
+        .expect("should write inventory");
+    }
+
+    fn rejected(&self, output: &Output, diagnostic: &str) {
+        let output_text = String::from_utf8_lossy(&output.stderr);
+        assert!(
+            !output.status.success(),
+            "should reject fixture: {output_text}"
+        );
+        assert!(
+            output_text.contains(diagnostic),
+            "should report {diagnostic}: {output_text}"
+        );
+        assert!(
+            !self.path("npm-called").exists(),
+            "should reject before invoking npm"
+        );
+        assert!(
+            !self.path("out/tsjs_modules.rs").exists(),
+            "should not generate a rejected module table"
+        );
+    }
+
+    fn add_integration(&mut self, id: &str) {
+        fs::create_dir(self.path(&format!("lib/src/integrations/{id}")))
+            .expect("should create integration");
+        fs::write(
+            self.path(&format!("lib/src/integrations/{id}/index.ts")),
+            b"export {};",
+        )
+        .expect("should write integration entry");
+        fs::write(self.path(&format!("bundles/tsjs-{id}.js")), BYTES)
+            .expect("should write integration bundle");
+        let mut module = self.inventory["modules"][0].clone();
+        module["id"] = json!(id);
+        module["filename"] = json!(format!("tsjs-{id}.js"));
+        self.inventory["modules"]
+            .as_array_mut()
+            .expect("should access modules")
+            .push(module);
+        self.inventory["modules"]
+            .as_array_mut()
+            .expect("should access modules")
+            .sort_by(|left, right| left["id"].as_str().cmp(&right["id"].as_str()));
+    }
+}
+
+#[test]
+fn rejects_reversed_complete_two_module_inventory() {
+    let mut fixture = Fixture::new();
+    fixture.add_integration("aaa");
+    fixture.inventory["modules"]
+        .as_array_mut()
+        .expect("should access modules")
+        .reverse();
+    fixture.write_inventory();
+    fixture.rejected(
+        &fixture.command().output().expect("should execute fixture"),
+        "inventory module identity, order, size or digest is invalid",
+    );
+}
+
+#[test]
+fn rejects_unsafe_and_duplicate_core_source_integrations() {
+    for id in ["unsafe\"name", "core"] {
+        let mut fixture = Fixture::new();
+        fixture.add_integration(id);
+        fixture.write_inventory();
+        fixture.rejected(
+            &fixture.command().output().expect("should execute fixture"),
+            if id == "core" {
+                "duplicate core module ID"
+            } else {
+                "module ID unsafe\"name must be a safe ASCII identifier"
+            },
+        );
+    }
+}
+
+#[test]
+fn accepts_safe_opaque_floats_and_negative_integers() {
+    let mut fixture = Fixture::new();
+    fixture.inventory["tools"] = json!([
+        0.5,
+        1.5e-10,
+        -1,
+        -9_007_199_254_740_991_i64,
+        9_007_199_254_740_991_u64
+    ]);
+    fixture.inventory["materials"] = json!([{"nested": [1.0, -0.0]}]);
+    fixture.write_inventory();
+    let output = fixture.command().output().expect("should execute fixture");
+    assert!(
+        output.status.success(),
+        "should accept safe opaque numeric metadata: {output:?}"
+    );
+}
+
+#[test]
+#[ignore = "entry point invoked only by fixture subprocesses"]
+fn fixture_entry() {
+    if env::var_os("TRUSTED_SERVER__TSJS_TEST_SUBPROCESS").as_deref()
+        != Some(std::ffi::OsStr::new("1"))
+    {
+        return;
+    }
+    build_script::run_with_hook(|source, copied| {
+        match env::var("TRUSTED_SERVER__TSJS_TEST_MUTATION").as_deref() {
+            Ok("source") => fs::write(source.join("tsjs-core.js"), b"changed bytes")
+                .expect("should mutate source"),
+            Ok("swap") => {
+                fs::remove_file(source.join("tsjs-core.js")).expect("should remove source");
+                symlink(copied.join("tsjs-core.js"), source.join("tsjs-core.js"))
+                    .expect("should swap source to link");
+            }
+            Ok("private") => fs::write(copied.join("tsjs-core.js"), b"changed bytes")
+                .expect("should mutate copied bytes"),
+            Ok("extra") => {
+                fs::write(source.join("notes.txt"), b"extra").expect("should add source name")
+            }
+            Ok("identity") => {
+                fs::write(source.join("replacement.js"), BYTES)
+                    .expect("should write replacement bytes");
+                fs::rename(source.join("replacement.js"), source.join("tsjs-core.js"))
+                    .expect("should replace source identity");
+            }
+            Ok("directory") => {
+                fs::rename(source, source.with_extension("original"))
+                    .expect("should move source directory");
+                fs::create_dir(source).expect("should replace source directory");
+                fs::write(source.join("tsjs-core.js"), BYTES)
+                    .expect("should replace identical source bytes");
+            }
+            Ok("parent") => {
+                let parent = source.parent().expect("should have source parent");
+                let root = parent.parent().expect("should have fixture root");
+                fs::remove_file(parent).expect("should remove parent link");
+                symlink(root.join("other"), parent).expect("should redirect parent link");
+            }
+            _ => {}
+        }
+    });
+}
+
+#[test]
+fn release_accepts_checked_bundles_without_npm() {
+    let fixture = Fixture::new();
+    fixture.write_inventory();
+    let output = fixture.command().output().expect("should execute fixture");
+    assert!(
+        output.status.success(),
+        "should accept checked bundles: {output:?}"
+    );
+    assert_eq!(
+        fs::read(fixture.path("out/tsjs-dist/tsjs-core.js")).expect("should read copied bundle"),
+        BYTES,
+        "should copy authenticated bytes"
+    );
+    assert!(
+        !fixture.path("npm-called").exists(),
+        "should never invoke npm in release mode"
+    );
+}
+
+#[test]
+fn ignored_entry_without_explicit_subprocess_marker_does_not_write() {
+    let fixture = Fixture::new();
+    fixture.write_inventory();
+    let output = fixture
+        .command()
+        .env_remove("TRUSTED_SERVER__TSJS_TEST_SUBPROCESS")
+        .output()
+        .expect("should invoke ignored entry directly");
+    assert!(
+        output.status.success(),
+        "should leave the direct ignored entry inert: {output:?}"
+    );
+    assert!(
+        !fixture.path("out/tsjs_modules.rs").exists(),
+        "should never write without explicit marker"
+    );
+}
+
+#[test]
+fn rejects_any_skip_presence_before_prebuilt_selection() {
+    for value in [
+        OsString::from(""),
+        OsString::from("0"),
+        OsString::from("1"),
+        OsString::from_vec(vec![0xff]),
+    ] {
+        let fixture = Fixture::new();
+        fixture.write_inventory();
+        let output = fixture
+            .command()
+            .env("TSJS_SKIP_BUILD", value)
+            .output()
+            .expect("should execute fixture");
+        fixture.rejected(&output, "TSJS_SKIP_BUILD");
+    }
+}
+
+#[test]
+fn release_requires_both_prebuilt_inputs() {
+    for missing in [
+        "TSJS_PREBUILT_DIR",
+        "TRUSTED_SERVER__TSJS_PREBUILT_INVENTORY",
+    ] {
+        let fixture = Fixture::new();
+        fixture.write_inventory();
+        let output = fixture
+            .command()
+            .env_remove(missing)
+            .output()
+            .expect("should execute fixture");
+        fixture.rejected(&output, missing);
+    }
+}
+
+#[test]
+fn rejects_inventory_identity_and_module_tampering() {
+    for case in [
+        "source",
+        "digest",
+        "size",
+        "duplicate",
+        "filename",
+        "id",
+        "missing",
+        "empty",
+        "extra",
+        "unknown",
+        "version",
+        "tools",
+        "bool_size",
+        "float_size",
+        "negative_size",
+        "module_unknown",
+        "missing_array",
+        "size_bound",
+        "contributions",
+    ] {
+        let mut fixture = Fixture::new();
+        match case {
+            "source" => fixture.inventory["source_commit"] = json!("a".repeat(40)),
+            "digest" => fixture.inventory["modules"][0]["sha256"] = json!("a".repeat(64)),
+            "size" => fixture.inventory["modules"][0]["size"] = json!(BYTES.len() + 1),
+            "duplicate" => {
+                let module = fixture.inventory["modules"][0].clone();
+                fixture.inventory["modules"]
+                    .as_array_mut()
+                    .expect("should access modules")
+                    .push(module);
+            }
+            "filename" => fixture.inventory["modules"][0]["filename"] = json!("../tsjs-core.js"),
+            "id" => fixture.inventory["modules"][0]["id"] = json!("../core"),
+            "missing" => fixture.inventory["modules"] = json!([]),
+            "empty" => fixture.inventory["modules"][0]["size"] = json!(0),
+            "extra" => {
+                let mut module = fixture.inventory["modules"][0].clone();
+                module["id"] = json!("aaa");
+                module["filename"] = json!("tsjs-aaa.js");
+                fixture.inventory["modules"]
+                    .as_array_mut()
+                    .expect("should access modules")
+                    .push(module);
+            }
+            "unknown" => fixture.inventory["unknown"] = json!(1),
+            "version" => fixture.inventory["schema_version"] = json!(true),
+            "tools" => fixture.inventory["tools"] = json!({}),
+            "bool_size" => fixture.inventory["modules"][0]["size"] = json!(true),
+            "float_size" => fixture.inventory["modules"][0]["size"] = json!(1.0),
+            "negative_size" => fixture.inventory["modules"][0]["size"] = json!(-1),
+            "module_unknown" => fixture.inventory["modules"][0]["unknown"] = json!(1),
+            "missing_array" => {
+                fixture
+                    .inventory
+                    .as_object_mut()
+                    .expect("should access inventory")
+                    .remove("materials");
+            }
+            "size_bound" => fixture.inventory["modules"][0]["size"] = json!(32 * 1024 * 1024 + 1),
+            "contributions" => fixture.inventory["modules"][0]["contributions"] = json!({}),
+            _ => unreachable!("should use listed case"),
+        }
+        fixture.write_inventory();
+        fixture.rejected(
+            &fixture.command().output().expect("should execute fixture"),
+            match case {
+                "source" => "inventory schema version or source does not match",
+                "digest" => "inventory bundle digest mismatch",
+                "size" => "inventory bundle size mismatch",
+                "missing" => "missing bundles",
+                "unknown" | "module_unknown" => "unknown field",
+                "missing_array" => "missing field",
+                "version" | "tools" | "bool_size" | "float_size" | "contributions" => {
+                    "invalid type"
+                }
+                "negative_size" => "invalid value",
+                _ => "inventory module identity, order, size or digest is invalid",
+            },
+        );
+    }
+}
+
+#[test]
+fn rejects_inexact_source_directories() {
+    for case in [
+        "missing",
+        "empty",
+        "extra",
+        "unrelated",
+        "directory",
+        "link",
+        "hardlink",
+    ] {
+        let fixture = Fixture::new();
+        fixture.write_inventory();
+        match case {
+            "missing" => {
+                fs::remove_file(fixture.path("bundles/tsjs-core.js")).expect("should remove bundle")
+            }
+            "empty" => {
+                fs::write(fixture.path("bundles/tsjs-core.js"), []).expect("should empty bundle")
+            }
+            "extra" | "unrelated" => fs::write(
+                fixture.path(if case == "extra" {
+                    "bundles/tsjs-extra.js"
+                } else {
+                    "bundles/notes.txt"
+                }),
+                BYTES,
+            )
+            .expect("should add file"),
+            "directory" => {
+                fs::create_dir(fixture.path("bundles/extra")).expect("should add directory")
+            }
+            "link" => {
+                fs::remove_file(fixture.path("bundles/tsjs-core.js"))
+                    .expect("should remove bundle");
+                symlink(
+                    fixture.path("inventory.json"),
+                    fixture.path("bundles/tsjs-core.js"),
+                )
+                .expect("should link bundle");
+            }
+            "hardlink" => fs::hard_link(
+                fixture.path("bundles/tsjs-core.js"),
+                fixture.path("alias.js"),
+            )
+            .expect("should hardlink bundle"),
+            _ => unreachable!("should use listed case"),
+        }
+        fixture.rejected(
+            &fixture.command().output().expect("should execute fixture"),
+            match case {
+                "missing" => "missing bundles",
+                "empty" => "empty bundles",
+                "extra" | "unrelated" | "directory" => "unexpected extra bundle directory entry",
+                "link" => "cannot open bundle",
+                "hardlink" => "exactly one hard link",
+                _ => unreachable!("should use listed case"),
+            },
+        );
+    }
+}
+
+#[test]
+fn rejects_ambiguous_or_unbounded_json() {
+    for case in [
+        "duplicate",
+        "nested",
+        "nonfinite",
+        "overflow",
+        "integer_overflow",
+        "depth",
+        "oversize",
+        "bom",
+        "utf8",
+    ] {
+        let fixture = Fixture::new();
+        let valid = serde_json::to_string(&fixture.inventory).expect("should serialize fixture");
+        let raw = match case {
+            "duplicate" => valid
+                .replacen("{", "{\"schema_version\":1,", 1)
+                .into_bytes(),
+            "nested" => valid
+                .replace("\"tools\":[]", "\"tools\":[{\"a\":1,\"a\":2}]")
+                .into_bytes(),
+            "nonfinite" => valid
+                .replace("\"tools\":[]", "\"tools\":[NaN]")
+                .into_bytes(),
+            "overflow" => valid
+                .replace("\"tools\":[]", "\"tools\":[1e9999]")
+                .into_bytes(),
+            "integer_overflow" => valid
+                .replace("\"tools\":[]", "\"tools\":[18446744073709551616]")
+                .into_bytes(),
+            "depth" => valid
+                .replace(
+                    "\"tools\":[]",
+                    &format!("\"tools\":[{}0{}]", "[".repeat(65), "]".repeat(65)),
+                )
+                .into_bytes(),
+            "oversize" => vec![b' '; 1024 * 1024 + 1],
+            "bom" => [vec![0xef, 0xbb, 0xbf], valid.into_bytes()].concat(),
+            "utf8" => vec![0xff],
+            _ => unreachable!("should use listed case"),
+        };
+        fs::write(fixture.path("inventory.json"), raw).expect("should write malformed inventory");
+        fixture.rejected(
+            &fixture.command().output().expect("should execute fixture"),
+            match case {
+                "duplicate" | "nested" => "duplicate JSON key",
+                "nonfinite" | "bom" => "expected value",
+                "overflow" => "inventory number overflows",
+                "integer_overflow" => "unsafe integer",
+                "depth" => "JSON depth exceeds 64",
+                "oversize" => "inventory exceeds 1 MiB",
+                "utf8" => "inventory must be UTF-8",
+                _ => unreachable!("should use listed case"),
+            },
+        );
+    }
+}
+
+#[test]
+fn development_prebuilt_without_inventory_remains_supported() {
+    let fixture = Fixture::new();
+    fs::write(fixture.path("bundles/manifest.json"), b"{}").expect("should write legacy manifest");
+    fs::write(fixture.path("bundles/.DS_Store"), b"metadata")
+        .expect("should write legacy metadata");
+    fs::create_dir(fixture.path("bundles/prebid")).expect("should create legacy tree");
+    fs::write(fixture.path("bundles/prebid/package.json"), b"{}")
+        .expect("should write legacy package output");
+    fs::write(fixture.path("bundles/prebid/prebid.js"), BYTES)
+        .expect("should write legacy external bundle output");
+    symlink(
+        fixture.path("bundles/prebid"),
+        fixture.path("bundles/legacy-link"),
+    )
+    .expect("should create legacy directory alias");
+    fs::hard_link(
+        fixture.path("bundles/tsjs-core.js"),
+        fixture.path("alias.js"),
+    )
+    .expect("should retain legacy bundle hard links");
+    let output = fixture
+        .command()
+        .env_remove("TRUSTED_SERVER__RELEASE_BUILD")
+        .env_remove("TRUSTED_SERVER__TSJS_PREBUILT_INVENTORY")
+        .output()
+        .expect("should execute fixture");
+    assert!(
+        output.status.success(),
+        "should support development prebuilt bundles: {output:?}"
+    );
+}
+
+#[test]
+fn rejects_source_or_copied_bytes_changed_during_copy() {
+    for mutation in [
+        "source",
+        "swap",
+        "private",
+        "extra",
+        "identity",
+        "directory",
+    ] {
+        let fixture = Fixture::new();
+        fixture.write_inventory();
+        let output = fixture
+            .command()
+            .env("TRUSTED_SERVER__TSJS_TEST_MUTATION", mutation)
+            .output()
+            .expect("should execute fixture");
+        fixture.rejected(
+            &output,
+            match mutation {
+                "source" => "changed during copy",
+                "swap" => "cannot open bundle",
+                "private" => "private copied bundle does not match",
+                "extra" => "unexpected extra bundle directory entry",
+                "identity" | "directory" => "identity changed during copy",
+                _ => unreachable!("should use listed mutation"),
+            },
+        );
+    }
+}
+
+#[test]
+fn rejects_release_controls_and_relative_paths_before_npm() {
+    for (variable, value) in [
+        ("TRUSTED_SERVER__RELEASE_BUILD", ""),
+        ("TRUSTED_SERVER__RELEASE_BUILD", "0"),
+        ("TRUSTED_SERVER__RELEASE_BUILD", "true"),
+        ("TRUSTED_SERVER__GIT_VERSION", ""),
+        ("TRUSTED_SERVER__GIT_VERSION", "abcdef"),
+        ("TSJS_PREBUILT_DIR", "bundles"),
+        ("TRUSTED_SERVER__TSJS_PREBUILT_INVENTORY", "inventory.json"),
+    ] {
+        let fixture = Fixture::new();
+        fixture.write_inventory();
+        fixture.rejected(
+            &fixture
+                .command()
+                .env(variable, value)
+                .output()
+                .expect("should execute fixture"),
+            match variable {
+                "TRUSTED_SERVER__RELEASE_BUILD" => {
+                    "TRUSTED_SERVER__RELEASE_BUILD must be exactly 1"
+                }
+                "TRUSTED_SERVER__GIT_VERSION" if value.is_empty() => {
+                    "release source must be exactly 40"
+                }
+                "TRUSTED_SERVER__GIT_VERSION" => "release source must be exactly 40",
+                _ => "must be an absolute path",
+            },
+        );
+    }
+    let fixture = Fixture::new();
+    fixture.write_inventory();
+    fixture.rejected(
+        &fixture
+            .command()
+            .env_remove("TRUSTED_SERVER__GIT_VERSION")
+            .output()
+            .expect("should execute fixture"),
+        "TRUSTED_SERVER__GIT_VERSION",
+    );
+}
+
+#[test]
+fn development_inventory_checks_bundle_bytes_without_comparing_display_source() {
+    for identity in ["main", "v1.2.3", "a".repeat(40).as_str()] {
+        let fixture = Fixture::new();
+        fixture.write_inventory();
+        let output = fixture
+            .command()
+            .env_remove("TRUSTED_SERVER__RELEASE_BUILD")
+            .env("TRUSTED_SERVER__GIT_VERSION", identity)
+            .output()
+            .expect("should execute development fixture");
+        assert!(
+            output.status.success(),
+            "should permit development display identity: {output:?}"
+        );
+    }
+    {
+        let fixture = Fixture::new();
+        fixture.write_inventory();
+        let mut command = fixture.command();
+        command.env_remove("TRUSTED_SERVER__RELEASE_BUILD");
+        fs::write(fixture.path("bundles/tsjs-core.js"), b"tampered bytes")
+            .expect("should change bundle");
+        fixture.rejected(
+            &command.output().expect("should execute fixture"),
+            "inventory bundle size mismatch",
+        );
+    }
+    let fixture = Fixture::new();
+    fixture.write_inventory();
+    let output = fixture
+        .command()
+        .env_remove("TRUSTED_SERVER__RELEASE_BUILD")
+        .env_remove("TRUSTED_SERVER__GIT_VERSION")
+        .output()
+        .expect("should execute fixture");
+    assert!(
+        output.status.success(),
+        "should validate development inventory without claiming approved source: {output:?}"
+    );
+}
+
+#[test]
+fn rejects_skip_presence_in_development_source_and_prebuilt_modes() {
+    for prebuilt in [true, false] {
+        for value in ["", "0", "1"] {
+            let fixture = Fixture::new();
+            let mut command = fixture.command();
+            command
+                .env_remove("TRUSTED_SERVER__RELEASE_BUILD")
+                .env_remove("TRUSTED_SERVER__TSJS_PREBUILT_INVENTORY")
+                .env("TSJS_SKIP_BUILD", value);
+            if !prebuilt {
+                command.env_remove("TSJS_PREBUILT_DIR");
+            }
+            fixture.rejected(
+                &command.output().expect("should execute fixture"),
+                "TSJS_SKIP_BUILD",
+            );
+        }
+    }
+}
+
+#[test]
+fn development_source_build_uses_fresh_npm_output() {
+    let fixture = Fixture::new();
+    fs::write(fixture.path("lib/package.json"), json!({}).to_string())
+        .expect("should write package fixture");
+    fs::create_dir(fixture.path("lib/node_modules"))
+        .expect("should create installed dependencies fixture");
+    fs::create_dir(fixture.path("dist")).expect("should create stale old dist");
+    fs::write(fixture.path("dist/tsjs-core.js"), b"stale bytes")
+        .expect("should write stale bundle");
+    fs::write(fixture.path("bin/npm"), "#!/bin/sh\n: > \"$CARGO_MANIFEST_DIR/npm-called\"\nfor argument in \"$@\"; do output=\"$argument\"; done\n/bin/mkdir -p \"$output\"\nprintf 'fresh source bytes' > \"$output/tsjs-core.js\"\n").expect("should write source builder fixture");
+    let output = fixture
+        .command()
+        .env_remove("TRUSTED_SERVER__RELEASE_BUILD")
+        .env_remove("TSJS_PREBUILT_DIR")
+        .env_remove("TRUSTED_SERVER__TSJS_PREBUILT_INVENTORY")
+        .output()
+        .expect("should execute fixture");
+    assert!(
+        output.status.success(),
+        "should support ordinary fresh development build: {output:?}"
+    );
+    assert_eq!(
+        fs::read(fixture.path("out/tsjs-dist/tsjs-core.js")).expect("should read fresh bundle"),
+        b"fresh source bytes",
+        "should embed current npm output"
+    );
+    assert!(
+        fixture.path("npm-called").exists(),
+        "should invoke npm for development source build"
+    );
+}
+
+#[test]
+fn inventory_sorting_preserves_core_first_runtime_order() {
+    let mut fixture = Fixture::new();
+    fs::create_dir(fixture.path("lib/src/integrations/aaa")).expect("should create integration");
+    fs::write(
+        fixture.path("lib/src/integrations/aaa/index.ts"),
+        b"export {};",
+    )
+    .expect("should write source entry");
+    fs::write(fixture.path("bundles/tsjs-aaa.js"), BYTES).expect("should write integration bundle");
+    let mut module = fixture.inventory["modules"][0].clone();
+    module["id"] = json!("aaa");
+    module["filename"] = json!("tsjs-aaa.js");
+    fixture.inventory["modules"]
+        .as_array_mut()
+        .expect("should access modules")
+        .insert(0, module);
+    fixture.write_inventory();
+    let output = fixture.command().output().expect("should execute fixture");
+    assert!(
+        output.status.success(),
+        "should accept sorted inventory independently of runtime order: {output:?}"
+    );
+    let generated = fs::read_to_string(fixture.path("out/tsjs_modules.rs"))
+        .expect("should read generated code");
+    assert!(
+        generated.find("id: \"core\"") < generated.find("id: \"aaa\""),
+        "should retain core first runtime order"
+    );
+}
+
+#[test]
+fn rejects_inventory_inside_source_and_private_destination_links() {
+    for case in ["inside", "link", "file"] {
+        let fixture = Fixture::new();
+        fixture.write_inventory();
+        let mut command = fixture.command();
+        match case {
+            "inside" => {
+                fs::copy(
+                    fixture.path("inventory.json"),
+                    fixture.path("bundles/inventory.json"),
+                )
+                .expect("should place inventory inside source");
+                command.env(
+                    "TRUSTED_SERVER__TSJS_PREBUILT_INVENTORY",
+                    fixture.path("bundles/inventory.json"),
+                );
+            }
+            "link" => symlink(fixture.path("bundles"), fixture.path("out/tsjs-dist"))
+                .expect("should link private destination"),
+            "file" => fs::write(fixture.path("out/tsjs-dist"), b"existing file")
+                .expect("should write conflicting destination"),
+            _ => unreachable!("should use listed case"),
+        }
+        fixture.rejected(
+            &command.output().expect("should execute fixture"),
+            match case {
+                "inside" => "inventory must be outside",
+                "link" | "file" => "private bundle destination must be a directory",
+                _ => unreachable!("should use listed case"),
+            },
+        );
+        assert_eq!(
+            fs::read(fixture.path("bundles/tsjs-core.js")).expect("should preserve input bundle"),
+            BYTES,
+            "should preserve source when rejecting destination"
+        );
+    }
+}
+
+#[test]
+fn emits_rerun_directives_for_inventory_and_release_inputs() {
+    let fixture = Fixture::new();
+    fixture.write_inventory();
+    let output = fixture.command().output().expect("should execute fixture");
+    assert!(output.status.success(), "should accept checked fixture");
+    let stdout = String::from_utf8(output.stdout).expect("should capture UTF-8 directives");
+    for variable in [
+        "TSJS_SKIP_BUILD",
+        "TSJS_PREBUILT_DIR",
+        "TRUSTED_SERVER__TSJS_PREBUILT_INVENTORY",
+        "TRUSTED_SERVER__RELEASE_BUILD",
+        "TRUSTED_SERVER__GIT_VERSION",
+    ] {
+        assert!(
+            stdout.contains(&format!("cargo:rerun-if-env-changed={variable}")),
+            "should watch {variable}"
+        );
+    }
+    for path in [
+        "lib/build-module-options.mjs",
+        "lib/release-composition.mjs",
+        "lib/vitest.config.ts",
+    ] {
+        assert!(
+            stdout.contains(&format!("cargo:rerun-if-changed={path}")),
+            "should watch JS build and test configuration input {path}"
+        );
+    }
+    for path in [fixture.path("inventory.json"), fixture.path("bundles")] {
+        assert!(
+            stdout.contains(&format!("cargo:rerun-if-changed={}", path.display())),
+            "should watch prebuilt input path"
+        );
+    }
+}
+
+#[test]
+fn exposes_raw_inventory_digest_for_later_cargo_build_evidence() {
+    let fixture = Fixture::new();
+    let mut raw = serde_json::to_vec(&fixture.inventory).expect("should serialize inventory");
+    raw.extend_from_slice(b"\n \n");
+    fs::write(fixture.path("inventory.json"), &raw).expect("should write raw inventory");
+
+    let output = fixture.command().output().expect("should execute fixture");
+
+    assert!(
+        output.status.success(),
+        "should accept whitespace-preserving inventory"
+    );
+    let stdout = String::from_utf8(output.stdout).expect("should capture UTF-8 directives");
+    assert!(
+        stdout.contains(&format!(
+            "cargo:rustc-env=TRUSTED_SERVER__TSJS_INVENTORY_SHA256={}",
+            hex::encode(Sha256::digest(&raw))
+        )),
+        "should report digest of the exact held inventory bytes: {stdout}"
+    );
+}
+
+#[test]
+fn development_inventory_does_not_compare_non_unicode_display_source() {
+    let fixture = Fixture::new();
+    fixture.write_inventory();
+
+    let output = fixture
+        .command()
+        .env_remove("TRUSTED_SERVER__RELEASE_BUILD")
+        .env(
+            "TRUSTED_SERVER__GIT_VERSION",
+            OsString::from_vec(vec![0xff]),
+        )
+        .output()
+        .expect("should execute fixture");
+
+    assert!(
+        output.status.success(),
+        "should leave development identity resolution to core: {output:?}"
+    );
+}
+
+#[test]
+fn rejects_source_leaf_links_with_lexical_directory_suffixes() {
+    for suffix in ["", "/", "//", "/.", "/./"] {
+        let fixture = Fixture::new();
+        fixture.write_inventory();
+        symlink(fixture.path("bundles"), fixture.path("bundles-link"))
+            .expect("should link source directory");
+        let output = fixture
+            .command()
+            .env(
+                "TSJS_PREBUILT_DIR",
+                format!("{}{suffix}", fixture.path("bundles-link").display()),
+            )
+            .output()
+            .expect("should execute linked source fixture");
+        fixture.rejected(&output, "bundles-link");
+    }
+}
+
+#[test]
+fn rejects_unsafe_integral_opaque_numbers() {
+    for literal in ["9007199254740993", "-9007199254740993", "1e20", "1.5e300"] {
+        for field in ["tools", "materials", "contributions"] {
+            let fixture = Fixture::new();
+            let raw = serde_json::to_string(&fixture.inventory)
+                .expect("should serialize inventory")
+                .replace(
+                    &format!("\"{field}\":[]"),
+                    &format!("\"{field}\":[{{\"nested\":{literal}}}]"),
+                );
+            fs::write(fixture.path("inventory.json"), raw).expect("should write opaque number");
+            fixture.rejected(
+                &fixture.command().output().expect("should execute fixture"),
+                "unsafe integer",
+            );
+        }
+    }
+}
+
+#[test]
+fn permits_exact_inventory_size_and_depth_boundaries() {
+    let mut fixture = Fixture::new();
+    let mut value = json!(0);
+    for _ in 0..62 {
+        value = json!([value]);
+    }
+    fixture.inventory["tools"] = json!([value]);
+    let mut raw =
+        serde_json::to_vec(&fixture.inventory).expect("should serialize boundary inventory");
+    raw.resize(1024 * 1024, b' ');
+    fs::write(fixture.path("inventory.json"), raw).expect("should write boundary inventory");
+
+    let output = fixture.command().output().expect("should execute fixture");
+
+    assert!(
+        output.status.success(),
+        "should accept inventory at byte and container-depth limits: {output:?}"
+    );
+}
+
+#[test]
+fn permits_parent_links_when_the_held_source_identity_stays_fixed() {
+    let fixture = Fixture::new();
+    fixture.write_inventory();
+    symlink(fixture.root.path(), fixture.path("parent-alias")).expect("should create parent alias");
+
+    let output = fixture
+        .command()
+        .env("TSJS_PREBUILT_DIR", fixture.path("parent-alias/bundles"))
+        .output()
+        .expect("should execute fixture");
+
+    assert!(
+        output.status.success(),
+        "should anchor copying to unchanged directory identity through a parent alias: {output:?}"
+    );
+}
+
+#[test]
+fn rejects_parent_link_redirection_to_byte_identical_directory() {
+    let fixture = Fixture::new();
+    fixture.write_inventory();
+    symlink(fixture.root.path(), fixture.path("parent-alias")).expect("should create parent alias");
+    fs::create_dir_all(fixture.path("other/bundles"))
+        .expect("should create other source directory");
+    fs::write(fixture.path("other/bundles/tsjs-core.js"), BYTES)
+        .expect("should write identical other bytes");
+
+    let output = fixture
+        .command()
+        .env("TSJS_PREBUILT_DIR", fixture.path("parent-alias/bundles"))
+        .env("TRUSTED_SERVER__TSJS_TEST_MUTATION", "parent")
+        .output()
+        .expect("should execute fixture");
+
+    fixture.rejected(&output, "identity changed");
+}
diff --git a/crates/trusted-server-release/Cargo.toml b/crates/trusted-server-release/Cargo.toml
new file mode 100644
index 0000000000..21ef8f2afc
--- /dev/null
+++ b/crates/trusted-server-release/Cargo.toml
@@ -0,0 +1,48 @@
+[package]
+name = "trusted-server-release"
+edition.workspace = true
+license.workspace = true
+publish.workspace = true
+version.workspace = true
+rust-version = "1.95"
+
+[dependencies]
+base64.workspace = true
+clap.workspace = true
+derive_more.workspace = true
+error-stack.workspace = true
+flate2.workspace = true
+hex.workspace = true
+hmac.workspace = true
+libc.workspace = true
+jsonschema = { version = "=0.58.6", default-features = false }
+object = { version = "=0.37.3", default-features = false, features = [
+    "elf",
+    "macho",
+    "read_core",
+    "std",
+] }
+reqwest = { workspace = true, features = ["hickory-dns"] }
+serde.workspace = true
+serde_json.workspace = true
+# Parse reviewed workflow contracts with the workspace's existing YAML parser.
+serde_yaml_ng.workspace = true
+sha1-checked = { version = "=0.10.0", default-features = false }
+sha2.workspace = true
+tempfile.workspace = true
+tar = { version = "=0.4.46", default-features = false }
+tokio.workspace = true
+toml.workspace = true
+wasmparser = { version = "=0.247.0", default-features = false, features = [
+    "features",
+    "simd",
+    "std",
+    "validate",
+] }
+
+[dev-dependencies]
+rcgen.workspace = true
+rustls.workspace = true
+
+[lints]
+workspace = true
diff --git a/crates/trusted-server-release/schemas/SPDX-LICENSE b/crates/trusted-server-release/schemas/SPDX-LICENSE
new file mode 100644
index 0000000000..44a22d370b
--- /dev/null
+++ b/crates/trusted-server-release/schemas/SPDX-LICENSE
@@ -0,0 +1,92 @@
+Creative Commons Attribution 3.0 Unported
+
+CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE LEGAL SERVICES. DISTRIBUTION OF THIS LICENSE DOES NOT CREATE AN ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES REGARDING THE INFORMATION PROVIDED, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM ITS USE.
+License
+
+THE WORK (AS DEFINED BELOW) IS PROVIDED UNDER THE TERMS OF THIS CREATIVE COMMONS PUBLIC LICENSE ("CCPL" OR "LICENSE"). THE WORK IS PROTECTED BY COPYRIGHT AND/OR OTHER APPLICABLE LAW. ANY USE OF THE WORK OTHER THAN AS AUTHORIZED UNDER THIS LICENSE OR COPYRIGHT LAW IS PROHIBITED.
+
+BY EXERCISING ANY RIGHTS TO THE WORK PROVIDED HERE, YOU ACCEPT AND AGREE TO BE BOUND BY THE TERMS OF THIS LICENSE. TO THE EXTENT THIS LICENSE MAY BE CONSIDERED TO BE A CONTRACT, THE LICENSOR GRANTS YOU THE RIGHTS CONTAINED HERE IN CONSIDERATION OF YOUR ACCEPTANCE OF SUCH TERMS AND CONDITIONS.
+
+1. Definitions
+
+a. "Adaptation" means a work based upon the Work, or upon the Work and other pre-existing works, such as a translation, adaptation, derivative work, arrangement of music or other alterations of a literary or artistic work, or phonogram or performance and includes cinematographic adaptations or any other form in which the Work may be recast, transformed, or adapted including in any form recognizably derived from the original, except that a work that constitutes a Collection will not be considered an Adaptation for the purpose of this License. For the avoidance of doubt, where the Work is a musical work, performance or phonogram, the synchronization of the Work in timed-relation with a moving image ("synching") will be considered an Adaptation for the purpose of this License.
+
+b. "Collection" means a collection of literary or artistic works, such as encyclopedias and anthologies, or performances, phonograms or broadcasts, or other works or subject matter other than works listed in Section 1(f) below, which, by reason of the selection and arrangement of their contents, constitute intellectual creations, in which the Work is included in its entirety in unmodified form along with one or more other contributions, each constituting separate and independent works in themselves, which together are assembled into a collective whole. A work that constitutes a Collection will not be considered an Adaptation (as defined above) for the purposes of this License.
+
+c. "Distribute" means to make available to the public the original and copies of the Work or Adaptation, as appropriate, through sale or other transfer of ownership.
+
+d. "Licensor" means the individual, individuals, entity or entities that offer(s) the Work under the terms of this License.
+
+e. "Original Author" means, in the case of a literary or artistic work, the individual, individuals, entity or entities who created the Work or if no individual or entity can be identified, the publisher; and in addition (i) in the case of a performance the actors, singers, musicians, dancers, and other persons who act, sing, deliver, declaim, play in, interpret or otherwise perform literary or artistic works or expressions of folklore; (ii) in the case of a phonogram the producer being the person or legal entity who first fixes the sounds of a performance or other sounds; and, (iii) in the case of broadcasts, the organization that transmits the broadcast.
+
+f. "Work" means the literary and/or artistic work offered under the terms of this License including without limitation any production in the literary, scientific and artistic domain, whatever may be the mode or form of its expression including digital form, such as a book, pamphlet and other writing; a lecture, address, sermon or other work of the same nature; a dramatic or dramatico-musical work; a choreographic work or entertainment in dumb show; a musical composition with or without words; a cinematographic work to which are assimilated works expressed by a process analogous to cinematography; a work of drawing, painting, architecture, sculpture, engraving or lithography; a photographic work to which are assimilated works expressed by a process analogous to photography; a work of applied art; an illustration, map, plan, sketch or three-dimensional work relative to geography, topography, architecture or science; a performance; a broadcast; a phonogram; a compilation of data to the extent it is protected as a copyrightable work; or a work performed by a variety or circus performer to the extent it is not otherwise considered a literary or artistic work.
+
+g. "You" means an individual or entity exercising rights under this License who has not previously violated the terms of this License with respect to the Work, or who has received express permission from the Licensor to exercise rights under this License despite a previous violation.
+
+h. "Publicly Perform" means to perform public recitations of the Work and to communicate to the public those public recitations, by any means or process, including by wire or wireless means or public digital performances; to make available to the public Works in such a way that members of the public may access these Works from a place and at a place individually chosen by them; to perform the Work to the public by any means or process and the communication to the public of the performances of the Work, including by public digital performance; to broadcast and rebroadcast the Work by any means including signs, sounds or images.
+
+i. "Reproduce" means to make copies of the Work by any means including without limitation by sound or visual recordings and the right of fixation and reproducing fixations of the Work, including storage of a protected performance or phonogram in digital form or other electronic medium.
+
+2. Fair Dealing Rights. Nothing in this License is intended to reduce, limit, or restrict any uses free from copyright or rights arising from limitations or exceptions that are provided for in connection with the copyright protection under copyright law or other applicable laws.
+
+3. License Grant. Subject to the terms and conditions of this License, Licensor hereby grants You a worldwide, royalty-free, non-exclusive, perpetual (for the duration of the applicable copyright) license to exercise the rights in the Work as stated below:
+
+a. to Reproduce the Work, to incorporate the Work into one or more Collections, and to Reproduce the Work as incorporated in the Collections;
+
+b. to create and Reproduce Adaptations provided that any such Adaptation, including any translation in any medium, takes reasonable steps to clearly label, demarcate or otherwise identify that changes were made to the original Work. For example, a translation could be marked "The original work was translated from English to Spanish," or a modification could indicate "The original work has been modified.";
+
+c. to Distribute and Publicly Perform the Work including as incorporated in Collections; and,
+
+d. to Distribute and Publicly Perform Adaptations.
+
+e. For the avoidance of doubt:
+
+i. Non-waivable Compulsory License Schemes. In those jurisdictions in which the right to collect royalties through any statutory or compulsory licensing scheme cannot be waived, the Licensor reserves the exclusive right to collect such royalties for any exercise by You of the rights granted under this License;
+
+ii. Waivable Compulsory License Schemes. In those jurisdictions in which the right to collect royalties through any statutory or compulsory licensing scheme can be waived, the Licensor waives the exclusive right to collect such royalties for any exercise by You of the rights granted under this License; and,
+
+iii. Voluntary License Schemes. The Licensor waives the right to collect royalties, whether individually or, in the event that the Licensor is a member of a collecting society that administers voluntary licensing schemes, via that society, from any exercise by You of the rights granted under this License.
+
+The above rights may be exercised in all media and formats whether now known or hereafter devised. The above rights include the right to make such modifications as are technically necessary to exercise the rights in other media and formats. Subject to Section 8(f), all rights not expressly granted by Licensor are hereby reserved.
+
+4. Restrictions. The license granted in Section 3 above is expressly made subject to and limited by the following restrictions:
+
+a. You may Distribute or Publicly Perform the Work only under the terms of this License. You must include a copy of, or the Uniform Resource Identifier (URI) for, this License with every copy of the Work You Distribute or Publicly Perform. You may not offer or impose any terms on the Work that restrict the terms of this License or the ability of the recipient of the Work to exercise the rights granted to that recipient under the terms of the License. You may not sublicense the Work. You must keep intact all notices that refer to this License and to the disclaimer of warranties with every copy of the Work You Distribute or Publicly Perform. When You Distribute or Publicly Perform the Work, You may not impose any effective technological measures on the Work that restrict the ability of a recipient of the Work from You to exercise the rights granted to that recipient under the terms of the License. This Section 4(a) applies to the Work as incorporated in a Collection, but this does not require the Collection apart from the Work itself to be made subject to the terms of this License. If You create a Collection, upon notice from any Licensor You must, to the extent practicable, remove from the Collection any credit as required by Section 4(b), as requested. If You create an Adaptation, upon notice from any Licensor You must, to the extent practicable, remove from the Adaptation any credit as required by Section 4(b), as requested.
+
+b. If You Distribute, or Publicly Perform the Work or any Adaptations or Collections, You must, unless a request has been made pursuant to Section 4(a), keep intact all copyright notices for the Work and provide, reasonable to the medium or means You are utilizing: (i) the name of the Original Author (or pseudonym, if applicable) if supplied, and/or if the Original Author and/or Licensor designate another party or parties (e.g., a sponsor institute, publishing entity, journal) for attribution ("Attribution Parties") in Licensor's copyright notice, terms of service or by other reasonable means, the name of such party or parties; (ii) the title of the Work if supplied; (iii) to the extent reasonably practicable, the URI, if any, that Licensor specifies to be associated with the Work, unless such URI does not refer to the copyright notice or licensing information for the Work; and (iv) , consistent with Section 3(b), in the case of an Adaptation, a credit identifying the use of the Work in the Adaptation (e.g., "French translation of the Work by Original Author," or "Screenplay based on original Work by Original Author"). The credit required by this Section 4 (b) may be implemented in any reasonable manner; provided, however, that in the case of a Adaptation or Collection, at a minimum such credit will appear, if a credit for all contributing authors of the Adaptation or Collection appears, then as part of these credits and in a manner at least as prominent as the credits for the other contributing authors. For the avoidance of doubt, You may only use the credit required by this Section for the purpose of attribution in the manner set out above and, by exercising Your rights under this License, You may not implicitly or explicitly assert or imply any connection with, sponsorship or endorsement by the Original Author, Licensor and/or Attribution Parties, as appropriate, of You or Your use of the Work, without the separate, express prior written permission of the Original Author, Licensor and/or Attribution Parties.
+
+c. Except as otherwise agreed in writing by the Licensor or as may be otherwise permitted by applicable law, if You Reproduce, Distribute or Publicly Perform the Work either by itself or as part of any Adaptations or Collections, You must not distort, mutilate, modify or take other derogatory action in relation to the Work which would be prejudicial to the Original Author's honor or reputation. Licensor agrees that in those jurisdictions (e.g. Japan), in which any exercise of the right granted in Section 3(b) of this License (the right to make Adaptations) would be deemed to be a distortion, mutilation, modification or other derogatory action prejudicial to the Original Author's honor and reputation, the Licensor will waive or not assert, as appropriate, this Section, to the fullest extent permitted by the applicable national law, to enable You to reasonably exercise Your right under Section 3(b) of this License (right to make Adaptations) but not otherwise.
+
+5. Representations, Warranties and Disclaimer
+
+UNLESS OTHERWISE MUTUALLY AGREED TO BY THE PARTIES IN WRITING, LICENSOR OFFERS THE WORK AS-IS AND MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND CONCERNING THE WORK, EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, INCLUDING, WITHOUT LIMITATION, WARRANTIES OF TITLE, MERCHANTIBILITY, FITNESS FOR A PARTICULAR PURPOSE, NONINFRINGEMENT, OR THE ABSENCE OF LATENT OR OTHER DEFECTS, ACCURACY, OR THE PRESENCE OF ABSENCE OF ERRORS, WHETHER OR NOT DISCOVERABLE. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES, SO SUCH EXCLUSION MAY NOT APPLY TO YOU.
+
+6. Limitation on Liability. EXCEPT TO THE EXTENT REQUIRED BY APPLICABLE LAW, IN NO EVENT WILL LICENSOR BE LIABLE TO YOU ON ANY LEGAL THEORY FOR ANY SPECIAL, INCIDENTAL, CONSEQUENTIAL, PUNITIVE OR EXEMPLARY DAMAGES ARISING OUT OF THIS LICENSE OR THE USE OF THE WORK, EVEN IF LICENSOR HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+7. Termination
+
+a. This License and the rights granted hereunder will terminate automatically upon any breach by You of the terms of this License. Individuals or entities who have received Adaptations or Collections from You under this License, however, will not have their licenses terminated provided such individuals or entities remain in full compliance with those licenses. Sections 1, 2, 5, 6, 7, and 8 will survive any termination of this License.
+
+b. Subject to the above terms and conditions, the license granted here is perpetual (for the duration of the applicable copyright in the Work). Notwithstanding the above, Licensor reserves the right to release the Work under different license terms or to stop distributing the Work at any time; provided, however that any such election will not serve to withdraw this License (or any other license that has been, or is required to be, granted under the terms of this License), and this License will continue in full force and effect unless terminated as stated above.
+
+8. Miscellaneous
+
+a. Each time You Distribute or Publicly Perform the Work or a Collection, the Licensor offers to the recipient a license to the Work on the same terms and conditions as the license granted to You under this License.
+
+b. Each time You Distribute or Publicly Perform an Adaptation, Licensor offers to the recipient a license to the original Work on the same terms and conditions as the license granted to You under this License.
+
+c. If any provision of this License is invalid or unenforceable under applicable law, it shall not affect the validity or enforceability of the remainder of the terms of this License, and without further action by the parties to this agreement, such provision shall be reformed to the minimum extent necessary to make such provision valid and enforceable.
+
+d. No term or provision of this License shall be deemed waived and no breach consented to unless such waiver or consent shall be in writing and signed by the party to be charged with such waiver or consent. This License constitutes the entire agreement between the parties with respect to the Work licensed here. There are no understandings, agreements or representations with respect to the Work not specified here. Licensor shall not be bound by any additional provisions that may appear in any communication from You.
+
+e. This License may not be modified without the mutual written agreement of the Licensor and You.
+
+f. The rights granted under, and the subject matter referenced, in this License were drafted utilizing the terminology of the Berne Convention for the Protection of Literary and Artistic Works (as amended on September 28, 1979), the Rome Convention of 1961, the WIPO Copyright Treaty of 1996, the WIPO Performances and Phonograms Treaty of 1996 and the Universal Copyright Convention (as revised on July 24, 1971). These rights and subject matter take effect in the relevant jurisdiction in which the License terms are sought to be enforced according to the corresponding provisions of the implementation of those treaty provisions in the applicable national law. If the standard suite of rights granted under applicable copyright law includes additional rights not granted under this License, such additional rights are deemed to be included in the License; this License is not intended to restrict the license of any rights under applicable law.
+
+Creative Commons Notice
+
+Creative Commons is not a party to this License, and makes no warranty whatsoever in connection with the Work. Creative Commons will not be liable to You or any party on any legal theory for any damages whatsoever, including without limitation any general, special, incidental or consequential damages arising in connection to this license. Notwithstanding the foregoing two (2) sentences, if Creative Commons has expressly identified itself as the Licensor hereunder, it shall have all rights and obligations of Licensor.
+
+Except for the limited purpose of indicating to the public that the Work is licensed under the CCPL, Creative Commons does not authorize the use by either party of the trademark "Creative Commons" or any related trademark or logo of Creative Commons without the prior written consent of Creative Commons. Any permitted use will be in compliance with Creative Commons' then-current trademark usage guidelines, as may be published on its website or otherwise made available upon request from time to time. For the avoidance of doubt, this trademark restriction does not form part of this License.
+
+Creative Commons may be contacted at http://creativecommons.org/.
\ No newline at end of file
diff --git a/crates/trusted-server-release/schemas/spdx-2.3.schema.json b/crates/trusted-server-release/schemas/spdx-2.3.schema.json
new file mode 100644
index 0000000000..ee61e6686e
--- /dev/null
+++ b/crates/trusted-server-release/schemas/spdx-2.3.schema.json
@@ -0,0 +1,740 @@
+{
+  "$schema" : "http://json-schema.org/draft-07/schema#",
+  "$id" : "http://spdx.org/rdf/terms/2.3",
+  "title" : "SPDX 2.3",
+  "type" : "object",
+  "properties" : {
+    "SPDXID" : {
+      "type" : "string",
+      "description" : "Uniquely identify any element in an SPDX document which may be referenced by other elements."
+    },
+    "annotations" : {
+      "description" : "Provide additional information about an SpdxElement.",
+      "type" : "array",
+      "items" : {
+        "type" : "object",
+        "properties" : {
+          "annotationDate" : {
+            "description" : "Identify when the comment was made. This is to be specified according to the combined date and time in the UTC format, as specified in the ISO 8601 standard.",
+            "type" : "string"
+          },
+          "annotationType" : {
+            "description" : "Type of the annotation.",
+            "type" : "string",
+            "enum" : [ "OTHER", "REVIEW" ]
+          },
+          "annotator" : {
+            "description" : "This field identifies the person, organization, or tool that has commented on a file, package, snippet, or the entire document.",
+            "type" : "string"
+          },
+          "comment" : {
+            "type" : "string"
+          }
+        },
+        "required" : [ "annotationDate", "annotationType", "annotator", "comment" ],
+        "additionalProperties" : false,
+        "description" : "An Annotation is a comment on an SpdxItem by an agent."
+      }
+    },
+    "comment" : {
+      "type" : "string"
+    },
+    "creationInfo" : {
+      "type" : "object",
+      "properties" : {
+        "comment" : {
+          "type" : "string"
+        },
+        "created" : {
+          "description" : "Identify when the SPDX document was originally created. The date is to be specified according to combined date and time in UTC format as specified in ISO 8601 standard.",
+          "type" : "string"
+        },
+        "creators" : {
+          "description" : "Identify who (or what, in the case of a tool) created the SPDX document. If the SPDX document was created by an individual, indicate the person's name. If the SPDX document was created on behalf of a company or organization, indicate the entity name. If the SPDX document was created using a software tool, indicate the name and version for that tool. If multiple participants or tools were involved, use multiple instances of this field. Person name or organization name may be designated as “anonymous” if appropriate.",
+          "minItems" : 1,
+          "type" : "array",
+          "items" : {
+            "description" : "Identify who (or what, in the case of a tool) created the SPDX document. If the SPDX document was created by an individual, indicate the person's name. If the SPDX document was created on behalf of a company or organization, indicate the entity name. If the SPDX document was created using a software tool, indicate the name and version for that tool. If multiple participants or tools were involved, use multiple instances of this field. Person name or organization name may be designated as “anonymous” if appropriate.",
+            "type" : "string"
+          }
+        },
+        "licenseListVersion" : {
+          "description" : "An optional field for creators of the SPDX file to provide the version of the SPDX License List used when the SPDX file was created.",
+          "type" : "string"
+        }
+      },
+      "required" : [ "created", "creators" ],
+      "additionalProperties" : false,
+      "description" : "One instance is required for each SPDX file produced. It provides the necessary information for forward and backward compatibility for processing tools."
+    },
+    "dataLicense" : {
+      "description" : "License expression for dataLicense. See SPDX Annex D for the license expression syntax.  Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (\"SPDX-Metadata\"). The SPDX specification contains numerous fields where an SPDX document creator may provide relevant explanatory text in SPDX-Metadata. Without opining on the lawfulness of \"database rights\" (in jurisdictions where applicable), such explanatory text is copyrightable subject matter in most Berne Convention countries. By using the SPDX specification, or any portion hereof, you hereby agree that any copyright rights (as determined by your jurisdiction) in any SPDX-Metadata, including without limitation explanatory text, shall be subject to the terms of the Creative Commons CC0 1.0 Universal license. For SPDX-Metadata not containing any copyright rights, you hereby agree and acknowledge that the SPDX-Metadata is provided to you \"as-is\" and without any representations or warranties of any kind concerning the SPDX-Metadata, express, implied, statutory or otherwise, including without limitation warranties of title, merchantability, fitness for a particular purpose, non-infringement, or the absence of latent or other defects, accuracy, or the presence or absence of errors, whether or not discoverable, all to the greatest extent permissible under applicable law.",
+      "type" : "string"
+    },
+    "externalDocumentRefs" : {
+      "description" : "Identify any external SPDX documents referenced within this SPDX document.",
+      "type" : "array",
+      "items" : {
+        "type" : "object",
+        "properties" : {
+          "checksum" : {
+            "type" : "object",
+            "properties" : {
+              "algorithm" : {
+                "description" : "Identifies the algorithm used to produce the subject Checksum. Currently, SHA-1 is the only supported algorithm. It is anticipated that other algorithms will be supported at a later time.",
+                "type" : "string",
+                "enum" : [ "SHA1", "BLAKE3", "SHA3-384", "SHA256", "SHA384", "BLAKE2b-512", "BLAKE2b-256", "SHA3-512", "MD2", "ADLER32", "MD4", "SHA3-256", "BLAKE2b-384", "SHA512", "MD6", "MD5", "SHA224" ]
+              },
+              "checksumValue" : {
+                "description" : "The checksumValue property provides a lower case hexidecimal encoded digest value produced using a specific algorithm.",
+                "type" : "string"
+              }
+            },
+            "required" : [ "algorithm", "checksumValue" ],
+            "additionalProperties" : false,
+            "description" : "A Checksum is value that allows the contents of a file to be authenticated. Even small changes to the content of the file will change its checksum. This class allows the results of a variety of checksum and cryptographic message digest algorithms to be represented."
+          },
+          "externalDocumentId" : {
+            "description" : "externalDocumentId is a string containing letters, numbers, ., - and/or + which uniquely identifies an external document within this document.",
+            "type" : "string"
+          },
+          "spdxDocument" : {
+            "description" : "SPDX ID for SpdxDocument.  A property containing an SPDX document.",
+            "type" : "string"
+          }
+        },
+        "required" : [ "checksum", "externalDocumentId", "spdxDocument" ],
+        "additionalProperties" : false,
+        "description" : "Information about an external SPDX document reference including the checksum. This allows for verification of the external references."
+      }
+    },
+    "hasExtractedLicensingInfos" : {
+      "description" : "Indicates that a particular ExtractedLicensingInfo was defined in the subject SpdxDocument.",
+      "type" : "array",
+      "items" : {
+        "type" : "object",
+        "properties" : {
+          "comment" : {
+            "type" : "string"
+          },
+          "crossRefs" : {
+            "description" : "Cross Reference Detail for a license SeeAlso URL",
+            "type" : "array",
+            "items" : {
+              "type" : "object",
+              "properties" : {
+                "isLive" : {
+                  "description" : "Indicate a URL is still a live accessible location on the public internet",
+                  "type" : "boolean"
+                },
+                "isValid" : {
+                  "description" : "True if the URL is a valid well formed URL",
+                  "type" : "boolean"
+                },
+                "isWayBackLink" : {
+                  "description" : "True if the License SeeAlso URL points to a Wayback archive",
+                  "type" : "boolean"
+                },
+                "match" : {
+                  "description" : "Status of a License List SeeAlso URL reference if it refers to a website that matches the license text.",
+                  "type" : "string"
+                },
+                "order" : {
+                  "description" : "The ordinal order of this element within a list",
+                  "type" : "integer"
+                },
+                "timestamp" : {
+                  "description" : "Timestamp",
+                  "type" : "string"
+                },
+                "url" : {
+                  "description" : "URL Reference",
+                  "type" : "string"
+                }
+              },
+              "required" : [ "url" ],
+              "additionalProperties" : false,
+              "description" : "Cross reference details for the a URL reference"
+            }
+          },
+          "extractedText" : {
+            "description" : "Provide a copy of the actual text of the license reference extracted from the package, file or snippet that is associated with the License Identifier to aid in future analysis.",
+            "type" : "string"
+          },
+          "licenseId" : {
+            "description" : "A human readable short form license identifier for a license. The license ID is either on the standard license list or the form \"LicenseRef-[idString]\" where [idString] is a unique string containing letters, numbers, \".\" or \"-\".  When used within a license expression, the license ID can optionally include a reference to an external document in the form \"DocumentRef-[docrefIdString]:LicenseRef-[idString]\" where docRefIdString is an ID for an external document reference.",
+            "type" : "string"
+          },
+          "name" : {
+            "description" : "Identify name of this SpdxElement.",
+            "type" : "string"
+          },
+          "seeAlsos" : {
+            "type" : "array",
+            "items" : {
+              "type" : "string"
+            }
+          }
+        },
+        "required" : [ "extractedText", "licenseId" ],
+        "additionalProperties" : false,
+        "description" : "An ExtractedLicensingInfo represents a license or licensing notice that was found in a package, file or snippet. Any license text that is recognized as a license may be represented as a License rather than an ExtractedLicensingInfo."
+      }
+    },
+    "name" : {
+      "description" : "Identify name of this SpdxElement.",
+      "type" : "string"
+    },
+    "revieweds" : {
+      "description" : "Reviewed",
+      "type" : "array",
+      "items" : {
+        "type" : "object",
+        "properties" : {
+          "comment" : {
+            "type" : "string"
+          },
+          "reviewDate" : {
+            "description" : "The date and time at which the SpdxDocument was reviewed. This value must be in UTC and have 'Z' as its timezone indicator.",
+            "type" : "string"
+          },
+          "reviewer" : {
+            "description" : "The name and, optionally, contact information of the person who performed the review. Values of this property must conform to the agent and tool syntax.  The reviewer property is deprecated in favor of Annotation with an annotationType review.",
+            "type" : "string"
+          }
+        },
+        "required" : [ "reviewDate" ],
+        "additionalProperties" : false,
+        "description" : "This class has been deprecated in favor of an Annotation with an Annotation type of review."
+      }
+    },
+    "spdxVersion" : {
+      "description" : "Provide a reference number that can be used to understand how to parse and interpret the rest of the file. It will enable both future changes to the specification and to support backward compatibility. The version number consists of a major and minor version indicator. The major field will be incremented when incompatible changes between versions are made (one or more sections are created, modified or deleted). The minor field will be incremented when backwards compatible changes are made.",
+      "type" : "string"
+    },
+    "documentNamespace" : {
+      "type" : "string",
+      "description" : "The URI provides an unambiguous mechanism for other SPDX documents to reference SPDX elements within this SPDX document."
+    },
+    "documentDescribes" : {
+      "description" : "Packages, files and/or Snippets described by this SPDX document",
+      "type" : "array",
+      "items" : {
+        "type" : "string",
+        "description" : "SPDX ID for each Package, File, or Snippet."
+      }
+    },
+    "packages" : {
+      "description" : "Packages referenced in the SPDX document",
+      "type" : "array",
+      "items" : {
+        "type" : "object",
+        "properties" : {
+          "SPDXID" : {
+            "type" : "string",
+            "description" : "Uniquely identify any element in an SPDX document which may be referenced by other elements."
+          },
+          "annotations" : {
+            "description" : "Provide additional information about an SpdxElement.",
+            "type" : "array",
+            "items" : {
+              "type" : "object",
+              "properties" : {
+                "annotationDate" : {
+                  "description" : "Identify when the comment was made. This is to be specified according to the combined date and time in the UTC format, as specified in the ISO 8601 standard.",
+                  "type" : "string"
+                },
+                "annotationType" : {
+                  "description" : "Type of the annotation.",
+                  "type" : "string",
+                  "enum" : [ "OTHER", "REVIEW" ]
+                },
+                "annotator" : {
+                  "description" : "This field identifies the person, organization, or tool that has commented on a file, package, snippet, or the entire document.",
+                  "type" : "string"
+                },
+                "comment" : {
+                  "type" : "string"
+                }
+              },
+              "required" : [ "annotationDate", "annotationType", "annotator", "comment" ],
+              "additionalProperties" : false,
+              "description" : "An Annotation is a comment on an SpdxItem by an agent."
+            }
+          },
+          "attributionTexts" : {
+            "description" : "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include the actual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.",
+            "type" : "array",
+            "items" : {
+              "description" : "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include the actual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.",
+              "type" : "string"
+            }
+          },
+          "builtDate" : {
+            "description" : "This field provides a place for recording the actual date the package was built.",
+            "type" : "string"
+          },
+          "checksums" : {
+            "description" : "The checksum property provides a mechanism that can be used to verify that the contents of a File or Package have not changed.",
+            "type" : "array",
+            "items" : {
+              "type" : "object",
+              "properties" : {
+                "algorithm" : {
+                  "description" : "Identifies the algorithm used to produce the subject Checksum. Currently, SHA-1 is the only supported algorithm. It is anticipated that other algorithms will be supported at a later time.",
+                  "type" : "string",
+                  "enum" : [ "SHA1", "BLAKE3", "SHA3-384", "SHA256", "SHA384", "BLAKE2b-512", "BLAKE2b-256", "SHA3-512", "MD2", "ADLER32", "MD4", "SHA3-256", "BLAKE2b-384", "SHA512", "MD6", "MD5", "SHA224" ]
+                },
+                "checksumValue" : {
+                  "description" : "The checksumValue property provides a lower case hexidecimal encoded digest value produced using a specific algorithm.",
+                  "type" : "string"
+                }
+              },
+              "required" : [ "algorithm", "checksumValue" ],
+              "additionalProperties" : false,
+              "description" : "A Checksum is value that allows the contents of a file to be authenticated. Even small changes to the content of the file will change its checksum. This class allows the results of a variety of checksum and cryptographic message digest algorithms to be represented."
+            }
+          },
+          "comment" : {
+            "type" : "string"
+          },
+          "copyrightText" : {
+            "description" : "The text of copyright declarations recited in the package, file or snippet.\n\nIf the copyrightText field is not present, it implies an equivalent meaning to NOASSERTION.",
+            "type" : "string"
+          },
+          "description" : {
+            "description" : "Provides a detailed description of the package.",
+            "type" : "string"
+          },
+          "downloadLocation" : {
+            "description" : "The URI at which this package is available for download. Private (i.e., not publicly reachable) URIs are acceptable as values of this property. The values http://spdx.org/rdf/terms#none and http://spdx.org/rdf/terms#noassertion may be used to specify that the package is not downloadable or that no attempt was made to determine its download location, respectively.",
+            "type" : "string"
+          },
+          "externalRefs" : {
+            "description" : "An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package.",
+            "type" : "array",
+            "items" : {
+              "type" : "object",
+              "properties" : {
+                "comment" : {
+                  "type" : "string"
+                },
+                "referenceCategory" : {
+                  "description" : "Category for the external reference",
+                  "type" : "string",
+                  "enum" : [ "OTHER", "PERSISTENT-ID", "SECURITY", "PACKAGE-MANAGER" ]
+                },
+                "referenceLocator" : {
+                  "description" : "The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location. The format of the locator is subject to constraints defined by the <type>.",
+                  "type" : "string"
+                },
+                "referenceType" : {
+                  "description" : "Type of the external reference. These are definined in an appendix in the SPDX specification.",
+                  "type" : "string"
+                }
+              },
+              "required" : [ "referenceCategory", "referenceLocator", "referenceType" ],
+              "additionalProperties" : false,
+              "description" : "An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package."
+            }
+          },
+          "filesAnalyzed" : {
+            "description" : "Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document. If false indicates packages that represent metadata or URI references to a project, product, artifact, distribution or a component. If set to false, the package must not contain any files.",
+            "type" : "boolean"
+          },
+          "hasFiles" : {
+            "description" : "Indicates that a particular file belongs to a package.",
+            "type" : "array",
+            "items" : {
+              "description" : "SPDX ID for File.  Indicates that a particular file belongs to a package.",
+              "type" : "string"
+            }
+          },
+          "homepage" : {
+            "type" : "string"
+          },
+          "licenseComments" : {
+            "description" : "The licenseComments property allows the preparer of the SPDX document to describe why the licensing in spdx:licenseConcluded was chosen.",
+            "type" : "string"
+          },
+          "licenseConcluded" : {
+            "description" : "License expression for licenseConcluded. See SPDX Annex D for the license expression syntax.  The licensing that the preparer of this SPDX document has concluded, based on the evidence, actually applies to the SPDX Item.\n\nIf the licenseConcluded field is not present for an SPDX Item, it implies an equivalent meaning to NOASSERTION.",
+            "type" : "string"
+          },
+          "licenseDeclared" : {
+            "description" : "License expression for licenseDeclared. See SPDX Annex D for the license expression syntax.  The licensing that the creators of the software in the package, or the packager, have declared. Declarations by the original software creator should be preferred, if they exist.",
+            "type" : "string"
+          },
+          "licenseInfoFromFiles" : {
+            "description" : "The licensing information that was discovered directly within the package. There will be an instance of this property for each distinct value of alllicenseInfoInFile properties of all files contained in the package.\n\nIf the licenseInfoFromFiles field is not present for a package and filesAnalyzed property for that same pacakge is true or omitted, it implies an equivalent meaning to NOASSERTION.",
+            "type" : "array",
+            "items" : {
+              "description" : "License expression for licenseInfoFromFiles. See SPDX Annex D for the license expression syntax.  The licensing information that was discovered directly within the package. There will be an instance of this property for each distinct value of alllicenseInfoInFile properties of all files contained in the package.\n\nIf the licenseInfoFromFiles field is not present for a package and filesAnalyzed property for that same pacakge is true or omitted, it implies an equivalent meaning to NOASSERTION.",
+              "type" : "string"
+            }
+          },
+          "name" : {
+            "description" : "Identify name of this SpdxElement.",
+            "type" : "string"
+          },
+          "originator" : {
+            "description" : "The name and, optionally, contact information of the person or organization that originally created the package. Values of this property must conform to the agent and tool syntax.",
+            "type" : "string"
+          },
+          "packageFileName" : {
+            "description" : "The base name of the package file name. For example, zlib-1.2.5.tar.gz.",
+            "type" : "string"
+          },
+          "packageVerificationCode" : {
+            "type" : "object",
+            "properties" : {
+              "packageVerificationCodeExcludedFiles" : {
+                "description" : "A file that was excluded when calculating the package verification code. This is usually a file containing SPDX data regarding the package. If a package contains more than one SPDX file all SPDX files must be excluded from the package verification code. If this is not done it would be impossible to correctly calculate the verification codes in both files.",
+                "type" : "array",
+                "items" : {
+                  "description" : "A file that was excluded when calculating the package verification code. This is usually a file containing SPDX data regarding the package. If a package contains more than one SPDX file all SPDX files must be excluded from the package verification code. If this is not done it would be impossible to correctly calculate the verification codes in both files.",
+                  "type" : "string"
+                }
+              },
+              "packageVerificationCodeValue" : {
+                "description" : "The actual package verification code as a hex encoded value.",
+                "type" : "string"
+              }
+            },
+            "required" : [ "packageVerificationCodeValue" ],
+            "additionalProperties" : false,
+            "description" : "A manifest based verification code (the algorithm is defined in section 4.7 of the full specification) of the SPDX Item. This allows consumers of this data and/or database to determine if an SPDX item they have in hand is identical to the SPDX item from which the data was produced. This algorithm works even if the SPDX document is included in the SPDX item."
+          },
+          "primaryPackagePurpose" : {
+            "description" : "This field provides information about the primary purpose of the identified package. Package Purpose is intrinsic to how the package is being used rather than the content of the package.",
+            "type" : "string",
+            "enum" : [ "OTHER", "INSTALL", "ARCHIVE", "FIRMWARE", "APPLICATION", "FRAMEWORK", "LIBRARY", "CONTAINER", "SOURCE", "DEVICE", "OPERATING_SYSTEM", "FILE" ]
+          },
+          "releaseDate" : {
+            "description" : "This field provides a place for recording the date the package was released.",
+            "type" : "string"
+          },
+          "sourceInfo" : {
+            "description" : "Allows the producer(s) of the SPDX document to describe how the package was acquired and/or changed from the original source.",
+            "type" : "string"
+          },
+          "summary" : {
+            "description" : "Provides a short description of the package.",
+            "type" : "string"
+          },
+          "supplier" : {
+            "description" : "The name and, optionally, contact information of the person or organization who was the immediate supplier of this package to the recipient. The supplier may be different than originator when the software has been repackaged. Values of this property must conform to the agent and tool syntax.",
+            "type" : "string"
+          },
+          "validUntilDate" : {
+            "description" : "This field provides a place for recording the end of the support period for a package from the supplier.",
+            "type" : "string"
+          },
+          "versionInfo" : {
+            "description" : "Provides an indication of the version of the package that is described by this SpdxDocument.",
+            "type" : "string"
+          }
+        },
+        "required" : [ "SPDXID", "downloadLocation", "name" ],
+        "additionalProperties" : false
+      }
+    },
+    "files" : {
+      "description" : "Files referenced in the SPDX document",
+      "type" : "array",
+      "items" : {
+        "type" : "object",
+        "properties" : {
+          "SPDXID" : {
+            "type" : "string",
+            "description" : "Uniquely identify any element in an SPDX document which may be referenced by other elements."
+          },
+          "annotations" : {
+            "description" : "Provide additional information about an SpdxElement.",
+            "type" : "array",
+            "items" : {
+              "type" : "object",
+              "properties" : {
+                "annotationDate" : {
+                  "description" : "Identify when the comment was made. This is to be specified according to the combined date and time in the UTC format, as specified in the ISO 8601 standard.",
+                  "type" : "string"
+                },
+                "annotationType" : {
+                  "description" : "Type of the annotation.",
+                  "type" : "string",
+                  "enum" : [ "OTHER", "REVIEW" ]
+                },
+                "annotator" : {
+                  "description" : "This field identifies the person, organization, or tool that has commented on a file, package, snippet, or the entire document.",
+                  "type" : "string"
+                },
+                "comment" : {
+                  "type" : "string"
+                }
+              },
+              "required" : [ "annotationDate", "annotationType", "annotator", "comment" ],
+              "additionalProperties" : false,
+              "description" : "An Annotation is a comment on an SpdxItem by an agent."
+            }
+          },
+          "artifactOfs" : {
+            "description" : "Indicates the project in which the SpdxElement originated. Tools must preserve doap:homepage and doap:name properties and the URI (if one is known) of doap:Project resources that are values of this property. All other properties of doap:Projects are not directly supported by SPDX and may be dropped when translating to or from some SPDX formats.",
+            "type" : "array",
+            "items" : {
+              "type" : "object"
+            }
+          },
+          "attributionTexts" : {
+            "description" : "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include the actual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.",
+            "type" : "array",
+            "items" : {
+              "description" : "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include the actual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.",
+              "type" : "string"
+            }
+          },
+          "checksums" : {
+            "description" : "The checksum property provides a mechanism that can be used to verify that the contents of a File or Package have not changed.",
+            "minItems" : 1,
+            "type" : "array",
+            "items" : {
+              "type" : "object",
+              "properties" : {
+                "algorithm" : {
+                  "description" : "Identifies the algorithm used to produce the subject Checksum. Currently, SHA-1 is the only supported algorithm. It is anticipated that other algorithms will be supported at a later time.",
+                  "type" : "string",
+                  "enum" : [ "SHA1", "BLAKE3", "SHA3-384", "SHA256", "SHA384", "BLAKE2b-512", "BLAKE2b-256", "SHA3-512", "MD2", "ADLER32", "MD4", "SHA3-256", "BLAKE2b-384", "SHA512", "MD6", "MD5", "SHA224" ]
+                },
+                "checksumValue" : {
+                  "description" : "The checksumValue property provides a lower case hexidecimal encoded digest value produced using a specific algorithm.",
+                  "type" : "string"
+                }
+              },
+              "required" : [ "algorithm", "checksumValue" ],
+              "additionalProperties" : false,
+              "description" : "A Checksum is value that allows the contents of a file to be authenticated. Even small changes to the content of the file will change its checksum. This class allows the results of a variety of checksum and cryptographic message digest algorithms to be represented."
+            }
+          },
+          "comment" : {
+            "type" : "string"
+          },
+          "copyrightText" : {
+            "description" : "The text of copyright declarations recited in the package, file or snippet.\n\nIf the copyrightText field is not present, it implies an equivalent meaning to NOASSERTION.",
+            "type" : "string"
+          },
+          "fileContributors" : {
+            "description" : "This field provides a place for the SPDX file creator to record file contributors. Contributors could include names of copyright holders and/or authors who may not be copyright holders yet contributed to the file content.",
+            "type" : "array",
+            "items" : {
+              "description" : "This field provides a place for the SPDX file creator to record file contributors. Contributors could include names of copyright holders and/or authors who may not be copyright holders yet contributed to the file content.",
+              "type" : "string"
+            }
+          },
+          "fileDependencies" : {
+            "description" : "This field is deprecated since SPDX 2.0 in favor of using Section 7 which provides more granularity about relationships.",
+            "type" : "array",
+            "items" : {
+              "description" : "SPDX ID for File.  This field is deprecated since SPDX 2.0 in favor of using Section 7 which provides more granularity about relationships.",
+              "type" : "string"
+            }
+          },
+          "fileName" : {
+            "description" : "The name of the file relative to the root of the package.",
+            "type" : "string"
+          },
+          "fileTypes" : {
+            "description" : "The type of the file.",
+            "type" : "array",
+            "items" : {
+              "description" : "The type of the file.",
+              "type" : "string",
+              "enum" : [ "OTHER", "DOCUMENTATION", "IMAGE", "VIDEO", "ARCHIVE", "SPDX", "APPLICATION", "SOURCE", "BINARY", "TEXT", "AUDIO" ]
+            }
+          },
+          "licenseComments" : {
+            "description" : "The licenseComments property allows the preparer of the SPDX document to describe why the licensing in spdx:licenseConcluded was chosen.",
+            "type" : "string"
+          },
+          "licenseConcluded" : {
+            "description" : "License expression for licenseConcluded. See SPDX Annex D for the license expression syntax.  The licensing that the preparer of this SPDX document has concluded, based on the evidence, actually applies to the SPDX Item.\n\nIf the licenseConcluded field is not present for an SPDX Item, it implies an equivalent meaning to NOASSERTION.",
+            "type" : "string"
+          },
+          "licenseInfoInFiles" : {
+            "description" : "Licensing information that was discovered directly in the subject file. This is also considered a declared license for the file.\n\nIf the licenseInfoInFile field is not present for a file, it implies an equivalent meaning to NOASSERTION.",
+            "type" : "array",
+            "items" : {
+              "description" : "License expression for licenseInfoInFile. See SPDX Annex D for the license expression syntax.  Licensing information that was discovered directly in the subject file. This is also considered a declared license for the file.\n\nIf the licenseInfoInFile field is not present for a file, it implies an equivalent meaning to NOASSERTION.",
+              "type" : "string"
+            }
+          },
+          "noticeText" : {
+            "description" : "This field provides a place for the SPDX file creator to record potential legal notices found in the file. This may or may not include copyright statements.",
+            "type" : "string"
+          }
+        },
+        "required" : [ "SPDXID", "checksums", "fileName" ],
+        "additionalProperties" : false
+      }
+    },
+    "snippets" : {
+      "description" : "Snippets referenced in the SPDX document",
+      "type" : "array",
+      "items" : {
+        "type" : "object",
+        "properties" : {
+          "SPDXID" : {
+            "type" : "string",
+            "description" : "Uniquely identify any element in an SPDX document which may be referenced by other elements."
+          },
+          "annotations" : {
+            "description" : "Provide additional information about an SpdxElement.",
+            "type" : "array",
+            "items" : {
+              "type" : "object",
+              "properties" : {
+                "annotationDate" : {
+                  "description" : "Identify when the comment was made. This is to be specified according to the combined date and time in the UTC format, as specified in the ISO 8601 standard.",
+                  "type" : "string"
+                },
+                "annotationType" : {
+                  "description" : "Type of the annotation.",
+                  "type" : "string",
+                  "enum" : [ "OTHER", "REVIEW" ]
+                },
+                "annotator" : {
+                  "description" : "This field identifies the person, organization, or tool that has commented on a file, package, snippet, or the entire document.",
+                  "type" : "string"
+                },
+                "comment" : {
+                  "type" : "string"
+                }
+              },
+              "required" : [ "annotationDate", "annotationType", "annotator", "comment" ],
+              "additionalProperties" : false,
+              "description" : "An Annotation is a comment on an SpdxItem by an agent."
+            }
+          },
+          "attributionTexts" : {
+            "description" : "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include the actual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.",
+            "type" : "array",
+            "items" : {
+              "description" : "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include the actual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.",
+              "type" : "string"
+            }
+          },
+          "comment" : {
+            "type" : "string"
+          },
+          "copyrightText" : {
+            "description" : "The text of copyright declarations recited in the package, file or snippet.\n\nIf the copyrightText field is not present, it implies an equivalent meaning to NOASSERTION.",
+            "type" : "string"
+          },
+          "licenseComments" : {
+            "description" : "The licenseComments property allows the preparer of the SPDX document to describe why the licensing in spdx:licenseConcluded was chosen.",
+            "type" : "string"
+          },
+          "licenseConcluded" : {
+            "description" : "License expression for licenseConcluded. See SPDX Annex D for the license expression syntax.  The licensing that the preparer of this SPDX document has concluded, based on the evidence, actually applies to the SPDX Item.\n\nIf the licenseConcluded field is not present for an SPDX Item, it implies an equivalent meaning to NOASSERTION.",
+            "type" : "string"
+          },
+          "licenseInfoInSnippets" : {
+            "description" : "Licensing information that was discovered directly in the subject snippet. This is also considered a declared license for the snippet.\n\nIf the licenseInfoInSnippet field is not present for a snippet, it implies an equivalent meaning to NOASSERTION.",
+            "type" : "array",
+            "items" : {
+              "description" : "License expression for licenseInfoInSnippet. See SPDX Annex D for the license expression syntax.  Licensing information that was discovered directly in the subject snippet. This is also considered a declared license for the snippet.\n\nIf the licenseInfoInSnippet field is not present for a snippet, it implies an equivalent meaning to NOASSERTION.",
+              "type" : "string"
+            }
+          },
+          "name" : {
+            "description" : "Identify name of this SpdxElement.",
+            "type" : "string"
+          },
+          "ranges" : {
+            "description" : "This field defines the byte range in the original host file (in X.2) that the snippet information applies to",
+            "minItems" : 1,
+            "type" : "array",
+            "items" : {
+              "type" : "object",
+              "properties" : {
+                "endPointer" : {
+                  "type" : "object",
+                  "properties" : {
+                    "reference" : {
+                      "description" : "SPDX ID for File",
+                      "type" : "string"
+                    },
+                    "offset" : {
+                      "type" : "integer",
+                      "description" : "Byte offset in the file"
+                    },
+                    "lineNumber" : {
+                      "type" : "integer",
+                      "description" : "line number offset in the file"
+                    }
+                  },
+                  "required" : [ "reference" ],
+                  "additionalProperties" : false
+                },
+                "startPointer" : {
+                  "type" : "object",
+                  "properties" : {
+                    "reference" : {
+                      "description" : "SPDX ID for File",
+                      "type" : "string"
+                    },
+                    "offset" : {
+                      "type" : "integer",
+                      "description" : "Byte offset in the file"
+                    },
+                    "lineNumber" : {
+                      "type" : "integer",
+                      "description" : "line number offset in the file"
+                    }
+                  },
+                  "required" : [ "reference" ],
+                  "additionalProperties" : false
+                }
+              },
+              "required" : [ "endPointer", "startPointer" ],
+              "additionalProperties" : false
+            }
+          },
+          "snippetFromFile" : {
+            "description" : "SPDX ID for File.  File containing the SPDX element (e.g. the file contaning a snippet).",
+            "type" : "string"
+          }
+        },
+        "required" : [ "SPDXID", "name", "ranges", "snippetFromFile" ],
+        "additionalProperties" : false
+      }
+    },
+    "relationships" : {
+      "description" : "Relationships referenced in the SPDX document",
+      "type" : "array",
+      "items" : {
+        "type" : "object",
+        "properties" : {
+          "spdxElementId" : {
+            "type" : "string",
+            "description" : "Id to which the SPDX element is related"
+          },
+          "comment" : {
+            "type" : "string"
+          },
+          "relatedSpdxElement" : {
+            "description" : "SPDX ID for SpdxElement.  A related SpdxElement.",
+            "type" : "string"
+          },
+          "relationshipType" : {
+            "description" : "Describes the type of relationship between two SPDX elements.",
+            "type" : "string",
+            "enum" : [ "VARIANT_OF", "COPY_OF", "PATCH_FOR", "TEST_DEPENDENCY_OF", "CONTAINED_BY", "DATA_FILE_OF", "OPTIONAL_COMPONENT_OF", "ANCESTOR_OF", "GENERATES", "CONTAINS", "OPTIONAL_DEPENDENCY_OF", "FILE_ADDED", "REQUIREMENT_DESCRIPTION_FOR", "DEV_DEPENDENCY_OF", "DEPENDENCY_OF", "BUILD_DEPENDENCY_OF", "DESCRIBES", "PREREQUISITE_FOR", "HAS_PREREQUISITE", "PROVIDED_DEPENDENCY_OF", "DYNAMIC_LINK", "DESCRIBED_BY", "METAFILE_OF", "DEPENDENCY_MANIFEST_OF", "PATCH_APPLIED", "RUNTIME_DEPENDENCY_OF", "TEST_OF", "TEST_TOOL_OF", "DEPENDS_ON", "SPECIFICATION_FOR", "FILE_MODIFIED", "DISTRIBUTION_ARTIFACT", "AMENDS", "DOCUMENTATION_OF", "GENERATED_FROM", "STATIC_LINK", "OTHER", "BUILD_TOOL_OF", "TEST_CASE_OF", "PACKAGE_OF", "DESCENDANT_OF", "FILE_DELETED", "EXPANDED_FROM_ARCHIVE", "DEV_TOOL_OF", "EXAMPLE_OF" ]
+          }
+        },
+        "required" : [ "spdxElementId", "relatedSpdxElement", "relationshipType" ],
+        "additionalProperties" : false
+      }
+    }
+  },
+  "required" : [ "SPDXID", "creationInfo", "dataLicense", "name", "spdxVersion" ],
+  "additionalProperties" : false
+}
\ No newline at end of file
diff --git a/crates/trusted-server-release/src/boundary.rs b/crates/trusted-server-release/src/boundary.rs
new file mode 100644
index 0000000000..68d2bb2d09
--- /dev/null
+++ b/crates/trusted-server-release/src/boundary.rs
@@ -0,0 +1,513 @@
+//! Native OS network-denial boundary (`source-owned-os-denial-v1`).
+//!
+//! A [`Boundary`] runs a [`ConfinedCommand`] under operating-system enforced
+//! network denial: on macOS a generated deny-default `sandbox-exec` profile,
+//! on Linux a Docker container with `--network none`, an effective seccomp
+//! profile denying non-Unix sockets, and `--init` in Docker's default private
+//! PID namespace. [`Boundary::run_confined`] requires a [`DenialProof`],
+//! which [`Boundary::establish_denial`] constructs only after an unconfined
+//! positive socket control connected and the confined probe was denied with
+//! a real errno, for this boundary instance, in this process run.
+//!
+//! Every fingerprint includes a fresh per-instance random nonce, so a proof
+//! never transfers to another [`Boundary`], even one with identical roots.
+//!
+//! # Root checks around every confined execution
+//!
+//! - Immutable and tool roots: every regular file must have `nlink == 1` and
+//!   every alias must be relative, inside its root and not dangling. Full file
+//!   facts (content hash, mode, inode, times) are recorded before and
+//!   compared after; any change rejects the run. Tool executables must
+//!   therefore be private single-link copies ([`ProbeProgram::staged`]), not
+//!   Cargo's hard-linked `target/` outputs.
+//! - Writable roots: `nlink == 1` and safe aliases before the run; safe
+//!   aliases again after it.
+//!
+//! # Descendants
+//!
+//! On Linux the container's private PID namespace with `--init` ends every
+//! descendant when the run's container is stopped and removed. On macOS:
+//!
+//! - The profile denies the `setsid` and `setpgid` system calls, so a
+//!   descendant cannot leave the supervised process group that way, and the
+//!   process module's group kill reaps it.
+//! - `posix_spawn` with `POSIX_SPAWN_SETPGROUP`/`POSIX_SPAWN_SETSID` (Rust's
+//!   `Command::process_group`) bypasses that syscall filter (observed). As a
+//!   fail-closed backstop, after each run every process that started during
+//!   it and belongs to that run's sandbox instance (identified by per-run
+//!   marker rules through `sandbox_check`) or carries its environment nonce is
+//!   killed and the run rejected. Scrubbing the environment does not hide a
+//!   descendant, and a confined process cannot re-apply a sandbox.
+//! - Survivors are found only after the run exits, so the macOS backend
+//!   still does not own descendant cleanup the way a container does
+//!   ([`Boundary::has_owned_descendant_cleanup`] stays false). It reports
+//!   [`DescendantCleanup::ReapedAfterRun`], which only a selection that
+//!   explicitly permits it may accept.
+//!
+//! # Sibling boundaries
+//!
+//! [`Boundary::sibling_without_writable`] derives a Linux container with the
+//! same image, settings and roots minus the last writable root. It lets a
+//! step that must not see a build's output root (whose legitimate Cargo hard
+//! links the pre-run single-link scan rejects) run under its own proof, while
+//! the scan policy itself stays unchanged.
+//!
+//! # System roots
+//!
+//! A host system tool directory (the Apple developer directory) is a
+//! read-and-execute-only system root. It is not scanned; its identity is
+//! the caller's record of versions and tool hashes. The Linux container
+//! boundary refuses system roots.
+//!
+//! # What this module does not prove
+//!
+//! - It probes one IPv4 TCP loopback connect; the UDP, IPv6 and
+//!   documentation-address matrix belongs to Task 8 qualification.
+//! - No sandbox profile or container image is qualified:
+//!   [`QualifiedSandboxProfile`] and [`QualifiedImage`](docker::QualifiedImage)
+//!   are uninhabited, so
+//!   production execution stays closed.
+//! - The Docker client is trust-on-first-use pinned by digest for the life of
+//!   a boundary, not authenticated against an independent trust root.
+
+mod command;
+pub(crate) mod daemon;
+mod docker;
+mod entropy;
+mod host_inputs;
+mod macos;
+mod probe;
+mod proof;
+mod roots;
+mod seccomp;
+#[cfg(target_os = "macos")]
+mod survivors;
+#[cfg(test)]
+mod tests;
+
+use std::path::Path;
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256};
+
+pub(crate) use command::{ConfinedCommand, Umask};
+pub(crate) use docker::{DockerSettings, ImageSelection};
+pub(crate) use entropy::random_bytes;
+pub(crate) use probe::{DENIED_STATUS, ProbeProgram, ProbeReport, connect_probe, parse_loopback};
+pub(crate) use proof::{DenialProof, DenialReceipt};
+pub(crate) use roots::BoundaryRoots;
+
+use crate::error::ReleaseError;
+use crate::process::{ProcessLimits, ProcessResult};
+use roots::{RootRole, ScanPolicy, TreeFacts};
+
+/// Domain separating the instance fingerprint from platform fingerprints.
+const INSTANCE_DOMAIN: &[u8] = b"trusted-server-boundary-instance-v1\n";
+
+fn boundary_error(message: impl std::fmt::Display) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Boundary).attach(message.to_string())
+}
+
+/// A macOS sandbox profile that passed Task 8 qualification.
+///
+/// None has, so this type is uninhabited and production macOS selection
+/// stays closed; tests use a `#[cfg(test)]` constructor.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum QualifiedSandboxProfile {}
+
+/// How a boundary ends the descendants a confined run started.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, derive_more::Display)]
+pub(crate) enum DescendantCleanup {
+    /// Container teardown ends every descendant: the run's private PID
+    /// namespace dies with its container.
+    #[display("owned-by-container")]
+    OwnedByContainer,
+    /// After the run exits, every process of the run's sandbox instance (or
+    /// carrying its nonce) is found, killed and the run rejected. Survivors
+    /// exist until that post-run reap, so this is weaker than ownership.
+    #[display("post-run-reaped")]
+    ReapedAfterRun,
+}
+
+/// The platform mechanism enforcing denial.
+#[derive(Debug)]
+enum Platform {
+    MacSandbox(macos::MacProfile),
+    LinuxContainer(Box<docker::DockerBoundary>),
+}
+
+impl Platform {
+    /// The descendant cleanup this mechanism provides.
+    fn descendant_cleanup(&self) -> DescendantCleanup {
+        match self {
+            Self::MacSandbox(_) => DescendantCleanup::ReapedAfterRun,
+            Self::LinuxContainer(_) => DescendantCleanup::OwnedByContainer,
+        }
+    }
+}
+
+/// A configured OS network-denial boundary.
+#[derive(Debug)]
+pub(crate) struct Boundary {
+    roots: BoundaryRoots,
+    platform: Platform,
+    fingerprint: [u8; 32],
+    /// The fingerprint of the boundary this sibling was derived from.
+    derived_from: Option<[u8; 32]>,
+}
+
+/// Reports whether `path` equals its rebuilt components, so it has no `.`,
+/// doubled or trailing separators (`components` silently drops them).
+fn lexically_normal(path: &Path) -> bool {
+    path.components()
+        .collect::<std::path::PathBuf>()
+        .as_os_str()
+        == path.as_os_str()
+}
+
+/// Binds a platform fingerprint to a fresh per-instance nonce.
+fn instance_fingerprint(platform: &[u8; 32]) -> Result<[u8; 32], Report<ReleaseError>> {
+    let nonce: [u8; 16] = random_bytes()?;
+    let mut hasher = Sha256::new();
+    hasher.update(INSTANCE_DOMAIN);
+    hasher.update(platform);
+    hasher.update(nonce);
+    Ok(hasher.finalize().into())
+}
+
+/// Before-run facts of the immutable and tool roots.
+struct FixedFacts(Vec<TreeFacts>);
+
+impl Boundary {
+    /// Returns the current instance's measured roots, controls and nonce binding.
+    ///
+    /// This binds an executed candidate; it does not qualify that candidate.
+    pub(crate) fn execution_fingerprint(&self) -> [u8; 32] {
+        self.fingerprint
+    }
+    /// Requires exact mount roles and placement for an owning recipe.
+    pub(crate) fn matches_roots(&self, roots: &BoundaryRoots) -> bool {
+        self.roots == *roots
+    }
+
+    /// Reports whether container teardown owns every run descendant.
+    ///
+    /// The experimental macOS backend deliberately cannot satisfy this gate,
+    /// which the JS and preparation callers keep using.
+    pub(crate) fn has_owned_descendant_cleanup(&self) -> bool {
+        matches!(self.platform, Platform::LinuxContainer(_))
+    }
+
+    /// Returns how this boundary ends run descendants.
+    ///
+    /// The recipe gate admits [`DescendantCleanup::ReapedAfterRun`] only for a
+    /// selection that explicitly permits it.
+    pub(crate) fn descendant_cleanup(&self) -> DescendantCleanup {
+        self.platform.descendant_cleanup()
+    }
+
+    /// Translates a selected host path into the command's execution namespace.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when the path is not inside this boundary's roots.
+    pub(crate) fn execution_path(
+        &self,
+        path: &Path,
+    ) -> Result<std::path::PathBuf, Report<ReleaseError>> {
+        match &self.platform {
+            Platform::LinuxContainer(_) => docker::container_path(&self.roots, path),
+            Platform::MacSandbox(_) if self.roots.locate(path).is_some() => Ok(path.to_owned()),
+            _ => Err(boundary_error("execution path is outside boundary roots")),
+        }
+    }
+    /// Translates a path reported by a confined command back to the host.
+    ///
+    /// Only paths inside writable roots translate: a build output may not
+    /// name an immutable or tool file.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when the path is not inside a writable root.
+    pub(crate) fn host_path(
+        &self,
+        execution: &Path,
+    ) -> Result<std::path::PathBuf, Report<ReleaseError>> {
+        match &self.platform {
+            Platform::LinuxContainer(_) => docker::host_path(&self.roots, execution),
+            Platform::MacSandbox(_) if !lexically_normal(execution) => Err(boundary_error(
+                "execution path is not in lexical normal form",
+            )),
+            Platform::MacSandbox(_) => match self.roots.locate(execution) {
+                Some((RootRole::Writable, _, relative))
+                    if relative
+                        .components()
+                        .all(|component| matches!(component, std::path::Component::Normal(_))) =>
+                {
+                    Ok(execution.to_owned())
+                }
+                _ => Err(boundary_error("execution path is outside writable roots")),
+            },
+        }
+    }
+
+    /// Configures the qualified macOS `sandbox-exec` boundary.
+    ///
+    /// # Errors
+    ///
+    /// Never returns: [`QualifiedSandboxProfile`] is uninhabited until a
+    /// profile is qualified.
+    pub(crate) fn mac_sandbox(
+        _roots: BoundaryRoots,
+        qualification: QualifiedSandboxProfile,
+    ) -> Result<Self, Report<ReleaseError>> {
+        match qualification {}
+    }
+
+    /// Configures the unqualified macOS boundary for tests.
+    ///
+    /// # Errors
+    ///
+    /// As [`Self::mac_sandbox_unqualified`].
+    #[cfg(test)]
+    pub(crate) fn mac_sandbox_for_tests(
+        roots: BoundaryRoots,
+    ) -> Result<Self, Report<ReleaseError>> {
+        Self::mac_sandbox_unqualified(roots)
+    }
+
+    /// Generates the profile and binds the instance fingerprint.
+    fn mac_sandbox_unqualified(roots: BoundaryRoots) -> Result<Self, Report<ReleaseError>> {
+        if !cfg!(target_os = "macos") {
+            return Err(boundary_error("the sandbox-exec boundary is macOS-only"));
+        }
+        let profile = macos::MacProfile::generate(&roots)?;
+        Ok(Self {
+            fingerprint: instance_fingerprint(&profile.fingerprint())?,
+            platform: Platform::MacSandbox(profile),
+            roots,
+            derived_from: None,
+        })
+    }
+
+    /// Configures the Linux Docker container boundary.
+    ///
+    /// Host-owned seccomp profiles and the empty client configuration are
+    /// created in a fresh directory under `state_parent`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] on any target other than Linux, or
+    /// as [`docker::DockerBoundary::new`] does.
+    pub(crate) fn linux_container(
+        roots: BoundaryRoots,
+        settings: DockerSettings,
+        image: ImageSelection,
+        state_parent: &Path,
+    ) -> Result<Self, Report<ReleaseError>> {
+        if !cfg!(target_os = "linux") {
+            return Err(boundary_error(
+                "the Docker container boundary is Linux-only",
+            ));
+        }
+        let container = docker::DockerBoundary::new(&roots, settings, image, state_parent)?;
+        Ok(Self {
+            fingerprint: instance_fingerprint(&container.fingerprint())?,
+            platform: Platform::LinuxContainer(Box::new(container)),
+            roots,
+            derived_from: None,
+        })
+    }
+
+    /// Derives a sibling Linux container boundary without the writable root
+    /// `excluded`.
+    ///
+    /// The sibling keeps this boundary's image, Docker settings, immutable,
+    /// tool and system roots, and every writable root except `excluded`,
+    /// which must be the last one, so every remaining root keeps its index
+    /// and execution path. It gets fresh host inputs and a fresh instance
+    /// fingerprint, so it needs its own [`DenialProof`]; this boundary's
+    /// fingerprint is recorded as [`Self::derived_from`]. A sibling is never
+    /// derived again.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] for a macOS or already-derived
+    /// boundary, an exclusion that is not the last of at least two writable
+    /// roots, or as [`docker::DockerBoundary::new`] does.
+    pub(crate) fn sibling_without_writable(
+        &self,
+        excluded: &Path,
+    ) -> Result<Self, Report<ReleaseError>> {
+        let Platform::LinuxContainer(container) = &self.platform else {
+            return Err(boundary_error(
+                "only a Linux container boundary derives a sibling",
+            ));
+        };
+        if self.derived_from.is_some() {
+            return Err(boundary_error(
+                "a derived sibling boundary is never derived again",
+            ));
+        }
+        let roots = self.roots.without_last_writable(excluded)?;
+        let sibling = container.sibling(&roots)?;
+        Ok(Self {
+            fingerprint: instance_fingerprint(&sibling.fingerprint())?,
+            platform: Platform::LinuxContainer(Box::new(sibling)),
+            roots,
+            derived_from: Some(self.fingerprint),
+        })
+    }
+
+    /// Builds an unrunnable profile-only boundary with a chosen parent for
+    /// pure derivation checks.
+    ///
+    /// Its platform owns no descendant cleanup, so container-only gates still
+    /// reject it.
+    ///
+    /// # Errors
+    ///
+    /// As [`macos::MacProfile::generate`].
+    #[cfg(test)]
+    pub(crate) fn derivation_fixture_for_tests(
+        roots: BoundaryRoots,
+        derived_from: Option<[u8; 32]>,
+    ) -> Result<Self, Report<ReleaseError>> {
+        Ok(Self {
+            platform: Platform::MacSandbox(macos::MacProfile::generate(&roots)?),
+            roots,
+            fingerprint: [2; 32],
+            derived_from,
+        })
+    }
+
+    /// Returns the fingerprint of the boundary this sibling was derived from.
+    pub(crate) fn derived_from(&self) -> Option<[u8; 32]> {
+        self.derived_from
+    }
+
+    /// Runs the unconfined control and the confined probe for this instance
+    /// and returns the proof only when both behave.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] when the control or denial fails,
+    /// or [`ReleaseError::Process`] when a probe cannot be run.
+    pub(crate) fn establish_denial(
+        &self,
+        probe: &ProbeProgram,
+        limits: ProcessLimits,
+    ) -> Result<DenialProof, Report<ReleaseError>> {
+        proof::establish(self, probe, limits)
+    }
+
+    /// Runs `command` confined, requiring a proof for this instance.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] for a proof from another instance, a
+    /// rejected or changed root, a surviving escaped descendant, or a command
+    /// outside the roots, or [`ReleaseError::Process`] when the child cannot
+    /// be run.
+    pub(crate) fn run_confined(
+        &self,
+        command: &ConfinedCommand,
+        proof: &DenialProof,
+    ) -> Result<ProcessResult, Report<ReleaseError>> {
+        if !proof.matches(&self.fingerprint) {
+            return Err(boundary_error(
+                "denial proof belongs to a different boundary instance",
+            ));
+        }
+        self.execute(command)
+    }
+
+    /// Checks every root, runs `command` confined, then rechecks them.
+    fn execute(&self, command: &ConfinedCommand) -> Result<ProcessResult, Report<ReleaseError>> {
+        self.check_placement(command)?;
+        let before = self.scan_fixed()?;
+        self.scan_writable(ScanPolicy::SingleLinks)?;
+        let outcome = match &self.platform {
+            Platform::MacSandbox(profile) => profile.run(command),
+            Platform::LinuxContainer(container) => container.run(&self.roots, command),
+        };
+        let after = self.verify_after(&before);
+        match (outcome, after) {
+            (Ok(result), Ok(())) => Ok(result),
+            (Ok(_), Err(changed)) => Err(changed),
+            (Err(run), Ok(())) => Err(run),
+            (Err(run), Err(changed)) => {
+                Err(run.attach(format!("roots also failed their checks: {changed:?}")))
+            }
+        }
+    }
+
+    fn fixed_roots(&self) -> impl Iterator<Item = &Path> {
+        self.roots
+            .immutable()
+            .iter()
+            .chain(self.roots.tools())
+            .map(std::path::PathBuf::as_path)
+    }
+
+    fn scan_fixed(&self) -> Result<FixedFacts, Report<ReleaseError>> {
+        self.fixed_roots()
+            .map(|root| TreeFacts::scan(root, ScanPolicy::Immutable))
+            .collect::<Result<_, _>>()
+            .map(FixedFacts)
+    }
+
+    fn scan_writable(&self, policy: ScanPolicy) -> Result<(), Report<ReleaseError>> {
+        for root in self.roots.writable() {
+            TreeFacts::scan(root, policy)?;
+        }
+        Ok(())
+    }
+
+    fn verify_after(&self, before: &FixedFacts) -> Result<(), Report<ReleaseError>> {
+        let after = self.scan_fixed()?;
+        for (before, after) in before.0.iter().zip(&after.0) {
+            before.ensure_unchanged(after)?;
+        }
+        self.scan_writable(ScanPolicy::AliasesOnly)
+    }
+
+    /// Requires every tool selector to name exactly `<tool root>/bin/rustc`
+    /// in the execution namespace, so a build cannot select another compiler.
+    fn check_tool_selectors(&self, command: &ConfinedCommand) -> Result<(), Report<ReleaseError>> {
+        for (name, value) in command.tool_selector_entries() {
+            let allowed = self.roots.tools().iter().any(|tool_root| {
+                self.execution_path(&tool_root.join("bin").join("rustc"))
+                    .is_ok_and(|expected| expected.as_os_str() == value.as_os_str())
+            });
+            if !allowed {
+                return Err(boundary_error(format!(
+                    "tool selector {name:?} is not the bin/rustc of a tool root"
+                )));
+            }
+        }
+        Ok(())
+    }
+
+    fn check_placement(&self, command: &ConfinedCommand) -> Result<(), Report<ReleaseError>> {
+        if self.roots.locate(&command.program).is_none() {
+            return Err(boundary_error(
+                "confined program is outside every boundary root",
+            ));
+        }
+        self.check_tool_selectors(command)?;
+        match self.roots.locate(&command.working_directory) {
+            Some((RootRole::Immutable | RootRole::Writable, _, _)) => Ok(()),
+            _ => Err(boundary_error(
+                "confined working directory is outside the immutable and writable roots",
+            )),
+        }
+    }
+}
+
+#[cfg(test)]
+mod cleanup_and_system_root_tests;
+#[cfg(test)]
+mod selector_placement_tests;
+#[cfg(test)]
+mod sibling_tests;
diff --git a/crates/trusted-server-release/src/boundary/cleanup_and_system_root_tests.rs b/crates/trusted-server-release/src/boundary/cleanup_and_system_root_tests.rs
new file mode 100644
index 0000000000..f10022eecf
--- /dev/null
+++ b/crates/trusted-server-release/src/boundary/cleanup_and_system_root_tests.rs
@@ -0,0 +1,187 @@
+//! Pure tests of descendant-cleanup reporting and system roots; nothing runs.
+
+use std::fs;
+use std::path::PathBuf;
+
+use super::macos::MacProfile;
+use super::*;
+
+struct Layout {
+    _directory: tempfile::TempDir,
+    base: PathBuf,
+}
+
+fn layout() -> Layout {
+    let directory = tempfile::tempdir().expect("should create layout");
+    let base = fs::canonicalize(directory.path()).expect("should canonicalize layout");
+    for relative in [
+        "checkout",
+        "tools/bin",
+        "state",
+        "developer",
+        "developer-file",
+    ] {
+        fs::create_dir_all(base.join(relative)).expect("should create root");
+    }
+    Layout {
+        _directory: directory,
+        base,
+    }
+}
+
+impl Layout {
+    fn roots(&self) -> BoundaryRoots {
+        BoundaryRoots::new(
+            &[self.base.join("checkout")],
+            &[self.base.join("tools")],
+            &[self.base.join("state")],
+        )
+        .expect("should build roots")
+    }
+
+    fn with_developer(&self) -> BoundaryRoots {
+        self.roots()
+            .with_system(&[self.base.join("developer")])
+            .expect("should add the system root")
+    }
+}
+
+#[test]
+fn mac_sandbox_reports_post_run_reaped_cleanup() {
+    let layout = layout();
+    let profile = MacProfile::generate(&layout.roots()).expect("should generate the profile");
+
+    let cleanup = Platform::MacSandbox(profile).descendant_cleanup();
+
+    assert_eq!(
+        cleanup,
+        DescendantCleanup::ReapedAfterRun,
+        "should report that macOS survivors are reaped only after the run"
+    );
+    assert_eq!(
+        cleanup.to_string(),
+        "post-run-reaped",
+        "should label the cleanup mode for measurements"
+    );
+    assert_eq!(
+        DescendantCleanup::OwnedByContainer.to_string(),
+        "owned-by-container",
+        "should label container-owned cleanup for measurements"
+    );
+}
+
+#[test]
+fn system_roots_are_read_and_execute_only_in_the_profile() {
+    let layout = layout();
+    let profile =
+        MacProfile::generate(&layout.with_developer()).expect("should generate the profile");
+    let text = profile.text();
+
+    assert!(
+        text.contains("(allow file-read* process-exec (subpath (param \"SYSTEM_0\")))"),
+        "should allow only reading and executing below the system root: {text}"
+    );
+    assert!(
+        text.contains("(deny file-write* (subpath (param \"SYSTEM_0\")))"),
+        "should explicitly deny writes below the system root"
+    );
+    assert!(
+        !text.contains("file-write* process-exec (subpath (param \"SYSTEM_0\"))"),
+        "should never allow writes below the system root"
+    );
+    assert!(
+        !text.contains("unix-socket (subpath (param \"SYSTEM_0\"))"),
+        "should never allow sockets below the system root"
+    );
+    for denied in [
+        "/usr/bin/sudo",
+        "/usr/bin/su",
+        "/usr/bin/login",
+        "/usr/bin/newgrp",
+        "/usr/bin/xcrun",
+        "/usr/bin/xcodebuild",
+        "/usr/bin/xcode-select",
+    ] {
+        assert!(
+            text.contains(&format!("(deny process-exec (literal \"{denied}\"))")),
+            "should refuse to execute {denied}"
+        );
+    }
+    for allowed in ["/usr/bin/cc", "/usr/bin/clang", "/usr/bin/ld"] {
+        assert!(
+            !text.contains(&format!("(literal \"{allowed}\")")),
+            "should leave the {allowed} shim to build scripts"
+        );
+    }
+    assert!(
+        profile
+            .defines()
+            .iter()
+            .any(|(name, value)| name == "SYSTEM_0"
+                && Some(value.as_str()) == layout.base.join("developer").to_str()),
+        "should bind the system root through a define"
+    );
+}
+
+#[test]
+fn system_roots_take_part_in_equality_and_the_fingerprint() {
+    let layout = layout();
+    let plain = layout.roots();
+    let with_developer = layout.with_developer();
+
+    assert_ne!(
+        plain, with_developer,
+        "should not treat roots without the system root as the same roots"
+    );
+    let plain_profile = MacProfile::generate(&plain).expect("should generate the profile");
+    let developer_profile =
+        MacProfile::generate(&with_developer).expect("should generate the profile");
+    assert_ne!(
+        plain_profile.fingerprint(),
+        developer_profile.fingerprint(),
+        "should bind the system root into the profile fingerprint"
+    );
+    assert_eq!(
+        with_developer.system(),
+        [layout.base.join("developer")],
+        "should keep the canonical system root"
+    );
+    assert!(
+        with_developer
+            .locate(&layout.base.join("developer/usr/bin/clang"))
+            .is_some_and(|(role, _, _)| role == roots::RootRole::System),
+        "should locate tools below the system root"
+    );
+}
+
+#[test]
+fn system_roots_must_be_disjoint_directories() {
+    let layout = layout();
+    fs::write(layout.base.join("developer-file/tool"), b"fictional").expect("should write file");
+    let cases = [
+        ("nested in the checkout", layout.base.join("checkout/inner")),
+        ("containing the tools", layout.base.clone()),
+        ("a regular file", layout.base.join("developer-file/tool")),
+        ("missing", layout.base.join("absent")),
+    ];
+    fs::create_dir_all(layout.base.join("checkout/inner")).expect("should create nested root");
+    for (label, system) in cases {
+        assert!(
+            layout.roots().with_system(&[system]).is_err(),
+            "should reject a system root {label}"
+        );
+    }
+}
+
+#[test]
+fn container_boundary_refuses_system_roots() {
+    let layout = layout();
+
+    let error = docker::mounts(&layout.with_developer()).expect_err("should refuse system roots");
+
+    assert!(
+        format!("{error:?}").contains("refuses host system roots"),
+        "should name the refused system root: {error:?}"
+    );
+    docker::mounts(&layout.roots()).expect("should mount roots without a system root");
+}
diff --git a/crates/trusted-server-release/src/boundary/command.rs b/crates/trusted-server-release/src/boundary/command.rs
new file mode 100644
index 0000000000..e6b534dbb7
--- /dev/null
+++ b/crates/trusted-server-release/src/boundary/command.rs
@@ -0,0 +1,235 @@
+//! The command description a [`Boundary`](super::Boundary) runs confined.
+
+use std::ffi::{OsStr, OsString};
+use std::fmt;
+use std::os::unix::ffi::OsStrExt as _;
+use std::path::{Path, PathBuf};
+
+use error_stack::Report;
+
+use crate::error::ReleaseError;
+pub(crate) use crate::process::Umask;
+use crate::process::{BoundedCommand, Cancellation, ProcessLimits};
+
+/// A child to run inside a [`Boundary`](super::Boundary), described by host
+/// paths.
+///
+/// The program must lie inside a boundary root and the working directory
+/// inside an immutable or writable root; on Linux both are translated to the
+/// container namespace. Both must be absolute with only normal components
+/// (no `.` or `..`), so the root they are located in is the root they reach.
+/// Arguments are passed verbatim. Environment values are validated by the
+/// same rules as [`BoundedCommand::environment`]; secret values are not
+/// supported because Docker would carry them in argv.
+pub(crate) struct ConfinedCommand {
+    pub(super) program: PathBuf,
+    pub(super) arguments: Vec<OsString>,
+    pub(super) working_directory: PathBuf,
+    pub(super) environment: Vec<(OsString, OsString)>,
+    /// Names in `environment` added through [`Self::tool_environment`].
+    tool_selectors: Vec<OsString>,
+    pub(super) stdin: Option<Vec<u8>>,
+    pub(super) limits: ProcessLimits,
+    pub(super) cancellation: Option<Cancellation>,
+    pub(super) umask: Option<Umask>,
+}
+
+impl fmt::Debug for ConfinedCommand {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("ConfinedCommand")
+            .field("program", &self.program)
+            .field("arguments", &self.arguments)
+            .field("working_directory", &self.working_directory)
+            .field(
+                "environment_names",
+                &self
+                    .environment
+                    .iter()
+                    .map(|(name, _)| name)
+                    .collect::<Vec<_>>(),
+            )
+            .field("stdin_bytes", &self.stdin.as_ref().map(Vec::len))
+            .field("limits", &self.limits)
+            .field("cancellation", &self.cancellation)
+            .field("umask", &self.umask)
+            .finish()
+    }
+}
+
+fn invalid_path(path: &Path) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Boundary).attach(format!(
+        "confined path {} must be absolute with only normal components",
+        path.display()
+    ))
+}
+
+/// Rejects relative paths and `.`/`..` segments.
+///
+/// The raw bytes are split because [`Path::components`] silently drops
+/// interior `.` segments.
+fn require_normal(path: &Path) -> Result<(), Report<ReleaseError>> {
+    let dotted = path
+        .as_os_str()
+        .as_bytes()
+        .split(|byte| *byte == b'/')
+        .any(|segment| segment == b"." || segment == b"..");
+    if !path.has_root() || dotted {
+        return Err(invalid_path(path));
+    }
+    Ok(())
+}
+
+impl ConfinedCommand {
+    /// Describes `program` running in `working_directory` under `limits`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] when either path is relative or has
+    /// a `.` or `..` component.
+    pub(crate) fn new(
+        program: &Path,
+        working_directory: &Path,
+        limits: ProcessLimits,
+    ) -> Result<Self, Report<ReleaseError>> {
+        require_normal(program)?;
+        require_normal(working_directory)?;
+        Ok(Self {
+            program: program.to_path_buf(),
+            arguments: Vec::new(),
+            working_directory: working_directory.to_path_buf(),
+            environment: Vec::new(),
+            tool_selectors: Vec::new(),
+            stdin: None,
+            limits,
+            cancellation: None,
+            umask: None,
+        })
+    }
+
+    /// Adds an explicitly selected tool path such as `RUSTC`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Process`] for any name or value
+    /// [`BoundedCommand::tool_selector_environment`] rejects, including a
+    /// duplicate.
+    pub(crate) fn tool_environment(
+        mut self,
+        name: impl AsRef<OsStr>,
+        value: impl AsRef<OsStr>,
+    ) -> Result<Self, Report<ReleaseError>> {
+        self.validated(None)?
+            .tool_selector_environment(name.as_ref(), value.as_ref())?;
+        self.environment
+            .push((name.as_ref().to_os_string(), value.as_ref().to_os_string()));
+        self.tool_selectors.push(name.as_ref().to_os_string());
+        Ok(self)
+    }
+
+    /// Appends fixed arguments.
+    #[must_use]
+    pub(crate) fn arguments<I>(mut self, arguments: I) -> Self
+    where
+        I: IntoIterator<Item = OsString>,
+    {
+        self.arguments.extend(arguments);
+        self
+    }
+
+    /// Adds a non-secret environment variable.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Process`] for any name or value
+    /// [`BoundedCommand::environment`] rejects, including a duplicate.
+    pub(crate) fn environment(
+        mut self,
+        name: impl AsRef<OsStr>,
+        value: impl AsRef<OsStr>,
+    ) -> Result<Self, Report<ReleaseError>> {
+        self.validated(Some((name.as_ref(), value.as_ref())))?;
+        self.environment
+            .push((name.as_ref().to_os_string(), value.as_ref().to_os_string()));
+        Ok(self)
+    }
+
+    /// Returns whether `name` was added through [`Self::tool_environment`].
+    pub(super) fn is_tool_selector(&self, name: &OsStr) -> bool {
+        self.tool_selectors.iter().any(|selected| selected == name)
+    }
+
+    /// Returns the tool-selector entries, for the boundary's placement check.
+    pub(super) fn tool_selector_entries(&self) -> impl Iterator<Item = (&OsString, &OsString)> {
+        self.environment
+            .iter()
+            .filter(|(name, _)| self.is_tool_selector(name))
+            .map(|(name, value)| (name, value))
+    }
+
+    /// Validates the environment plus `extra` through a scratch
+    /// [`BoundedCommand`].
+    pub(super) fn validated(
+        &self,
+        extra: Option<(&OsStr, &OsStr)>,
+    ) -> Result<BoundedCommand, Report<ReleaseError>> {
+        let mut validator =
+            BoundedCommand::new(&self.program, &self.working_directory, self.limits)?;
+        for (name, value) in self.environment.iter() {
+            validator = if self.tool_selectors.contains(name) {
+                validator.tool_selector_environment(name, value)?
+            } else {
+                validator.environment(name, value)?
+            };
+        }
+        if let Some((name, value)) = extra {
+            validator = validator.environment(name, value)?;
+        }
+        Ok(validator)
+    }
+
+    /// Supplies fixed stdin bytes.
+    #[must_use]
+    pub(crate) fn stdin_bytes(mut self, bytes: Vec<u8>) -> Self {
+        self.stdin = Some(bytes);
+        self
+    }
+
+    /// Observes `cancellation`.
+    #[must_use]
+    pub(crate) fn cancellation(mut self, cancellation: Cancellation) -> Self {
+        self.cancellation = Some(cancellation);
+        self
+    }
+
+    /// Runs the child under `umask`.
+    ///
+    /// macOS sets it in the child just before `sandbox-exec` executes; Linux
+    /// runs the program through `/bin/sh` of the selected image, which must
+    /// exist there. The orchestrator's own umask is never changed.
+    #[must_use]
+    pub(crate) fn umask(mut self, umask: Umask) -> Self {
+        self.umask = Some(umask);
+        self
+    }
+
+    /// Returns the requested umask, for tests of command construction.
+    #[cfg(test)]
+    pub(crate) fn requested_umask(&self) -> Option<Umask> {
+        self.umask
+    }
+
+    /// Applies stdin and cancellation to the wrapping bounded command.
+    pub(super) fn finish(&self, mut bounded: BoundedCommand) -> BoundedCommand {
+        if let Some(bytes) = &self.stdin {
+            bounded = bounded.stdin_bytes(bytes.clone());
+        }
+        if let Some(cancellation) = &self.cancellation {
+            bounded = bounded.cancellation(cancellation.clone());
+        }
+        bounded
+    }
+}
+
+#[cfg(test)]
+mod selector_tests;
diff --git a/crates/trusted-server-release/src/boundary/command/selector_tests.rs b/crates/trusted-server-release/src/boundary/command/selector_tests.rs
new file mode 100644
index 0000000000..83fa19bcf6
--- /dev/null
+++ b/crates/trusted-server-release/src/boundary/command/selector_tests.rs
@@ -0,0 +1,61 @@
+//! Pure tests of confined tool-selector variables; no process is started.
+
+use std::ffi::OsString;
+use std::path::Path;
+use std::time::Duration;
+
+use super::*;
+
+fn command() -> ConfinedCommand {
+    ConfinedCommand::new(
+        Path::new("/example/bin/cargo"),
+        Path::new("/example/checkout"),
+        ProcessLimits {
+            wall: Duration::from_secs(1),
+            stdout_max: 1024,
+            stderr_max: 1024,
+        },
+    )
+    .expect("should describe a confined command")
+}
+
+#[test]
+fn rustc_needs_the_explicit_tool_method_and_survives_later_variables() {
+    assert!(
+        command()
+            .environment("RUSTC", "/example/bin/rustc")
+            .is_err(),
+        "should reject RUSTC through the generic environment"
+    );
+    let described = command()
+        .tool_environment("RUSTC", "/example/bin/rustc")
+        .expect("should accept the explicit tool selector")
+        .environment("TZ", "UTC")
+        .expect("should accept a later ordinary variable")
+        .tool_environment("RUSTC_WRAPPER", "/example/wrapper");
+    assert!(described.is_err(), "should reject any other tool selector");
+
+    let described = command()
+        .tool_environment("RUSTC", "/example/bin/rustc")
+        .expect("should accept the explicit tool selector")
+        .environment("TZ", "UTC")
+        .expect("should accept a later ordinary variable");
+    assert_eq!(
+        described.environment,
+        [
+            (
+                OsString::from("RUSTC"),
+                OsString::from("/example/bin/rustc")
+            ),
+            (OsString::from("TZ"), OsString::from("UTC")),
+        ],
+        "should carry both variables to the platform runner in order"
+    );
+    assert!(
+        command()
+            .tool_environment("RUSTC", "/example/bin/rustc")
+            .and_then(|command| command.environment("RUSTC", "/example/other"))
+            .is_err(),
+        "should reject a second RUSTC through the generic environment"
+    );
+}
diff --git a/crates/trusted-server-release/src/boundary/daemon.rs b/crates/trusted-server-release/src/boundary/daemon.rs
new file mode 100644
index 0000000000..92e57bb080
--- /dev/null
+++ b/crates/trusted-server-release/src/boundary/daemon.rs
@@ -0,0 +1,342 @@
+//! The pinned Docker client and its daemon-socket checks.
+//!
+//! Before every Docker host command the client rehashes its pinned inputs
+//! (see [`HostInputs`]) and rechecks the daemon socket: the socket itself
+//! must be a root-owned socket reached without a final alias, and every
+//! ancestor directory, both on the configured path and on its canonical
+//! form (for example `/var/run` → `/run`), must be root-owned and not group-
+//! or other-writable, so no unprivileged user can substitute the endpoint.
+//!
+//! The client executable is trust-on-first-use pinned by digest for the life
+//! of a boundary; it is not authenticated against an independent root.
+//! Production use stays closed through the uninhabited
+//! [`QualifiedImage`](super::docker::QualifiedImage).
+
+use std::ffi::OsString;
+use std::fs;
+use std::os::unix::fs::{FileTypeExt as _, MetadataExt as _};
+use std::path::Path;
+
+use error_stack::Report;
+
+use super::host_inputs::HostInputs;
+use crate::documents::{Role as DocumentRole, parse_json};
+use crate::error::ReleaseError;
+use crate::process::{BoundedCommand, ProcessLimits, ProcessResult};
+
+/// The fixed Docker daemon endpoint.
+pub(crate) const DOCKER_HOST: &str = "unix:///var/run/docker.sock";
+/// The daemon socket behind [`DOCKER_HOST`].
+pub(crate) const DOCKER_SOCKET: &str = "/var/run/docker.sock";
+/// Group and other write permission bits.
+const SHARED_WRITE: u32 = 0o022;
+
+fn daemon_error(message: impl std::fmt::Display) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Boundary).attach(message.to_string())
+}
+
+/// Requires every ancestor of `path` to be root-owned, and every ancestor
+/// directory not group- or other-writable.
+fn check_ancestors(path: &Path) -> Result<(), Report<ReleaseError>> {
+    for ancestor in path.ancestors().skip(1) {
+        let metadata = fs::symlink_metadata(ancestor).map_err(|error| {
+            daemon_error(format!("cannot inspect {}: {error}", ancestor.display()))
+        })?;
+        let shared = metadata.is_dir() && metadata.mode() & SHARED_WRITE != 0;
+        if metadata.uid() != 0 || shared {
+            return Err(daemon_error(format!(
+                "Docker socket ancestor {} is not root-owned and protected",
+                ancestor.display()
+            )));
+        }
+    }
+    Ok(())
+}
+
+/// Checks the daemon socket at `path`.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Boundary`] when the socket is missing, is an
+/// alias, is not a root-owned socket, or any ancestor (configured or
+/// canonical) is not root-owned or is group- or other-writable.
+pub(crate) fn check_daemon_socket(path: &Path) -> Result<(), Report<ReleaseError>> {
+    let (Some(parent), Some(name)) = (path.parent(), path.file_name()) else {
+        return Err(daemon_error("Docker socket path has no parent"));
+    };
+    check_ancestors(path)?;
+    let canonical = fs::canonicalize(parent)
+        .map_err(|error| daemon_error(format!("cannot resolve Docker socket parent: {error}")))?
+        .join(name);
+    check_ancestors(&canonical)?;
+    let metadata = fs::symlink_metadata(&canonical)
+        .map_err(|error| daemon_error(format!("Docker daemon socket unavailable: {error}")))?;
+    if !metadata.file_type().is_socket() || metadata.uid() != 0 {
+        return Err(daemon_error(
+            "Docker daemon endpoint is not a root-owned socket (aliases are rejected)",
+        ));
+    }
+    Ok(())
+}
+
+/// Returns the client-level arguments selecting the empty config and daemon.
+#[must_use]
+pub(crate) fn host_arguments(config: &Path) -> Vec<OsString> {
+    vec![
+        OsString::from("--config"),
+        config.as_os_str().to_os_string(),
+        OsString::from("--host"),
+        OsString::from(DOCKER_HOST),
+    ]
+}
+
+/// A pinned Docker client that rehashes its inputs before every command.
+#[derive(Debug)]
+pub(crate) struct DockerClient {
+    inputs: HostInputs,
+    host_limits: ProcessLimits,
+}
+
+impl DockerClient {
+    /// Creates pinned host inputs under `state_parent`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] as [`HostInputs::create`] does.
+    pub(crate) fn new(
+        client: &Path,
+        state_parent: &Path,
+        mounted: &[&Path],
+        host_limits: ProcessLimits,
+    ) -> Result<Self, Report<ReleaseError>> {
+        Ok(Self {
+            inputs: HostInputs::create(state_parent, client, mounted)?,
+            host_limits,
+        })
+    }
+
+    /// Returns the pinned inputs.
+    #[must_use]
+    pub(crate) fn inputs(&self) -> &HostInputs {
+        &self.inputs
+    }
+
+    /// Builds a client command after rehashing every pinned input and
+    /// rechecking the daemon socket.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] when an input changed or the socket
+    /// check fails, or [`ReleaseError::Process`] for an invalid command.
+    pub(crate) fn command(
+        &self,
+        arguments: Vec<OsString>,
+        limits: ProcessLimits,
+    ) -> Result<BoundedCommand, Report<ReleaseError>> {
+        self.inputs.verify()?;
+        self.control_command(arguments, limits)
+    }
+
+    /// Builds a command after checking its client, config and daemon inputs.
+    fn control_command(
+        &self,
+        arguments: Vec<OsString>,
+        limits: ProcessLimits,
+    ) -> Result<BoundedCommand, Report<ReleaseError>> {
+        self.inputs.verify_control()?;
+        check_daemon_socket(Path::new(DOCKER_SOCKET))?;
+        Ok(
+            BoundedCommand::new(self.inputs.client(), self.inputs.directory(), limits)?
+                .arguments(arguments),
+        )
+    }
+
+    fn full_arguments(&self, arguments: &[&str]) -> Vec<OsString> {
+        let mut full = host_arguments(self.inputs.config());
+        full.extend(arguments.iter().map(OsString::from));
+        full
+    }
+
+    /// Requires the selected image not to declare anonymous writable volumes.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when image inspection fails or its volume declaration
+    /// is malformed or nonempty. Inspection uses the pinned host client.
+    pub(crate) fn require_no_image_volumes(&self, image: &str) -> Result<(), Report<ReleaseError>> {
+        let result = self.host(&[
+            "image",
+            "inspect",
+            "--format",
+            "{{json .Config.Volumes}}",
+            image,
+        ])?;
+        validate_image_volumes(&result.require_success()?)
+    }
+
+    /// Creates a stopped container and requires its acknowledged full identity.
+    ///
+    /// Callers must supply fixed `create` arguments and must not issue a start
+    /// request before this returns successfully. Killing a create client cannot
+    /// cancel its daemon RPC, so an error leaves creation explicitly unresolved.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for changed host inputs, failed creation or an invalid
+    /// ID. A late stopped container remains possible after any failure; name
+    /// cleanup and an absence observation cannot turn that failure into success.
+    pub(crate) fn create(
+        &self,
+        arguments: Vec<OsString>,
+        limits: ProcessLimits,
+    ) -> Result<ContainerId, Report<ReleaseError>> {
+        self.command(arguments, limits)
+            .and_then(|command| command.run())
+            .and_then(ProcessResult::require_success)
+            .and_then(|stdout| ContainerId::parse(&stdout))
+            .map_err(|error| error.attach(
+                "container creation is unresolved; a late stopped container may remain; no start is authorized"
+            ))
+    }
+
+    /// Runs one host command (`docker --config … --host … <arguments>`).
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] when an input changed or the socket
+    /// check fails before the command, or [`ReleaseError::Process`] when the
+    /// child cannot be run.
+    pub(crate) fn host(&self, arguments: &[&str]) -> Result<ProcessResult, Report<ReleaseError>> {
+        self.command(self.full_arguments(arguments), self.host_limits)?
+            .run()
+    }
+
+    /// Runs one cleanup command, rehashing inputs first when they are still
+    /// intact. Profile-only failures are recorded while safe cleanup is
+    /// attempted; a changed client or config prevents all execution.
+    pub(crate) fn cleanup_host(
+        &self,
+        arguments: &[&str],
+        failures: &mut Vec<Report<ReleaseError>>,
+    ) -> Option<ProcessResult> {
+        if let Err(integrity) = self.inputs.verify_control() {
+            failures.push(integrity);
+            return None;
+        }
+        let full = self.full_arguments(arguments);
+        if let Err(integrity) = self.inputs.verify() {
+            failures.push(integrity);
+        }
+        let command = self.control_command(full, self.host_limits);
+        match command.and_then(|command| command.run()) {
+            Ok(result) => Some(result),
+            Err(error) => {
+                failures.push(error);
+                None
+            }
+        }
+    }
+}
+
+/// Full immutable identity acknowledged by a successful Docker create command.
+#[derive(Debug)]
+pub(crate) struct ContainerId(String);
+
+impl ContainerId {
+    /// Parses exactly one full lowercase hexadecimal container ID.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for abbreviated IDs, names, extra output or invalid bytes.
+    pub(crate) fn parse(stdout: &[u8]) -> Result<Self, Report<ReleaseError>> {
+        let bytes = stdout.strip_suffix(b"\n").unwrap_or(stdout);
+        if bytes.len() != 64
+            || !bytes
+                .iter()
+                .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(byte))
+        {
+            return Err(daemon_error(
+                "container creation returned no unambiguous full identity",
+            ));
+        }
+        let id = std::str::from_utf8(bytes)
+            .map_err(|error| daemon_error(format!("container identity is not UTF-8: {error}")))?;
+        Ok(Self(id.to_owned()))
+    }
+
+    /// Returns the full daemon-owned container identity.
+    pub(crate) fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+#[cfg(test)]
+mod create_tests {
+    use super::*;
+
+    #[test]
+    fn created_container_identity_is_full_and_unambiguous() {
+        let id = "a".repeat(64);
+        for bytes in [id.clone(), format!("{id}\n")] {
+            assert_eq!(
+                ContainerId::parse(bytes.as_bytes())
+                    .expect("should accept one full ID")
+                    .as_str(),
+                id
+            );
+        }
+        for invalid in [
+            String::new(),
+            "a".repeat(12),
+            "A".repeat(64),
+            format!("sha256:{id}"),
+            format!("{id}\nextra"),
+            format!(" {id}"),
+            format!("{id}\n\n"),
+        ] {
+            assert!(
+                ContainerId::parse(invalid.as_bytes()).is_err(),
+                "should reject ambiguous container identity {invalid:?}"
+            );
+        }
+    }
+}
+
+#[cfg(test)]
+mod volume_tests {
+    use super::*;
+
+    #[test]
+    fn image_volumes_must_be_absent_or_an_empty_object() {
+        for accepted in [b"null".as_slice(), b"{}\n"] {
+            validate_image_volumes(accepted)
+                .expect("should accept an image without declared volumes");
+        }
+        for rejected in [
+            b"{\"/scratch\":{}}".as_slice(),
+            b"[]",
+            b"\"null\"",
+            b"true",
+            b"",
+            b"{} trailing",
+            b"{\"x\":{},\"x\":{}}",
+        ] {
+            assert!(
+                validate_image_volumes(rejected).is_err(),
+                "should reject malformed or writable image volumes: {rejected:?}"
+            );
+        }
+    }
+}
+
+/// Accepts only the Docker image volume JSON values that declare no mounts.
+fn validate_image_volumes(stdout: &[u8]) -> Result<(), Report<ReleaseError>> {
+    let value = parse_json(stdout, DocumentRole::Metadata)
+        .map_err(|error| error.change_context(ReleaseError::Boundary))?;
+    if value.is_null() || value.as_object().is_some_and(serde_json::Map::is_empty) {
+        return Ok(());
+    }
+    Err(daemon_error(
+        "selected image declares writable volumes or malformed volume metadata",
+    ))
+}
diff --git a/crates/trusted-server-release/src/boundary/docker.rs b/crates/trusted-server-release/src/boundary/docker.rs
new file mode 100644
index 0000000000..c45521ece2
--- /dev/null
+++ b/crates/trusted-server-release/src/boundary/docker.rs
@@ -0,0 +1,671 @@
+//! Linux Docker container boundary.
+//!
+//! Every container runs with `--init` in Docker's default private PID
+//! namespace (never the invalid `--pid=private`), `--network none`, the
+//! effective seccomp profile (every non-Unix socket denied with `EPERM`), a read-only
+//! root filesystem, all capabilities dropped, `no-new-privileges`, private
+//! IPC without a `/dev/shm` mount, an empty read-only `/tmp`, a non-root user
+//! and CPU, memory and process limits that fit the
+//! actual host. The client is a fixed absolute executable invoked with an
+//! explicit empty `--config` and the fixed Unix daemon socket, a cleared
+//! environment (no `DOCKER_HOST`, `DOCKER_CONTEXT` or `DOCKER_CONFIG`), no TTY
+//! and `--pull never`.
+//!
+//! Mounts use `--mount type=bind`, which fails on a missing source instead of
+//! creating it the way `-v` does. Immutable roots and tools are mounted
+//! read-only and recursively read-only (`bind-recursive=readonly`), writable
+//! roots read-write, at fixed `/boundary/<role>/<index>` targets.
+//!
+//! Creation must acknowledge a full container ID before a separate attached
+//! start can execute the guest. A failed creation remains unresolved and fatal;
+//! a later name lookup cannot exclude a delayed daemon-side creation.
+//! Every acknowledged start is followed, on success and failure alike, by bounded
+//! `docker stop --time <n>`, `docker rm --force` and a listing that must show
+//! the acknowledged container ID gone. Each step is attempted even when an earlier one
+//! failed, and every failure is reported. If the pinned host inputs fail
+//! their integrity check during cleanup, cleanup still proceeds through the
+//! pinned client path (a left-running container is the worse outcome) and the
+//! integrity failure is returned.
+
+use std::ffi::OsString;
+use std::path::{Path, PathBuf};
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256};
+
+use super::daemon::{
+    ContainerId, DOCKER_SOCKET, DockerClient, check_daemon_socket, host_arguments,
+};
+use super::roots::{BoundaryRoots, RootRole, validate_path_text};
+use super::{ConfinedCommand, Umask};
+use crate::error::ReleaseError;
+use crate::process::{ProcessLimits, ProcessOutcome, ProcessResult};
+
+/// Container-namespace prefix for every mount target.
+const MOUNT_PREFIX: &str = "/boundary";
+/// Configuration fingerprint domain.
+const FINGERPRINT_DOMAIN: &[u8] = b"trusted-server-boundary-docker-confirmed-create-v2\n";
+/// Fixed absolute shell of the selected image that applies a requested umask.
+const SHELL: &str = "/bin/sh";
+/// Fixed `argv[0]` of [`SHELL`]; the program and its arguments follow it.
+const SHELL_NAME: &str = "sh";
+
+fn docker_error(message: impl std::fmt::Display) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Boundary).attach(message.to_string())
+}
+
+/// A production OCI image that passed Task 8 qualification.
+///
+/// No image is qualified yet (`release-tools.json` keeps the GNU builder
+/// `image_reference` null), so this type is uninhabited and production
+/// selection stays closed.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum QualifiedImage {}
+
+/// The image a container boundary runs.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) enum ImageSelection {
+    /// A qualified production image (currently impossible to construct).
+    Qualified(QualifiedImage),
+    /// A test-only local image resolved to its content ID.
+    #[cfg(test)]
+    Test { id: String },
+}
+
+impl ImageSelection {
+    fn into_id(self) -> String {
+        match self {
+            Self::Qualified(image) => match image {},
+            #[cfg(test)]
+            Self::Test { id } => id,
+        }
+    }
+}
+
+/// Validates a local image content ID (`sha256:<64 lowercase hex>`).
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Boundary`] for anything else.
+pub(crate) fn validate_image_id(id: &str) -> Result<(), Report<ReleaseError>> {
+    let valid = id.strip_prefix("sha256:").is_some_and(|digest| {
+        digest.len() == 64
+            && digest
+                .bytes()
+                .all(|byte| matches!(byte, b'0'..=b'9' | b'a'..=b'f'))
+    });
+    if !valid {
+        return Err(docker_error("image is not pinned by a sha256 content ID"));
+    }
+    Ok(())
+}
+
+/// Container resource and cleanup settings.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct DockerSettings {
+    /// Absolute fixed Docker client executable.
+    pub(crate) client: PathBuf,
+    /// Whole CPUs; never more than the host's available parallelism.
+    pub(crate) cpus: u32,
+    /// Memory limit in bytes; never more than host physical memory.
+    pub(crate) memory_bytes: u64,
+    /// Maximum container processes.
+    pub(crate) pids_limit: u32,
+    /// Size bound of the empty read-only `/tmp` tmpfs in bytes.
+    pub(crate) tmpfs_bytes: u64,
+    /// Non-root container user and group IDs.
+    pub(crate) user: (u32, u32),
+    /// `docker stop -t` grace in seconds.
+    pub(crate) stop_timeout_seconds: u32,
+    /// Limits for Docker creation and host cleanup commands.
+    pub(crate) host_limits: ProcessLimits,
+}
+
+/// Returns host physical memory in bytes, when the OS reports it.
+fn physical_memory() -> Option<u64> {
+    // SAFETY: `sysconf` has no preconditions and only reads system values.
+    let (pages, page_size) = unsafe {
+        (
+            libc::sysconf(libc::_SC_PHYS_PAGES),
+            libc::sysconf(libc::_SC_PAGESIZE),
+        )
+    };
+    let pages = u64::try_from(pages).ok()?;
+    let page_size = u64::try_from(page_size).ok()?;
+    pages.checked_mul(page_size)
+}
+
+impl DockerSettings {
+    /// Checks the settings against the actual host capacity.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] for zero limits, CPUs above
+    /// [`std::thread::available_parallelism`], memory above physical memory,
+    /// a root user, or a stop grace not below the host command deadline.
+    pub(crate) fn validate(&self) -> Result<(), Report<ReleaseError>> {
+        let parallelism = std::thread::available_parallelism()
+            .map_err(|error| docker_error(format!("cannot read host parallelism: {error}")))?;
+        let parallelism = u32::try_from(parallelism.get()).unwrap_or(u32::MAX);
+        if self.cpus == 0 || self.cpus > parallelism {
+            return Err(docker_error(format!(
+                "container CPUs {} must be between 1 and host parallelism {parallelism}",
+                self.cpus
+            )));
+        }
+        let memory =
+            physical_memory().ok_or_else(|| docker_error("cannot read host physical memory"))?;
+        if self.memory_bytes == 0 || self.memory_bytes > memory {
+            return Err(docker_error(format!(
+                "container memory {} must be nonzero and at most host memory {memory}",
+                self.memory_bytes
+            )));
+        }
+        if self.pids_limit == 0 || self.tmpfs_bytes == 0 || self.user.0 == 0 {
+            return Err(docker_error(
+                "pids, tmpfs and non-root user must all be set",
+            ));
+        }
+        let stop = std::time::Duration::from_secs(u64::from(self.stop_timeout_seconds));
+        if self.stop_timeout_seconds == 0 || stop >= self.host_limits.wall {
+            return Err(docker_error(
+                "stop grace must be nonzero and below the host deadline",
+            ));
+        }
+        Ok(())
+    }
+}
+
+/// One bind mount into the container namespace.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct Mount {
+    source: PathBuf,
+    target: String,
+    read_only: bool,
+}
+
+fn role_directory(role: RootRole) -> &'static str {
+    match role {
+        RootRole::Immutable => "immutable",
+        RootRole::Tool => "tool",
+        RootRole::Writable => "writable",
+        RootRole::System => "system",
+    }
+}
+
+/// Returns the container path of `host`, which must lie inside a root.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Boundary`] when `host` is outside every root.
+pub(crate) fn container_path(
+    roots: &BoundaryRoots,
+    host: &Path,
+) -> Result<PathBuf, Report<ReleaseError>> {
+    let (role, index, relative) = roots.locate(host).ok_or_else(|| {
+        docker_error(format!("{} is outside every boundary root", host.display()))
+    })?;
+    let base = PathBuf::from(format!("{MOUNT_PREFIX}/{}/{index}", role_directory(role)));
+    Ok(if relative.as_os_str().is_empty() {
+        base
+    } else {
+        base.join(relative)
+    })
+}
+
+/// Returns the host path of a container path inside a writable root.
+///
+/// Only writable roots map back: a build must never name an immutable or tool
+/// file as its output. Dot segments are rejected rather than resolved.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Boundary`] when `container` is not an absolute
+/// path below `/boundary/writable/<index>` with a canonical decimal index of
+/// an existing writable root and only normal components after it.
+pub(crate) fn host_path(
+    roots: &BoundaryRoots,
+    container: &Path,
+) -> Result<PathBuf, Report<ReleaseError>> {
+    // `components` silently drops `.`, doubled and trailing separators, so
+    // lexical normal form is checked against the original text.
+    if container.components().collect::<PathBuf>().as_os_str() != container.as_os_str() {
+        return Err(docker_error("container path is not in lexical normal form"));
+    }
+    let prefix = Path::new(MOUNT_PREFIX).join(role_directory(RootRole::Writable));
+    let relative = container.strip_prefix(&prefix).map_err(|_| {
+        docker_error(format!(
+            "{} is not below the writable mount prefix",
+            container.display()
+        ))
+    })?;
+    let mut components = relative.components();
+    let index = components
+        .next()
+        .and_then(|component| match component {
+            std::path::Component::Normal(text) => text.to_str(),
+            _ => None,
+        })
+        .filter(|text| {
+            text.bytes().all(|byte| byte.is_ascii_digit())
+                && (*text == "0" || !text.starts_with('0'))
+        })
+        .and_then(|text| text.parse::<usize>().ok())
+        .ok_or_else(|| docker_error("container path has no canonical writable root index"))?;
+    let root = roots
+        .writable()
+        .get(index)
+        .ok_or_else(|| docker_error(format!("no writable root has index {index}")))?;
+    let mut host = root.clone();
+    for component in components {
+        match component {
+            std::path::Component::Normal(part) => host.push(part),
+            _ => {
+                return Err(docker_error(
+                    "container path has a dot segment after its root",
+                ));
+            }
+        }
+    }
+    Ok(host)
+}
+
+/// Builds the bind mounts for `roots`.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Boundary`] when a source path contains `,` or `=`,
+/// which the `--mount` field syntax cannot carry unambiguously, or when any
+/// system root is present: the container exposes only reviewed image tools,
+/// never a host system directory.
+pub(crate) fn mounts(roots: &BoundaryRoots) -> Result<Vec<Mount>, Report<ReleaseError>> {
+    if !roots.system().is_empty() {
+        return Err(docker_error(
+            "the container boundary refuses host system roots",
+        ));
+    }
+    roots
+        .entries()
+        .map(|(role, _, source)| {
+            let text = validate_path_text(source)?;
+            if text.contains(',') || text.contains('=') {
+                return Err(docker_error(format!(
+                    "mount source {text:?} contains ',' or '='"
+                )));
+            }
+            Ok(Mount {
+                source: source.to_path_buf(),
+                target: container_path(roots, source)?
+                    .to_string_lossy()
+                    .into_owned(),
+                read_only: role != RootRole::Writable,
+            })
+        })
+        .collect()
+}
+
+/// Everything one `docker run` invocation needs besides settings.
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct RunPlan<'a> {
+    pub(crate) config: &'a Path,
+    pub(crate) seccomp: &'a Path,
+    pub(crate) name: &'a str,
+    pub(crate) image: &'a str,
+    pub(crate) mounts: &'a [Mount],
+    pub(crate) environment: &'a [(OsString, OsString)],
+    pub(crate) working_directory: &'a Path,
+    pub(crate) program: &'a Path,
+    pub(crate) arguments: &'a [OsString],
+    pub(crate) interactive: bool,
+    /// Mask applied before the program through [`SHELL`], when set.
+    pub(crate) umask: Option<Umask>,
+}
+
+fn mount_argument(mount: &Mount) -> OsString {
+    let mut value = OsString::from("type=bind,source=");
+    value.push(&mount.source);
+    value.push(",target=");
+    value.push(&mount.target);
+    if mount.read_only {
+        value.push(",readonly,bind-propagation=rprivate,bind-recursive=readonly");
+    }
+    value
+}
+
+/// Fixed isolation flags; deliberately no `--pid` (the default namespace is
+/// already private) and no `--tty`.
+const ISOLATION_ARGUMENTS: [&str; 12] = [
+    "--init",
+    "--pull",
+    "never",
+    "--network",
+    "none",
+    "--ipc",
+    "none",
+    "--read-only",
+    "--cap-drop",
+    "ALL",
+    "--security-opt",
+    "no-new-privileges=true",
+];
+
+fn limit_arguments(settings: &DockerSettings) -> [String; 10] {
+    [
+        String::from("--pids-limit"),
+        settings.pids_limit.to_string(),
+        String::from("--cpus"),
+        settings.cpus.to_string(),
+        String::from("--memory"),
+        format!("{}b", settings.memory_bytes),
+        String::from("--user"),
+        format!("{}:{}", settings.user.0, settings.user.1),
+        String::from("--tmpfs"),
+        format!("/tmp:ro,noexec,nosuid,nodev,size={}", settings.tmpfs_bytes),
+    ]
+}
+
+/// Returns the fixed shell words that apply `umask` before `exec "$@"`.
+///
+/// The script is built only from the validated octal digits; the program and
+/// its arguments follow as positional parameters and are never interpolated.
+fn umask_prefix(umask: Option<Umask>) -> Vec<OsString> {
+    umask
+        .map(|umask| {
+            [
+                String::from(SHELL),
+                String::from("-c"),
+                format!("umask {umask} && exec \"$@\""),
+                String::from(SHELL_NAME),
+            ]
+            .into_iter()
+            .map(OsString::from)
+            .collect()
+        })
+        .unwrap_or_default()
+}
+
+/// Returns the complete fixed `docker create` argument vector for `plan`.
+#[must_use]
+pub(crate) fn create_arguments(settings: &DockerSettings, plan: &RunPlan<'_>) -> Vec<OsString> {
+    let mut arguments = host_arguments(plan.config);
+    arguments.extend(["create", "--name", plan.name].iter().map(OsString::from));
+    arguments.extend(ISOLATION_ARGUMENTS.iter().map(OsString::from));
+    let mut seccomp = OsString::from("seccomp=");
+    seccomp.push(plan.seccomp);
+    arguments.extend([OsString::from("--security-opt"), seccomp]);
+    arguments.extend(limit_arguments(settings).into_iter().map(OsString::from));
+    if plan.interactive {
+        arguments.push(OsString::from("--interactive"));
+    }
+    for mount in plan.mounts {
+        arguments.extend([OsString::from("--mount"), mount_argument(mount)]);
+    }
+    for (name, value) in plan.environment {
+        let mut assignment = name.clone();
+        assignment.push("=");
+        assignment.push(value);
+        arguments.extend([OsString::from("--env"), assignment]);
+    }
+    arguments.extend([
+        OsString::from("--workdir"),
+        plan.working_directory.as_os_str().to_os_string(),
+        OsString::from(plan.image),
+    ]);
+    arguments.extend(umask_prefix(plan.umask));
+    arguments.push(plan.program.as_os_str().to_os_string());
+    arguments.extend(plan.arguments.iter().cloned());
+    arguments
+}
+
+fn container_name() -> Result<String, Report<ReleaseError>> {
+    Ok(format!(
+        "ts-release-boundary-{}",
+        hex::encode(super::random_bytes::<12>()?)
+    ))
+}
+
+/// Folds `failures` into one report, or `Ok` when there are none.
+fn aggregate(mut failures: Vec<Report<ReleaseError>>) -> Result<(), Report<ReleaseError>> {
+    if failures.is_empty() {
+        return Ok(());
+    }
+    let first = failures.remove(0);
+    Err(failures.into_iter().fold(first, |report, other| {
+        report.attach(format!("additional cleanup failure: {other:?}"))
+    }))
+}
+
+/// A configured container boundary.
+#[derive(Debug)]
+pub(crate) struct DockerBoundary {
+    client: DockerClient,
+    settings: DockerSettings,
+    /// Content ID of the [`ImageSelection`] this boundary was configured with.
+    image_id: String,
+    mounts: Vec<Mount>,
+}
+
+impl DockerBoundary {
+    /// Validates settings, the daemon socket and mounts, then pins inputs.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] for invalid settings, an unusable
+    /// daemon socket, an unpinned image, unmountable roots or host inputs
+    /// that overlap a mounted root, or an image with declared volumes.
+    pub(crate) fn new(
+        roots: &BoundaryRoots,
+        settings: DockerSettings,
+        image: ImageSelection,
+        state_parent: &Path,
+    ) -> Result<Self, Report<ReleaseError>> {
+        Self::configure(roots, settings, image.into_id(), state_parent)
+    }
+
+    /// Configures a boundary for an image ID taken from an [`ImageSelection`].
+    fn configure(
+        roots: &BoundaryRoots,
+        settings: DockerSettings,
+        image_id: String,
+        state_parent: &Path,
+    ) -> Result<Self, Report<ReleaseError>> {
+        settings.validate()?;
+        validate_image_id(&image_id)?;
+        check_daemon_socket(Path::new(DOCKER_SOCKET))?;
+        let mounts = mounts(roots)?;
+        let mounted: Vec<&Path> = mounts.iter().map(|mount| mount.source.as_path()).collect();
+        let client = DockerClient::new(
+            &settings.client,
+            state_parent,
+            &mounted,
+            settings.host_limits,
+        )?;
+        client.require_no_image_volumes(&image_id)?;
+        Ok(Self {
+            client,
+            settings,
+            image_id,
+            mounts,
+        })
+    }
+
+    /// Configures a sibling container with the same image and settings over
+    /// `roots`, with fresh host inputs beside this boundary's inputs.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] as [`Self::new`] does, or when the
+    /// sibling pinned a different client or seccomp profile.
+    pub(crate) fn sibling(&self, roots: &BoundaryRoots) -> Result<Self, Report<ReleaseError>> {
+        let state_parent = self
+            .client
+            .inputs()
+            .directory()
+            .parent()
+            .ok_or_else(|| docker_error("Docker host input directory has no parent"))?;
+        let sibling = Self::configure(
+            roots,
+            self.settings.clone(),
+            self.image_id.clone(),
+            state_parent,
+        )?;
+        if sibling.client.inputs().digests() != self.client.inputs().digests() {
+            return Err(docker_error(
+                "sibling container pinned another Docker client or seccomp profile",
+            ));
+        }
+        Ok(sibling)
+    }
+
+    /// Returns the configuration fingerprint (before the instance nonce).
+    #[must_use]
+    pub(crate) fn fingerprint(&self) -> [u8; 32] {
+        let plan = RunPlan {
+            config: self.client.inputs().config(),
+            seccomp: self.client.inputs().effective_profile(),
+            name: "",
+            image: &self.image_id,
+            mounts: &self.mounts,
+            environment: &[],
+            working_directory: Path::new("/"),
+            program: Path::new("/"),
+            arguments: &[],
+            interactive: false,
+            umask: None,
+        };
+        let mut hasher = Sha256::new();
+        hasher.update(FINGERPRINT_DOMAIN);
+        let digests = self.client.inputs().digests();
+        let parts = create_arguments(&self.settings, &plan)
+            .into_iter()
+            .chain(digests.iter().map(OsString::from));
+        for part in parts {
+            let bytes = part.as_encoded_bytes();
+            hasher.update((bytes.len() as u64).to_be_bytes());
+            hasher.update(bytes);
+        }
+        hasher.finalize().into()
+    }
+
+    /// Runs `command` in a fresh container, then always cleans it up.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] for changed host inputs, a failed
+    /// daemon-socket check or failed cleanup, or [`ReleaseError::Process`]
+    /// when the client cannot be run.
+    pub(crate) fn run(
+        &self,
+        roots: &BoundaryRoots,
+        command: &ConfinedCommand,
+    ) -> Result<ProcessResult, Report<ReleaseError>> {
+        let name = container_name()?;
+        let working_directory = container_path(roots, &command.working_directory)?;
+        let program = container_path(roots, &command.program)?;
+        let plan = RunPlan {
+            config: self.client.inputs().config(),
+            seccomp: self.client.inputs().effective_profile(),
+            name: &name,
+            image: &self.image_id,
+            mounts: &self.mounts,
+            environment: &command.environment,
+            working_directory: &working_directory,
+            program: &program,
+            arguments: &command.arguments,
+            interactive: command.stdin.is_some(),
+            umask: command.umask,
+        };
+        let arguments = create_arguments(&self.settings, &plan);
+        complete_created(
+            self.client.create(arguments, self.settings.host_limits),
+            |id| {
+                self.client
+                    .command(
+                        start_arguments(self.client.inputs().config(), id, command.stdin.is_some()),
+                        command.limits,
+                    )
+                    .and_then(|bounded| command.finish(bounded).run())
+            },
+            |id| self.cleanup(&name, id),
+        )
+    }
+
+    /// Attempts bounded stop, remove and a confirming listing independently,
+    /// and aggregates every failure, including a host-input integrity
+    /// failure observed during cleanup.
+    fn cleanup(&self, name: &str, id: Option<&ContainerId>) -> Result<(), Report<ReleaseError>> {
+        let grace = self.settings.stop_timeout_seconds.to_string();
+        let (reference, filter) = cleanup_target(name, id);
+        let mut failures = Vec::new();
+        // A stopped or already removed container can make stop or rm fail;
+        // the final listing confirms absence of the exact acknowledged ID.
+        // After failed creation, name absence never resolves the creation error.
+        let _ = self
+            .client
+            .cleanup_host(&["stop", "--time", &grace, reference], &mut failures);
+        let _ = self
+            .client
+            .cleanup_host(&["rm", "--force", reference], &mut failures);
+        let listing = self.client.cleanup_host(
+            &["ps", "--all", "--quiet", "--filter", &filter],
+            &mut failures,
+        );
+        let gone = listing.as_ref().is_some_and(|listing| {
+            listing.outcome() == (ProcessOutcome::Exited { code: 0 }) && listing.stdout().is_empty()
+        });
+        if !gone {
+            failures.push(docker_error(format!(
+                "container {reference} was not confirmed removed"
+            )));
+        }
+        aggregate(failures)
+    }
+}
+
+#[cfg(test)]
+mod host_path_tests;
+
+/// Attaches to a confirmed container, preserving its configured stdin behavior.
+#[must_use]
+pub(crate) fn start_arguments(config: &Path, id: &ContainerId, interactive: bool) -> Vec<OsString> {
+    let mut arguments = host_arguments(config);
+    arguments.extend([OsString::from("start"), OsString::from("--attach")]);
+    if interactive {
+        arguments.push(OsString::from("--interactive"));
+    }
+    arguments.push(OsString::from(id.as_str()));
+    arguments
+}
+
+/// Starts only acknowledged creations and always attempts the matching cleanup.
+///
+/// # Errors
+///
+/// Returns the creation or start failure together with any cleanup failure.
+/// Observing absence after failed creation never clears the creation error.
+pub(crate) fn complete_created<T>(
+    created: Result<ContainerId, Report<ReleaseError>>,
+    start: impl FnOnce(&ContainerId) -> Result<T, Report<ReleaseError>>,
+    cleanup: impl FnOnce(Option<&ContainerId>) -> Result<(), Report<ReleaseError>>,
+) -> Result<T, Report<ReleaseError>> {
+    let (outcome, cleanup) = match created {
+        Ok(id) => (start(&id), cleanup(Some(&id))),
+        Err(error) => (Err(error), cleanup(None)),
+    };
+    match (outcome, cleanup) {
+        (Ok(result), Ok(())) => Ok(result),
+        (Ok(_), Err(cleanup)) => Err(cleanup),
+        (Err(error), Ok(())) => Err(error),
+        (Err(error), Err(cleanup)) => {
+            Err(error.attach(format!("cleanup also failed: {cleanup:?}")))
+        }
+    }
+}
+
+/// Selects ID-based cleanup after acknowledgment, or name lookup for unresolved creation.
+pub(crate) fn cleanup_target<'a>(name: &'a str, id: Option<&'a ContainerId>) -> (&'a str, String) {
+    match id {
+        Some(id) => (id.as_str(), format!("id={}", id.as_str())),
+        None => (name, format!("name=^/{name}$")),
+    }
+}
diff --git a/crates/trusted-server-release/src/boundary/docker/host_path_tests.rs b/crates/trusted-server-release/src/boundary/docker/host_path_tests.rs
new file mode 100644
index 0000000000..5523ac7a35
--- /dev/null
+++ b/crates/trusted-server-release/src/boundary/docker/host_path_tests.rs
@@ -0,0 +1,85 @@
+//! Pure tests of the container-to-host path inverse; no process is started.
+
+use std::fs;
+use std::path::{Path, PathBuf};
+
+use super::*;
+
+struct Layout {
+    _directory: tempfile::TempDir,
+    roots: BoundaryRoots,
+    base: PathBuf,
+}
+
+fn layout() -> Layout {
+    let directory = tempfile::tempdir().expect("should create layout directory");
+    let base = fs::canonicalize(directory.path()).expect("should canonicalize layout");
+    for name in ["source", "tools", "work-a", "work-b"] {
+        fs::create_dir(base.join(name)).expect("should create root directory");
+    }
+    let roots = BoundaryRoots::new(
+        &[base.join("source")],
+        &[base.join("tools")],
+        &[base.join("work-a"), base.join("work-b")],
+    )
+    .expect("should build roots");
+    Layout {
+        _directory: directory,
+        roots,
+        base,
+    }
+}
+
+#[test]
+fn writable_container_paths_map_back_to_their_host_roots() {
+    let layout = layout();
+    for (name, container) in [
+        ("work-a", "/boundary/writable/0"),
+        ("work-b", "/boundary/writable/1"),
+    ] {
+        let host = layout.base.join(name);
+        assert_eq!(
+            host_path(&layout.roots, Path::new(container)).expect("should map the root itself"),
+            host,
+            "should map {container} to its root"
+        );
+        let nested = layout.base.join(name).join("release/example.wasm");
+        let forward = container_path(&layout.roots, &nested).expect("should map forward");
+        assert_eq!(
+            host_path(&layout.roots, &forward).expect("should map the nested file back"),
+            nested,
+            "should invert container_path for {name}"
+        );
+    }
+}
+
+#[test]
+fn immutable_tool_unknown_and_malformed_container_paths_are_rejected() {
+    let layout = layout();
+    for text in [
+        "/boundary/immutable/0/file",
+        "/boundary/tool/0/bin/cargo",
+        "/boundary/writable/2/file",
+        "/boundary/writable/x/file",
+        "/boundary/writable/00/file",
+        "/boundary/writable/+1/file",
+        "/boundary/writable/+0/file",
+        "/boundary/writable/-0/file",
+        "/boundary/writable/1e0/file",
+        "/boundary/writable/１/file",
+        "/boundary/writable/0/../1/file",
+        "/boundary/writable/0/./file",
+        "/boundary/writable",
+        "/boundary/writable/",
+        "/boundaryx/writable/0/file",
+        "/boundary/writable/0file",
+        "boundary/writable/0/file",
+        "/etc/passwd",
+        "",
+    ] {
+        assert!(
+            host_path(&layout.roots, Path::new(text)).is_err(),
+            "should reject container path {text:?}"
+        );
+    }
+}
diff --git a/crates/trusted-server-release/src/boundary/entropy.rs b/crates/trusted-server-release/src/boundary/entropy.rs
new file mode 100644
index 0000000000..ee660907d6
--- /dev/null
+++ b/crates/trusted-server-release/src/boundary/entropy.rs
@@ -0,0 +1,79 @@
+//! Exact, bounded reads from the kernel entropy source.
+
+use std::fs::File;
+use std::io::Read;
+
+use error_stack::Report;
+
+use super::boundary_error;
+use crate::error::ReleaseError;
+
+/// Returns `N` bytes from the kernel random source.
+///
+/// # Errors
+///
+/// Rejects inaccessible entropy, read failures and short reads without a fallback.
+pub(crate) fn random_bytes<const N: usize>() -> Result<[u8; N], Report<ReleaseError>> {
+    let source = File::open("/dev/urandom")
+        .map_err(|error| boundary_error(format!("cannot open kernel randomness: {error}")))?;
+    read_entropy(source)
+}
+
+fn read_entropy<const N: usize>(source: impl Read) -> Result<[u8; N], Report<ReleaseError>> {
+    let limit =
+        u64::try_from(N).map_err(|_| boundary_error("entropy request exceeds read limit"))?;
+    let mut bytes = Vec::new();
+    source
+        .take(limit)
+        .read_to_end(&mut bytes)
+        .map_err(|error| boundary_error(format!("cannot read kernel randomness: {error}")))?;
+    // Array conversion errors contain the bytes, so never attach the error itself.
+    bytes
+        .try_into()
+        .map_err(|_| boundary_error("kernel randomness returned fewer bytes than requested"))
+}
+
+#[cfg(test)]
+mod tests {
+    use std::io::{self, Cursor};
+
+    use super::*;
+
+    struct FailedRead;
+
+    impl Read for FailedRead {
+        fn read(&mut self, _buffer: &mut [u8]) -> io::Result<usize> {
+            Err(io::Error::other("example read failure"))
+        }
+    }
+
+    #[test]
+    fn entropy_read_preserves_source_bytes_and_does_not_consume_past_limit() {
+        let mut source = Cursor::new(b"example entropy bytes");
+        let bytes = read_entropy::<7>(&mut source).expect("should read the requested bytes");
+        assert_eq!(bytes, *b"example", "should preserve source bytes exactly");
+        assert_eq!(source.position(), 7, "should stop at the requested limit");
+    }
+
+    #[test]
+    fn entropy_read_rejects_short_input_without_disclosing_bytes() {
+        let report = read_entropy::<32>(&b"example partial entropy"[..])
+            .expect_err("should reject a short entropy source");
+        let text = format!("{report:?}");
+        assert!(text.contains("fewer bytes"), "should identify a short read");
+        assert!(
+            !text.contains("example partial entropy"),
+            "should not disclose partial entropy"
+        );
+    }
+
+    #[test]
+    fn entropy_read_rejects_io_failure() {
+        let source = io::repeat(1).take(1).chain(FailedRead);
+        let report = read_entropy::<32>(source).expect_err("should reject a read failure");
+        assert!(
+            format!("{report:?}").contains("cannot read kernel randomness"),
+            "should identify the entropy read failure"
+        );
+    }
+}
diff --git a/crates/trusted-server-release/src/boundary/host_inputs.rs b/crates/trusted-server-release/src/boundary/host_inputs.rs
new file mode 100644
index 0000000000..1c92f2d409
--- /dev/null
+++ b/crates/trusted-server-release/src/boundary/host_inputs.rs
@@ -0,0 +1,312 @@
+//! Host-owned Docker client inputs pinned for the life of one boundary.
+//!
+//! The reviewed seccomp baseline, the derived effective profile and an empty
+//! Docker client configuration directory live in a fresh private directory
+//! that is disjoint from every mounted root (checked before anything is
+//! created). The two profiles, the fixed client executable and the empty
+//! configuration are rehashed before every Docker host command, so a change
+//! between commands rejects the run instead of silently applying.
+
+use std::collections::BTreeSet;
+use std::ffi::OsString;
+use std::fs::{self, File};
+use std::io::{Read as _, Write as _};
+use std::os::unix::fs::{MetadataExt as _, OpenOptionsExt as _, PermissionsExt as _};
+use std::path::{Path, PathBuf};
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256};
+use tempfile::TempDir;
+
+use super::roots::{overlaps, validate_path_text};
+use super::seccomp;
+use crate::error::ReleaseError;
+
+const BASELINE_NAME: &str = "seccomp-baseline.json";
+const EFFECTIVE_NAME: &str = "seccomp-effective.json";
+const CONFIG_NAME: &str = "docker-config";
+const READ_ONLY_FILE: u32 = 0o444;
+const READ_ONLY_DIRECTORY: u32 = 0o500;
+const HASH_CHUNK: usize = 64 * 1024;
+
+fn input_error(message: impl std::fmt::Display) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Boundary).attach(message.to_string())
+}
+
+/// Hashes a regular file without following a final symlink.
+fn hash_regular(path: &Path) -> Result<String, Report<ReleaseError>> {
+    let mut file = File::options()
+        .read(true)
+        .custom_flags(libc::O_NOFOLLOW | libc::O_NONBLOCK)
+        .open(path)
+        .map_err(|error| input_error(format!("cannot open {}: {error}", path.display())))?;
+    let metadata = file
+        .metadata()
+        .map_err(|error| input_error(format!("cannot stat {}: {error}", path.display())))?;
+    if !metadata.is_file() {
+        return Err(input_error(format!(
+            "{} is not a regular file",
+            path.display()
+        )));
+    }
+    let mut hasher = Sha256::new();
+    let mut buffer = vec![0_u8; HASH_CHUNK];
+    loop {
+        let read = file
+            .read(&mut buffer)
+            .map_err(|error| input_error(format!("cannot read {}: {error}", path.display())))?;
+        let Some(chunk) = buffer.get(..read).filter(|chunk| !chunk.is_empty()) else {
+            return Ok(hex::encode(hasher.finalize()));
+        };
+        hasher.update(chunk);
+    }
+}
+
+/// A file whose digest must not change.
+#[derive(Debug)]
+struct PinnedFile {
+    path: PathBuf,
+    sha256: String,
+}
+
+impl PinnedFile {
+    fn verify(&self) -> Result<(), Report<ReleaseError>> {
+        if hash_regular(&self.path)? != self.sha256 {
+            return Err(input_error(format!(
+                "pinned Docker input {} changed",
+                self.path.display()
+            )));
+        }
+        Ok(())
+    }
+}
+
+/// Identity of the empty configuration directory.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+struct DirectoryIdentity {
+    device: u64,
+    inode: u64,
+    mode: u32,
+}
+
+fn directory_identity(path: &Path) -> Result<DirectoryIdentity, Report<ReleaseError>> {
+    let metadata = fs::symlink_metadata(path)
+        .map_err(|error| input_error(format!("cannot inspect {}: {error}", path.display())))?;
+    if !metadata.is_dir() {
+        return Err(input_error(format!(
+            "{} is not a directory",
+            path.display()
+        )));
+    }
+    Ok(DirectoryIdentity {
+        device: metadata.dev(),
+        inode: metadata.ino(),
+        mode: metadata.mode(),
+    })
+}
+
+fn entry_names(path: &Path) -> Result<BTreeSet<OsString>, Report<ReleaseError>> {
+    let list_error =
+        |error: std::io::Error| input_error(format!("cannot list {}: {error}", path.display()));
+    let mut names = BTreeSet::new();
+    for entry in fs::read_dir(path).map_err(list_error)? {
+        names.insert(entry.map_err(list_error)?.file_name());
+    }
+    Ok(names)
+}
+
+fn write_read_only(path: &Path, bytes: &[u8]) -> Result<PinnedFile, Report<ReleaseError>> {
+    let write_error =
+        |error: std::io::Error| input_error(format!("cannot write {}: {error}", path.display()));
+    let mut file = File::options()
+        .write(true)
+        .create_new(true)
+        .mode(0o600)
+        .open(path)
+        .map_err(write_error)?;
+    file.write_all(bytes).map_err(write_error)?;
+    file.sync_all().map_err(write_error)?;
+    fs::set_permissions(path, fs::Permissions::from_mode(READ_ONLY_FILE)).map_err(write_error)?;
+    let pinned = PinnedFile {
+        path: path.to_path_buf(),
+        sha256: seccomp::sha256_hex(bytes),
+    };
+    pinned.verify()?;
+    Ok(pinned)
+}
+
+/// Rejects a state parent that overlaps any mounted root.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Boundary`] when `parent` is invalid, missing, or
+/// equal to, inside or above any of `mounted`.
+pub(crate) fn check_disjoint(
+    parent: &Path,
+    mounted: &[&Path],
+) -> Result<PathBuf, Report<ReleaseError>> {
+    validate_path_text(parent)?;
+    let canonical = fs::canonicalize(parent)
+        .map_err(|error| input_error(format!("cannot resolve Docker state parent: {error}")))?;
+    validate_path_text(&canonical)?;
+    if let Some(root) = mounted.iter().find(|root| overlaps(&canonical, root)) {
+        return Err(input_error(format!(
+            "Docker host inputs at {} overlap mounted root {}",
+            canonical.display(),
+            root.display()
+        )));
+    }
+    Ok(canonical)
+}
+
+/// Pinned host-owned inputs for every Docker client invocation.
+#[derive(Debug)]
+pub(crate) struct HostInputs {
+    directory: TempDir,
+    client: PinnedFile,
+    baseline: PinnedFile,
+    effective: PinnedFile,
+    config: PathBuf,
+    config_identity: DirectoryIdentity,
+}
+
+impl HostInputs {
+    /// Scans, then creates the inputs in a fresh directory under `parent`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] when `parent` overlaps a mounted
+    /// root, `client` is not a canonical regular file, the seccomp baseline
+    /// fails its reviewed digest, or any input cannot be written and pinned.
+    pub(crate) fn create(
+        parent: &Path,
+        client: &Path,
+        mounted: &[&Path],
+    ) -> Result<Self, Report<ReleaseError>> {
+        let parent = check_disjoint(parent, mounted)?;
+        validate_path_text(client)?;
+        let canonical_client = fs::canonicalize(client)
+            .map_err(|error| input_error(format!("cannot resolve Docker client: {error}")))?;
+        if canonical_client != client {
+            return Err(input_error(
+                "Docker client path must be canonical, not an alias",
+            ));
+        }
+        if mounted.iter().any(|root| overlaps(&canonical_client, root)) {
+            return Err(input_error(
+                "Docker client must be outside every mounted root",
+            ));
+        }
+        let client = PinnedFile {
+            sha256: hash_regular(client)?,
+            path: canonical_client,
+        };
+        let directory = tempfile::Builder::new()
+            .prefix("ts-boundary-host-")
+            .tempdir_in(&parent)
+            .map_err(|error| input_error(format!("cannot create Docker host inputs: {error}")))?;
+        if !entry_names(directory.path())?.is_empty() {
+            return Err(input_error(
+                "fresh Docker host input directory is not empty",
+            ));
+        }
+        let baseline_bytes = seccomp::baseline()?;
+        let baseline = write_read_only(&directory.path().join(BASELINE_NAME), baseline_bytes)?;
+        let effective_bytes = seccomp::effective(baseline_bytes)?;
+        let effective = write_read_only(&directory.path().join(EFFECTIVE_NAME), &effective_bytes)?;
+        let config = directory.path().join(CONFIG_NAME);
+        fs::create_dir(&config)
+            .and_then(|()| {
+                fs::set_permissions(&config, fs::Permissions::from_mode(READ_ONLY_DIRECTORY))
+            })
+            .map_err(|error| input_error(format!("cannot create empty Docker config: {error}")))?;
+        let config_identity = directory_identity(&config)?;
+        let inputs = Self {
+            directory,
+            client,
+            baseline,
+            effective,
+            config,
+            config_identity,
+        };
+        inputs.verify()?;
+        Ok(inputs)
+    }
+
+    /// Rehashes every input; called before every Docker host command.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] when the client or either profile
+    /// changed, the configuration directory was replaced or is not empty, or
+    /// the input directory gained or lost an entry.
+    pub(crate) fn verify(&self) -> Result<(), Report<ReleaseError>> {
+        self.verify_control()?;
+        self.baseline.verify()?;
+        self.effective.verify()?;
+        Ok(())
+    }
+
+    /// Verifies the inputs used by every host operation, including cleanup.
+    ///
+    /// Cleanup does not consume seccomp profiles, so it may still stop a
+    /// container after profile tampering. It must never execute a changed
+    /// client or consume a changed configuration.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] when a control input changed.
+    pub(crate) fn verify_control(&self) -> Result<(), Report<ReleaseError>> {
+        self.client.verify()?;
+        if directory_identity(&self.config)? != self.config_identity {
+            return Err(input_error("empty Docker config directory was replaced"));
+        }
+        if !entry_names(&self.config)?.is_empty() {
+            return Err(input_error("Docker config directory is no longer empty"));
+        }
+        let expected: BTreeSet<OsString> = [BASELINE_NAME, EFFECTIVE_NAME, CONFIG_NAME]
+            .into_iter()
+            .map(OsString::from)
+            .collect();
+        if entry_names(self.directory.path())? != expected {
+            return Err(input_error(
+                "Docker host input directory gained or lost entries",
+            ));
+        }
+        Ok(())
+    }
+
+    /// Returns the private host input directory.
+    #[must_use]
+    pub(crate) fn directory(&self) -> &Path {
+        self.directory.path()
+    }
+
+    /// Returns the pinned client executable.
+    #[must_use]
+    pub(crate) fn client(&self) -> &Path {
+        &self.client.path
+    }
+
+    /// Returns the empty client configuration directory.
+    #[must_use]
+    pub(crate) fn config(&self) -> &Path {
+        &self.config
+    }
+
+    /// Returns the effective seccomp profile path.
+    #[must_use]
+    pub(crate) fn effective_profile(&self) -> &Path {
+        &self.effective.path
+    }
+
+    /// Returns the client, baseline and effective digests, in that order.
+    #[must_use]
+    pub(crate) fn digests(&self) -> [&str; 3] {
+        [
+            &self.client.sha256,
+            &self.baseline.sha256,
+            &self.effective.sha256,
+        ]
+    }
+}
diff --git a/crates/trusted-server-release/src/boundary/macos.rs b/crates/trusted-server-release/src/boundary/macos.rs
new file mode 100644
index 0000000000..fe920d9cd9
--- /dev/null
+++ b/crates/trusted-server-release/src/boundary/macos.rs
@@ -0,0 +1,389 @@
+//! macOS `sandbox-exec` deny-default profile.
+//!
+//! The profile text is assembled only from compiled-in fragments and
+//! generated slot indices; every path reaches the sandbox as a `-D NAME=PATH`
+//! define read through `(param "NAME")`, never as profile text. A missing
+//! define makes `sandbox-exec` reject the profile, so slots fail closed.
+//!
+//! The base rules follow the observed working deny-default profile that ran
+//! offline `npm ci` and the full Vitest suite under denial: system library
+//! reads from explicit `/usr` subdirectories (never `/usr/local`),
+//! `same-sandbox` signals only, file writes only under private writable roots
+//! and `(deny network*)`, after which only Unix-domain sockets whose paths lie
+//! under a writable root are re-allowed. `connect` to an INET address from
+//! the confined process and every descendant fails with `EPERM`.
+//!
+//! Observed on macOS 26.6.2: under `(deny default)` alone the `setsid` and
+//! `setpgid` system calls are not filtered; `(allow syscall-unix)` followed by
+//! `(deny syscall-unix (syscall-number …))` makes both fail with `EPERM` in
+//! the confined process and its descendants.
+//!
+//! System roots, such as the Apple developer directory, are allowed only
+//! `file-read*` and `process-exec` and carry the same explicit `file-write*`
+//! denial as immutable and tool roots.
+//!
+//! `xcrun`, `xcodebuild`, `xcode-select`, `sudo`, `su`, `login` and
+//! `newgrp` in `/usr/bin` may not be executed. A build script that invokes
+//! `xcrun` (for example to locate an SDK) therefore fails closed; the recipe
+//! supplies `SDKROOT`, `DEVELOPER_DIR` and the direct Xcode `clang` and `ar`
+//! instead. The `/usr/bin` `cc`, `clang` and `ld` shims are not denied.
+//!
+//! Each run also binds two fresh empty marker files, created outside every
+//! root: the profile allows reading one and denies reading the other. That
+//! pair of rules identifies processes of exactly this run's sandbox instance
+//! to the survivor check, independent of their environment.
+
+use std::ffi::OsString;
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::time::{Duration, SystemTime, UNIX_EPOCH};
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256};
+
+use super::ConfinedCommand;
+use super::roots::{BoundaryRoots, RootRole, validate_path_text};
+use crate::error::ReleaseError;
+use crate::process::{BoundedCommand, ProcessResult};
+
+/// The fixed system `sandbox-exec` executable.
+pub(crate) const SANDBOX_EXEC: &str = "/usr/bin/sandbox-exec";
+/// Environment variable carrying the per-run survivor-detection nonce.
+pub(crate) const RUN_NONCE_VARIABLE: &str = "TS_RELEASE_BOUNDARY_RUN";
+/// Darwin `SYS_setpgid` (`<sys/syscall.h>`), identical on `arm64` and `x86_64`.
+pub(crate) const SYS_SETPGID: u32 = 82;
+/// Darwin `SYS_setsid` (`<sys/syscall.h>`), identical on `arm64` and `x86_64`.
+pub(crate) const SYS_SETSID: u32 = 147;
+
+/// Deny-default base rules; contains no caller-supplied text.
+const PROFILE_HEADER: &str = r#"(version 1)
+(deny default)
+(allow process-fork)
+(allow signal (target same-sandbox))
+(allow sysctl-read)
+(allow syscall-unix)
+(deny syscall-unix (syscall-number 147 82))
+(allow file-read-metadata)
+(allow file-read*
+  (literal "/")
+  (subpath "/usr/bin")
+  (subpath "/usr/lib")
+  (subpath "/usr/libexec")
+  (subpath "/usr/share")
+  (subpath "/bin")
+  (subpath "/System")
+  (subpath "/Library/Apple")
+  (subpath "/private/var/db/dyld")
+  (subpath "/dev")
+  (literal "/private/var/select/sh"))
+(allow process-exec
+  (subpath "/usr/bin")
+  (subpath "/usr/libexec")
+  (subpath "/bin")
+  (subpath "/System"))
+(allow file-read* file-write* (literal "/dev/null"))
+(allow file-ioctl (literal "/dev/null"))
+"#;
+/// Network denial; later SBPL rules take precedence over earlier ones.
+const NETWORK_DENIAL: &str = "(deny network*)\n";
+/// Cargo's macOS `LibreSSL` initialization ignores `OPENSSL_CONF` and exits on
+/// EPERM for its optional system configuration. Hide only that ambient input
+/// as absent instead of granting it access. Apply after every root read grant.
+const OPENSSL_CONFIGURATION_DENIAL: &str = "(deny file-read* (with errno ENOENT)\n  \
+    (literal \"/private/etc/ssl/openssl.cnf\")\n  \
+    (literal \"/etc/ssl/openssl.cnf\"))\n";
+/// Tools no build step may start, even though `/usr/bin` is executable: the
+/// Xcode selection shims (`xcrun`, `xcodebuild`, `xcode-select`), which
+/// would pick a developer directory outside the bound record, and the
+/// privilege tools. The `/usr/bin` compiler and linker shims stay allowed:
+/// the recipe selects the bound Xcode tools directly, and the shims honour
+/// the bound `DEVELOPER_DIR` if a build script runs them anyway.
+pub(crate) const DENIED_EXECUTABLES: [&str; 7] = [
+    "/usr/bin/sudo",
+    "/usr/bin/su",
+    "/usr/bin/login",
+    "/usr/bin/newgrp",
+    "/usr/bin/xcrun",
+    "/usr/bin/xcodebuild",
+    "/usr/bin/xcode-select",
+];
+
+/// One explicit `process-exec` denial for a fixed compiled-in path.
+fn execution_denial(path: &str) -> String {
+    format!("(deny process-exec (literal \"{path}\"))\n")
+}
+/// Profile parameter naming the run marker the instance may read.
+pub(crate) const RUN_MARK_ALLOW: &str = "RUN_MARK_ALLOW";
+/// Profile parameter naming the run marker the instance must not read.
+pub(crate) const RUN_MARK_DENY: &str = "RUN_MARK_DENY";
+/// Instance-identifying marker rules, last so that they take precedence.
+const RUN_MARK_RULES: &str = "(allow file-read-data (literal (param \"RUN_MARK_ALLOW\")))\n\
+                              (deny file-read* (literal (param \"RUN_MARK_DENY\")))\n";
+/// Allowance before a run's recorded start. It only widens eligibility;
+/// identity checks still gate every match.
+const START_MARGIN: Duration = Duration::from_secs(1);
+/// Profile identity domain for the configuration fingerprint.
+const FINGERPRINT_DOMAIN: &[u8] = b"trusted-server-boundary-macos-sbpl-v2\n";
+
+/// A generated profile and the defines that bind its slots.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct MacProfile {
+    text: String,
+    defines: Vec<(String, String)>,
+}
+
+fn slot_name(role: RootRole, index: usize) -> String {
+    let prefix = match role {
+        RootRole::Immutable => "IMMUTABLE",
+        RootRole::Tool => "TOOL",
+        RootRole::Writable => "WRITABLE",
+        RootRole::System => "SYSTEM",
+    };
+    format!("{prefix}_{index}")
+}
+
+fn allow_rule(role: RootRole, name: &str) -> String {
+    let operations = match role {
+        RootRole::Immutable | RootRole::Tool | RootRole::System => "file-read* process-exec",
+        RootRole::Writable => "file-read* file-write* process-exec",
+    };
+    format!("(allow {operations} (subpath (param \"{name}\")))\n")
+}
+
+fn deny_write_rule(name: &str) -> String {
+    format!("(deny file-write* (subpath (param \"{name}\")))\n")
+}
+
+fn unix_socket_rule(name: &str) -> String {
+    format!(
+        "(allow network-bind network-outbound network-inbound \
+         (local unix-socket (subpath (param \"{name}\"))) \
+         (remote unix-socket (subpath (param \"{name}\"))))\n"
+    )
+}
+
+/// Validates one define; the value must be safe profile-parameter text.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Boundary`] when `path` fails
+/// [`validate_path_text`].
+pub(crate) fn define(name: &str, path: &Path) -> Result<(String, String), Report<ReleaseError>> {
+    let value = validate_path_text(path)?;
+    Ok((name.to_owned(), value.to_owned()))
+}
+
+/// Returns 16 random bytes as lowercase hex.
+fn run_nonce() -> Result<String, Report<ReleaseError>> {
+    Ok(hex::encode(super::random_bytes::<16>()?))
+}
+
+impl MacProfile {
+    /// Generates the profile for `roots`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] when a root path is not safe define
+    /// text.
+    pub(crate) fn generate(roots: &BoundaryRoots) -> Result<Self, Report<ReleaseError>> {
+        let mut text = String::from(PROFILE_HEADER);
+        let mut denials = String::new();
+        let mut sockets = String::new();
+        let mut defines = Vec::new();
+        for (role, index, path) in roots.entries() {
+            let name = slot_name(role, index);
+            text.push_str(&allow_rule(role, &name));
+            if role == RootRole::Writable {
+                sockets.push_str(&unix_socket_rule(&name));
+            } else {
+                denials.push_str(&deny_write_rule(&name));
+            }
+            defines.push(define(&name, path)?);
+        }
+        text.push_str(&denials);
+        text.push_str(OPENSSL_CONFIGURATION_DENIAL);
+        for path in DENIED_EXECUTABLES {
+            text.push_str(&execution_denial(path));
+        }
+        text.push_str(NETWORK_DENIAL);
+        text.push_str(&sockets);
+        text.push_str(RUN_MARK_RULES);
+        Ok(Self { text, defines })
+    }
+
+    /// Returns the profile text.
+    #[must_use]
+    pub(crate) fn text(&self) -> &str {
+        &self.text
+    }
+
+    /// Returns the `-D` defines in slot order.
+    #[must_use]
+    pub(crate) fn defines(&self) -> &[(String, String)] {
+        &self.defines
+    }
+
+    /// Returns `sandbox-exec` arguments preceding the confined program.
+    #[must_use]
+    pub(crate) fn arguments(&self) -> Vec<OsString> {
+        let mut arguments = vec![OsString::from("-p"), OsString::from(&self.text)];
+        for (name, value) in &self.defines {
+            arguments.push(OsString::from("-D"));
+            arguments.push(OsString::from(format!("{name}={value}")));
+        }
+        arguments
+    }
+
+    /// Returns the profile fingerprint (before the instance nonce). The marker
+    /// rules are covered; per-run marker paths are not.
+    #[must_use]
+    pub(crate) fn fingerprint(&self) -> [u8; 32] {
+        let mut hasher = Sha256::new();
+        hasher.update(FINGERPRINT_DOMAIN);
+        for argument in self.arguments() {
+            let bytes = argument.as_encoded_bytes();
+            hasher.update((bytes.len() as u64).to_be_bytes());
+            hasher.update(bytes);
+        }
+        hasher.finalize().into()
+    }
+
+    /// Wraps `command` in `sandbox-exec`, adding the run's marker defines and
+    /// nonce variable.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Process`] when the bounded command rejects the
+    /// working directory or an environment variable (including a caller
+    /// variable named [`RUN_NONCE_VARIABLE`]).
+    pub(crate) fn wrap(
+        &self,
+        command: &ConfinedCommand,
+        run: &RunIdentity,
+    ) -> Result<BoundedCommand, Report<ReleaseError>> {
+        let mut arguments = self.arguments();
+        for (name, value) in &run.defines {
+            arguments.push(OsString::from("-D"));
+            arguments.push(OsString::from(format!("{name}={value}")));
+        }
+        arguments.push(command.program.clone().into_os_string());
+        arguments.extend(command.arguments.iter().cloned());
+        let mut bounded = BoundedCommand::new(
+            Path::new(SANDBOX_EXEC),
+            &command.working_directory,
+            command.limits,
+        )?
+        .arguments(arguments)
+        .environment(RUN_NONCE_VARIABLE, &run.nonce)?;
+        if let Some(umask) = command.umask {
+            bounded = bounded.umask(umask);
+        }
+        for (name, value) in &command.environment {
+            bounded = if command.is_tool_selector(name) {
+                bounded.tool_selector_environment(name, value)?
+            } else {
+                bounded.environment(name, value)?
+            };
+        }
+        Ok(command.finish(bounded))
+    }
+
+    /// Runs `command` confined, then kills and rejects any process of this
+    /// run's sandbox instance, or carrying its nonce, that outlived it.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] when the run identity cannot be
+    /// created or an escaped descendant was found (even if the run itself
+    /// succeeded), or the run's own error.
+    pub(crate) fn run(
+        &self,
+        command: &ConfinedCommand,
+    ) -> Result<ProcessResult, Report<ReleaseError>> {
+        let run = RunIdentity::new(self)?;
+        let outcome = self.wrap(command, &run).and_then(|bounded| bounded.run());
+        let survivors = reap_survivors(&run);
+        match (outcome, survivors) {
+            (Ok(result), Ok(())) => Ok(result),
+            (Err(run), Ok(())) => Err(run),
+            (Ok(_), Err(survivors)) => Err(survivors),
+            (Err(run), Err(survivors)) => {
+                Err(survivors.attach(format!("the run also failed: {run:?}")))
+            }
+        }
+    }
+}
+
+/// One run's survivor identity: an environment nonce and two private marker
+/// files outside every boundary root.
+pub(crate) struct RunIdentity {
+    nonce: String,
+    started_after_micros: u64,
+    defines: [(String, String); 2],
+    allow: PathBuf,
+    deny: PathBuf,
+    _directory: tempfile::TempDir,
+}
+
+impl RunIdentity {
+    /// Creates fresh markers for one run of `profile`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] when the markers cannot be created,
+    /// are not safe define text, or overlap a boundary root.
+    pub(crate) fn new(profile: &MacProfile) -> Result<Self, Report<ReleaseError>> {
+        let directory = tempfile::Builder::new()
+            .prefix("ts-boundary-run-")
+            .tempdir()
+            .map_err(super::boundary_error)?;
+        let base = fs::canonicalize(directory.path()).map_err(super::boundary_error)?;
+        if profile.defines.iter().any(|(_, root)| {
+            let root = Path::new(root);
+            base.starts_with(root) || root.starts_with(&base)
+        }) {
+            return Err(super::boundary_error("run markers overlap a boundary root"));
+        }
+        let allow = base.join("allow");
+        let deny = base.join("deny");
+        for marker in [&allow, &deny] {
+            fs::write(marker, b"").map_err(super::boundary_error)?;
+        }
+        Ok(Self {
+            nonce: run_nonce()?,
+            started_after_micros: started_after_micros()?,
+            defines: [
+                define(RUN_MARK_ALLOW, &allow)?,
+                define(RUN_MARK_DENY, &deny)?,
+            ],
+            allow,
+            deny,
+            _directory: directory,
+        })
+    }
+}
+
+/// Returns the earliest process start this run may own: now, less a
+/// [`START_MARGIN`], in microseconds since the epoch.
+fn started_after_micros() -> Result<u64, Report<ReleaseError>> {
+    let now = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map_err(super::boundary_error)?;
+    u64::try_from(now.saturating_sub(START_MARGIN).as_micros()).map_err(super::boundary_error)
+}
+
+#[cfg(target_os = "macos")]
+fn reap_survivors(run: &RunIdentity) -> Result<(), Report<ReleaseError>> {
+    super::survivors::reap(&super::survivors::RunSignature {
+        variable: RUN_NONCE_VARIABLE,
+        nonce: &run.nonce,
+        allow: &run.allow,
+        deny: &run.deny,
+        started_after_micros: run.started_after_micros,
+    })
+}
+
+#[cfg(not(target_os = "macos"))]
+fn reap_survivors(_run: &RunIdentity) -> Result<(), Report<ReleaseError>> {
+    Err(Report::new(ReleaseError::Boundary).attach("sandbox-exec survivor checks are macOS-only"))
+}
diff --git a/crates/trusted-server-release/src/boundary/probe.rs b/crates/trusted-server-release/src/boundary/probe.rs
new file mode 100644
index 0000000000..a3992c885e
--- /dev/null
+++ b/crates/trusted-server-release/src/boundary/probe.rs
@@ -0,0 +1,290 @@
+//! Loopback TCP socket probe and the listener that observes it.
+//!
+//! The probe makes exactly one TCP `connect` to a loopback `IP:PORT` and
+//! reports either `connected` or `denied errno=<n>` with the operating
+//! system's real errno. It never synthesizes an errno: a failure without one
+//! is an error, not a report. `socket()` success is not evidence (macOS
+//! allows `socket(AF_INET)` under `deny default`), so only `connect` against a
+//! listener the unconfined control actually reached counts.
+
+use std::ffi::OsString;
+use std::io::{self, ErrorKind};
+use std::net::{SocketAddr, TcpListener, TcpStream};
+use std::os::unix::fs::PermissionsExt as _;
+use std::path::{Path, PathBuf};
+
+use error_stack::Report;
+
+use crate::error::ReleaseError;
+
+/// Exit status of a probe whose connect was refused by the operating system.
+pub(crate) const DENIED_STATUS: u8 = 3;
+/// `boundary-probe` subcommand arguments preceding the address.
+const RELEASE_PROBE_ARGUMENTS: [&str; 2] = ["boundary-probe", "connect"];
+
+/// The single-line result of one probe connect.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, derive_more::Display)]
+pub(crate) enum ProbeReport {
+    /// The TCP handshake completed.
+    #[display("connected")]
+    Connected,
+    /// `connect` failed with the operating system's `errno`.
+    #[display("denied errno={errno}")]
+    Denied { errno: i32 },
+}
+
+impl ProbeReport {
+    /// Parses exactly one report line terminated by a newline.
+    #[must_use]
+    pub(crate) fn parse_line(output: &[u8]) -> Option<Self> {
+        let line = std::str::from_utf8(output.strip_suffix(b"\n")?).ok()?;
+        if line == "connected" {
+            return Some(Self::Connected);
+        }
+        let digits = line.strip_prefix("denied errno=")?;
+        if digits.is_empty() || !digits.bytes().all(|byte| byte.is_ascii_digit()) {
+            return None;
+        }
+        digits.parse().ok().map(|errno| Self::Denied { errno })
+    }
+}
+
+fn boundary_error(message: impl std::fmt::Display) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Boundary).attach(message.to_string())
+}
+
+/// Parses a literal loopback `IP:PORT` with a nonzero port.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Usage`] for anything other than a literal IPv4 or
+/// IPv6 loopback socket address with a nonzero port; host names are never
+/// resolved.
+pub(crate) fn parse_loopback(address: &str) -> Result<SocketAddr, Report<ReleaseError>> {
+    let parsed: SocketAddr = address.parse().map_err(|_| {
+        Report::new(ReleaseError::Usage).attach("probe address is not a literal IP:PORT")
+    })?;
+    if !parsed.ip().is_loopback() || parsed.port() == 0 {
+        return Err(Report::new(ReleaseError::Usage)
+            .attach("probe address must be loopback with a nonzero port"));
+    }
+    Ok(parsed)
+}
+
+/// Attempts one TCP connect and reports the real outcome.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Boundary`] when `connect` fails without an
+/// operating-system errno; no errno is invented for it.
+pub(crate) fn connect_probe(address: SocketAddr) -> Result<ProbeReport, Report<ReleaseError>> {
+    match TcpStream::connect(address) {
+        Ok(_) => Ok(ProbeReport::Connected),
+        Err(error) => match error.raw_os_error() {
+            Some(errno) => Ok(ProbeReport::Denied { errno }),
+            None => Err(boundary_error(format!(
+                "probe connect failed without an errno: {error}"
+            ))),
+        },
+    }
+}
+
+/// How a probe program frames its report on stdout.
+#[derive(Clone, Copy, Debug)]
+enum ProbeOutput {
+    /// Stdout is exactly one report line.
+    Exact,
+    /// Stdout carries a harness preamble, then the sentinel, then the line.
+    #[cfg(test)]
+    AfterSentinel(&'static [u8]),
+}
+
+/// An executable that speaks the probe protocol: the final argument is the
+/// loopback address, stdout is the report, exit `0` means connected and
+/// [`DENIED_STATUS`] means denied.
+#[derive(Clone, Debug)]
+pub(crate) struct ProbeProgram {
+    program: PathBuf,
+    prefix: Vec<OsString>,
+    environment: Vec<(OsString, OsString)>,
+    output: ProbeOutput,
+}
+
+impl ProbeProgram {
+    /// Selects an ordinary CI copy of the source-built producer's fixed probe.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when the staged executable cannot be resolved. This
+    /// test-only selector supplies no production tool authentication.
+    #[cfg(test)]
+    pub(crate) fn from_staged_release_binary(path: &Path) -> Result<Self, Report<ReleaseError>> {
+        let program =
+            std::fs::canonicalize(path).map_err(|error| boundary_error(error.to_string()))?;
+        Ok(Self {
+            program,
+            prefix: RELEASE_PROBE_ARGUMENTS.iter().map(OsString::from).collect(),
+            environment: Vec::new(),
+            output: ProbeOutput::Exact,
+        })
+    }
+    /// Selects this release binary's documented `boundary-probe connect`
+    /// subcommand.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] when the running executable cannot
+    /// be located or canonicalized.
+    pub(crate) fn release_binary() -> Result<Self, Report<ReleaseError>> {
+        let program = std::env::current_exe()
+            .and_then(std::fs::canonicalize)
+            .map_err(|error| boundary_error(format!("cannot locate release binary: {error}")))?;
+        Ok(Self {
+            program,
+            prefix: RELEASE_PROBE_ARGUMENTS.iter().map(OsString::from).collect(),
+            environment: Vec::new(),
+            output: ProbeOutput::Exact,
+        })
+    }
+
+    /// Selects a test-binary helper speaking the same protocol after a
+    /// harness preamble ending in `sentinel`.
+    #[cfg(test)]
+    pub(super) fn test_helper(
+        program: PathBuf,
+        prefix: Vec<OsString>,
+        environment: Vec<(OsString, OsString)>,
+        sentinel: &'static [u8],
+    ) -> Self {
+        Self {
+            program,
+            prefix,
+            environment,
+            output: ProbeOutput::AfterSentinel(sentinel),
+        }
+    }
+
+    /// Copies the executable into `directory` (a tool root) as a private
+    /// single-link, read-only file and returns the probe pointing at it.
+    ///
+    /// Cargo hard-links its build outputs, and tool roots require
+    /// `nlink == 1`, so a probe is never run from `target/` directly.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] when the copy cannot be created
+    /// (including when the destination already exists) or made read-only.
+    pub(crate) fn staged(&self, directory: &Path) -> Result<Self, Report<ReleaseError>> {
+        let name = self
+            .program
+            .file_name()
+            .ok_or_else(|| boundary_error("probe program has no file name"))?;
+        let directory = std::fs::canonicalize(directory)
+            .map_err(|error| boundary_error(format!("cannot resolve tool directory: {error}")))?;
+        let destination = directory.join(name);
+        if destination.exists() {
+            return Err(boundary_error("staged probe destination already exists"));
+        }
+        std::fs::copy(&self.program, &destination)
+            .and_then(|_| {
+                std::fs::set_permissions(&destination, std::fs::Permissions::from_mode(0o555))
+            })
+            .map_err(|error| boundary_error(format!("cannot stage probe: {error}")))?;
+        Ok(Self {
+            program: destination,
+            ..self.clone()
+        })
+    }
+
+    /// Returns the probe executable path.
+    pub(super) fn program(&self) -> &Path {
+        &self.program
+    }
+
+    /// Returns the fixed environment the probe needs.
+    pub(super) fn environment(&self) -> &[(OsString, OsString)] {
+        &self.environment
+    }
+
+    /// Returns the argument vector targeting `address`.
+    pub(super) fn arguments(&self, address: SocketAddr) -> Vec<OsString> {
+        let mut arguments = self.prefix.clone();
+        arguments.push(OsString::from(address.to_string()));
+        arguments
+    }
+
+    /// Parses the probe's stdout under its framing.
+    pub(super) fn parse(&self, stdout: &[u8]) -> Option<ProbeReport> {
+        match self.output {
+            ProbeOutput::Exact => ProbeReport::parse_line(stdout),
+            #[cfg(test)]
+            ProbeOutput::AfterSentinel(sentinel) => {
+                let start = stdout
+                    .windows(sentinel.len())
+                    .rposition(|window| window == sentinel)?;
+                ProbeReport::parse_line(stdout.get(start + sentinel.len()..)?)
+            }
+        }
+    }
+}
+
+/// A non-blocking IPv4 loopback listener that counts completed connections.
+pub(crate) struct LoopbackListener {
+    listener: TcpListener,
+    address: SocketAddr,
+}
+
+impl LoopbackListener {
+    /// Binds an ephemeral port on `127.0.0.1`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] when the listener cannot be bound or
+    /// made non-blocking.
+    pub(crate) fn bind() -> Result<Self, Report<ReleaseError>> {
+        let listener = TcpListener::bind(("127.0.0.1", 0))
+            .and_then(|listener| {
+                listener.set_nonblocking(true)?;
+                Ok(listener)
+            })
+            .map_err(|error| boundary_error(format!("cannot bind control listener: {error}")))?;
+        let address = listener
+            .local_addr()
+            .map_err(|error| boundary_error(format!("cannot read listener address: {error}")))?;
+        Ok(Self { listener, address })
+    }
+
+    /// Returns the bound loopback address.
+    #[must_use]
+    pub(crate) fn address(&self) -> SocketAddr {
+        self.address
+    }
+
+    /// Accepts every queued connection and returns how many there were.
+    ///
+    /// A probe's handshake completes before it exits, so after its process
+    /// is reaped any connection it made is already queued.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] when `accept` fails with anything
+    /// other than would-block or interruption.
+    pub(crate) fn drain_accepts(&self) -> Result<usize, Report<ReleaseError>> {
+        let mut accepted = 0;
+        loop {
+            match self.listener.accept() {
+                Ok(_) => accepted += 1,
+                Err(error) if error.kind() == ErrorKind::WouldBlock => return Ok(accepted),
+                Err(error) if error.kind() == ErrorKind::Interrupted => {}
+                Err(error) => return Err(accept_error(&error)),
+            }
+        }
+    }
+}
+
+fn accept_error(error: &io::Error) -> Report<ReleaseError> {
+    boundary_error(format!(
+        "control listener accept failed (errno {:?}): {error}",
+        error.raw_os_error()
+    ))
+}
diff --git a/crates/trusted-server-release/src/boundary/proof.rs b/crates/trusted-server-release/src/boundary/proof.rs
new file mode 100644
index 0000000000..b28645e6a5
--- /dev/null
+++ b/crates/trusted-server-release/src/boundary/proof.rs
@@ -0,0 +1,520 @@
+//! Construct-only-through-success network denial proof.
+//!
+//! [`DenialProof`] has private fields, no `Default`, `Clone` or serde
+//! implementations, and is built only by [`evaluate`] after, in this process
+//! run and for one boundary instance fingerprint (configuration plus a fresh
+//! per-instance nonce):
+//!
+//! 1. the probe ran **unconfined**, exited `0`, reported `connected`, and the
+//!    control listener accepted exactly one connection; then
+//! 2. the same probe ran **confined**, exited with
+//!    [`DENIED_STATUS`], reported a real `EPERM`
+//!    or `EACCES`, and the listener accepted nothing.
+//!
+//! A failed or refused unconfined control (no local socket permission, an
+//! enclosing sandbox) yields no proof, so confined denial is never inferred
+//! from a probe that could not have connected anyway.
+
+use std::path::Path;
+
+use error_stack::Report;
+use serde::Serialize;
+
+use super::probe::{DENIED_STATUS, LoopbackListener, ProbeProgram, ProbeReport};
+use super::{Boundary, ConfinedCommand};
+use crate::error::ReleaseError;
+use crate::process::{BoundedCommand, ProcessLimits, ProcessOutcome, ProcessResult};
+
+/// Errnos accepted as an operating-system network denial.
+const DENIAL_ERRNOS: [i32; 2] = [libc::EPERM, libc::EACCES];
+
+fn proof_error(message: impl std::fmt::Display) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Boundary).attach(message.to_string())
+}
+
+/// Evidence that this boundary configuration denies network access.
+#[derive(Debug)]
+pub(crate) struct DenialProof {
+    fingerprint: [u8; 32],
+    denied_errno: i32,
+    observations: ProofObservations,
+}
+
+#[derive(Debug)]
+enum ProofObservations {
+    Measured {
+        control: Observation,
+        confined: Observation,
+    },
+    #[cfg(test)]
+    Fixture,
+}
+
+/// Read-only measured socket diagnostics; never an execution capability.
+#[derive(Debug, Serialize)]
+pub(crate) struct DenialReceipt {
+    fingerprint: String,
+    denied_errno: i32,
+    control: ProbeReceipt,
+    probe: ProbeReceipt,
+}
+
+impl DenialReceipt {
+    /// Returns whether these measured diagnostics name the expected boundary instance.
+    pub(crate) fn matches_fingerprint(&self, expected: &[u8; 32]) -> bool {
+        self.fingerprint == hex::encode(expected)
+    }
+
+    /// Lowercase hex fingerprint of the measured boundary instance.
+    pub(crate) fn fingerprint(&self) -> &str {
+        &self.fingerprint
+    }
+
+    /// Real errno the confined probe reported.
+    pub(crate) fn denied_errno(&self) -> i32 {
+        self.denied_errno
+    }
+
+    /// Exit status and listener accepts of the unconfined control run.
+    pub(crate) fn control(&self) -> (i32, usize) {
+        self.control.measured()
+    }
+
+    /// Exit status and listener accepts of the confined probe run.
+    pub(crate) fn probe(&self) -> (i32, usize) {
+        self.probe.measured()
+    }
+}
+
+#[derive(Debug, Serialize)]
+struct ProbeReceipt {
+    outcome: ExitReceipt,
+    report: ReportReceipt,
+    accepted_connections: usize,
+}
+
+#[derive(Debug, Serialize)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+enum ExitReceipt {
+    Exited { status: i32 },
+}
+
+#[derive(Debug, Serialize)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+enum ReportReceipt {
+    Connected,
+    Denied { errno: i32 },
+}
+
+impl ProbeReceipt {
+    fn measured(&self) -> (i32, usize) {
+        let ExitReceipt::Exited { status } = self.outcome;
+        (status, self.accepted_connections)
+    }
+
+    fn from_observation(observed: Observation) -> Result<Self, Report<ReleaseError>> {
+        let ProcessOutcome::Exited { code } = observed.outcome else {
+            return Err(proof_error(
+                "measured socket observation did not exit normally",
+            ));
+        };
+        let report = match observed.report {
+            Some(ProbeReport::Connected) => ReportReceipt::Connected,
+            Some(ProbeReport::Denied { errno }) => ReportReceipt::Denied { errno },
+            None => return Err(proof_error("measured socket observation has no report")),
+        };
+        Ok(Self {
+            outcome: ExitReceipt::Exited { status: code },
+            report,
+            accepted_connections: observed.accepts,
+        })
+    }
+}
+
+impl DenialProof {
+    /// Exports actual socket observations for the expected boundary instance.
+    ///
+    /// # Errors
+    ///
+    /// Rejects a mismatched instance, missing measured observations or any
+    /// control/probe pair that does not establish successful socket denial.
+    pub(crate) fn receipt_for(
+        &self,
+        expected_boundary_fingerprint: &[u8; 32],
+    ) -> Result<DenialReceipt, Report<ReleaseError>> {
+        if !self.matches(expected_boundary_fingerprint) {
+            return Err(proof_error(
+                "measured denial receipt belongs to another boundary instance",
+            ));
+        }
+        let (control, confined) = match &self.observations {
+            ProofObservations::Measured { control, confined } => (*control, *confined),
+            #[cfg(test)]
+            ProofObservations::Fixture => {
+                return Err(proof_error(
+                    "synthetic test proof has no measured socket observations",
+                ));
+            }
+        };
+        if validate_observations(control, confined)? != self.denied_errno {
+            return Err(proof_error(
+                "stored denial errno differs from measured observations",
+            ));
+        }
+        Ok(DenialReceipt {
+            fingerprint: hex::encode(self.fingerprint),
+            denied_errno: self.denied_errno,
+            control: ProbeReceipt::from_observation(control)?,
+            probe: ProbeReceipt::from_observation(confined)?,
+        })
+    }
+
+    /// Returns whether the proof was established for `fingerprint`.
+    pub(super) fn matches(&self, fingerprint: &[u8; 32]) -> bool {
+        &self.fingerprint == fingerprint
+    }
+
+    /// Builds a proof for unit tests that never run a confined command.
+    #[cfg(test)]
+    pub(crate) fn for_tests() -> Self {
+        Self {
+            fingerprint: [0; 32],
+            denied_errno: 1,
+            observations: ProofObservations::Fixture,
+        }
+    }
+
+    /// Returns the real errno the confined probe observed.
+    #[must_use]
+    pub(crate) fn denied_errno(&self) -> i32 {
+        self.denied_errno
+    }
+}
+
+/// One probe run as the controls observed it.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+struct Observation {
+    /// The probe's exit outcome.
+    outcome: ProcessOutcome,
+    /// The parsed report, if stdout carried exactly one.
+    report: Option<ProbeReport>,
+    /// Connections the control listener accepted during this run.
+    accepts: usize,
+}
+
+/// Constructs a proof only from a successful control and a denied probe.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Boundary`] when the control did not connect with
+/// exactly one observed accept, or the confined probe was not denied with
+/// `EPERM`/`EACCES` and zero accepts.
+fn evaluate(
+    fingerprint: [u8; 32],
+    control: Observation,
+    confined: Observation,
+) -> Result<DenialProof, Report<ReleaseError>> {
+    let denied_errno = validate_observations(control, confined)?;
+    Ok(DenialProof {
+        fingerprint,
+        denied_errno,
+        observations: ProofObservations::Measured { control, confined },
+    })
+}
+
+fn validate_observations(
+    control: Observation,
+    confined: Observation,
+) -> Result<i32, Report<ReleaseError>> {
+    let control_ok = control.outcome == (ProcessOutcome::Exited { code: 0 })
+        && control.report == Some(ProbeReport::Connected)
+        && control.accepts == 1;
+    if !control_ok {
+        return Err(proof_error(format!(
+            "unconfined socket control failed: {control:?}"
+        )));
+    }
+    let denied_status = ProcessOutcome::Exited {
+        code: i32::from(DENIED_STATUS),
+    };
+    let denied_errno = match confined.report {
+        Some(ProbeReport::Denied { errno })
+            if confined.outcome == denied_status
+                && DENIAL_ERRNOS.contains(&errno)
+                && confined.accepts == 0 =>
+        {
+            errno
+        }
+        _ => {
+            return Err(proof_error(format!(
+                "confined probe was not denied: {confined:?}"
+            )));
+        }
+    };
+    Ok(denied_errno)
+}
+
+fn observe(
+    probe: &ProbeProgram,
+    listener: &LoopbackListener,
+    result: ProcessResult,
+) -> Result<Observation, Report<ReleaseError>> {
+    let observation = Observation {
+        outcome: result.outcome(),
+        report: probe.parse(result.stdout()),
+        accepts: listener.drain_accepts()?,
+    };
+    match observation.outcome {
+        ProcessOutcome::Exited { code } if code == 0 || code == i32::from(DENIED_STATUS) => {
+            Ok(observation)
+        }
+        _ => result.require_success().map(|_| observation),
+    }
+}
+
+fn unconfined_command(
+    probe: &ProbeProgram,
+    listener: &LoopbackListener,
+    limits: ProcessLimits,
+) -> Result<BoundedCommand, Report<ReleaseError>> {
+    let mut command = BoundedCommand::new(probe.program(), Path::new("/"), limits)?
+        .arguments(probe.arguments(listener.address()));
+    for (name, value) in probe.environment() {
+        command = command.environment(name, value)?;
+    }
+    Ok(command)
+}
+
+fn confined_command(
+    boundary: &Boundary,
+    probe: &ProbeProgram,
+    listener: &LoopbackListener,
+    limits: ProcessLimits,
+) -> Result<ConfinedCommand, Report<ReleaseError>> {
+    let working_directory = boundary
+        .roots
+        .writable()
+        .first()
+        .ok_or_else(|| proof_error("boundary has no writable root"))?;
+    let mut command = ConfinedCommand::new(probe.program(), working_directory, limits)?
+        .arguments(probe.arguments(listener.address()));
+    for (name, value) in probe.environment() {
+        command = command.environment(name, value)?;
+    }
+    Ok(command)
+}
+
+/// Runs the unconfined control, then the confined probe, and evaluates both.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Boundary`] when either control fails, the probe is
+/// outside the boundary's roots or the listener fails, or
+/// [`ReleaseError::Process`] when a probe child cannot be run.
+pub(super) fn establish(
+    boundary: &Boundary,
+    probe: &ProbeProgram,
+    limits: ProcessLimits,
+) -> Result<DenialProof, Report<ReleaseError>> {
+    let listener = LoopbackListener::bind()?;
+    if listener.drain_accepts()? != 0 {
+        return Err(proof_error(
+            "control listener had a connection before the control",
+        ));
+    }
+    let control_result = unconfined_command(probe, &listener, limits)?.run()?;
+    let control = observe(probe, &listener, control_result)?;
+    let confined_result =
+        boundary.execute(&confined_command(boundary, probe, &listener, limits)?)?;
+    let confined = observe(probe, &listener, confined_result)?;
+    evaluate(boundary.fingerprint, control, confined)
+}
+
+#[cfg(test)]
+mod tests {
+    use std::ffi::OsString;
+    use std::time::Duration;
+
+    use serde_json::json;
+
+    use super::*;
+
+    #[test]
+    fn unexpected_probe_exit_keeps_bounded_startup_diagnostic() {
+        let probe = ProbeProgram::release_binary().expect("should locate probe executable");
+        let listener = LoopbackListener::bind().expect("should bind fixture listener");
+        let result = BoundedCommand::new(
+            Path::new("/bin/sh"),
+            Path::new("/"),
+            ProcessLimits {
+                wall: Duration::from_secs(5),
+                stdout_max: 1024,
+                stderr_max: 1024,
+            },
+        )
+        .expect("should select fixture command")
+        .arguments(
+            [
+                "-c",
+                "printf 'fictional container startup failure' >&2; exit 125",
+            ]
+            .map(OsString::from),
+        )
+        .run()
+        .expect("should supervise fixture child");
+        let error = observe(&probe, &listener, result)
+            .expect_err("should reject failed probe child before protocol evaluation");
+        assert!(
+            format!("{error:?}").contains("fictional container startup failure"),
+            "should preserve bounded child failure diagnostic"
+        );
+    }
+
+    fn observation(code: i32, report: Option<ProbeReport>, accepts: usize) -> Observation {
+        Observation {
+            outcome: ProcessOutcome::Exited { code },
+            report,
+            accepts,
+        }
+    }
+
+    fn denied(errno: i32, accepts: usize) -> Observation {
+        observation(3, Some(ProbeReport::Denied { errno }), accepts)
+    }
+
+    #[test]
+    fn measured_receipt_retains_validated_control_and_probe_observations() {
+        let fingerprint = [7; 32];
+        let control = observation(0, Some(ProbeReport::Connected), 1);
+        for errno in [libc::EPERM, libc::EACCES] {
+            let proof = evaluate(fingerprint, control, denied(errno, 0))
+                .expect("should evaluate a successful pure observation fixture");
+            let receipt = proof
+                .receipt_for(&fingerprint)
+                .expect("should export validated observations for the same boundary");
+            assert!(
+                receipt.matches_fingerprint(&fingerprint),
+                "should bind diagnostics to the measured boundary instance"
+            );
+            assert!(
+                !receipt.matches_fingerprint(&[8; 32]),
+                "should reject an unrelated boundary fingerprint"
+            );
+            let value =
+                serde_json::to_value(&receipt).expect("should serialize measured diagnostics");
+            assert_eq!(
+                value,
+                json!({
+                    "fingerprint": hex::encode(fingerprint), "denied_errno": errno,
+                    "control": {"outcome":{"kind":"exited","status":0},"report":{"kind":"connected"},"accepted_connections":1},
+                    "probe": {"outcome":{"kind":"exited","status":3},"report":{"kind":"denied","errno":errno},"accepted_connections":0}
+                }),
+                "should retain exactly the successful fixture observations without claiming an operating-system run"
+            );
+        }
+    }
+
+    #[test]
+    fn measured_receipt_rejects_other_instances_and_unmeasured_test_proofs() {
+        let proof = evaluate(
+            [7; 32],
+            observation(0, Some(ProbeReport::Connected), 1),
+            denied(libc::EPERM, 0),
+        )
+        .expect("should evaluate a successful pure observation fixture");
+        assert!(
+            proof.receipt_for(&[8; 32]).is_err(),
+            "should reject a different boundary instance"
+        );
+        assert!(
+            DenialProof::for_tests().receipt_for(&[0; 32]).is_err(),
+            "should never export measured success from a synthetic test capability"
+        );
+    }
+
+    #[test]
+    fn measured_receipt_revalidates_stored_observations_and_errno() {
+        let control = observation(0, Some(ProbeReport::Connected), 1);
+        let confined = denied(libc::EPERM, 0);
+        for (changed_control, changed_confined) in [
+            (observation(0, Some(ProbeReport::Connected), 0), confined),
+            (control, denied(libc::EPERM, 1)),
+            (control, observation(3, None, 0)),
+        ] {
+            let mut proof = evaluate([7; 32], control, confined)
+                .expect("should evaluate a successful pure observation fixture");
+            proof.observations = ProofObservations::Measured {
+                control: changed_control,
+                confined: changed_confined,
+            };
+            assert!(
+                proof.receipt_for(&[7; 32]).is_err(),
+                "should reject corrupted stored observations"
+            );
+        }
+        let mut proof = evaluate([7; 32], control, confined)
+            .expect("should evaluate a successful pure observation fixture");
+        proof.denied_errno = libc::EACCES;
+        assert!(
+            proof.receipt_for(&[7; 32]).is_err(),
+            "should reject a stored errno that differs from the observed report"
+        );
+    }
+
+    #[test]
+    fn proof_requires_successful_control_and_denied_probe() {
+        let fingerprint = [7; 32];
+        let control = observation(0, Some(ProbeReport::Connected), 1);
+        let proof =
+            evaluate(fingerprint, control, denied(libc::EPERM, 0)).expect("should prove denial");
+        assert_eq!(
+            proof.denied_errno(),
+            libc::EPERM,
+            "should keep the real errno"
+        );
+        assert!(proof.matches(&fingerprint), "should bind the instance");
+        assert!(
+            !proof.matches(&[8; 32]),
+            "should not match another instance"
+        );
+        let eacces =
+            evaluate(fingerprint, control, denied(libc::EACCES, 0)).expect("should accept EACCES");
+        assert_eq!(eacces.denied_errno(), libc::EACCES, "should keep EACCES");
+    }
+
+    #[test]
+    fn proof_rejects_failed_controls() {
+        let bad_controls = [
+            denied(libc::ECONNREFUSED, 0),
+            observation(0, Some(ProbeReport::Connected), 0),
+            observation(0, Some(ProbeReport::Connected), 2),
+            observation(0, None, 1),
+            observation(1, Some(ProbeReport::Connected), 1),
+        ];
+        for control in bad_controls {
+            assert!(
+                evaluate([7; 32], control, denied(libc::EPERM, 0)).is_err(),
+                "should reject failed control {control:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn proof_rejects_undenied_probes() {
+        let control = observation(0, Some(ProbeReport::Connected), 1);
+        let bad_confined = [
+            observation(0, Some(ProbeReport::Connected), 1),
+            denied(libc::ECONNREFUSED, 0),
+            denied(111, 0),
+            denied(libc::EPERM, 1),
+            observation(0, Some(ProbeReport::Denied { errno: libc::EPERM }), 0),
+            observation(3, None, 0),
+        ];
+        for confined in bad_confined {
+            assert!(
+                evaluate([7; 32], control, confined).is_err(),
+                "should reject undenied probe {confined:?}"
+            );
+        }
+    }
+}
diff --git a/crates/trusted-server-release/src/boundary/roots.rs b/crates/trusted-server-release/src/boundary/roots.rs
new file mode 100644
index 0000000000..de214fc968
--- /dev/null
+++ b/crates/trusted-server-release/src/boundary/roots.rs
@@ -0,0 +1,545 @@
+//! Boundary root validation, alias checks and immutable tree facts.
+//!
+//! Every root is canonicalized, must be UTF-8 without quote, backslash or
+//! control characters (so it can travel as an SBPL `-D` define or a Docker
+//! mount field without escaping), and must be disjoint from every other root.
+//!
+//! Immutable roots are scanned before and after each confined execution.
+//! Every regular file must have `nlink == 1`: a pre-existing hard link outside
+//! the root writes through path-based write denial, and a write followed by
+//! content, mode and mtime restoration is invisible to a hash comparison, so
+//! the link itself is rejected before anything runs. Symlinks must be
+//! relative, resolve inside their root and not dangle, which keeps their
+//! meaning identical in the host and container namespaces.
+
+use std::collections::BTreeMap;
+use std::fs::{self, File, Metadata};
+use std::io::Read as _;
+use std::os::unix::fs::{MetadataExt as _, OpenOptionsExt as _};
+use std::path::{Component, Path, PathBuf};
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256};
+
+use crate::error::ReleaseError;
+
+/// Maximum number of roots per role; SBPL parameter slots are fixed.
+pub(crate) const MAX_ROOTS: usize = 8;
+/// File read size while hashing immutable files.
+const HASH_CHUNK: usize = 64 * 1024;
+
+fn boundary_error(message: impl std::fmt::Display) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Boundary).attach(message.to_string())
+}
+
+/// How a root is exposed inside the boundary.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, derive_more::Display)]
+pub(crate) enum RootRole {
+    /// Read-only source or object store, scanned and rehashed.
+    #[display("immutable")]
+    Immutable,
+    /// Read-only authenticated tool file or directory.
+    #[display("tool")]
+    Tool,
+    /// Private writable installation or output root.
+    #[display("writable")]
+    Writable,
+    /// Read-and-execute-only host system tool directory, such as the Apple
+    /// developer directory.
+    ///
+    /// It is never scanned: its identity is an explicit record of versions
+    /// and tool hashes held by the caller, not a tree snapshot.
+    #[display("system")]
+    System,
+}
+
+/// Validated, canonical and pairwise-disjoint boundary roots.
+///
+/// System roots take part in equality, so a boundary configured without the
+/// exact system roots never matches a recipe that requires them.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct BoundaryRoots {
+    immutable: Vec<PathBuf>,
+    tools: Vec<PathBuf>,
+    writable: Vec<PathBuf>,
+    system: Vec<PathBuf>,
+}
+
+/// Rejects path text that cannot travel unescaped as a profile define.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Boundary`] for a relative or non-UTF-8 path, the
+/// filesystem root, or one containing `"`, `\` or any control character
+/// (including newline and NUL).
+pub(crate) fn validate_path_text(path: &Path) -> Result<&str, Report<ReleaseError>> {
+    let text = path
+        .to_str()
+        .ok_or_else(|| boundary_error("boundary path is not UTF-8"))?;
+    if !path.is_absolute() || text == "/" {
+        return Err(boundary_error(format!(
+            "boundary path {text:?} must be absolute and not the filesystem root"
+        )));
+    }
+    if text
+        .chars()
+        .any(|c| c == '"' || c == '\\' || c.is_control())
+    {
+        return Err(boundary_error(format!(
+            "boundary path {text:?} contains a quote, backslash or control character"
+        )));
+    }
+    Ok(text)
+}
+
+fn canonical_root(path: &Path, role: RootRole) -> Result<PathBuf, Report<ReleaseError>> {
+    validate_path_text(path)?;
+    let canonical = fs::canonicalize(path)
+        .map_err(|error| boundary_error(format!("cannot resolve {role} root: {error}")))?;
+    validate_path_text(&canonical)?;
+    let metadata = fs::symlink_metadata(&canonical)
+        .map_err(|error| boundary_error(format!("cannot inspect {role} root: {error}")))?;
+    let accepted = metadata.is_dir() || (role == RootRole::Tool && metadata.is_file());
+    if !accepted {
+        return Err(boundary_error(format!(
+            "{role} root {} has an unsupported file type",
+            canonical.display()
+        )));
+    }
+    Ok(canonical)
+}
+
+fn canonical_roots(
+    paths: &[PathBuf],
+    role: RootRole,
+) -> Result<Vec<PathBuf>, Report<ReleaseError>> {
+    if paths.len() > MAX_ROOTS {
+        return Err(boundary_error(format!(
+            "at most {MAX_ROOTS} {role} roots are supported"
+        )));
+    }
+    paths
+        .iter()
+        .map(|path| canonical_root(path, role))
+        .collect()
+}
+
+/// Returns whether either path contains the other.
+#[must_use]
+pub(crate) fn overlaps(first: &Path, second: &Path) -> bool {
+    first.starts_with(second) || second.starts_with(first)
+}
+
+impl BoundaryRoots {
+    /// Canonicalizes and validates the roots.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] for invalid path text, a missing
+    /// root, a non-directory immutable or writable root, more than
+    /// [`MAX_ROOTS`] roots of one role, no writable root, or any two roots
+    /// that are equal or nested.
+    pub(crate) fn new(
+        immutable: &[PathBuf],
+        tools: &[PathBuf],
+        writable: &[PathBuf],
+    ) -> Result<Self, Report<ReleaseError>> {
+        let roots = Self {
+            immutable: canonical_roots(immutable, RootRole::Immutable)?,
+            tools: canonical_roots(tools, RootRole::Tool)?,
+            writable: canonical_roots(writable, RootRole::Writable)?,
+            system: Vec::new(),
+        };
+        if roots.writable.is_empty() {
+            return Err(boundary_error("a boundary needs a private writable root"));
+        }
+        roots.check_disjoint()?;
+        Ok(roots)
+    }
+
+    /// Adds read-and-execute-only system roots, replacing any set before.
+    ///
+    /// System roots are never scanned or written; the macOS profile allows
+    /// only reading and executing below them and the Linux container
+    /// boundary refuses them.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] for invalid path text, a missing or
+    /// non-directory root, more than [`MAX_ROOTS`] system roots, or a system
+    /// root equal to or nested with any other root.
+    pub(crate) fn with_system(mut self, system: &[PathBuf]) -> Result<Self, Report<ReleaseError>> {
+        self.system = canonical_roots(system, RootRole::System)?;
+        self.check_disjoint()?;
+        Ok(self)
+    }
+
+    /// Requires every pair of roots to be neither equal nor nested.
+    fn check_disjoint(&self) -> Result<(), Report<ReleaseError>> {
+        let all: Vec<(RootRole, usize, &Path)> = self.entries().collect();
+        for (index, (_, _, first)) in all.iter().enumerate() {
+            for (_, _, second) in all.iter().skip(index + 1) {
+                if overlaps(first, second) {
+                    return Err(boundary_error(format!(
+                        "boundary roots {} and {} are not disjoint",
+                        first.display(),
+                        second.display()
+                    )));
+                }
+            }
+        }
+        Ok(())
+    }
+
+    /// Returns these roots without the last writable root, which must be
+    /// `excluded`.
+    ///
+    /// Only the last writable root may be dropped, so every remaining root
+    /// keeps its role, per-role index and therefore its execution path.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] when `excluded` cannot be resolved,
+    /// is not the last writable root, or is the only writable root.
+    pub(crate) fn without_last_writable(
+        &self,
+        excluded: &Path,
+    ) -> Result<Self, Report<ReleaseError>> {
+        let excluded = fs::canonicalize(excluded).map_err(|error| {
+            boundary_error(format!(
+                "cannot resolve the excluded writable root: {error}"
+            ))
+        })?;
+        let Some((last, remaining)) = self.writable.split_last() else {
+            return Err(boundary_error("a boundary needs a private writable root"));
+        };
+        if *last != excluded {
+            return Err(boundary_error(
+                "only the last writable root may be excluded without shifting root indices",
+            ));
+        }
+        if remaining.is_empty() {
+            return Err(boundary_error(
+                "excluding the only writable root leaves no private writable root",
+            ));
+        }
+        Ok(Self {
+            immutable: self.immutable.clone(),
+            tools: self.tools.clone(),
+            writable: remaining.to_vec(),
+            system: self.system.clone(),
+        })
+    }
+
+    /// Returns every root with its role and per-role index.
+    pub(crate) fn entries(&self) -> impl Iterator<Item = (RootRole, usize, &Path)> {
+        fn tag(
+            role: RootRole,
+            paths: &[PathBuf],
+        ) -> impl Iterator<Item = (RootRole, usize, &Path)> {
+            paths
+                .iter()
+                .enumerate()
+                .map(move |(index, path)| (role, index, path.as_path()))
+        }
+        tag(RootRole::Immutable, &self.immutable)
+            .chain(tag(RootRole::Tool, &self.tools))
+            .chain(tag(RootRole::Writable, &self.writable))
+            .chain(tag(RootRole::System, &self.system))
+    }
+
+    /// Returns the read-and-execute-only system roots.
+    #[must_use]
+    pub(crate) fn system(&self) -> &[PathBuf] {
+        &self.system
+    }
+
+    /// Returns the immutable roots.
+    #[must_use]
+    pub(crate) fn immutable(&self) -> &[PathBuf] {
+        &self.immutable
+    }
+
+    /// Returns the tool roots.
+    #[must_use]
+    pub(crate) fn tools(&self) -> &[PathBuf] {
+        &self.tools
+    }
+
+    /// Returns the writable roots.
+    #[must_use]
+    pub(crate) fn writable(&self) -> &[PathBuf] {
+        &self.writable
+    }
+
+    /// Returns the root containing `path` and the path relative to it.
+    #[must_use]
+    pub(crate) fn locate<'a>(&self, path: &'a Path) -> Option<(RootRole, usize, &'a Path)> {
+        self.entries().find_map(|(role, index, root)| {
+            path.strip_prefix(root)
+                .ok()
+                .map(|relative| (role, index, relative))
+        })
+    }
+}
+
+/// The observed identity of one entry under an immutable root.
+#[derive(Clone, Debug, PartialEq, Eq)]
+enum EntryKind {
+    Directory,
+    File { size: u64, sha256: [u8; 32] },
+    Symlink { target: PathBuf },
+}
+
+/// Metadata compared before and after each confined execution.
+#[derive(Clone, Debug, PartialEq, Eq)]
+struct EntryFacts {
+    kind: EntryKind,
+    mode: u32,
+    nlink: u64,
+    device: u64,
+    inode: u64,
+    mtime_ns: i128,
+    ctime_ns: i128,
+}
+
+/// A complete snapshot of one immutable root.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct TreeFacts {
+    root: PathBuf,
+    entries: BTreeMap<PathBuf, EntryFacts>,
+}
+
+/// What a tree scan records.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum ScanPolicy {
+    /// Hash files, require `nlink == 1` and check aliases.
+    Immutable,
+    /// Require `nlink == 1` and check aliases without hashing (writable
+    /// roots before a run).
+    SingleLinks,
+    /// Check aliases and file types only (writable roots after a run).
+    AliasesOnly,
+}
+
+fn nanos(seconds: i64, nanoseconds: i64) -> i128 {
+    i128::from(seconds) * 1_000_000_000 + i128::from(nanoseconds)
+}
+
+fn facts(kind: EntryKind, metadata: &Metadata) -> EntryFacts {
+    EntryFacts {
+        kind,
+        mode: metadata.mode(),
+        nlink: metadata.nlink(),
+        device: metadata.dev(),
+        inode: metadata.ino(),
+        mtime_ns: nanos(metadata.mtime(), metadata.mtime_nsec()),
+        ctime_ns: nanos(metadata.ctime(), metadata.ctime_nsec()),
+    }
+}
+
+/// Hashes a regular file opened without following links, rejecting hard
+/// links and a file swapped between `lstat` and `open`.
+fn hash_file(path: &Path, listed: &Metadata) -> Result<[u8; 32], Report<ReleaseError>> {
+    let mut file = File::options()
+        .read(true)
+        .custom_flags(libc::O_NOFOLLOW)
+        .open(path)
+        .map_err(|error| boundary_error(format!("cannot open {}: {error}", path.display())))?;
+    let opened = file
+        .metadata()
+        .map_err(|error| boundary_error(format!("cannot stat {}: {error}", path.display())))?;
+    if opened.dev() != listed.dev() || opened.ino() != listed.ino() {
+        return Err(boundary_error(format!(
+            "{} changed while it was scanned",
+            path.display()
+        )));
+    }
+    if opened.nlink() != 1 {
+        return Err(boundary_error(format!(
+            "file {} has {} hard links; a link outside the root would bypass write denial",
+            path.display(),
+            opened.nlink()
+        )));
+    }
+    let mut hasher = Sha256::new();
+    let mut buffer = vec![0_u8; HASH_CHUNK];
+    loop {
+        let read = file
+            .read(&mut buffer)
+            .map_err(|error| boundary_error(format!("cannot read {}: {error}", path.display())))?;
+        let Some(chunk) = buffer.get(..read).filter(|chunk| !chunk.is_empty()) else {
+            return Ok(hasher.finalize().into());
+        };
+        hasher.update(chunk);
+    }
+}
+
+/// Lexically resolves a relative link target from the link's directory,
+/// returning `None` when it climbs above the root.
+fn lexical_target(link_relative: &Path, target: &Path) -> Option<PathBuf> {
+    let mut resolved: Vec<Component<'_>> = link_relative.parent()?.components().collect();
+    for component in target.components() {
+        match component {
+            Component::CurDir => {}
+            Component::ParentDir => {
+                resolved.pop()?;
+            }
+            Component::Normal(_) => resolved.push(component),
+            Component::RootDir | Component::Prefix(_) => return None,
+        }
+    }
+    Some(resolved.iter().collect())
+}
+
+/// Rejects an alias that is absolute, escapes the root or dangles.
+fn check_alias(root: &Path, relative: &Path) -> Result<PathBuf, Report<ReleaseError>> {
+    let path = root.join(relative);
+    let target = fs::read_link(&path)
+        .map_err(|error| boundary_error(format!("cannot read link {}: {error}", path.display())))?;
+    if target.is_absolute() {
+        return Err(boundary_error(format!(
+            "link {} is absolute and resolves differently inside the container namespace",
+            path.display()
+        )));
+    }
+    if lexical_target(relative, &target).is_none() {
+        return Err(boundary_error(format!(
+            "link {} escapes its root",
+            path.display()
+        )));
+    }
+    let resolved = fs::canonicalize(&path)
+        .map_err(|error| boundary_error(format!("link {} dangles: {error}", path.display())))?;
+    if !resolved.starts_with(root) {
+        return Err(boundary_error(format!(
+            "link {} resolves outside its root",
+            path.display()
+        )));
+    }
+    Ok(target)
+}
+
+fn entry_kind(
+    root: &Path,
+    relative: &Path,
+    metadata: &Metadata,
+    policy: ScanPolicy,
+) -> Result<EntryKind, Report<ReleaseError>> {
+    let file_type = metadata.file_type();
+    if file_type.is_dir() {
+        return Ok(EntryKind::Directory);
+    }
+    if file_type.is_symlink() {
+        return Ok(EntryKind::Symlink {
+            target: check_alias(root, relative)?,
+        });
+    }
+    if !file_type.is_file() {
+        return Err(boundary_error(format!(
+            "{} is a socket, FIFO or device; only files, directories and links are allowed",
+            entry_path(root, relative).display()
+        )));
+    }
+    let path = entry_path(root, relative);
+    let sha256 = match policy {
+        ScanPolicy::Immutable => hash_file(&path, metadata)?,
+        ScanPolicy::SingleLinks if metadata.nlink() != 1 => {
+            return Err(boundary_error(format!(
+                "file {} has {} hard links; a link outside the root would bypass write denial",
+                path.display(),
+                metadata.nlink()
+            )));
+        }
+        ScanPolicy::SingleLinks | ScanPolicy::AliasesOnly => [0; 32],
+    };
+    Ok(EntryKind::File {
+        size: metadata.len(),
+        sha256,
+    })
+}
+
+/// Returns `root` itself for the empty relative path (a file root) and the
+/// joined path otherwise.
+fn entry_path(root: &Path, relative: &Path) -> PathBuf {
+    if relative.as_os_str().is_empty() {
+        root.to_path_buf()
+    } else {
+        root.join(relative)
+    }
+}
+
+fn child_names(directory: &Path) -> Result<Vec<PathBuf>, Report<ReleaseError>> {
+    let read_error = |error: std::io::Error| {
+        boundary_error(format!("cannot list {}: {error}", directory.display()))
+    };
+    let mut names = Vec::new();
+    for entry in fs::read_dir(directory).map_err(read_error)? {
+        names.push(PathBuf::from(entry.map_err(read_error)?.file_name()));
+    }
+    Ok(names)
+}
+
+impl TreeFacts {
+    /// Scans `root` (canonical) under `policy`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] for an unreadable entry, a
+    /// non-regular special file, a hard-linked regular file (immutable and
+    /// single-link policies), or an absolute, escaping or dangling symlink.
+    pub(crate) fn scan(root: &Path, policy: ScanPolicy) -> Result<Self, Report<ReleaseError>> {
+        let mut entries = BTreeMap::new();
+        let mut pending = vec![PathBuf::new()];
+        while let Some(relative) = pending.pop() {
+            let path = entry_path(root, &relative);
+            let metadata = fs::symlink_metadata(&path).map_err(|error| {
+                boundary_error(format!("cannot inspect {}: {error}", path.display()))
+            })?;
+            let kind = entry_kind(root, &relative, &metadata, policy)?;
+            if kind == EntryKind::Directory {
+                pending.extend(
+                    child_names(&path)?
+                        .into_iter()
+                        .map(|name| relative.join(name)),
+                );
+            }
+            entries.insert(relative, facts(kind, &metadata));
+        }
+        Ok(Self {
+            root: root.to_path_buf(),
+            entries,
+        })
+    }
+
+    /// Requires `after` to match this snapshot exactly.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] naming the first added, removed or
+    /// changed entry.
+    pub(crate) fn ensure_unchanged(&self, after: &Self) -> Result<(), Report<ReleaseError>> {
+        if self.root != after.root {
+            return Err(boundary_error("tree snapshots describe different roots"));
+        }
+        let changed = self
+            .entries
+            .iter()
+            .find(|(path, facts)| after.entries.get(*path) != Some(facts))
+            .map(|(path, _)| path)
+            .or_else(|| {
+                after
+                    .entries
+                    .keys()
+                    .find(|path| !self.entries.contains_key(*path))
+            });
+        match changed {
+            None => Ok(()),
+            Some(path) => Err(boundary_error(format!(
+                "immutable root {} changed at {:?}",
+                self.root.display(),
+                path
+            ))),
+        }
+    }
+}
diff --git a/crates/trusted-server-release/src/boundary/seccomp.rs b/crates/trusted-server-release/src/boundary/seccomp.rs
new file mode 100644
index 0000000000..3dc31f7c25
--- /dev/null
+++ b/crates/trusted-server-release/src/boundary/seccomp.rs
@@ -0,0 +1,123 @@
+//! Effective Docker seccomp profile derived from the source-owned baseline.
+//!
+//! The baseline is the reviewed `moby/profiles` `seccomp/v0.2.1` default
+//! profile retained in `scripts/release/qualification/`. Its SHA-256 is
+//! checked before use. The effective profile preserves the baseline's default
+//! `SCMP_ACT_ERRNO`/`EPERM` action, native architectures and every other
+//! syscall rule except process-memory and descriptor-transfer allowances.
+//! It empties every `subArchitectures` list, so non-native ABIs
+//! (x86 and x32 on `x86_64`, where sockets go through `socketcall`; 32-bit
+//! ARM on `aarch64`) are not admitted by the filter at all and fail with the
+//! filter's bad-architecture action. It removes every `socket`, `socketpair`
+//! and `socketcall` allowance and adds exactly one rule allowing
+//! `socket`/`socketpair` with argument zero equal to `AF_UNIX`, so INET,
+//! INET6, netlink and packet sockets fail with `EPERM`. `--network none` alone still permits loopback INET
+//! sockets, so this layer is what turns them into `EPERM`.
+
+use error_stack::Report;
+use serde_json::{Value, json};
+use sha2::{Digest as _, Sha256};
+
+use crate::error::ReleaseError;
+
+/// The reviewed baseline bytes, compiled in from the source tree.
+const BASELINE: &[u8] =
+    include_bytes!("../../../../scripts/release/qualification/seccomp-default.json");
+/// SHA-256 of the reviewed baseline recorded in the qualification README.
+pub(crate) const BASELINE_SHA256: &str =
+    "536529b665dd0972c37bfb569f5d4ac8a53592e7b00752bc39ff063ca9864c74";
+/// Socket-creating syscalls whose baseline allowances are removed.
+const SOCKET_SYSCALLS: [&str; 3] = ["socket", "socketpair", "socketcall"];
+/// An install hook must not inspect or modify its trusted observer's memory.
+const PROCESS_ACCESS_SYSCALLS: [&str; 6] = [
+    "ptrace",
+    "process_vm_readv",
+    "process_vm_writev",
+    "pidfd_getfd",
+    "kcmp",
+    "process_madvise",
+];
+/// `AF_UNIX` on every Linux architecture.
+const AF_UNIX: u64 = 1;
+
+fn seccomp_error(message: impl std::fmt::Display) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Boundary).attach(message.to_string())
+}
+
+/// Returns the hex SHA-256 of `bytes`.
+#[must_use]
+pub(crate) fn sha256_hex(bytes: &[u8]) -> String {
+    hex::encode(Sha256::digest(bytes))
+}
+
+/// Returns the baseline after checking its reviewed digest.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Boundary`] when the compiled-in bytes do not match
+/// [`BASELINE_SHA256`].
+pub(crate) fn baseline() -> Result<&'static [u8], Report<ReleaseError>> {
+    if sha256_hex(BASELINE) != BASELINE_SHA256 {
+        return Err(seccomp_error(
+            "seccomp baseline digest does not match review",
+        ));
+    }
+    Ok(BASELINE)
+}
+
+fn strip_socket_names(rule: &mut Value) -> Result<bool, Report<ReleaseError>> {
+    let names = rule
+        .get_mut("names")
+        .and_then(Value::as_array_mut)
+        .ok_or_else(|| seccomp_error("seccomp rule has no names array"))?;
+    names.retain(|name| {
+        name.as_str().is_none_or(|name| {
+            !SOCKET_SYSCALLS.contains(&name) && !PROCESS_ACCESS_SYSCALLS.contains(&name)
+        })
+    });
+    Ok(!names.is_empty())
+}
+
+/// Derives the effective profile from `baseline`.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Boundary`] when the baseline is not JSON, does not
+/// default to `SCMP_ACT_ERRNO` with errno `1`, or has a malformed rule.
+pub(crate) fn effective(baseline: &[u8]) -> Result<Vec<u8>, Report<ReleaseError>> {
+    let mut profile: Value = serde_json::from_slice(baseline)
+        .map_err(|error| seccomp_error(format!("seccomp baseline is not JSON: {error}")))?;
+    let default_denies = profile.get("defaultAction") == Some(&json!("SCMP_ACT_ERRNO"))
+        && profile.get("defaultErrnoRet") == Some(&json!(1));
+    if !default_denies {
+        return Err(seccomp_error("seccomp baseline does not default to EPERM"));
+    }
+    let architectures = profile
+        .get_mut("archMap")
+        .and_then(Value::as_array_mut)
+        .ok_or_else(|| seccomp_error("seccomp baseline has no archMap"))?;
+    for architecture in architectures {
+        let entry = architecture
+            .as_object_mut()
+            .ok_or_else(|| seccomp_error("seccomp archMap entry is not an object"))?;
+        entry.insert(String::from("subArchitectures"), json!([]));
+    }
+    let rules = profile
+        .get_mut("syscalls")
+        .and_then(Value::as_array_mut)
+        .ok_or_else(|| seccomp_error("seccomp baseline has no syscalls array"))?;
+    let mut retained = Vec::with_capacity(rules.len() + 1);
+    for mut rule in rules.drain(..) {
+        if strip_socket_names(&mut rule)? {
+            retained.push(rule);
+        }
+    }
+    retained.push(json!({
+        "names": ["socket", "socketpair"],
+        "action": "SCMP_ACT_ALLOW",
+        "args": [{"index": 0, "value": AF_UNIX, "op": "SCMP_CMP_EQ"}],
+    }));
+    *rules = retained;
+    serde_json::to_vec_pretty(&profile)
+        .map_err(|error| seccomp_error(format!("cannot serialize seccomp profile: {error}")))
+}
diff --git a/crates/trusted-server-release/src/boundary/selector_placement_tests.rs b/crates/trusted-server-release/src/boundary/selector_placement_tests.rs
new file mode 100644
index 0000000000..e88df1a2f2
--- /dev/null
+++ b/crates/trusted-server-release/src/boundary/selector_placement_tests.rs
@@ -0,0 +1,127 @@
+//! Pure tests of tool-selector placement and sandbox wrapping; nothing runs.
+
+use std::fs;
+use std::path::PathBuf;
+use std::time::Duration;
+
+use super::macos::{MacProfile, RunIdentity};
+use super::*;
+
+struct Layout {
+    _directory: tempfile::TempDir,
+    base: PathBuf,
+    roots: BoundaryRoots,
+}
+
+fn layout() -> Layout {
+    let directory = tempfile::tempdir().expect("should create layout");
+    let base = fs::canonicalize(directory.path()).expect("should canonicalize layout");
+    for relative in ["tools/bin", "checkout", "state"] {
+        fs::create_dir_all(base.join(relative)).expect("should create root");
+    }
+    let roots = BoundaryRoots::new(
+        &[base.join("checkout")],
+        &[base.join("tools")],
+        &[base.join("state")],
+    )
+    .expect("should build roots");
+    Layout {
+        _directory: directory,
+        base,
+        roots,
+    }
+}
+
+fn command(layout: &Layout, rustc: &std::path::Path) -> ConfinedCommand {
+    ConfinedCommand::new(
+        &layout.base.join("tools/bin/cargo"),
+        &layout.base.join("checkout"),
+        ProcessLimits {
+            wall: Duration::from_secs(1),
+            stdout_max: 1024,
+            stderr_max: 1024,
+        },
+    )
+    .expect("should describe the command")
+    .tool_environment("RUSTC", rustc)
+    .expect("should accept an absolute RUSTC")
+}
+
+#[cfg(target_os = "macos")]
+#[test]
+fn rustc_must_be_the_tool_roots_own_bin_rustc() {
+    let layout = layout();
+    let boundary =
+        Boundary::mac_sandbox_for_tests(layout.roots.clone()).expect("should configure, not run");
+    boundary
+        .check_placement(&command(&layout, &layout.base.join("tools/bin/rustc")))
+        .expect("should accept the tool root's rustc");
+    for (label, other) in [
+        (
+            "another file in the tool root",
+            layout.base.join("tools/bin/other"),
+        ),
+        (
+            "a nested lookalike",
+            layout.base.join("tools/bin/rustc/rustc"),
+        ),
+        ("a file in the checkout", layout.base.join("checkout/rustc")),
+        ("a file outside every root", PathBuf::from("/usr/bin/rustc")),
+        ("the tool root itself", layout.base.join("tools")),
+    ] {
+        assert!(
+            boundary.check_placement(&command(&layout, &other)).is_err(),
+            "should reject RUSTC naming {label}"
+        );
+    }
+}
+
+#[test]
+fn sandbox_wrap_carries_rustc_but_still_rejects_the_nonce_variable() {
+    let layout = layout();
+    let profile = MacProfile::generate(&layout.roots).expect("should generate the profile");
+    let run = RunIdentity::new(&profile).expect("should create run markers");
+    profile
+        .wrap(
+            &command(&layout, &layout.base.join("tools/bin/rustc")),
+            &run,
+        )
+        .expect("should wrap a command carrying the explicit compiler");
+    let forged = command(&layout, &layout.base.join("tools/bin/rustc"))
+        .environment(super::macos::RUN_NONCE_VARIABLE, "x")
+        .expect("should hold the variable until wrapping");
+    assert!(
+        profile.wrap(&forged, &run).is_err(),
+        "should reject a caller variable named like the run nonce"
+    );
+}
+
+#[cfg(target_os = "macos")]
+#[test]
+fn mac_host_path_maps_only_lexically_normal_writable_paths() {
+    let layout = layout();
+    let boundary =
+        Boundary::mac_sandbox_for_tests(layout.roots.clone()).expect("should configure, not run");
+    let state = layout.base.join("state");
+    assert_eq!(
+        boundary
+            .host_path(&state.join("release/ts"))
+            .expect("should accept a normal writable path"),
+        state.join("release/ts"),
+        "should map a writable path to itself"
+    );
+    let text = |relative: &str| PathBuf::from(format!("{}/{relative}", state.display()));
+    for path in [
+        text("release/./ts"),
+        text("release//ts"),
+        text("release/ts/"),
+        text("release/../state/ts"),
+        layout.base.join("checkout/ts"),
+        layout.base.join("tools/bin/rustc"),
+    ] {
+        assert!(
+            boundary.host_path(&path).is_err(),
+            "should reject {path:?} as a host path"
+        );
+    }
+}
diff --git a/crates/trusted-server-release/src/boundary/sibling_tests.rs b/crates/trusted-server-release/src/boundary/sibling_tests.rs
new file mode 100644
index 0000000000..2c99e50d1c
--- /dev/null
+++ b/crates/trusted-server-release/src/boundary/sibling_tests.rs
@@ -0,0 +1,149 @@
+//! Pure tests of sibling boundary root derivation; nothing runs.
+
+use std::fs;
+use std::path::PathBuf;
+
+use super::docker::container_path;
+use super::macos::MacProfile;
+use super::*;
+
+struct Layout {
+    _directory: tempfile::TempDir,
+    base: PathBuf,
+}
+
+fn layout() -> Layout {
+    let directory = tempfile::tempdir().expect("should create layout");
+    let base = fs::canonicalize(directory.path()).expect("should canonicalize layout");
+    for relative in ["checkout", "tools/bin", "cargo-state/home", "target"] {
+        fs::create_dir_all(base.join(relative)).expect("should create root");
+    }
+    Layout {
+        _directory: directory,
+        base,
+    }
+}
+
+impl Layout {
+    fn recipe_roots(&self) -> BoundaryRoots {
+        BoundaryRoots::new(
+            &[self.base.join("checkout")],
+            &[self.base.join("tools")],
+            &[self.base.join("cargo-state"), self.base.join("target")],
+        )
+        .expect("should build recipe roots")
+    }
+}
+
+#[test]
+fn excluding_the_last_writable_root_keeps_every_remaining_execution_path() {
+    let layout = layout();
+    let roots = layout.recipe_roots();
+
+    let sibling = roots
+        .without_last_writable(&layout.base.join("target"))
+        .expect("should exclude the target root");
+
+    assert_eq!(
+        sibling.writable(),
+        [layout.base.join("cargo-state")],
+        "should keep only the Cargo state root writable"
+    );
+    assert_eq!(
+        sibling.immutable(),
+        roots.immutable(),
+        "should keep the immutable roots"
+    );
+    assert_eq!(sibling.tools(), roots.tools(), "should keep the tool roots");
+    for host in [
+        layout.base.join("checkout"),
+        layout.base.join("tools/bin"),
+        layout.base.join("cargo-state/home"),
+    ] {
+        assert_eq!(
+            container_path(&sibling, &host).expect("should translate in the sibling"),
+            container_path(&roots, &host).expect("should translate in the build"),
+            "should keep the execution path of {}",
+            host.display()
+        );
+    }
+    assert!(
+        container_path(&sibling, &layout.base.join("target")).is_err(),
+        "should not expose the excluded target root"
+    );
+}
+
+#[test]
+fn excluding_a_writable_root_that_would_shift_indices_is_rejected() {
+    let layout = layout();
+
+    let error = layout
+        .recipe_roots()
+        .without_last_writable(&layout.base.join("cargo-state"))
+        .expect_err("should reject excluding the first of two writable roots");
+
+    assert!(
+        format!("{error:?}").contains("only the last writable root"),
+        "should explain the index-preservation rule"
+    );
+}
+
+#[test]
+fn excluding_the_only_writable_root_or_a_foreign_path_is_rejected() {
+    let layout = layout();
+    let single = BoundaryRoots::new(
+        &[layout.base.join("checkout")],
+        &[layout.base.join("tools")],
+        &[layout.base.join("target")],
+    )
+    .expect("should build single-writable roots");
+
+    assert!(
+        single
+            .without_last_writable(&layout.base.join("target"))
+            .is_err(),
+        "should keep a private writable root"
+    );
+    assert!(
+        layout
+            .recipe_roots()
+            .without_last_writable(&layout.base.join("checkout"))
+            .is_err(),
+        "should reject excluding a root that is not writable"
+    );
+    assert!(
+        layout
+            .recipe_roots()
+            .without_last_writable(&layout.base.join("missing"))
+            .is_err(),
+        "should reject an unresolvable exclusion"
+    );
+}
+
+#[test]
+fn a_macos_boundary_derives_no_sibling() {
+    let layout = layout();
+    let roots = layout.recipe_roots();
+    let boundary = Boundary {
+        platform: Platform::MacSandbox(
+            MacProfile::generate(&roots).expect("should generate the profile"),
+        ),
+        roots,
+        fingerprint: [1; 32],
+        derived_from: None,
+    };
+
+    let error = boundary
+        .sibling_without_writable(&layout.base.join("target"))
+        .expect_err("should reject a macOS sibling");
+
+    assert!(
+        format!("{error:?}").contains("only a Linux container boundary"),
+        "should name the Linux-only rule"
+    );
+    assert_eq!(
+        boundary.derived_from(),
+        None,
+        "should record no parent for a directly configured boundary"
+    );
+}
diff --git a/crates/trusted-server-release/src/boundary/survivors.rs b/crates/trusted-server-release/src/boundary/survivors.rs
new file mode 100644
index 0000000000..c012346cfa
--- /dev/null
+++ b/crates/trusted-server-release/src/boundary/survivors.rs
@@ -0,0 +1,326 @@
+//! Fail-closed detection of confined descendants that outlived a macOS run.
+//!
+//! macOS has no subreaper, and `posix_spawn` with `POSIX_SPAWN_SETPGROUP` or
+//! `POSIX_SPAWN_SETSID` leaves the supervised process group even though the
+//! profile denies the `setsid`/`setpgid` system calls. After every run, each
+//! other process is checked two ways, and every match is sent `SIGKILL` and
+//! the run rejected:
+//!
+//! - Sandbox instance: the process is sandboxed, may read the run's allow
+//!   marker and may not read its deny marker, according to `sandbox_check`.
+//!   A confined process cannot leave or re-apply its sandbox (nested
+//!   `sandbox_apply` fails with `EPERM`), so scrubbing its environment or
+//!   changing its process group does not hide it.
+//! - Environment: its exec-time arguments and environment (`KERN_PROCARGS2`,
+//!   readable only for same-user processes) hold `NAME=<run nonce>`. macOS
+//!   hides this area for Apple platform binaries such as `/bin/sleep`, so
+//!   this signal is secondary to the sandbox-instance check.
+//!
+//! Only processes that started after the run began, less a one-second clock
+//! margin, are eligible, so already-running applications are never
+//! signalled even if a check misbehaves.
+//!
+//! `sandbox_check` is exported by libSystem's `libsystem_sandbox` but is not
+//! declared in the public SDK header. A self-check against this unsandboxed
+//! orchestrator must give the expected answers before any scan is trusted;
+//! the orchestrator must therefore not itself run inside a sandbox.
+
+use std::ffi::{CStr, CString};
+use std::os::unix::ffi::OsStrExt as _;
+use std::path::Path;
+use std::time::{Duration, Instant};
+
+use error_stack::Report;
+
+use crate::error::ReleaseError;
+
+/// Bound for killing survivors and waiting for them to disappear.
+const REAP_GRACE: Duration = Duration::from_secs(2);
+/// Polling interval while waiting for killed survivors to vanish.
+const POLL_INTERVAL: Duration = Duration::from_millis(10);
+/// Extra slots when listing pids, for processes started between calls.
+const PID_SLACK: usize = 256;
+/// `SANDBOX_FILTER_NONE` in the private `sandbox_filter_type` enumeration.
+const SANDBOX_FILTER_NONE: libc::c_int = 0;
+/// `SANDBOX_FILTER_PATH` in the same enumeration; observed with
+/// `sandbox-exec` profiles on macOS 26.6.2.
+const SANDBOX_FILTER_PATH: libc::c_int = 1;
+/// The checked file operation.
+const FILE_READ_DATA: &CStr = c"file-read-data";
+
+unsafe extern "C" {
+    /// Returns 0 when `operation` is allowed for `pid`, 1 when denied and -1
+    /// on error; with no operation, 1 means `pid` is sandboxed.
+    fn sandbox_check(
+        pid: libc::pid_t,
+        operation: *const libc::c_char,
+        filter: libc::c_int,
+        ...
+    ) -> libc::c_int;
+    /// Flag suppressing sandbox violation reports for a check.
+    static SANDBOX_CHECK_NO_REPORT: libc::c_int;
+}
+
+/// What identifies one run's processes.
+pub(crate) struct RunSignature<'a> {
+    /// Environment variable name carrying the run nonce.
+    pub(crate) variable: &'a str,
+    /// The run nonce.
+    pub(crate) nonce: &'a str,
+    /// Marker file the run's sandbox instance may read.
+    pub(crate) allow: &'a Path,
+    /// Marker file the run's sandbox instance may not read.
+    pub(crate) deny: &'a Path,
+    /// Earliest eligible process start, in microseconds since the epoch.
+    /// Processes that started before the run, such as already-open
+    /// applications, are never matched or signalled.
+    pub(crate) started_after_micros: u64,
+}
+
+/// Prepared queries for one signature.
+struct Matcher {
+    started_after_micros: u64,
+    entry: Vec<u8>,
+    allow: CString,
+    deny: CString,
+}
+
+fn survivor_error(message: impl std::fmt::Display) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Boundary).attach(message.to_string())
+}
+
+fn no_report() -> libc::c_int {
+    // SAFETY: the exported constant is an initialized, immutable `int`.
+    unsafe { SANDBOX_CHECK_NO_REPORT }
+}
+
+/// Returns whether `pid` is sandboxed (1), not (0), or the check failed (-1).
+fn sandboxed(pid: libc::pid_t) -> libc::c_int {
+    // SAFETY: a null operation with the none filter takes no variadic value.
+    unsafe { sandbox_check(pid, core::ptr::null(), SANDBOX_FILTER_NONE | no_report()) }
+}
+
+/// Returns 0 when `pid` may read `path`, 1 when denied, -1 on error.
+fn read_check(pid: libc::pid_t, path: &CStr) -> libc::c_int {
+    // SAFETY: the path filter takes exactly one NUL-terminated string, and
+    // both strings outlive the call.
+    unsafe {
+        sandbox_check(
+            pid,
+            FILE_READ_DATA.as_ptr(),
+            SANDBOX_FILTER_PATH | no_report(),
+            path.as_ptr(),
+        )
+    }
+}
+
+impl Matcher {
+    fn new(signature: &RunSignature<'_>) -> Result<Self, Report<ReleaseError>> {
+        let path = |path: &Path| {
+            CString::new(path.as_os_str().as_bytes())
+                .map_err(|_| survivor_error("run marker path holds a NUL byte"))
+        };
+        Ok(Self {
+            started_after_micros: signature.started_after_micros,
+            entry: format!("{}={}", signature.variable, signature.nonce).into_bytes(),
+            allow: path(signature.allow)?,
+            deny: path(signature.deny)?,
+        })
+    }
+
+    /// Requires the expected answers for the unsandboxed orchestrator.
+    fn self_check(&self, own: libc::pid_t) -> Result<(), Report<ReleaseError>> {
+        let answers = (
+            sandboxed(own),
+            read_check(own, &self.allow),
+            read_check(own, &self.deny),
+        );
+        if answers == (0, 0, 0) {
+            Ok(())
+        } else {
+            Err(survivor_error(format!(
+                "sandbox state query self-check failed with {answers:?}; no process was signalled and the orchestrator must run unsandboxed"
+            )))
+        }
+    }
+
+    /// Returns whether `pid` belongs to the run's sandbox instance.
+    fn in_instance(&self, pid: libc::pid_t) -> bool {
+        sandboxed(pid) == 1 && read_check(pid, &self.allow) == 0 && read_check(pid, &self.deny) == 1
+    }
+}
+
+/// Returns `pid`'s start time in microseconds since the epoch, when readable.
+fn start_micros(pid: libc::pid_t) -> Option<u64> {
+    // SAFETY: `proc_bsdinfo` is plain old data; all-zero bytes are valid.
+    let mut info: libc::proc_bsdinfo = unsafe { core::mem::zeroed() };
+    let size = libc::c_int::try_from(size_of::<libc::proc_bsdinfo>()).ok()?;
+    // SAFETY: `info` is a writable buffer of exactly `size` bytes.
+    let filled =
+        unsafe { libc::proc_pidinfo(pid, libc::PROC_PIDTBSDINFO, 0, (&raw mut info).cast(), size) };
+    (filled == size).then(|| {
+        info.pbi_start_tvsec
+            .saturating_mul(1_000_000)
+            .saturating_add(info.pbi_start_tvusec)
+    })
+}
+
+/// Lists every process ID on the system.
+fn all_pids() -> Result<Vec<libc::pid_t>, Report<ReleaseError>> {
+    // SAFETY: a null buffer of size zero asks only for the current count.
+    let count = unsafe { libc::proc_listallpids(core::ptr::null_mut(), 0) };
+    let count =
+        usize::try_from(count).map_err(|_| survivor_error("cannot count processes"))? + PID_SLACK;
+    let mut pids: Vec<libc::pid_t> = vec![0; count];
+    let bytes = libc::c_int::try_from(count * size_of::<libc::pid_t>())
+        .map_err(|_| survivor_error("process list is too large"))?;
+    // SAFETY: `pids` has room for exactly `bytes` bytes of pid entries.
+    let listed = unsafe { libc::proc_listallpids(pids.as_mut_ptr().cast(), bytes) };
+    let listed = usize::try_from(listed).map_err(|_| survivor_error("cannot list processes"))?;
+    pids.truncate(listed.min(count));
+    Ok(pids)
+}
+
+/// Returns the kernel's maximum argument-area size (`KERN_ARGMAX`).
+fn argument_area_size() -> Result<usize, Report<ReleaseError>> {
+    let mut maximum: libc::c_int = 0;
+    let mut size = size_of::<libc::c_int>();
+    let mut mib = [libc::CTL_KERN, libc::KERN_ARGMAX];
+    // SAFETY: `maximum` and `size` describe a valid c_int output buffer.
+    let rc = unsafe {
+        libc::sysctl(
+            mib.as_mut_ptr(),
+            2,
+            (&raw mut maximum).cast(),
+            &raw mut size,
+            core::ptr::null_mut(),
+            0,
+        )
+    };
+    usize::try_from(maximum)
+        .ok()
+        .filter(|maximum| rc == 0 && *maximum > 0)
+        .ok_or_else(|| survivor_error("cannot read KERN_ARGMAX"))
+}
+
+/// Reads `pid`'s exec-time argument and environment area into `buffer`,
+/// returning the filled prefix when readable (same-user processes only).
+fn process_arguments(pid: libc::pid_t, buffer: &mut [u8]) -> Option<&[u8]> {
+    let mut size = buffer.len();
+    let mut mib = [libc::CTL_KERN, libc::KERN_PROCARGS2, pid];
+    // SAFETY: `buffer` and `size` describe a valid output buffer.
+    let rc = unsafe {
+        libc::sysctl(
+            mib.as_mut_ptr(),
+            3,
+            buffer.as_mut_ptr().cast(),
+            &raw mut size,
+            core::ptr::null_mut(),
+            0,
+        )
+    };
+    if rc == 0 { buffer.get(..size) } else { None }
+}
+
+/// Returns whether `area` holds `entry` as a whole NUL-delimited string.
+fn holds_entry(area: &[u8], entry: &[u8]) -> bool {
+    area.split(|byte| *byte == 0).any(|item| item == entry)
+}
+
+/// Returns `pid`'s start time when it is another eligible process of the
+/// run's instance or carries its nonce.
+fn identify(
+    matcher: &Matcher,
+    pid: libc::pid_t,
+    own: libc::pid_t,
+    buffer: &mut [u8],
+) -> Option<u64> {
+    if pid <= 1 || pid == own {
+        return None;
+    }
+    let started = start_micros(pid).filter(|started| *started >= matcher.started_after_micros)?;
+    let carries = matcher.in_instance(pid)
+        || process_arguments(pid, buffer).is_some_and(|area| holds_entry(area, &matcher.entry));
+    carries.then_some(started)
+}
+
+/// Returns every other matching process with its start time.
+fn carriers(
+    matcher: &Matcher,
+    own: libc::pid_t,
+    buffer: &mut [u8],
+) -> Result<Vec<(libc::pid_t, u64)>, Report<ReleaseError>> {
+    matcher.self_check(own)?;
+    Ok(all_pids()?
+        .into_iter()
+        .filter_map(|pid| identify(matcher, pid, own, buffer).map(|started| (pid, started)))
+        .collect())
+}
+
+fn own_pid() -> libc::pid_t {
+    // SAFETY: `getpid` has no preconditions.
+    unsafe { libc::getpid() }
+}
+
+/// Lists, without signalling them, every other process matching `signature`.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Boundary`] when the markers are not C strings,
+/// the sandbox state query fails its self-check or processes cannot be listed.
+#[cfg(test)]
+pub(crate) fn matching(
+    signature: &RunSignature<'_>,
+) -> Result<Vec<libc::pid_t>, Report<ReleaseError>> {
+    let mut buffer = vec![0_u8; argument_area_size()?];
+    let found = carriers(&Matcher::new(signature)?, own_pid(), &mut buffer)?;
+    Ok(found.into_iter().map(|(pid, _)| pid).collect())
+}
+
+/// Kills every surviving process of the run and rejects the run if any
+/// existed.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Boundary`] naming the survivors when any were
+/// found (after killing them), when they did not vanish within the grace,
+/// or when the sandbox state query fails its self-check.
+pub(crate) fn reap(signature: &RunSignature<'_>) -> Result<(), Report<ReleaseError>> {
+    let matcher = Matcher::new(signature)?;
+    let own = own_pid();
+    let mut buffer = vec![0_u8; argument_area_size()?];
+    let deadline = Instant::now() + REAP_GRACE;
+    let mut killed = Vec::new();
+    loop {
+        let found = carriers(&matcher, own, &mut buffer)?;
+        if found.is_empty() {
+            break;
+        }
+        for (pid, started) in found {
+            // Re-identify immediately before signalling so that a reused pid
+            // with a different start time is never killed.
+            if identify(&matcher, pid, own, &mut buffer) == Some(started) {
+                // SAFETY: `kill` has no memory-safety preconditions;
+                // `identify` only returns pids above 1 other than our own.
+                unsafe {
+                    libc::kill(pid, libc::SIGKILL);
+                }
+                killed.push(pid);
+            }
+        }
+        if Instant::now() >= deadline {
+            return Err(survivor_error(format!(
+                "confined descendants {killed:?} still exist after SIGKILL"
+            )));
+        }
+        std::thread::sleep(POLL_INTERVAL);
+    }
+    if killed.is_empty() {
+        return Ok(());
+    }
+    killed.sort_unstable();
+    killed.dedup();
+    Err(survivor_error(format!(
+        "confined descendants {killed:?} escaped the process group and were killed"
+    )))
+}
diff --git a/crates/trusted-server-release/src/boundary/tests.rs b/crates/trusted-server-release/src/boundary/tests.rs
new file mode 100644
index 0000000000..2913b320f6
--- /dev/null
+++ b/crates/trusted-server-release/src/boundary/tests.rs
@@ -0,0 +1,236 @@
+//! Boundary tests.
+//!
+//! Fixtures are host-independent: confined children re-execute this test
+//! binary in a hidden, nonce-gated helper mode (see [`helper_entry`] and
+//! [`modes`]) built from std and libc only — no shells, interpreters or
+//! coreutils. The helper speaks the same probe protocol as
+//! `boundary-probe connect`, sharing
+//! [`connect_probe`](super::probe::connect_probe), after a sentinel that
+//! skips the libtest preamble.
+//!
+//! Tool roots require `nlink == 1`, and Cargo hard-links its test binaries,
+//! so every boundary fixture runs a private staged copy of this binary.
+
+mod container;
+mod modes;
+mod unit;
+
+#[cfg(target_os = "linux")]
+mod linux;
+#[cfg(target_os = "macos")]
+mod macos;
+
+use std::ffi::OsString;
+use std::path::{Path, PathBuf};
+use std::process::Command as StdCommand;
+use std::sync::OnceLock;
+use std::time::{Duration, Instant};
+
+use super::*;
+
+/// Environment selector `<mode>:<nonce>`; absent in normal test runs.
+const HELPER_SELECTOR: &str = "TS_RELEASE_BOUNDARY_HELPER";
+/// Environment variable carrying the nonce the selector must match.
+const HELPER_NONCE: &str = "TS_RELEASE_BOUNDARY_NONCE";
+/// Exact libtest name of [`helper_entry`].
+const HELPER_TEST: &str = "boundary::tests::helper_entry";
+/// Marks the helper's report after the libtest preamble.
+const SENTINEL: &[u8] = b"\x1eTS-BOUNDARY-HELPER\x1e";
+/// libtest arguments selecting only [`helper_entry`]; mode arguments follow.
+const HELPER_ARGUMENTS: [&str; 4] = ["--exact", HELPER_TEST, "--nocapture", "--test-threads=1"];
+/// Exit status of a helper whose setup failed.
+const HELPER_SETUP_FAILED: i32 = 90;
+/// Generous per-run bound for every fixture child.
+const SLACK: Duration = Duration::from_secs(60);
+
+/// Returns limits generous enough for any fixture child.
+fn limits() -> ProcessLimits {
+    ProcessLimits {
+        wall: SLACK,
+        stdout_max: 1024 * 1024,
+        stderr_max: 1024 * 1024,
+    }
+}
+
+/// Returns this run's helper nonce.
+fn nonce() -> &'static str {
+    static NONCE: OnceLock<String> = OnceLock::new();
+    NONCE.get_or_init(|| {
+        hex::encode(super::random_bytes::<16>().expect("should read nonce entropy"))
+    })
+}
+
+/// Returns the canonical (Cargo hard-linked) test binary path.
+fn test_binary() -> PathBuf {
+    std::env::current_exe()
+        .and_then(std::fs::canonicalize)
+        .expect("should locate the test binary")
+}
+
+/// Returns the helper environment selecting `mode`.
+fn helper_environment(mode: &str) -> Vec<(OsString, OsString)> {
+    vec![
+        (
+            OsString::from(HELPER_SELECTOR),
+            OsString::from(format!("{mode}:{}", nonce())),
+        ),
+        (OsString::from(HELPER_NONCE), OsString::from(nonce())),
+    ]
+}
+
+/// Returns the full helper argument vector for `mode_arguments`.
+fn helper_arguments(mode_arguments: &[&str]) -> Vec<OsString> {
+    HELPER_ARGUMENTS
+        .iter()
+        .chain(mode_arguments)
+        .map(OsString::from)
+        .collect()
+}
+
+/// Returns the test-binary probe at `program`.
+fn helper_probe(program: &Path) -> ProbeProgram {
+    ProbeProgram::test_helper(
+        program.to_path_buf(),
+        helper_arguments(&[]),
+        helper_environment("connect"),
+        SENTINEL,
+    )
+}
+
+/// Stages a private single-link copy of the test binary into `tools` and
+/// returns its probe.
+fn staged_probe(tools: &Path) -> ProbeProgram {
+    helper_probe(&test_binary())
+        .staged(tools)
+        .expect("should stage the helper binary")
+}
+
+/// Builds a confined helper command running `mode` from `working_directory`.
+fn helper_command(
+    program: &Path,
+    working_directory: &Path,
+    mode: &str,
+    mode_arguments: &[&str],
+) -> ConfinedCommand {
+    let mut command = ConfinedCommand::new(program, working_directory, limits())
+        .expect("should describe helper command")
+        .arguments(helper_arguments(mode_arguments));
+    for (name, value) in helper_environment(mode) {
+        command = command
+            .environment(name, value)
+            .expect("should accept helper environment");
+    }
+    command
+}
+
+/// Returns the helper's report text after the sentinel.
+fn helper_report(stdout: &[u8]) -> String {
+    let start = stdout
+        .windows(SENTINEL.len())
+        .rposition(|window| window == SENTINEL)
+        .expect("should find helper sentinel in stdout");
+    String::from_utf8_lossy(&stdout[start + SENTINEL.len()..])
+        .trim_end()
+        .to_owned()
+}
+
+/// Spawns a same-user sibling that lives until killed or its parent pipe closes.
+fn spawn_sibling() -> std::process::Child {
+    let mut command = StdCommand::new(test_binary());
+    command
+        .args(helper_arguments(&[]))
+        .env_clear()
+        .stdin(std::process::Stdio::piped())
+        .stdout(std::process::Stdio::null());
+    for (name, value) in helper_environment("wait-for-eof") {
+        command.env(name, value);
+    }
+    command.spawn().expect("should spawn sibling")
+}
+
+/// Returns whether `pid` still exists (zombies count until reaped).
+fn process_exists(pid: libc::pid_t) -> bool {
+    // SAFETY: signal 0 only checks existence; callers pass a pid > 1.
+    unsafe { libc::kill(pid, 0) == 0 }
+}
+
+/// Waits up to five seconds for `pid` to disappear.
+fn wait_gone(pid: libc::pid_t) -> bool {
+    let deadline = Instant::now() + Duration::from_secs(5);
+    while Instant::now() < deadline {
+        if !process_exists(pid) {
+            return true;
+        }
+        std::thread::sleep(Duration::from_millis(20));
+    }
+    false
+}
+
+/// Reads a pid recorded by a helper.
+fn read_pid(path: &Path) -> libc::pid_t {
+    let pid: libc::pid_t = std::fs::read_to_string(path)
+        .expect("should read recorded pid")
+        .trim()
+        .parse()
+        .expect("should parse recorded pid");
+    assert!(pid > 1, "should record a real pid");
+    pid
+}
+
+/// Returns the helper mode when the selector, nonce and argv all match a
+/// fixture-launched helper run.
+fn authorized_mode(selector: &str, nonce: Option<&str>, arguments: &[String]) -> Option<String> {
+    let (mode, selector_nonce) = selector.rsplit_once(':')?;
+    let exact = arguments.iter().any(|argument| argument == "--exact");
+    let filtered = arguments.iter().any(|argument| argument == HELPER_TEST);
+    let matched = nonce.is_some_and(|nonce| !nonce.is_empty() && nonce == selector_nonce);
+    (exact && filtered && matched).then(|| mode.to_owned())
+}
+
+/// Hidden re-exec entry point; returns immediately in normal test runs.
+///
+/// A selector present without the fixture's exact filter and nonce fails the
+/// run rather than silently acting or passing.
+#[test]
+fn helper_entry() {
+    let Some(selector) = std::env::var_os(HELPER_SELECTOR) else {
+        return;
+    };
+    let nonce = std::env::var(HELPER_NONCE).ok();
+    let arguments: Vec<String> = std::env::args().collect();
+    let mode = authorized_mode(&selector.to_string_lossy(), nonce.as_deref(), &arguments);
+    assert!(
+        mode.is_some(),
+        "should run helper mode only from a fixture-launched exact helper invocation"
+    );
+    let rest: Vec<String> = arguments
+        .iter()
+        .skip_while(|argument| argument.as_str() != "--test-threads=1")
+        .skip(1)
+        .cloned()
+        .collect();
+    let code = mode.map_or(HELPER_SETUP_FAILED, |mode| modes::run(&mode, &rest));
+    // SAFETY: `_exit` ends the helper without returning to the harness, so no
+    // harness summary is appended to the captured output.
+    unsafe { libc::_exit(code) }
+}
+
+#[test]
+fn helper_requires_exact_filter_and_matching_nonce() {
+    let exact: Vec<String> = ["binary", "--exact", HELPER_TEST]
+        .iter()
+        .map(|part| (*part).to_owned())
+        .collect();
+    assert_eq!(
+        authorized_mode("connect:abc", Some("abc"), &exact),
+        Some(String::from("connect")),
+        "should authorize a fixture-launched helper"
+    );
+    assert_eq!(authorized_mode("connect:abc", Some("xyz"), &exact), None);
+    assert_eq!(authorized_mode("connect:abc", None, &exact), None);
+    assert_eq!(authorized_mode("connect:", Some(""), &exact), None);
+    assert_eq!(
+        authorized_mode("connect:abc", Some("abc"), &exact[..2]),
+        None
+    );
+}
diff --git a/crates/trusted-server-release/src/boundary/tests/container.rs b/crates/trusted-server-release/src/boundary/tests/container.rs
new file mode 100644
index 0000000000..9a35fc826c
--- /dev/null
+++ b/crates/trusted-server-release/src/boundary/tests/container.rs
@@ -0,0 +1,727 @@
+//! Platform-independent seccomp, Docker argv, daemon-socket and host-input
+//! tests on real files.
+
+use std::ffi::CString;
+use std::fs::{self, File};
+use std::os::unix::ffi::OsStrExt as _;
+use std::os::unix::fs::{OpenOptionsExt as _, PermissionsExt as _, symlink};
+use std::os::unix::net::UnixListener;
+use std::sync::mpsc;
+use std::thread;
+use std::time::Duration;
+
+use serde_json::Value;
+use tempfile::TempDir;
+
+use super::super::daemon::check_daemon_socket;
+use super::super::daemon::{ContainerId, DockerClient};
+use super::super::docker::{
+    DockerSettings, RunPlan, cleanup_target, complete_created, container_path, create_arguments,
+    mounts, start_arguments, validate_image_id,
+};
+use super::super::host_inputs::HostInputs;
+use super::super::seccomp;
+use super::unit::{canonical_tempdir, sample_roots};
+use super::*;
+
+#[test]
+fn effective_seccomp_denies_inet_sockets_and_preserves_baseline() {
+    let baseline = seccomp::baseline().expect("should match reviewed digest");
+    let original: Value = serde_json::from_slice(baseline).expect("should parse baseline");
+    let effective: Value =
+        serde_json::from_slice(&seccomp::effective(baseline).expect("should derive profile"))
+            .expect("should parse effective profile");
+    for key in ["defaultAction", "defaultErrnoRet"] {
+        assert_eq!(
+            original.get(key),
+            effective.get(key),
+            "should preserve {key}"
+        );
+    }
+    let rules = effective["syscalls"]
+        .as_array()
+        .expect("should have syscalls");
+    let socket_rules: Vec<&Value> = rules
+        .iter()
+        .filter(|rule| {
+            rule["names"].as_array().is_some_and(|names| {
+                names.iter().any(|name| {
+                    matches!(name.as_str(), Some("socket" | "socketpair" | "socketcall"))
+                })
+            })
+        })
+        .collect();
+    assert_eq!(socket_rules.len(), 1, "should keep exactly one socket rule");
+    assert_eq!(
+        socket_rules[0]["args"],
+        serde_json::json!([{"index": 0, "value": 1, "op": "SCMP_CMP_EQ"}]),
+        "should allow only AF_UNIX"
+    );
+    let original_rules = original["syscalls"]
+        .as_array()
+        .expect("should have syscalls");
+    assert_eq!(
+        rules.len(),
+        original_rules.len() - 5 + 1,
+        "should drop three socket-only and two process-memory rules, then add the Unix socket rule"
+    );
+    let mut allowing = original.clone();
+    allowing["defaultAction"] = Value::from("SCMP_ACT_ALLOW");
+    let bytes = serde_json::to_vec(&allowing).expect("should serialize");
+    assert!(
+        seccomp::effective(&bytes).is_err(),
+        "should reject a permissive baseline"
+    );
+}
+
+fn docker_settings(client: &Path) -> DockerSettings {
+    DockerSettings {
+        client: client.to_path_buf(),
+        cpus: 1,
+        memory_bytes: 256 * 1024 * 1024,
+        pids_limit: 128,
+        tmpfs_bytes: 16 * 1024 * 1024,
+        user: (1001, 1001),
+        stop_timeout_seconds: 5,
+        host_limits: limits(),
+    }
+}
+
+#[test]
+fn docker_create_arguments_are_exact() {
+    let (_directory, base) = canonical_tempdir();
+    let roots = sample_roots(&base);
+    let mounts = mounts(&roots).expect("should build mounts");
+    let image = format!("sha256:{}", "b".repeat(64));
+    let environment = [(
+        OsString::from("HOME"),
+        OsString::from("/boundary/writable/0"),
+    )];
+    let arguments = [OsString::from("--flag")];
+    let mut plan = RunPlan {
+        config: Path::new("/host/config"),
+        seccomp: Path::new("/host/seccomp.json"),
+        name: "ts-release-boundary-fixture",
+        image: &image,
+        mounts: &mounts,
+        environment: &environment,
+        working_directory: Path::new("/boundary/writable/0"),
+        program: Path::new("/boundary/tool/0"),
+        arguments: &arguments,
+        interactive: false,
+        umask: None,
+    };
+    let actual: Vec<String> =
+        create_arguments(&docker_settings(Path::new("/usr/bin/docker")), &plan)
+            .iter()
+            .map(|part| part.to_string_lossy().into_owned())
+            .collect();
+    let root = base.to_str().expect("should be UTF-8");
+    assert_eq!(
+        actual,
+        expected_create_arguments(root, &image),
+        "should build the exact fixed argv"
+    );
+    assert!(
+        !actual.iter().any(|part| part == "--pid"
+            || part.starts_with("--pid=")
+            || part == "-t"
+            || part == "--tty"),
+        "should never pass --pid or a TTY"
+    );
+    plan.interactive = true;
+    let interactive = create_arguments(&docker_settings(Path::new("/usr/bin/docker")), &plan);
+    assert!(
+        interactive.contains(&OsString::from("--interactive")),
+        "should keep created stdin open for later attached input"
+    );
+    assert!(
+        !interactive.contains(&OsString::from("--rm")),
+        "should retain the acknowledged container until explicit cleanup"
+    );
+}
+
+/// The exact argv expected for the fixture plan rooted at `root`.
+/// Fixed argv prefix expected before the mounts.
+const EXPECTED_PREFIX: [&str; 32] = [
+    "--config",
+    "/host/config",
+    "--host",
+    "unix:///var/run/docker.sock",
+    "create",
+    "--name",
+    "ts-release-boundary-fixture",
+    "--init",
+    "--pull",
+    "never",
+    "--network",
+    "none",
+    "--ipc",
+    "none",
+    "--read-only",
+    "--cap-drop",
+    "ALL",
+    "--security-opt",
+    "no-new-privileges=true",
+    "--security-opt",
+    "seccomp=/host/seccomp.json",
+    "--pids-limit",
+    "128",
+    "--cpus",
+    "1",
+    "--memory",
+    "268435456b",
+    "--user",
+    "1001:1001",
+    "--tmpfs",
+    "/tmp:ro,noexec,nosuid,nodev,size=16777216",
+    "--mount",
+];
+
+fn expected_create_arguments(root: &str, image: &str) -> Vec<String> {
+    EXPECTED_PREFIX
+    .iter()
+    .map(|part| (*part).to_owned())
+    .chain([
+        format!("type=bind,source={root}/immutable,target=/boundary/immutable/0,readonly,bind-propagation=rprivate,bind-recursive=readonly"),
+        String::from("--mount"),
+        format!("type=bind,source={root}/tool,target=/boundary/tool/0,readonly,bind-propagation=rprivate,bind-recursive=readonly"),
+        String::from("--mount"),
+        format!("type=bind,source={root}/writable,target=/boundary/writable/0"),
+    ])
+    .chain(
+        [
+            "--env",
+            "HOME=/boundary/writable/0",
+            "--workdir",
+            "/boundary/writable/0",
+            image,
+            "/boundary/tool/0",
+            "--flag",
+        ]
+        .iter()
+        .map(|part| (*part).to_owned()),
+    )
+    .collect()
+}
+
+#[test]
+fn docker_paths_translate_and_reject_mount_metacharacters() {
+    let (_directory, base) = canonical_tempdir();
+    let roots = sample_roots(&base);
+    assert_eq!(
+        container_path(&roots, &base.join("writable/out/x")).expect("should translate"),
+        PathBuf::from("/boundary/writable/0/out/x"),
+        "should map into the writable mount"
+    );
+    assert!(
+        container_path(&roots, Path::new("/elsewhere")).is_err(),
+        "should reject paths outside every root"
+    );
+    let comma = base.join("with,comma");
+    fs::create_dir(&comma).expect("should create directory");
+    let roots = BoundaryRoots::new(&[], &[], &[comma]).expect("should accept roots");
+    assert!(
+        mounts(&roots).is_err(),
+        "should reject ',' in mount sources"
+    );
+}
+
+#[test]
+fn docker_settings_fit_host_capacity() {
+    let client = Path::new("/usr/bin/docker");
+    assert!(
+        docker_settings(client).validate().is_ok(),
+        "should accept modest limits"
+    );
+    let parallelism = std::thread::available_parallelism().expect("should read parallelism");
+    let mut settings = docker_settings(client);
+    settings.cpus = u32::try_from(parallelism.get()).expect("should fit") + 1;
+    assert!(
+        settings.validate().is_err(),
+        "should reject CPUs above host capacity"
+    );
+    for mutate in [
+        (|settings: &mut DockerSettings| settings.cpus = 0) as fn(&mut DockerSettings),
+        |settings| settings.memory_bytes = u64::MAX,
+        |settings| settings.user = (0, 0),
+        |settings| settings.stop_timeout_seconds = 0,
+        |settings| settings.stop_timeout_seconds = 3600,
+    ] {
+        let mut settings = docker_settings(client);
+        mutate(&mut settings);
+        assert!(settings.validate().is_err(), "should reject {settings:?}");
+    }
+}
+
+#[test]
+fn image_must_be_pinned_by_content_id() {
+    assert!(validate_image_id(&format!("sha256:{}", "c".repeat(64))).is_ok());
+    for rejected in [
+        "ubuntu:24.04",
+        "sha256:abc",
+        &format!("sha256:{}", "C".repeat(64)),
+    ] {
+        assert!(
+            validate_image_id(rejected).is_err(),
+            "should reject {rejected}"
+        );
+    }
+}
+
+fn host_inputs_fixture() -> (TempDir, PathBuf, HostInputs) {
+    let (directory, base) = canonical_tempdir();
+    let client = base.join("docker-client");
+    fs::write(&client, b"fictional client").expect("should write client");
+    let state = base.join("state");
+    fs::create_dir(&state).expect("should create state parent");
+    let inputs = HostInputs::create(&state, &client, &[]).expect("should create inputs");
+    (directory, client, inputs)
+}
+
+fn make_writable(path: &Path, mode: u32) {
+    fs::set_permissions(path, fs::Permissions::from_mode(mode)).expect("should chmod");
+}
+
+#[test]
+fn host_inputs_rehash_detects_tampering_between_commands() {
+    let (_directory, _client, inputs) = host_inputs_fixture();
+    inputs.verify().expect("should verify fresh inputs");
+    let effective = inputs.effective_profile().to_path_buf();
+    make_writable(&effective, 0o644);
+    fs::write(&effective, b"{}").expect("should tamper profile");
+    assert!(
+        inputs.verify().is_err(),
+        "should detect a changed effective profile"
+    );
+
+    let (_directory, _client, inputs) = host_inputs_fixture();
+    let baseline = inputs.directory().join("seccomp-baseline.json");
+    make_writable(&baseline, 0o644);
+    fs::write(&baseline, b"{}").expect("should tamper baseline");
+    assert!(
+        inputs.verify().is_err(),
+        "should detect a changed baseline profile"
+    );
+
+    let (_directory, _client, inputs) = host_inputs_fixture();
+    make_writable(inputs.config(), 0o700);
+    fs::write(inputs.config().join("config.json"), b"{}").expect("should add config");
+    assert!(inputs.verify().is_err(), "should detect a non-empty config");
+
+    let (_directory, client, inputs) = host_inputs_fixture();
+    fs::write(&client, b"substituted client").expect("should replace client");
+    assert!(inputs.verify().is_err(), "should detect a changed client");
+
+    let (_directory, _client, inputs) = host_inputs_fixture();
+    fs::write(inputs.directory().join("extra"), b"x").expect("should add entry");
+    assert!(inputs.verify().is_err(), "should detect an added entry");
+}
+
+#[test]
+fn host_inputs_must_be_disjoint_from_mounted_roots() {
+    let (_directory, base) = canonical_tempdir();
+    let client = base.join("docker-client");
+    fs::write(&client, b"fictional client").expect("should write client");
+    let mounted = base.join("mounted");
+    fs::create_dir_all(mounted.join("inner")).expect("should create mount");
+    for parent in [base.clone(), mounted.clone(), mounted.join("inner")] {
+        assert!(
+            HostInputs::create(&parent, &client, &[&mounted]).is_err(),
+            "should reject state parent {parent:?} overlapping a mount"
+        );
+    }
+    let alias = base.join("client-alias");
+    symlink(&client, &alias).expect("should create client alias");
+    let state = base.join("state");
+    fs::create_dir(&state).expect("should create state");
+    assert!(
+        HostInputs::create(&state, &alias, &[&mounted]).is_err(),
+        "should reject an aliased client path"
+    );
+}
+
+#[test]
+fn docker_client_must_be_outside_every_mounted_root() {
+    let (_directory, base) = canonical_tempdir();
+    let roots = sample_roots(&base);
+    let state = base.join("state");
+    fs::create_dir(&state).expect("should create state directory");
+    let mounted: Vec<&Path> = roots.entries().map(|(_, _, path)| path).collect();
+    for root in &mounted {
+        let client = if root.is_dir() {
+            root.join("docker-client")
+        } else {
+            root.to_path_buf()
+        };
+        fs::write(&client, b"fictional client").expect("should create fixture client");
+        assert!(
+            HostInputs::create(&state, &client, &mounted).is_err(),
+            "should reject a host executable exposed through a mounted root"
+        );
+    }
+}
+
+#[test]
+fn host_input_fifo_is_rejected_without_waiting_for_a_writer() {
+    let (_directory, base) = canonical_tempdir();
+    let client = base.join("docker-client");
+    let state = base.join("state");
+    fs::create_dir(&state).expect("should create state directory");
+    let name = CString::new(client.as_os_str().as_bytes()).expect("should encode FIFO path");
+    // SAFETY: The path is NUL-terminated and remains valid during mkfifo.
+    assert_eq!(
+        unsafe { libc::mkfifo(name.as_ptr(), 0o600) },
+        0,
+        "should create FIFO"
+    );
+    let (sender, receiver) = mpsc::channel();
+    let reader_path = client.clone();
+    let reader = thread::spawn(move || {
+        let rejected = HostInputs::create(&state, &reader_path, &[]).is_err();
+        let _ = sender.send(rejected);
+    });
+    let result = receiver.recv_timeout(Duration::from_millis(200));
+    // Release a regressed blocking open before joining, so failure cannot hang CI.
+    let _keeper = File::options()
+        .read(true)
+        .write(true)
+        .custom_flags(libc::O_NONBLOCK)
+        .open(&client)
+        .expect("should open nonblocking FIFO cleanup handle");
+    reader.join().expect("should reap input reader");
+    assert_eq!(result, Ok(true), "should reject FIFO without a writer");
+}
+
+#[test]
+fn cleanup_never_retries_through_changed_host_inputs() {
+    let (_directory, base) = canonical_tempdir();
+    let client_path = base.join("docker-client");
+    fs::write(&client_path, b"fictional client").expect("should create fixture client");
+    let client =
+        DockerClient::new(&client_path, &base, &[], limits()).expect("should create pinned client");
+    fs::write(&client_path, b"substituted client").expect("should replace fixture client");
+    let mut failures = Vec::new();
+    assert!(
+        client.cleanup_host(&["version"], &mut failures).is_none(),
+        "should reject cleanup after integrity failure"
+    );
+    assert_eq!(
+        failures.len(),
+        1,
+        "should stop at integrity failure before endpoint inspection or execution"
+    );
+}
+
+#[cfg(not(target_os = "linux"))]
+#[test]
+fn container_boundary_is_refused_off_linux() {
+    let (_directory, base) = canonical_tempdir();
+    let roots = sample_roots(&base);
+    let settings = docker_settings(Path::new("/usr/bin/docker"));
+    let image = super::super::docker::ImageSelection::Test {
+        id: format!("sha256:{}", "a".repeat(64)),
+    };
+    assert!(
+        Boundary::linux_container(roots, settings, image, &base).is_err(),
+        "should refuse the container boundary off Linux"
+    );
+}
+
+#[test]
+fn daemon_socket_rejects_user_owned_aliased_and_shared_paths() {
+    let (_directory, base) = canonical_tempdir();
+    let socket = base.join("d.sock");
+    let _listener = UnixListener::bind(&socket).expect("should bind fixture socket");
+    let error = check_daemon_socket(&socket).expect_err("should reject a user-owned path");
+    assert!(
+        format!("{error:?}").contains("root-owned"),
+        "should explain ownership"
+    );
+    let alias = base.join("alias.sock");
+    symlink(&socket, &alias).expect("should alias socket");
+    assert!(
+        check_daemon_socket(&alias).is_err(),
+        "should reject an alias"
+    );
+    assert!(
+        check_daemon_socket(&base.join("missing.sock")).is_err(),
+        "should reject a missing socket"
+    );
+    if cfg!(target_os = "macos") {
+        // Root-owned socket under the root-owned but group-writable
+        // /private/var/run: rejected for its shared-writable ancestor.
+        assert!(
+            check_daemon_socket(Path::new("/var/run/mDNSResponder")).is_err(),
+            "should reject a socket under a group-writable directory"
+        );
+    }
+}
+
+#[test]
+fn effective_seccomp_admits_only_native_architectures() {
+    let baseline = seccomp::baseline().expect("should match reviewed digest");
+    let original: Value = serde_json::from_slice(baseline).expect("should parse baseline");
+    let effective: Value =
+        serde_json::from_slice(&seccomp::effective(baseline).expect("should derive profile"))
+            .expect("should parse effective profile");
+    let native = |profile: &Value| -> Vec<Value> {
+        profile["archMap"]
+            .as_array()
+            .expect("should have archMap")
+            .iter()
+            .map(|entry| entry["architecture"].clone())
+            .collect()
+    };
+    assert_eq!(
+        native(&original),
+        native(&effective),
+        "should keep native ABIs"
+    );
+    for entry in effective["archMap"]
+        .as_array()
+        .expect("should have archMap")
+    {
+        assert_eq!(
+            entry["subArchitectures"],
+            serde_json::json!([]),
+            "should admit no non-native ABI (x86/x32 socketcall)"
+        );
+    }
+}
+
+#[test]
+fn effective_seccomp_has_no_process_memory_or_descriptor_transfer_allowance() {
+    let effective: Value = serde_json::from_slice(
+        &seccomp::effective(seccomp::baseline().expect("should authenticate baseline"))
+            .expect("should derive effective profile"),
+    )
+    .expect("should parse profile");
+    for rule in effective["syscalls"].as_array().expect("should list rules") {
+        for name in rule["names"].as_array().expect("should list syscall names") {
+            assert!(
+                ![
+                    "ptrace",
+                    "process_vm_readv",
+                    "process_vm_writev",
+                    "pidfd_getfd",
+                    "kcmp",
+                    "process_madvise"
+                ]
+                .contains(&name.as_str().expect("should have syscall name")),
+                "should remove process-memory and descriptor access from every allowance"
+            );
+        }
+    }
+}
+
+/// Returns the argv tail after the image for a fixture plan.
+fn argv_after_image(umask: Option<Umask>, program: &str, arguments: &[&str]) -> Vec<String> {
+    let (_directory, base) = canonical_tempdir();
+    let roots = sample_roots(&base);
+    let mounts = mounts(&roots).expect("should build mounts");
+    let image = format!("sha256:{}", "b".repeat(64));
+    let arguments: Vec<OsString> = arguments.iter().map(OsString::from).collect();
+    let plan = RunPlan {
+        config: Path::new("/host/config"),
+        seccomp: Path::new("/host/seccomp.json"),
+        name: "ts-release-boundary-fixture",
+        image: &image,
+        mounts: &mounts,
+        environment: &[],
+        working_directory: Path::new("/boundary/writable/0"),
+        program: Path::new(program),
+        arguments: &arguments,
+        interactive: false,
+        umask,
+    };
+    let argv: Vec<String> = create_arguments(&docker_settings(Path::new("/usr/bin/docker")), &plan)
+        .iter()
+        .map(|part| part.to_string_lossy().into_owned())
+        .collect();
+    let position = argv
+        .iter()
+        .position(|part| *part == image)
+        .expect("should place the image in argv");
+    argv[position + 1..].to_vec()
+}
+
+#[test]
+fn umask_validation_accepts_only_permission_bits() {
+    for valid in [0, 0o022, 0o027, 0o777] {
+        assert_eq!(
+            Umask::new(valid)
+                .expect("should accept a permission mask")
+                .mask(),
+            valid,
+            "should round-trip {valid:#o}"
+        );
+    }
+    for invalid in [0o1000, 0o4777, 0x1_0000, u32::MAX] {
+        assert!(
+            Umask::new(invalid).is_err(),
+            "should reject {invalid:#o} outside 0..=0o777"
+        );
+    }
+}
+
+#[test]
+fn umask_displays_as_three_octal_digits() {
+    let rendered: Vec<String> = [0, 0o7, 0o022, 0o027, 0o777]
+        .into_iter()
+        .map(|mask| Umask::new(mask).expect("should accept mask").to_string())
+        .collect();
+    assert_eq!(
+        rendered,
+        ["000", "007", "022", "027", "777"],
+        "should render zero-padded three-digit octal"
+    );
+}
+
+#[test]
+fn docker_argv_without_umask_runs_the_program_directly() {
+    assert_eq!(
+        argv_after_image(None, "/boundary/tool/0", &["--flag"]),
+        ["/boundary/tool/0", "--flag"],
+        "should not involve a shell without a umask"
+    );
+}
+
+#[test]
+fn docker_argv_with_umask_uses_the_fixed_shell_idiom() {
+    let umask = Umask::new(0o027).expect("should accept mask");
+    assert_eq!(
+        argv_after_image(Some(umask), "/boundary/tool/0", &["--flag", "value"]),
+        [
+            "/bin/sh",
+            "-c",
+            "umask 027 && exec \"$@\"",
+            "sh",
+            "/boundary/tool/0",
+            "--flag",
+            "value"
+        ],
+        "should wrap the program in the fixed umask script with positional arguments"
+    );
+}
+
+#[test]
+fn docker_argv_keeps_shell_metacharacters_positional() {
+    let umask = Umask::new(0o022).expect("should accept mask");
+    let hostile = [
+        "$(touch /boundary/writable/0/pwned)",
+        "`id`",
+        "a; rm -rf /",
+        "'quoted' \"double\" && || | > <",
+        "-c",
+        "$@",
+        "",
+    ];
+    let tail = argv_after_image(Some(umask), "/boundary/tool/0;$(id)", &hostile);
+    assert_eq!(
+        tail[..4],
+        ["/bin/sh", "-c", "umask 022 && exec \"$@\"", "sh"],
+        "should keep the script fixed whatever the program and arguments are"
+    );
+    assert_eq!(
+        tail[4], "/boundary/tool/0;$(id)",
+        "should pass the program as one positional word"
+    );
+    assert_eq!(
+        tail[5..],
+        hostile,
+        "should pass every hostile argument verbatim as its own word"
+    );
+}
+
+#[test]
+fn start_attaches_only_to_the_confirmed_full_container_id() {
+    let id = ContainerId::parse("a".repeat(64).as_bytes()).expect("should accept full ID");
+    for interactive in [false, true] {
+        let actual = start_arguments(Path::new("/host/config"), &id, interactive);
+        let mut expected: Vec<OsString> = [
+            "--config",
+            "/host/config",
+            "--host",
+            "unix:///var/run/docker.sock",
+            "start",
+            "--attach",
+        ]
+        .into_iter()
+        .map(OsString::from)
+        .collect();
+        if interactive {
+            expected.push(OsString::from("--interactive"));
+        }
+        expected.push(OsString::from(id.as_str()));
+        assert_eq!(
+            actual, expected,
+            "should attach by exact ID and preserve requested stdin"
+        );
+    }
+}
+
+#[test]
+fn unresolved_create_never_starts_even_when_name_cleanup_observes_absence() {
+    let mut cleanup_attempted = false;
+    let result = complete_created::<()>(
+        Err(boundary_error("unresolved creation")),
+        |_| panic!("should never start an unacknowledged container"),
+        |id| {
+            assert!(id.is_none(), "should clean up only the unresolved name");
+            cleanup_attempted = true;
+            Ok(())
+        },
+    );
+    assert!(
+        cleanup_attempted,
+        "should attempt cleanup after failed creation"
+    );
+    assert!(
+        result.is_err(),
+        "should retain unresolved creation despite current absence"
+    );
+}
+
+#[test]
+fn acknowledged_start_failure_cleans_up_the_same_id() {
+    let id = ContainerId::parse("b".repeat(64).as_bytes()).expect("should accept full ID");
+    let expected = id.as_str().to_owned();
+    let mut cleanup_attempted = false;
+    let result = complete_created::<()>(
+        Ok(id),
+        |id| {
+            assert_eq!(id.as_str(), expected, "should start the acknowledged ID");
+            Err(boundary_error("attached start failed"))
+        },
+        |id| {
+            assert_eq!(
+                id.expect("should clean a confirmed ID").as_str(),
+                expected,
+                "should remove the exact acknowledged ID"
+            );
+            cleanup_attempted = true;
+            Ok(())
+        },
+    );
+    assert!(
+        cleanup_attempted,
+        "should attempt cleanup after start failure"
+    );
+    assert!(result.is_err(), "should retain attached start failure");
+}
+
+#[test]
+fn confirmed_cleanup_filters_by_id_and_unresolved_cleanup_filters_by_name() {
+    let id = ContainerId::parse("c".repeat(64).as_bytes()).expect("should accept full ID");
+    assert_eq!(
+        cleanup_target("fixture-name", Some(&id)),
+        (id.as_str(), format!("id={}", id.as_str())),
+        "should never mistake an ID for a container name in absence confirmation"
+    );
+    assert_eq!(
+        cleanup_target("fixture-name", None),
+        ("fixture-name", "name=^/fixture-name$".to_owned()),
+        "should restrict unresolved best-effort cleanup to the owned name"
+    );
+}
diff --git a/crates/trusted-server-release/src/boundary/tests/linux.rs b/crates/trusted-server-release/src/boundary/tests/linux.rs
new file mode 100644
index 0000000000..d846a42e9a
--- /dev/null
+++ b/crates/trusted-server-release/src/boundary/tests/linux.rs
@@ -0,0 +1,377 @@
+//! Real Docker container boundary tests (Linux only).
+//!
+//! On Linux these REQUIRE a reachable Docker daemon at the fixed socket and
+//! fail otherwise; they never skip. The image comes from
+//! `TS_RELEASE_TEST_IMAGE` (default `ubuntu:24.04`, whose glibc matches the
+//! `ubuntu-24.04` runner that builds this test binary). A missing image is
+//! pulled once under a bounded deadline; a failed pull fails the test.
+//!
+//! What the confined probe shows: a staged copy of the test binary,
+//! bind-mounted read-only, attempts a TCP connect to `127.0.0.1:<port>`
+//! inside the container. Under `--network none` that is the container's own
+//! loopback, so without the effective seccomp profile the result would be
+//! `ECONNREFUSED`; the proof requires `EPERM`, which only the seccomp socket
+//! denial produces. It shows nothing about routes to other hosts.
+
+use std::fs;
+use std::os::unix::fs::symlink;
+
+use tempfile::{TempDir, tempdir};
+
+use super::super::daemon::DockerClient;
+use super::super::docker::{DockerSettings, ImageSelection, container_path};
+use super::super::probe::LoopbackListener;
+use super::*;
+use crate::process::{ProcessOutcome, ProcessResult};
+
+/// The fixed Docker client on GitHub-hosted Ubuntu runners.
+const DOCKER_CLIENT: &str = "/usr/bin/docker";
+const TEST_IMAGE_VARIABLE: &str = "TS_RELEASE_TEST_IMAGE";
+const DEFAULT_TEST_IMAGE: &str = "ubuntu:24.04";
+/// `EROFS`: a write into a read-only bind mount.
+const READ_ONLY_FILESYSTEM: &str = "denied errno=30";
+/// `ESRCH`: the host pid does not exist in the container's PID namespace.
+const NO_SUCH_PROCESS: &str = "denied errno=3";
+
+fn host_limits() -> ProcessLimits {
+    ProcessLimits {
+        wall: Duration::from_secs(300),
+        stdout_max: 1024 * 1024,
+        stderr_max: 1024 * 1024,
+    }
+}
+
+fn settings() -> DockerSettings {
+    // SAFETY: `getuid`/`getgid` have no preconditions.
+    let user = unsafe { (libc::getuid(), libc::getgid()) };
+    DockerSettings {
+        client: PathBuf::from(DOCKER_CLIENT),
+        cpus: 1,
+        memory_bytes: 256 * 1024 * 1024,
+        pids_limit: 128,
+        tmpfs_bytes: 16 * 1024 * 1024,
+        user,
+        stop_timeout_seconds: 5,
+        host_limits: host_limits(),
+    }
+}
+
+fn succeeded(result: &ProcessResult) -> bool {
+    result.outcome() == (ProcessOutcome::Exited { code: 0 })
+}
+
+/// Resolves the test image to its local content ID, pulling it if absent.
+fn test_image(client: &DockerClient) -> ImageSelection {
+    let reference =
+        std::env::var(TEST_IMAGE_VARIABLE).unwrap_or_else(|_| String::from(DEFAULT_TEST_IMAGE));
+    let inspect = [
+        "image",
+        "inspect",
+        "--format",
+        "{{.Id}}",
+        reference.as_str(),
+    ];
+    let mut result = client
+        .host(&inspect)
+        .expect("should run docker image inspect");
+    if !succeeded(&result) {
+        let pull = client
+            .host(&["pull", reference.as_str()])
+            .expect("should run docker pull");
+        assert!(
+            succeeded(&pull),
+            "should pull test image {reference}: {pull:?}"
+        );
+        result = client
+            .host(&inspect)
+            .expect("should rerun docker image inspect");
+    }
+    assert!(succeeded(&result), "should inspect test image {reference}");
+    let id = String::from_utf8_lossy(result.stdout()).trim().to_owned();
+    ImageSelection::Test { id }
+}
+
+struct Fixture {
+    _roots: TempDir,
+    _state: TempDir,
+    immutable: PathBuf,
+    tools: PathBuf,
+    writable: PathBuf,
+    probe: ProbeProgram,
+    boundary: Boundary,
+}
+
+/// Creates fixture roots under `base` and returns them.
+fn create_roots(base: &Path) -> (PathBuf, PathBuf, PathBuf) {
+    let immutable = base.join("immutable");
+    let tools = base.join("tools");
+    let writable = base.join("writable");
+    fs::create_dir_all(immutable.join("src")).expect("should create immutable root");
+    fs::create_dir(&tools).expect("should create tool root");
+    fs::create_dir(&writable).expect("should create writable root");
+    fs::write(immutable.join("src/a.txt"), b"original").expect("should write source");
+    (immutable, tools, writable)
+}
+
+/// Requires the daemon and resolves the test image.
+fn reachable_image(state: &Path) -> ImageSelection {
+    let client = DockerClient::new(Path::new(DOCKER_CLIENT), state, &[], host_limits())
+        .expect("should pin docker client inputs");
+    let version = client
+        .host(&["version", "--format", "{{.Server.Version}}"])
+        .expect("should run docker version");
+    assert!(
+        succeeded(&version),
+        "should reach the Docker daemon at the fixed socket: {version:?}"
+    );
+    test_image(&client)
+}
+
+impl Fixture {
+    fn new() -> Self {
+        let roots_directory = tempdir().expect("should create roots directory");
+        let state = tempdir().expect("should create state directory");
+        let base = fs::canonicalize(roots_directory.path()).expect("should canonicalize");
+        let (immutable, tools, writable) = create_roots(&base);
+        let probe = staged_probe(&tools);
+        let roots = BoundaryRoots::new(
+            std::slice::from_ref(&immutable),
+            std::slice::from_ref(&tools),
+            std::slice::from_ref(&writable),
+        )
+        .expect("should accept roots");
+        let image = reachable_image(state.path());
+        let boundary = Boundary::linux_container(roots, settings(), image, state.path())
+            .expect("should configure container boundary");
+        Self {
+            _roots: roots_directory,
+            _state: state,
+            immutable,
+            tools,
+            writable,
+            probe,
+            boundary,
+        }
+    }
+
+    fn prove(&self) -> DenialProof {
+        self.boundary
+            .establish_denial(&self.probe, limits())
+            .expect("should prove denial with a real control and denied container probe")
+    }
+
+    fn container(&self, host: &Path) -> String {
+        container_path(&self.boundary.roots, host)
+            .expect("should translate path")
+            .to_string_lossy()
+            .into_owned()
+    }
+
+    fn command(&self, mode: &str, arguments: &[&str]) -> ConfinedCommand {
+        helper_command(self.probe.program(), &self.writable, mode, arguments)
+    }
+
+    fn run(&self, proof: &DenialProof, mode: &str, arguments: &[&str]) -> String {
+        let result = self
+            .boundary
+            .run_confined(&self.command(mode, arguments), proof)
+            .expect("should run confined helper");
+        helper_report(result.stdout())
+    }
+}
+
+#[test]
+fn container_denies_process_memory_access() {
+    assert_eq!(
+        super::modes::process_memory_read(),
+        0,
+        "should permit the real self-memory operation outside confinement"
+    );
+    let fixture = Fixture::new();
+    let proof = fixture.prove();
+    assert_eq!(
+        fixture.run(&proof, "process-memory-read", &[]),
+        "denied errno=1",
+        "should deny the same process-memory syscall with real seccomp EPERM"
+    );
+}
+
+#[test]
+fn container_denial_proof_and_confined_execution() {
+    let fixture = Fixture::new();
+    let proof = fixture.prove();
+    assert_eq!(
+        proof.denied_errno(),
+        libc::EPERM,
+        "should observe seccomp EPERM"
+    );
+
+    let listener = LoopbackListener::bind().expect("should bind listener");
+    let address = listener.address().to_string();
+    let marker = fixture.container(&fixture.writable);
+    let report = fixture.run(&proof, "nest", &["2", &address, &marker]);
+    assert_eq!(
+        report, "denied errno=1",
+        "should deny the grandchild's connect"
+    );
+    assert_eq!(
+        listener.drain_accepts().expect("should drain"),
+        0,
+        "should see no accept"
+    );
+    for depth in 0..=2 {
+        assert!(
+            fixture.writable.join(format!("nest-{depth}")).exists(),
+            "should record nesting level {depth}"
+        );
+    }
+
+    let source = fixture.container(&fixture.immutable.join("src/a.txt"));
+    assert_eq!(
+        fixture.run(&proof, "write", &[&source]),
+        READ_ONLY_FILESYSTEM
+    );
+    assert_eq!(
+        fs::read(fixture.immutable.join("src/a.txt")).expect("should read"),
+        b"original",
+        "should keep the immutable source"
+    );
+    let private = fixture.container(&fixture.writable.join("out.txt"));
+    assert_eq!(fixture.run(&proof, "write", &[&private]), "written");
+    assert_eq!(
+        fs::read(fixture.writable.join("out.txt")).expect("should read"),
+        b"tampered",
+        "should allow private writes"
+    );
+}
+
+#[test]
+fn container_denies_every_non_unix_socket_family() {
+    let fixture = Fixture::new();
+    let proof = fixture.prove();
+    for domain in ["inet", "inet6", "netlink", "packet"] {
+        assert_eq!(
+            fixture.run(&proof, "socket", &[domain]),
+            "denied errno=1",
+            "should deny {domain} sockets with seccomp EPERM"
+        );
+    }
+    assert_eq!(fixture.run(&proof, "socket", &["unix"]), "created");
+    let socket = fixture.container(&fixture.writable.join("x.sock"));
+    assert_eq!(
+        fixture.run(&proof, "unix-exchange", &[&socket]),
+        "exchanged"
+    );
+}
+
+#[test]
+fn container_cannot_signal_a_host_sibling() {
+    let fixture = Fixture::new();
+    let proof = fixture.prove();
+    let mut sibling = spawn_sibling();
+    let pid = sibling.id().to_string();
+    let kill = libc::SIGKILL.to_string();
+    let report = fixture.run(&proof, "signal", &[&pid, &kill]);
+    let alive = sibling.try_wait().expect("should poll sibling").is_none();
+    sibling.kill().expect("should stop sibling");
+    sibling.wait().expect("should reap sibling");
+    assert_eq!(report, NO_SUCH_PROCESS, "should not see host pids");
+    assert!(alive, "should leave the host sibling running");
+}
+
+#[test]
+fn container_is_removed_after_a_timeout() {
+    let fixture = Fixture::new();
+    let proof = fixture.prove();
+    let mut command = fixture.command("sleep", &["30000"]);
+    command.limits.wall = Duration::from_secs(3);
+    let result = fixture
+        .boundary
+        .run_confined(&command, &proof)
+        .expect("should confirm the container removed after the timeout");
+    assert_eq!(
+        result.outcome(),
+        ProcessOutcome::TimedOut,
+        "should time out"
+    );
+}
+
+#[test]
+fn container_rejects_unsafe_aliases_and_hard_links_in_mounts() {
+    let fixture = Fixture::new();
+    let proof = fixture.prove();
+    let cases: [(&Path, &str, &str); 4] = [
+        (&fixture.writable, "absolute", "/etc"),
+        (&fixture.immutable, "escaping", "../../outside"),
+        (&fixture.immutable, "dangling", "src/missing"),
+        (&fixture.tools, "dangling", "missing-tool"),
+    ];
+    for (root, name, target) in cases {
+        let link = root.join(name);
+        symlink(target, &link).expect("should create alias");
+        assert!(
+            fixture
+                .boundary
+                .run_confined(&fixture.command("sleep", &["0"]), &proof)
+                .is_err(),
+            "should reject {name} alias {target} in {root:?}"
+        );
+        fs::remove_file(&link).expect("should remove alias");
+    }
+    let alias = fixture.writable.join("prelink");
+    fs::hard_link(fixture.immutable.join("src/a.txt"), &alias).expect("should hard link");
+    let error = fixture
+        .boundary
+        .run_confined(&fixture.command("sleep", &["0"]), &proof)
+        .expect_err("should reject a pre-existing hard link");
+    assert!(
+        format!("{error:?}").contains("hard links"),
+        "should name the hard link"
+    );
+}
+
+#[test]
+fn docker_client_rehash_rejects_tampering_between_commands() {
+    let state = tempdir().expect("should create state directory");
+    let client = DockerClient::new(Path::new(DOCKER_CLIENT), state.path(), &[], host_limits())
+        .expect("should pin inputs");
+    let first = client
+        .host(&["version", "--format", "{{.Client.Version}}"])
+        .expect("should run first host command");
+    assert!(succeeded(&first), "should run the pinned client");
+    let profile = client.inputs().effective_profile().to_path_buf();
+    fs::set_permissions(
+        &profile,
+        std::os::unix::fs::PermissionsExt::from_mode(0o644),
+    )
+    .expect("should chmod profile");
+    fs::write(&profile, b"{}").expect("should tamper profile");
+    assert!(
+        client.host(&["version"]).is_err(),
+        "should refuse the next host command after tampering"
+    );
+}
+
+#[test]
+fn container_command_reports_the_requested_umask() {
+    let fixture = Fixture::new();
+    let proof = fixture.prove();
+    let report = |umask: Option<u32>| {
+        let mut command = fixture.command("umask", &[]);
+        if let Some(mask) = umask {
+            command = command.umask(Umask::new(mask).expect("should accept mask"));
+        }
+        let result = fixture
+            .boundary
+            .run_confined(&command, &proof)
+            .expect("should run confined helper");
+        helper_report(result.stdout())
+    };
+    let default = report(None);
+    assert!(
+        default.len() == 3 && default.bytes().all(|digit| (b'0'..=b'7').contains(&digit)),
+        "should report the runtime default as three octal digits: {default}"
+    );
+    assert_eq!(report(Some(0o027)), "027", "should apply umask 027");
+    assert_eq!(report(Some(0o077)), "077", "should apply umask 077");
+}
diff --git a/crates/trusted-server-release/src/boundary/tests/macos.rs b/crates/trusted-server-release/src/boundary/tests/macos.rs
new file mode 100644
index 0000000000..34abeedde3
--- /dev/null
+++ b/crates/trusted-server-release/src/boundary/tests/macos.rs
@@ -0,0 +1,751 @@
+//! Real `sandbox-exec` boundary tests (macOS only).
+//!
+//! These must run outside an enclosing application sandbox: the unconfined
+//! control needs local socket permission, and without it no proof is
+//! constructed and the tests fail instead of passing vacuously.
+
+use std::fs;
+use std::os::unix::fs::{MetadataExt as _, PermissionsExt as _, symlink};
+use std::time::SystemTime;
+
+use tempfile::{TempDir, tempdir};
+
+use super::super::macos::{MacProfile, RunIdentity};
+use super::super::probe::LoopbackListener;
+use super::super::survivors::{RunSignature, matching};
+use super::*;
+use crate::process::ProcessOutcome;
+
+/// A sandbox fixture with one immutable root, a tool root holding a staged
+/// copy of the test binary and one private writable root.
+struct Fixture {
+    _directory: TempDir,
+    immutable: PathBuf,
+    writable: PathBuf,
+    probe: ProbeProgram,
+    boundary: Boundary,
+}
+
+impl Fixture {
+    fn new() -> Self {
+        let directory = tempdir().expect("should create fixture directory");
+        let base = fs::canonicalize(directory.path()).expect("should canonicalize fixture");
+        let immutable = base.join("immutable");
+        let writable = base.join("writable");
+        let tools = base.join("tools");
+        fs::create_dir_all(immutable.join("src")).expect("should create immutable root");
+        fs::create_dir(&writable).expect("should create writable root");
+        fs::create_dir(&tools).expect("should create tool root");
+        fs::write(immutable.join("src/a.txt"), b"original").expect("should write source");
+        let probe = staged_probe(&tools);
+        let roots = BoundaryRoots::new(
+            std::slice::from_ref(&immutable),
+            &[tools],
+            std::slice::from_ref(&writable),
+        )
+        .expect("should accept fixture roots");
+        let boundary = Boundary::mac_sandbox_for_tests(roots).expect("should configure sandbox");
+        Self {
+            _directory: directory,
+            immutable,
+            writable,
+            probe,
+            boundary,
+        }
+    }
+
+    fn prove(&self) -> DenialProof {
+        self.boundary
+            .establish_denial(&self.probe, limits())
+            .expect("should prove denial with a real control and denied probe")
+    }
+
+    fn command(&self, mode: &str, arguments: &[&str]) -> ConfinedCommand {
+        helper_command(self.probe.program(), &self.writable, mode, arguments)
+    }
+
+    fn run(&self, proof: &DenialProof, mode: &str, arguments: &[&str]) -> String {
+        let result = self
+            .boundary
+            .run_confined(&self.command(mode, arguments), proof)
+            .expect("should run confined helper");
+        helper_report(result.stdout())
+    }
+}
+
+fn path_text(path: &Path) -> &str {
+    path.to_str().expect("should be UTF-8")
+}
+
+#[test]
+fn selected_cargo_starts_without_reading_ambient_openssl_configuration() {
+    let directory = tempdir().expect("should create startup fixture");
+    let base = fs::canonicalize(directory.path()).expect("should canonicalize startup fixture");
+    let immutable = base.join("source");
+    let writable = base.join("private");
+    fs::create_dir(&immutable).expect("should create source");
+    fs::create_dir(&writable).expect("should create private state");
+    let cargo = fs::canonicalize(env!("CARGO")).expect("should locate selected Cargo");
+    let roots = BoundaryRoots::new(
+        &[immutable],
+        std::slice::from_ref(&cargo),
+        std::slice::from_ref(&writable),
+    )
+    .expect("should bind startup roots");
+    let profile = MacProfile::generate(&roots).expect("should generate actual profile");
+    let run = RunIdentity::new(&profile).expect("should create private run markers");
+    // These direct version/read commands create no descendants. Use the actual
+    // profile without the global survivor scan exercised by separate tests.
+    let execute = |program: &Path, arguments: &[&str]| {
+        let command = ConfinedCommand::new(program, &writable, limits())
+            .expect("should describe harmless command")
+            .arguments(arguments.iter().map(OsString::from))
+            .environment("OPENSSL_CONF", "/dev/null")
+            .expect("should normalize optional OpenSSL configuration")
+            .environment("LC_ALL", "C")
+            .expect("should normalize diagnostic locale")
+            .environment("HOME", &writable)
+            .expect("should use private home")
+            .environment("CARGO_HOME", &writable)
+            .expect("should use private Cargo home");
+        profile
+            .wrap(&command, &run)
+            .expect("should wrap command")
+            .run()
+            .expect("should finish bounded command")
+    };
+    let version = execute(&cargo, &["--version"])
+        .require_success()
+        .expect("should initialize selected Cargo without ambient configuration");
+    assert!(
+        version.starts_with(b"cargo "),
+        "should run actual selected Cargo"
+    );
+    for alias in ["/private/etc/ssl/openssl.cnf", "/etc/ssl/openssl.cnf"] {
+        let denied = execute(Path::new("/bin/cat"), &[alias]);
+        assert_ne!(
+            denied.outcome(),
+            ProcessOutcome::Exited { code: 0 },
+            "should deny configuration contents"
+        );
+        assert!(
+            denied.stdout().is_empty(),
+            "should expose no configuration bytes"
+        );
+        assert!(
+            String::from_utf8_lossy(denied.stderr()).contains("No such file or directory"),
+            "should report optional configuration as absent"
+        );
+    }
+    let unrelated = execute(Path::new("/bin/cat"), &["/private/etc/hosts"]);
+    assert_ne!(
+        unrelated.outcome(),
+        ProcessOutcome::Exited { code: 0 },
+        "should retain unrelated read denial"
+    );
+    assert!(
+        unrelated.stdout().is_empty(),
+        "should expose no unrelated host input"
+    );
+    assert!(
+        String::from_utf8_lossy(unrelated.stderr()).contains("Operation not permitted"),
+        "should retain ordinary denial outside the exact aliases"
+    );
+}
+
+#[test]
+fn confined_probe_is_denied_with_eperm_and_no_accept() {
+    let fixture = Fixture::new();
+    let proof = fixture.prove();
+    assert_eq!(
+        proof.denied_errno(),
+        libc::EPERM,
+        "should observe real EPERM"
+    );
+
+    let listener = LoopbackListener::bind().expect("should bind listener");
+    let address = listener.address().to_string();
+    let report = fixture.run(&proof, "connect", &[&address]);
+    assert_eq!(report, "denied errno=1", "should deny confined connect");
+    assert_eq!(
+        listener.drain_accepts().expect("should drain"),
+        0,
+        "should observe no accept from the confined probe"
+    );
+}
+
+#[test]
+fn grandchild_inherits_denial() {
+    let fixture = Fixture::new();
+    let proof = fixture.prove();
+    let listener = LoopbackListener::bind().expect("should bind listener");
+    let address = listener.address().to_string();
+    let report = fixture.run(
+        &proof,
+        "nest",
+        &["2", &address, path_text(&fixture.writable)],
+    );
+    assert_eq!(
+        report, "denied errno=1",
+        "should deny the grandchild's connect"
+    );
+    assert_eq!(
+        listener.drain_accepts().expect("should drain"),
+        0,
+        "should see no accept"
+    );
+    let pids: Vec<String> = (0..=2)
+        .map(|depth| {
+            fs::read_to_string(fixture.writable.join(format!("nest-{depth}")))
+                .expect("should record every nesting level")
+        })
+        .collect();
+    assert!(
+        pids[0] != pids[1] && pids[1] != pids[2] && pids[0] != pids[2],
+        "should run each level as a distinct process: {pids:?}"
+    );
+}
+
+#[test]
+fn private_unix_exchange_succeeds_while_inet_stays_denied() {
+    let fixture = Fixture::new();
+    let proof = fixture.prove();
+    let socket = fixture.writable.join("x.sock");
+    assert_eq!(
+        fixture.run(&proof, "unix-exchange", &[path_text(&socket)]),
+        "exchanged"
+    );
+    let outside = fixture.immutable.join("x.sock");
+    assert_eq!(
+        fixture.run(&proof, "unix-exchange", &[path_text(&outside)]),
+        "denied errno=1",
+        "should deny Unix sockets outside the writable roots"
+    );
+    let listener = LoopbackListener::bind().expect("should bind listener");
+    let address = listener.address().to_string();
+    assert_eq!(
+        fixture.run(&proof, "connect", &[&address]),
+        "denied errno=1"
+    );
+}
+
+#[test]
+fn writes_are_denied_in_read_only_roots_and_allowed_in_private_roots() {
+    let fixture = Fixture::new();
+    let proof = fixture.prove();
+    let denied = fixture.immutable.join("src/new.txt");
+    let existing = fixture.immutable.join("src/a.txt");
+    for target in [&denied, &existing, &fixture.probe.program().to_path_buf()] {
+        assert_eq!(
+            fixture.run(&proof, "write", &[path_text(target)]),
+            "denied errno=1",
+            "should deny writing {target:?}"
+        );
+    }
+    assert!(
+        !denied.exists(),
+        "should not create files in the immutable root"
+    );
+    assert_eq!(
+        fs::read(&existing).expect("should read"),
+        b"original",
+        "should keep source"
+    );
+
+    let private = fixture.writable.join("out.txt");
+    assert_eq!(
+        fixture.run(&proof, "write", &[path_text(&private)]),
+        "written"
+    );
+    assert_eq!(
+        fs::read(&private).expect("should read"),
+        b"tampered",
+        "should allow private writes"
+    );
+}
+
+#[test]
+fn signals_are_limited_to_the_same_sandbox() {
+    let fixture = Fixture::new();
+    let proof = fixture.prove();
+    assert_eq!(
+        fixture.run(&proof, "signal-own-child", &[]),
+        "signalled",
+        "should signal its own child"
+    );
+
+    let mut sibling = spawn_sibling();
+    let sibling_pid = sibling.id().to_string();
+    let kill = libc::SIGKILL.to_string();
+    assert_eq!(
+        fixture.run(&proof, "signal", &[&sibling_pid, &kill]),
+        "denied errno=1",
+        "should not signal an outside same-user sibling"
+    );
+    let alive = sibling.try_wait().expect("should poll sibling").is_none();
+    sibling.kill().expect("should stop sibling");
+    sibling.wait().expect("should reap sibling");
+    assert!(alive, "should leave the sibling running");
+
+    let orchestrator = std::process::id().to_string();
+    assert_eq!(
+        fixture.run(&proof, "signal", &[&orchestrator, "0"]),
+        "denied errno=1",
+        "should not signal the orchestrator"
+    );
+}
+
+#[test]
+fn setsid_and_setpgid_are_denied() {
+    let fixture = Fixture::new();
+    let proof = fixture.prove();
+    for mode in ["setsid", "setpgid"] {
+        assert_eq!(
+            fixture.run(&proof, mode, &[]),
+            "denied errno=1",
+            "should deny {mode} inside the sandbox"
+        );
+    }
+}
+
+#[test]
+fn same_group_orphan_is_killed_with_the_run() {
+    let fixture = Fixture::new();
+    let proof = fixture.prove();
+    let pid_file = fixture.writable.join("orphan.pid");
+    assert_eq!(
+        fixture.run(&proof, "orphan", &[path_text(&pid_file)]),
+        "spawned"
+    );
+    let pid = read_pid(&pid_file);
+    assert!(wait_gone(pid), "should kill the same-group orphan {pid}");
+}
+
+#[test]
+fn group_escape_keeping_the_run_nonce_is_killed_and_rejected() {
+    let fixture = Fixture::new();
+    let proof = fixture.prove();
+    let pid_file = fixture.writable.join("escape.pid");
+    let error = fixture
+        .boundary
+        .run_confined(
+            &fixture.command("escape", &[path_text(&pid_file), "keep"]),
+            &proof,
+        )
+        .expect_err("should reject a run whose descendant escaped the group");
+    assert!(
+        format!("{error:?}").contains("escaped"),
+        "should name the escape: {error:?}"
+    );
+    let pid = read_pid(&pid_file);
+    assert!(wait_gone(pid), "should kill the escaped descendant {pid}");
+}
+
+#[test]
+fn group_escape_with_scrubbed_environment_is_killed_and_rejected() {
+    let fixture = Fixture::new();
+    let proof = fixture.prove();
+    let pid_file = fixture.writable.join("scrubbed.pid");
+    let outcome = fixture.boundary.run_confined(
+        &fixture.command("escape", &[path_text(&pid_file), "scrub"]),
+        &proof,
+    );
+    let pid = read_pid(&pid_file);
+    let survived = process_exists(pid);
+    if survived {
+        // SAFETY: `pid` is the fixture's own escaped helper (> 1).
+        unsafe {
+            libc::kill(pid, libc::SIGKILL);
+        }
+    }
+    let error = outcome.expect_err("should reject a run whose scrubbed descendant escaped");
+    assert!(
+        format!("{error:?}").contains("escaped"),
+        "should name the escape: {error:?}"
+    );
+    assert!(
+        !survived,
+        "should kill the scrubbed escaped descendant {pid} before returning"
+    );
+}
+
+/// Collect-only: lists matches without signalling anything.
+#[test]
+fn fresh_run_signature_matches_no_existing_process() {
+    let directory = tempdir().expect("should create marker directory");
+    let base = fs::canonicalize(directory.path()).expect("should canonicalize markers");
+    let allow = base.join("allow");
+    let deny = base.join("deny");
+    fs::write(&allow, b"").expect("should write allow marker");
+    fs::write(&deny, b"").expect("should write deny marker");
+    let matches = matching(&RunSignature {
+        variable: "TS_RELEASE_BOUNDARY_RUN",
+        nonce: "fictional-unused-nonce",
+        allow: &allow,
+        deny: &deny,
+        started_after_micros: 0,
+    })
+    .expect("should query every process without signalling it");
+    assert!(
+        matches.is_empty(),
+        "should match no unrelated sandboxed or unsandboxed process: {matches:?}"
+    );
+}
+
+/// Collect-only: the single carrier is this test's own child.
+#[test]
+fn processes_started_before_the_run_are_never_matched() {
+    let directory = tempdir().expect("should create marker directory");
+    let base = fs::canonicalize(directory.path()).expect("should canonicalize markers");
+    let allow = base.join("allow");
+    let deny = base.join("deny");
+    fs::write(&allow, b"").expect("should write allow marker");
+    fs::write(&deny, b"").expect("should write deny marker");
+    let nonce = "fictional-start-guard-nonce";
+    // Apple platform binaries hide their environment from KERN_PROCARGS2.
+    let sleeper = base.join("sleep");
+    fs::copy("/bin/sleep", &sleeper).expect("should copy a visible sleeper");
+    let mut carrier = std::process::Command::new(&sleeper)
+        .arg("30")
+        .env("TS_RELEASE_BOUNDARY_RUN", nonce)
+        .spawn()
+        .expect("should start an own nonce carrier");
+    let carrier_pid = libc::pid_t::try_from(carrier.id()).expect("should fit a pid");
+    std::thread::sleep(Duration::from_millis(100));
+    let signature = |started_after_micros| RunSignature {
+        variable: "TS_RELEASE_BOUNDARY_RUN",
+        nonce,
+        allow: &allow,
+        deny: &deny,
+        started_after_micros,
+    };
+    let future = SystemTime::now()
+        .duration_since(SystemTime::UNIX_EPOCH)
+        .map(|now| now + Duration::from_secs(3600))
+        .ok()
+        .and_then(|future| u64::try_from(future.as_micros()).ok());
+    let eligible = matching(&signature(0));
+    let later = future.map(|future| matching(&signature(future)));
+    // Stop the own carrier before any assertion can unwind.
+    carrier.kill().expect("should stop own carrier");
+    carrier.wait().expect("should reap own carrier");
+    let eligible = eligible.expect("should list eligible carriers");
+    let later = later
+        .expect("should compute a later run start")
+        .expect("should list carriers started after a later run");
+    assert_eq!(
+        eligible,
+        vec![carrier_pid],
+        "should match exactly the own carrier"
+    );
+    assert!(
+        later.is_empty(),
+        "should never match a process that started before the run: {later:?}"
+    );
+}
+
+#[test]
+fn concurrent_run_of_another_instance_is_not_reaped() {
+    let first = Fixture::new();
+    let first_proof = first.prove();
+    let second = Fixture::new();
+    let second_proof = second.prove();
+    std::thread::scope(|scope| {
+        let long = scope.spawn(|| {
+            second
+                .boundary
+                .run_confined(&second.command("sleep", &["1500"]), &second_proof)
+        });
+        std::thread::sleep(Duration::from_millis(300));
+        let short = first
+            .boundary
+            .run_confined(&first.command("sleep", &["0"]), &first_proof)
+            .expect("should not count another instance's live run as a survivor");
+        assert_eq!(
+            short.outcome(),
+            ProcessOutcome::Exited { code: 0 },
+            "should complete the short run"
+        );
+        let long = long
+            .join()
+            .expect("should join the concurrent run")
+            .expect("should leave the other instance's run untouched");
+        assert_eq!(
+            long.outcome(),
+            ProcessOutcome::Exited { code: 0 },
+            "should let the other instance finish normally"
+        );
+    });
+}
+
+#[test]
+fn escaped_scrubbed_descendant_inherits_denial() {
+    let fixture = Fixture::new();
+    let proof = fixture.prove();
+    let listener = LoopbackListener::bind().expect("should bind listener");
+    let address = listener.address().to_string();
+    assert_eq!(
+        fixture.run(&proof, "escape-connect", &[&address]),
+        "denied errno=1",
+        "should deny a new-group descendant with a scrubbed environment"
+    );
+    assert_eq!(
+        listener.drain_accepts().expect("should drain"),
+        0,
+        "should see no accept from the escaped descendant"
+    );
+}
+
+#[test]
+fn runtime_hard_link_from_immutable_root_is_denied() {
+    let fixture = Fixture::new();
+    let proof = fixture.prove();
+    let source = fixture.immutable.join("src/a.txt");
+    let alias = fixture.writable.join("runtime-link");
+    assert_eq!(
+        fixture.run(&proof, "link", &[path_text(&source), path_text(&alias)]),
+        "denied errno=1",
+        "should deny creating a write-through alias during the run"
+    );
+    assert!(!alias.exists(), "should leave no alias behind");
+    assert_eq!(
+        fs::metadata(&source).expect("should stat source").nlink(),
+        1,
+        "should keep the immutable file single-linked"
+    );
+}
+
+#[test]
+fn pre_existing_hard_link_is_rejected_before_execution() {
+    let fixture = Fixture::new();
+    let proof = fixture.prove();
+    let source = fixture.immutable.join("src/a.txt");
+    let alias = fixture.writable.join("prelink");
+    fs::hard_link(&source, &alias).expect("should hard link into the private root");
+
+    let rejected = fixture
+        .boundary
+        .run_confined(&fixture.command("write", &[path_text(&alias)]), &proof)
+        .expect_err("should reject the hard-linked immutable file");
+    assert!(
+        format!("{rejected:?}").contains("hard links"),
+        "should name the hard link"
+    );
+    assert_eq!(
+        fs::read(&source).expect("should read"),
+        b"original",
+        "should not run the helper"
+    );
+}
+
+#[test]
+fn hard_linked_tool_is_rejected_before_execution() {
+    let fixture = Fixture::new();
+    let proof = fixture.prove();
+    fs::hard_link(fixture.probe.program(), fixture.writable.join("tool-alias"))
+        .expect("should hard link the tool");
+    let rejected = fixture
+        .boundary
+        .run_confined(&fixture.command("sleep", &["0"]), &proof)
+        .expect_err("should reject a hard-linked tool");
+    assert!(
+        format!("{rejected:?}").contains("hard links"),
+        "should name the hard link"
+    );
+}
+
+#[test]
+fn hard_link_write_through_bypasses_path_denial_and_restoration_hides_it() {
+    let fixture = Fixture::new();
+    let source = fixture.immutable.join("src/a.txt");
+    fs::set_permissions(&source, fs::Permissions::from_mode(0o444)).expect("should chmod");
+    let before = fs::metadata(&source).expect("should stat source");
+    let alias = fixture.writable.join("prelink");
+    fs::hard_link(&source, &alias).expect("should hard link");
+    fs::set_permissions(&alias, fs::Permissions::from_mode(0o644)).expect("should chmod alias");
+
+    // Deliberately skip the boundary's nlink scan to show what it prevents.
+    let profile = MacProfile::generate(&fixture.boundary.roots).expect("should generate");
+    let run = RunIdentity::new(&profile).expect("should create run markers");
+    let result = profile
+        .wrap(&fixture.command("write", &[path_text(&alias)]), &run)
+        .expect("should wrap")
+        .run()
+        .expect("should run unscanned helper");
+    assert_eq!(
+        helper_report(result.stdout()),
+        "written",
+        "should write through the link"
+    );
+    assert_eq!(
+        fs::read(&source).expect("should read"),
+        b"tampered",
+        "should reach the source"
+    );
+
+    restore_and_compare(&source, &alias, &before);
+}
+
+/// Restores content, mtime and mode through `alias` and shows the source
+/// then matches its pre-tamper content, mode and mtime.
+fn restore_and_compare(source: &Path, alias: &Path, before: &fs::Metadata) {
+    fs::write(alias, b"original").expect("should restore content");
+    let modified = before.modified().expect("should read mtime");
+    fs::File::options()
+        .write(true)
+        .open(alias)
+        .and_then(|file| file.set_modified(modified))
+        .expect("should restore mtime");
+    fs::set_permissions(source, fs::Permissions::from_mode(0o444)).expect("should restore mode");
+    let after = fs::metadata(source).expect("should stat source");
+    assert_eq!(
+        fs::read(source).expect("should read"),
+        b"original",
+        "should match content"
+    );
+    assert_eq!(
+        after.permissions(),
+        before.permissions(),
+        "should match mode"
+    );
+    assert_eq!(after.modified().ok(), Some(modified), "should match mtime");
+}
+
+/// Mutates `path` from an unconfined thread while a confined helper sleeps.
+fn mutate_during_run(fixture: &Fixture, proof: &DenialProof, path: PathBuf) -> String {
+    let started = SystemTime::now();
+    let mutator = std::thread::spawn(move || {
+        std::thread::sleep(Duration::from_millis(300));
+        let _ = fs::set_permissions(&path, fs::Permissions::from_mode(0o755));
+        fs::write(&path, b"mutated").expect("should mutate outside the sandbox");
+    });
+    let outcome = fixture
+        .boundary
+        .run_confined(&fixture.command("sleep", &["1500"]), proof);
+    mutator.join().expect("should join mutator");
+    let elapsed = started.elapsed().expect("should measure");
+    assert!(
+        elapsed >= Duration::from_millis(300),
+        "should overlap the mutation"
+    );
+    format!("{:?}", outcome.expect_err("should reject a changed root"))
+}
+
+#[test]
+fn immutable_and_tool_mutation_during_run_is_detected() {
+    let fixture = Fixture::new();
+    let proof = fixture.prove();
+    let error = mutate_during_run(&fixture, &proof, fixture.immutable.join("src/a.txt"));
+    assert!(
+        error.contains("changed"),
+        "should report the immutable change"
+    );
+
+    let fixture = Fixture::new();
+    let proof = fixture.prove();
+    let tool = fixture
+        .probe
+        .program()
+        .parent()
+        .expect("should have tool root")
+        .join("extra-tool");
+    let error = mutate_during_run(&fixture, &proof, tool);
+    assert!(
+        error.contains("changed"),
+        "should report the tool-root change"
+    );
+}
+
+#[test]
+fn unsafe_writable_alias_left_by_a_run_is_rejected() {
+    let fixture = Fixture::new();
+    let proof = fixture.prove();
+    let writable = fixture.writable.clone();
+    let creator = std::thread::spawn(move || {
+        std::thread::sleep(Duration::from_millis(300));
+        symlink("/etc", writable.join("absolute-alias")).expect("should create alias");
+    });
+    let outcome = fixture
+        .boundary
+        .run_confined(&fixture.command("sleep", &["1000"]), &proof);
+    creator.join().expect("should join creator");
+    let error = outcome.expect_err("should reject an unsafe alias after the run");
+    assert!(
+        format!("{error:?}").contains("absolute"),
+        "should name the alias"
+    );
+}
+
+#[test]
+fn proof_is_bound_to_its_instance() {
+    let first = Fixture::new();
+    let proof = first.prove();
+    let twin = Boundary::mac_sandbox_for_tests(first.boundary.roots.clone())
+        .expect("should configure an identical twin");
+    let error = twin
+        .run_confined(&first.command("sleep", &["0"]), &proof)
+        .expect_err("should reject a proof from another instance");
+    assert!(
+        format!("{error:?}").contains("different boundary"),
+        "should explain"
+    );
+    let result = first
+        .boundary
+        .run_confined(&first.command("sleep", &["0"]), &proof)
+        .expect("should accept its own proof");
+    assert_eq!(
+        result.outcome(),
+        ProcessOutcome::Exited { code: 0 },
+        "should run"
+    );
+}
+
+#[test]
+fn programs_outside_the_roots_are_rejected() {
+    let fixture = Fixture::new();
+    let proof = fixture.prove();
+    let command = ConfinedCommand::new(Path::new("/usr/bin/true"), &fixture.writable, limits())
+        .expect("should describe command");
+    assert!(
+        fixture.boundary.run_confined(&command, &proof).is_err(),
+        "should reject a program outside every root"
+    );
+}
+
+/// Reads the umask a helper inherits from this process, outside any sandbox.
+fn unconfined_umask() -> String {
+    let mut command = StdCommand::new(test_binary());
+    command
+        .args(helper_arguments(&[]))
+        .env_clear()
+        .stdin(std::process::Stdio::null());
+    for (name, value) in helper_environment("umask") {
+        command.env(name, value);
+    }
+    let output = command.output().expect("should run the unconfined helper");
+    helper_report(&output.stdout)
+}
+
+#[test]
+fn confined_command_reports_the_requested_umask() {
+    let fixture = Fixture::new();
+    let proof = fixture.prove();
+    let report = |umask: Option<u32>| {
+        let mut command = fixture.command("umask", &[]);
+        if let Some(mask) = umask {
+            command = command.umask(Umask::new(mask).expect("should accept mask"));
+        }
+        let result = fixture
+            .boundary
+            .run_confined(&command, &proof)
+            .expect("should run confined helper");
+        helper_report(result.stdout())
+    };
+    assert_eq!(
+        report(None),
+        unconfined_umask(),
+        "should inherit the orchestrator umask without a request"
+    );
+    assert_eq!(report(Some(0o027)), "027", "should apply umask 027");
+    assert_eq!(report(Some(0o077)), "077", "should apply umask 077");
+}
diff --git a/crates/trusted-server-release/src/boundary/tests/modes.rs b/crates/trusted-server-release/src/boundary/tests/modes.rs
new file mode 100644
index 0000000000..e10c4fc30e
--- /dev/null
+++ b/crates/trusted-server-release/src/boundary/tests/modes.rs
@@ -0,0 +1,340 @@
+//! Helper child modes run by [`helper_entry`](super::helper_entry).
+//!
+//! Every mode prints one report line after the sentinel: a success word, or
+//! `denied errno=<n>` with the operating system's real errno (exit 3).
+
+use std::io::Write as _;
+use std::os::unix::net::{UnixListener, UnixStream};
+use std::os::unix::process::CommandExt as _;
+use std::process::Stdio;
+
+use super::*;
+
+/// Prints `line` after the sentinel and returns `code`.
+fn report(line: &str, code: i32) -> i32 {
+    let mut stdout = std::io::stdout();
+    let mut bytes = SENTINEL.to_vec();
+    bytes.extend_from_slice(line.as_bytes());
+    bytes.push(b'\n');
+    if stdout
+        .write_all(&bytes)
+        .and_then(|()| stdout.flush())
+        .is_err()
+    {
+        return HELPER_SETUP_FAILED;
+    }
+    code
+}
+
+/// Reports `success`, or the real errno with the denied status.
+fn report_errno(success: &str, errno: Option<i32>) -> i32 {
+    match errno {
+        None => report(success, 0),
+        Some(errno) => report(&format!("denied errno={errno}"), i32::from(DENIED_STATUS)),
+    }
+}
+
+/// Returns the errno of a failed libc call (`rc < 0`).
+fn call_errno(rc: libc::c_int) -> Option<i32> {
+    (rc < 0).then(|| std::io::Error::last_os_error().raw_os_error().unwrap_or(-1))
+}
+
+/// Runs `mode` with its `arguments`, returning the exit status.
+pub(super) fn run(mode: &str, arguments: &[String]) -> i32 {
+    let argument = |index: usize| arguments.get(index).map(String::as_str).unwrap_or_default();
+    match mode {
+        "connect" => connect(argument(0)),
+        "nest" => nest(argument(0), argument(1), argument(2)),
+        "write" => report_errno(
+            "written",
+            std::fs::write(argument(0), b"tampered")
+                .err()
+                .map(|error| error.raw_os_error().unwrap_or(-1)),
+        ),
+        "signal" => signal(argument(0), argument(1)),
+        "signal-own-child" => signal_own_child(),
+        #[cfg(target_os = "linux")]
+        "process-memory-read" => process_memory_read(),
+        "wait-for-eof" => match std::io::copy(&mut std::io::stdin(), &mut std::io::sink()) {
+            Ok(_) => 0,
+            Err(_) => HELPER_SETUP_FAILED,
+        },
+        "sleep" => {
+            std::thread::sleep(Duration::from_millis(argument(0).parse().unwrap_or(0)));
+            0
+        }
+        // SAFETY: `setsid` and `setpgid` have no memory-safety preconditions.
+        "setsid" => report_errno("detached", call_errno(unsafe { libc::setsid() })),
+        // SAFETY: as above.
+        "setpgid" => report_errno("detached", call_errno(unsafe { libc::setpgid(0, 0) })),
+        "orphan" => leave_child(argument(0), Departure::SameGroup),
+        "escape" => leave_child(
+            argument(0),
+            Departure::NewGroup {
+                scrub: argument(1) == "scrub",
+            },
+        ),
+        "link" => report_errno(
+            "linked",
+            std::fs::hard_link(argument(0), argument(1))
+                .err()
+                .map(|error| error.raw_os_error().unwrap_or(-1)),
+        ),
+        "escape-connect" => escape_connect(argument(0)),
+        "unix-exchange" => unix_exchange(argument(0)),
+        "socket" => socket(argument(0)),
+        "umask" => umask(),
+        _ => HELPER_SETUP_FAILED,
+    }
+}
+
+/// Attempts a valid self-memory read, which the confined filter must deny.
+#[cfg(target_os = "linux")]
+pub(super) fn process_memory_read() -> i32 {
+    let remote = [0x5a_u8];
+    let mut local = [0_u8];
+    let local = libc::iovec {
+        iov_base: local.as_mut_ptr().cast(),
+        iov_len: 1,
+    };
+    let remote = libc::iovec {
+        iov_base: remote.as_ptr().cast_mut().cast(),
+        iov_len: 1,
+    };
+    // SAFETY: Both one-byte buffers remain live, and their iovecs describe
+    // valid memory in this process for the duration of the synchronous call.
+    let result = unsafe { libc::process_vm_readv(libc::getpid(), &local, 1, &remote, 1, 0) };
+    if result == 1 {
+        report("accessed", 0)
+    } else if result < 0 {
+        report_errno("accessed", std::io::Error::last_os_error().raw_os_error())
+    } else {
+        HELPER_SETUP_FAILED
+    }
+}
+
+fn connect(address: &str) -> i32 {
+    let Ok(address) = parse_loopback(address) else {
+        return HELPER_SETUP_FAILED;
+    };
+    match connect_probe(address) {
+        Ok(ProbeReport::Connected) => report("connected", 0),
+        Ok(ProbeReport::Denied { errno }) => report_errno("", Some(errno)),
+        Err(_) => HELPER_SETUP_FAILED,
+    }
+}
+
+/// Like [`helper_environment`] but reusing the inherited nonce.
+fn inherited_helper_environment(mode: &str) -> Vec<(OsString, OsString)> {
+    let inherited = std::env::var(HELPER_NONCE).unwrap_or_default();
+    vec![
+        (
+            OsString::from(HELPER_SELECTOR),
+            OsString::from(format!("{mode}:{inherited}")),
+        ),
+        (OsString::from(HELPER_NONCE), OsString::from(inherited)),
+    ]
+}
+
+/// Returns a command re-running this helper in `mode`.
+fn self_command(mode: &str, mode_arguments: &[&str]) -> Option<StdCommand> {
+    let mut command = StdCommand::new(std::env::current_exe().ok()?);
+    command.args(helper_arguments(mode_arguments));
+    for (name, value) in inherited_helper_environment(mode) {
+        command.env(name, value);
+    }
+    Some(command)
+}
+
+/// Records a marker in `marker_directory`, then connects directly at depth
+/// zero or through a child helper at depth `n - 1`.
+fn nest(depth: &str, address: &str, marker_directory: &str) -> i32 {
+    let Ok(depth) = depth.parse::<u32>() else {
+        return HELPER_SETUP_FAILED;
+    };
+    let marker = Path::new(marker_directory).join(format!("nest-{depth}"));
+    if std::fs::write(marker, std::process::id().to_string()).is_err() {
+        return HELPER_SETUP_FAILED;
+    }
+    if depth == 0 {
+        return connect(address);
+    }
+    let next = (depth - 1).to_string();
+    let Some(mut child) = self_command("nest", &[&next, address, marker_directory])
+        .and_then(|mut command| command.spawn().ok())
+    else {
+        return HELPER_SETUP_FAILED;
+    };
+    child
+        .wait()
+        .ok()
+        .and_then(|status| status.code())
+        .unwrap_or(HELPER_SETUP_FAILED)
+}
+
+fn kill_errno(pid: libc::pid_t, signal: libc::c_int) -> Option<i32> {
+    // SAFETY: `kill` has no memory-safety preconditions; callers never pass
+    // a pid <= 1.
+    call_errno(unsafe { libc::kill(pid, signal) })
+}
+
+fn signal(pid: &str, signal: &str) -> i32 {
+    let (Ok(pid), Ok(signal)) = (pid.parse::<libc::pid_t>(), signal.parse::<libc::c_int>()) else {
+        return HELPER_SETUP_FAILED;
+    };
+    if pid <= 1 {
+        return HELPER_SETUP_FAILED;
+    }
+    report_errno("signalled", kill_errno(pid, signal))
+}
+
+fn signal_own_child() -> i32 {
+    let Some(mut child) =
+        self_command("sleep", &["30000"]).and_then(|mut command| command.spawn().ok())
+    else {
+        return HELPER_SETUP_FAILED;
+    };
+    let Ok(pid) = libc::pid_t::try_from(child.id()) else {
+        return HELPER_SETUP_FAILED;
+    };
+    let error = kill_errno(pid, libc::SIGKILL);
+    if error.is_some() {
+        let _ = child.kill();
+    }
+    let _ = child.wait();
+    report_errno("signalled", error)
+}
+
+/// How a helper's child leaves it.
+#[derive(Clone, Copy)]
+enum Departure {
+    /// A daemon-style orphan that stays in the supervised process group.
+    SameGroup,
+    /// A `posix_spawn(POSIX_SPAWN_SETPGROUP)` child in a new group, keeping
+    /// or scrubbing the inherited environment.
+    NewGroup { scrub: bool },
+}
+
+/// Spawns a sleeping child with null stdio, records its pid and exits
+/// without waiting for it.
+fn leave_child(pid_file: &str, departure: Departure) -> i32 {
+    let Some(mut command) = self_command("sleep", &["30000"]) else {
+        return HELPER_SETUP_FAILED;
+    };
+    command
+        .stdin(Stdio::null())
+        .stdout(Stdio::null())
+        .stderr(Stdio::null());
+    if let Departure::NewGroup { scrub } = departure {
+        command.process_group(0);
+        if scrub {
+            command.env_clear();
+            for (name, value) in inherited_helper_environment("sleep") {
+                command.env(name, value);
+            }
+        }
+    }
+    let Ok(child) = command.spawn() else {
+        return HELPER_SETUP_FAILED;
+    };
+    if std::fs::write(pid_file, child.id().to_string()).is_err() {
+        return HELPER_SETUP_FAILED;
+    }
+    report("spawned", 0)
+}
+
+/// Runs `connect` in a `posix_spawn(POSIX_SPAWN_SETPGROUP)` child whose
+/// environment keeps only the helper selector, and waits for its report.
+fn escape_connect(address: &str) -> i32 {
+    let Some(mut command) = self_command("connect", &[address]) else {
+        return HELPER_SETUP_FAILED;
+    };
+    command.process_group(0).env_clear();
+    for (name, value) in inherited_helper_environment("connect") {
+        command.env(name, value);
+    }
+    command
+        .status()
+        .ok()
+        .and_then(|status| status.code())
+        .unwrap_or(HELPER_SETUP_FAILED)
+}
+
+/// Binds a Unix socket at `path`, connects to it and echoes four bytes.
+fn unix_exchange(path: &str) -> i32 {
+    let errno = |error: std::io::Error| Some(error.raw_os_error().unwrap_or(-1));
+    let listener = match UnixListener::bind(path) {
+        Ok(listener) => listener,
+        Err(error) => return report_errno("", errno(error)),
+    };
+    let server = std::thread::spawn(move || -> std::io::Result<()> {
+        let (mut stream, _) = listener.accept()?;
+        let mut bytes = [0_u8; 4];
+        std::io::Read::read_exact(&mut stream, &mut bytes)?;
+        stream.write_all(&bytes)
+    });
+    let exchanged = UnixStream::connect(path).and_then(|mut stream| {
+        stream.write_all(b"ping")?;
+        let mut bytes = [0_u8; 4];
+        std::io::Read::read_exact(&mut stream, &mut bytes)?;
+        Ok(bytes)
+    });
+    // The socket file is removed so the run leaves no special file behind
+    // in the writable root; the helper `_exit`s, so an unjoined server
+    // thread blocked in `accept` cannot hang it.
+    let removed = std::fs::remove_file(path).is_ok();
+    let bytes = match exchanged {
+        Ok(bytes) => bytes,
+        Err(error) => return report_errno("", errno(error)),
+    };
+    match server.join() {
+        Ok(Ok(())) if removed && &bytes == b"ping" => report("exchanged", 0),
+        _ => HELPER_SETUP_FAILED,
+    }
+}
+
+/// Maps a fixture domain name to `(domain, type)`.
+fn socket_kind(domain: &str) -> Option<(libc::c_int, libc::c_int)> {
+    match domain {
+        "unix" => Some((libc::AF_UNIX, libc::SOCK_STREAM)),
+        "inet" => Some((libc::AF_INET, libc::SOCK_STREAM)),
+        "inet6" => Some((libc::AF_INET6, libc::SOCK_STREAM)),
+        #[cfg(target_os = "linux")]
+        "netlink" => Some((libc::AF_NETLINK, libc::SOCK_RAW)),
+        #[cfg(target_os = "linux")]
+        "packet" => Some((libc::AF_PACKET, libc::SOCK_RAW)),
+        _ => None,
+    }
+}
+
+/// Creates (and closes) one socket of `domain`.
+fn socket(domain: &str) -> i32 {
+    let Some((domain, kind)) = socket_kind(domain) else {
+        return HELPER_SETUP_FAILED;
+    };
+    // SAFETY: `socket` has no memory-safety preconditions.
+    let fd = unsafe { libc::socket(domain, kind, 0) };
+    let errno = call_errno(fd);
+    if errno.is_none() {
+        // SAFETY: `fd` is a descriptor this helper just created.
+        unsafe {
+            libc::close(fd);
+        }
+    }
+    report_errno("created", errno)
+}
+
+/// Reports this process's umask as three octal digits.
+///
+/// Reading requires setting; the previous value is restored at once, and the
+/// helper is single-threaded.
+fn umask() -> i32 {
+    // SAFETY: `umask` has no memory-safety preconditions and cannot fail; the
+    // second call restores the value the first call returned.
+    let current = unsafe {
+        let current = libc::umask(0);
+        libc::umask(current);
+        current
+    };
+    report(&format!("{current:03o}"), 0)
+}
diff --git a/crates/trusted-server-release/src/boundary/tests/unit.rs b/crates/trusted-server-release/src/boundary/tests/unit.rs
new file mode 100644
index 0000000000..0406c88fc9
--- /dev/null
+++ b/crates/trusted-server-release/src/boundary/tests/unit.rs
@@ -0,0 +1,560 @@
+//! Platform-independent boundary tests on real files and processes.
+
+use std::fs;
+use std::os::unix::ffi::OsStrExt as _;
+use std::os::unix::fs::{MetadataExt as _, PermissionsExt as _, symlink};
+
+use tempfile::{TempDir, tempdir};
+
+use super::super::macos::{MacProfile, SYS_SETPGID, SYS_SETSID, define};
+use super::super::probe::LoopbackListener;
+use super::super::roots::validate_path_text;
+use super::*;
+use crate::process::{BoundedCommand, ProcessOutcome};
+
+pub(super) fn canonical_tempdir() -> (TempDir, PathBuf) {
+    let directory = tempdir().expect("should create temporary directory");
+    let canonical = fs::canonicalize(directory.path()).expect("should canonicalize tempdir");
+    (directory, canonical)
+}
+
+fn error_text(report: &Report<ReleaseError>) -> String {
+    format!("{report:?}")
+}
+
+// ---------------------------------------------------------------------------
+// Probe protocol
+// ---------------------------------------------------------------------------
+
+#[test]
+fn probe_report_round_trips_and_rejects_malformed_lines() {
+    for report in [ProbeReport::Connected, ProbeReport::Denied { errno: 1 }] {
+        let line = format!("{report}\n");
+        assert_eq!(
+            ProbeReport::parse_line(line.as_bytes()),
+            Some(report),
+            "should round-trip {report}"
+        );
+    }
+    for malformed in [
+        &b"connected"[..],
+        b"denied errno=\n",
+        b"denied errno=-1\n",
+        b"denied errno=1 \n",
+        b"connected\nconnected\n",
+        b"refused\n",
+    ] {
+        assert_eq!(
+            ProbeReport::parse_line(malformed),
+            None,
+            "should reject {malformed:?}"
+        );
+    }
+}
+
+#[test]
+fn probe_address_must_be_literal_loopback() {
+    for accepted in ["127.0.0.1:80", "[::1]:443"] {
+        assert!(parse_loopback(accepted).is_ok(), "should accept {accepted}");
+    }
+    for rejected in [
+        "10.0.0.1:80",
+        "192.0.2.1:80",
+        "localhost:80",
+        "127.0.0.1:0",
+        "127.0.0.1",
+    ] {
+        assert!(
+            parse_loopback(rejected).is_err(),
+            "should reject {rejected}"
+        );
+    }
+}
+
+#[test]
+fn unconfined_control_connects_and_listener_observes_accept() {
+    let listener = LoopbackListener::bind().expect("should bind listener");
+    let probe = helper_probe(&test_binary());
+    let mut command = BoundedCommand::new(probe.program(), Path::new("/"), limits())
+        .expect("should describe control")
+        .arguments(probe.arguments(listener.address()));
+    for (name, value) in probe.environment() {
+        command = command.environment(name, value).expect("should set env");
+    }
+    let result = command.run().expect("should run unconfined control");
+    assert_eq!(
+        result.outcome(),
+        ProcessOutcome::Exited { code: 0 },
+        "should exit 0 when connected"
+    );
+    assert_eq!(
+        probe.parse(result.stdout()),
+        Some(ProbeReport::Connected),
+        "should report connected"
+    );
+    assert_eq!(
+        listener.drain_accepts().expect("should drain"),
+        1,
+        "should observe exactly one accept"
+    );
+}
+
+// ---------------------------------------------------------------------------
+// Roots, SBPL template and tree facts
+// ---------------------------------------------------------------------------
+
+#[test]
+fn path_text_rejects_profile_metacharacters() {
+    assert!(validate_path_text(Path::new("/private/tmp/ok-root")).is_ok());
+    let nul = PathBuf::from(std::ffi::OsStr::from_bytes(b"/tmp/a\0b"));
+    for rejected in [
+        PathBuf::from("/tmp/quote\"root"),
+        PathBuf::from("/tmp/back\\slash"),
+        PathBuf::from("/tmp/new\nline"),
+        PathBuf::from("/tmp/tab\tchar"),
+        nul,
+        PathBuf::from("relative/root"),
+        PathBuf::from("/"),
+    ] {
+        assert!(
+            validate_path_text(&rejected).is_err(),
+            "should reject {rejected:?}"
+        );
+        assert!(
+            define("WRITABLE_0", &rejected).is_err(),
+            "should reject {rejected:?} as an SBPL define"
+        );
+    }
+}
+
+#[test]
+fn roots_reject_metacharacter_directories_and_overlap() {
+    let (_directory, base) = canonical_tempdir();
+    for name in ["quote\"dir", "back\\dir", "new\ndir"] {
+        let path = base.join(name);
+        fs::create_dir(&path).expect("should create odd directory");
+        assert!(
+            BoundaryRoots::new(&[], &[], &[path]).is_err(),
+            "should reject root named {name:?}"
+        );
+    }
+    let outer = base.join("outer");
+    let inner = outer.join("inner");
+    fs::create_dir_all(&inner).expect("should create nested roots");
+    assert!(
+        BoundaryRoots::new(
+            std::slice::from_ref(&inner),
+            &[],
+            std::slice::from_ref(&outer)
+        )
+        .is_err(),
+        "should reject nested roots"
+    );
+    assert!(
+        BoundaryRoots::new(
+            std::slice::from_ref(&outer),
+            &[],
+            std::slice::from_ref(&outer)
+        )
+        .is_err(),
+        "should reject duplicate roots"
+    );
+    assert!(
+        BoundaryRoots::new(&[outer], &[], &[]).is_err(),
+        "should require a writable root"
+    );
+    let many: Vec<PathBuf> = (0..=super::super::roots::MAX_ROOTS)
+        .map(|index| {
+            let path = base.join(format!("many-{index}"));
+            fs::create_dir(&path).expect("should create root");
+            path
+        })
+        .collect();
+    assert!(
+        BoundaryRoots::new(&[], &[], &many).is_err(),
+        "should reject more roots than profile slots"
+    );
+}
+
+pub(super) fn sample_roots(base: &Path) -> BoundaryRoots {
+    let immutable = base.join("immutable");
+    let writable = base.join("writable");
+    let tool = base.join("tool");
+    for path in [&immutable, &writable] {
+        fs::create_dir(path).expect("should create root");
+    }
+    fs::write(&tool, b"tool").expect("should create tool");
+    BoundaryRoots::new(&[immutable], &[tool], &[writable]).expect("should accept roots")
+}
+
+#[test]
+fn sbpl_profile_hides_ambient_openssl_configuration_after_root_grants() {
+    let (_directory, base) = canonical_tempdir();
+    let profile = MacProfile::generate(&sample_roots(&base)).expect("should generate profile");
+    let rule = "(deny file-read* (with errno ENOENT)\n  (literal \"/private/etc/ssl/openssl.cnf\")\n  (literal \"/etc/ssl/openssl.cnf\"))";
+    let denial = profile
+        .text()
+        .find(rule)
+        .expect("should hide both exact aliases");
+    let grant = profile
+        .text()
+        .rfind("(allow file-read*")
+        .expect("should have root grants");
+    assert!(denial > grant, "should override every file read grant");
+    assert!(
+        !profile.text().contains("(subpath \"/private/etc/ssl\")")
+            && !profile.text().contains("(subpath \"/etc/ssl\")"),
+        "should not grant access to ambient SSL configuration"
+    );
+}
+
+#[test]
+fn sbpl_profile_carries_paths_only_as_defines() {
+    let (_directory, base) = canonical_tempdir();
+    let roots = sample_roots(&base);
+    let profile = MacProfile::generate(&roots).expect("should generate profile");
+    let base_text = base.to_str().expect("should be UTF-8");
+    assert!(
+        !profile.text().contains(base_text),
+        "should never splice root paths into profile text"
+    );
+    for required in [
+        "(deny default)",
+        "(deny network*)",
+        "(allow signal (target same-sandbox))",
+        "(deny file-write* (subpath (param \"IMMUTABLE_0\")))",
+        "(allow file-read* file-write* process-exec (subpath (param \"WRITABLE_0\")))",
+    ] {
+        assert!(
+            profile.text().contains(required),
+            "should contain {required}"
+        );
+    }
+    let names: Vec<&str> = profile
+        .defines()
+        .iter()
+        .map(|(name, _)| name.as_str())
+        .collect();
+    assert_eq!(
+        names,
+        ["IMMUTABLE_0", "TOOL_0", "WRITABLE_0"],
+        "should bind every slot"
+    );
+    let arguments = profile.arguments();
+    assert_eq!(
+        arguments.first(),
+        Some(&OsString::from("-p")),
+        "should pass text with -p"
+    );
+    assert_eq!(
+        arguments
+            .iter()
+            .filter(|argument| *argument == "-D")
+            .count(),
+        3,
+        "should pass one define per root"
+    );
+}
+
+#[test]
+fn sbpl_fingerprint_depends_on_roots() {
+    let (_first_directory, first) = canonical_tempdir();
+    let (_second_directory, second) = canonical_tempdir();
+    let first = MacProfile::generate(&sample_roots(&first)).expect("should generate");
+    let second = MacProfile::generate(&sample_roots(&second)).expect("should generate");
+    assert_ne!(
+        first.fingerprint(),
+        second.fingerprint(),
+        "should bind root paths"
+    );
+    assert_eq!(
+        first.fingerprint(),
+        first.clone().fingerprint(),
+        "should be stable"
+    );
+}
+
+#[test]
+fn tree_scan_rejects_hard_links_and_unsafe_aliases() {
+    let (_directory, base) = canonical_tempdir();
+    let root = base.join("root");
+    fs::create_dir_all(root.join("sub")).expect("should create root");
+    fs::write(root.join("sub/file.txt"), b"source").expect("should write file");
+    symlink("sub/file.txt", root.join("inside")).expect("should create safe link");
+    TreeFacts::scan(&root, ScanPolicy::Immutable).expect("should accept a safe tree");
+
+    let hard = base.join("outside-link");
+    fs::hard_link(root.join("sub/file.txt"), &hard).expect("should hard link");
+    let rejected =
+        TreeFacts::scan(&root, ScanPolicy::Immutable).expect_err("should reject nlink 2");
+    assert!(
+        error_text(&rejected).contains("hard links"),
+        "should name the hard link"
+    );
+    fs::remove_file(&hard).expect("should remove link");
+
+    for (name, target) in [
+        ("absolute", "/etc/hosts"),
+        ("escaping", "../../outside"),
+        ("dangling", "sub/missing"),
+    ] {
+        let link = root.join(name);
+        symlink(target, &link).expect("should create link");
+        for policy in [ScanPolicy::Immutable, ScanPolicy::AliasesOnly] {
+            assert!(
+                TreeFacts::scan(&root, policy).is_err(),
+                "should reject {name} alias under {policy:?}"
+            );
+        }
+        fs::remove_file(&link).expect("should remove link");
+    }
+    let fifo = root.join("fifo");
+    let fifo_text =
+        std::ffi::CString::new(fifo.as_os_str().as_bytes()).expect("should be C string");
+    // SAFETY: `fifo_text` is a valid NUL-terminated path.
+    assert_eq!(
+        unsafe { libc::mkfifo(fifo_text.as_ptr(), 0o600) },
+        0,
+        "should create fifo"
+    );
+    assert!(
+        TreeFacts::scan(&root, ScanPolicy::AliasesOnly).is_err(),
+        "should reject special files"
+    );
+}
+
+#[test]
+fn tree_facts_detect_content_mode_and_membership_changes() {
+    let (_directory, base) = canonical_tempdir();
+    let file = base.join("file.txt");
+    fs::write(&file, b"one").expect("should write file");
+    let before = TreeFacts::scan(&base, ScanPolicy::Immutable).expect("should scan");
+    assert!(
+        before
+            .ensure_unchanged(&TreeFacts::scan(&base, ScanPolicy::Immutable).expect("should scan"))
+            .is_ok(),
+        "should accept an unchanged tree"
+    );
+    let mutations: [&dyn Fn(); 3] = [
+        &|| fs::write(&file, b"two").expect("should rewrite"),
+        &|| {
+            fs::set_permissions(&file, fs::Permissions::from_mode(0o400)).expect("should chmod");
+        },
+        &|| fs::write(base.join("added"), b"x").expect("should add"),
+    ];
+    for mutate in mutations {
+        let snapshot = TreeFacts::scan(&base, ScanPolicy::Immutable).expect("should scan");
+        mutate();
+        let after = TreeFacts::scan(&base, ScanPolicy::Immutable).expect("should rescan");
+        assert!(
+            snapshot.ensure_unchanged(&after).is_err(),
+            "should detect mutation"
+        );
+    }
+    let snapshot = TreeFacts::scan(&base, ScanPolicy::Immutable).expect("should scan");
+    fs::remove_file(base.join("added")).expect("should remove");
+    let after = TreeFacts::scan(&base, ScanPolicy::Immutable).expect("should rescan");
+    assert!(
+        snapshot.ensure_unchanged(&after).is_err(),
+        "should detect removal"
+    );
+}
+
+#[test]
+fn confined_command_environment_rejects_injection_and_duplicates() {
+    let command = ConfinedCommand::new(Path::new("/bin/tool"), Path::new("/work"), limits())
+        .expect("should describe command");
+    let command = command
+        .environment("HOME", "/work")
+        .expect("should accept HOME");
+    assert!(
+        ConfinedCommand::new(Path::new("/bin/tool"), Path::new("/work"), limits())
+            .expect("should describe command")
+            .environment("LD_PRELOAD", "/x.so")
+            .is_err(),
+        "should reject injection variables"
+    );
+    assert!(
+        command.environment("HOME", "/other").is_err(),
+        "should reject duplicates"
+    );
+    assert!(
+        ConfinedCommand::new(Path::new("relative"), Path::new("/work"), limits()).is_err(),
+        "should reject a relative program"
+    );
+}
+
+#[test]
+fn macos_boundary_is_test_only_until_qualified() {
+    let (_directory, base) = canonical_tempdir();
+    let roots = sample_roots(&base);
+    assert_eq!(
+        Boundary::mac_sandbox_for_tests(roots).is_ok(),
+        cfg!(target_os = "macos"),
+        "should allow sandbox-exec only on macOS"
+    );
+}
+
+#[test]
+fn instance_fingerprints_differ_for_identical_configurations() {
+    let platform = [9; 32];
+    let first = instance_fingerprint(&platform).expect("should draw a nonce");
+    let second = instance_fingerprint(&platform).expect("should draw a nonce");
+    assert_ne!(
+        first, second,
+        "should bind a fresh nonce into every instance"
+    );
+}
+
+#[cfg(target_os = "macos")]
+#[test]
+fn boundary_instances_never_share_a_fingerprint() {
+    let (_directory, base) = canonical_tempdir();
+    let roots = sample_roots(&base);
+    let first = Boundary::mac_sandbox_for_tests(roots.clone()).expect("should configure");
+    let second = Boundary::mac_sandbox_for_tests(roots).expect("should configure");
+    assert_ne!(
+        first.fingerprint, second.fingerprint,
+        "should bind a fresh nonce into every instance"
+    );
+}
+
+#[test]
+fn confined_paths_reject_dot_components() {
+    for (program, working_directory) in [
+        ("/tools/../bin/tool", "/work"),
+        ("/tools/./tool", "/work"),
+        ("/tools/tool", "/work/../etc"),
+        ("/tools/tool", "/work/."),
+        ("tools/tool", "/work"),
+    ] {
+        assert!(
+            ConfinedCommand::new(Path::new(program), Path::new(working_directory), limits())
+                .is_err(),
+            "should reject {program} in {working_directory}"
+        );
+    }
+}
+
+#[test]
+fn tool_roots_require_single_link_files_and_staging_provides_them() {
+    let (_directory, base) = canonical_tempdir();
+    let tools = base.join("tools");
+    fs::create_dir(&tools).expect("should create tools");
+    let staged = staged_probe(&tools);
+    let metadata = fs::metadata(staged.program()).expect("should stat staged probe");
+    assert_eq!(metadata.nlink(), 1, "should stage a single-link copy");
+    assert_eq!(metadata.mode() & 0o777, 0o555, "should stage read-only");
+    TreeFacts::scan(&tools, ScanPolicy::Immutable).expect("should accept the staged tool");
+    TreeFacts::scan(staged.program(), ScanPolicy::Immutable).expect("should scan a file root");
+    assert!(
+        helper_probe(&test_binary()).staged(&tools).is_err(),
+        "should refuse to overwrite a staged tool"
+    );
+    fs::hard_link(staged.program(), base.join("alias")).expect("should hard link");
+    assert!(
+        TreeFacts::scan(&tools, ScanPolicy::Immutable).is_err(),
+        "should reject a hard-linked tool"
+    );
+    assert!(
+        TreeFacts::scan(staged.program(), ScanPolicy::Immutable).is_err(),
+        "should reject a hard-linked file root"
+    );
+}
+
+#[test]
+fn writable_scans_reject_hard_links_before_runs() {
+    let (_directory, base) = canonical_tempdir();
+    let writable = base.join("writable");
+    fs::create_dir(&writable).expect("should create writable root");
+    fs::write(writable.join("file"), b"x").expect("should write");
+    TreeFacts::scan(&writable, ScanPolicy::SingleLinks).expect("should accept single links");
+    fs::hard_link(writable.join("file"), base.join("outside")).expect("should hard link");
+    assert!(
+        TreeFacts::scan(&writable, ScanPolicy::SingleLinks).is_err(),
+        "should reject a hard link before a run"
+    );
+    TreeFacts::scan(&writable, ScanPolicy::AliasesOnly).expect("should allow links after a run");
+}
+
+#[test]
+fn sbpl_profile_denies_group_escape_and_scopes_unix_sockets() {
+    let (_directory, base) = canonical_tempdir();
+    let profile = MacProfile::generate(&sample_roots(&base)).expect("should generate");
+    let text = profile.text();
+    let syscalls = format!("(deny syscall-unix (syscall-number {SYS_SETSID} {SYS_SETPGID}))");
+    assert!(text.contains(&syscalls), "should deny setsid and setpgid");
+    let network = text.find("(deny network*)").expect("should deny network");
+    let unix = text
+        .find("(local unix-socket (subpath (param \"WRITABLE_0\")))")
+        .expect("should allow Unix sockets under the writable root");
+    assert!(
+        unix > network,
+        "should re-allow only Unix sockets after the denial"
+    );
+    assert!(
+        !text.contains("unix-socket (subpath (param \"IMMUTABLE_0\"))"),
+        "should not allow Unix sockets in immutable roots"
+    );
+    for absent in ["(subpath \"/usr\")", "/usr/local"] {
+        assert!(!text.contains(absent), "should not allow {absent}");
+    }
+    assert!(
+        text.ends_with(
+            "(allow file-read-data (literal (param \"RUN_MARK_ALLOW\")))\n\
+             (deny file-read* (literal (param \"RUN_MARK_DENY\")))\n"
+        ),
+        "should end with the run instance marker rules so that they take precedence"
+    );
+}
+
+#[test]
+fn sibling_lifetime_is_owned_by_the_parent_pipe() {
+    let mut sibling = spawn_sibling();
+    let controlled = sibling.stdin.is_some();
+    if controlled {
+        drop(sibling.stdin.take());
+    } else {
+        sibling
+            .kill()
+            .expect("should stop the old timer-based fixture");
+    }
+    let deadline = Instant::now() + Duration::from_secs(5);
+    let status = loop {
+        if let Some(status) = sibling.try_wait().expect("should poll sibling") {
+            break Some(status);
+        }
+        if Instant::now() >= deadline {
+            sibling.kill().expect("should stop a failed fixture");
+            sibling.wait().expect("should reap a failed fixture");
+            break None;
+        }
+        std::thread::sleep(Duration::from_millis(10));
+    };
+    assert!(controlled, "should retain a parent-owned lifetime pipe");
+    assert!(
+        status.is_some_and(|status| status.success()),
+        "should exit successfully when the parent closes the pipe"
+    );
+}
+
+#[test]
+fn confined_debug_does_not_expose_private_stdin() {
+    let private = b"fictional-private-parent-input";
+    let command = ConfinedCommand::new(
+        Path::new("/example/tool"),
+        Path::new("/example/work"),
+        limits(),
+    )
+    .expect("should describe command")
+    .stdin_bytes(private.to_vec());
+    let debug = format!("{command:?}");
+    assert!(
+        !debug.contains("fictional-private-parent-input"),
+        "should omit private stdin from diagnostics"
+    );
+    assert!(
+        !debug.contains("102, 105, 99, 116"),
+        "should not render private stdin as decimal bytes"
+    );
+}
diff --git a/crates/trusted-server-release/src/collection.rs b/crates/trusted-server-release/src/collection.rs
new file mode 100644
index 0000000000..aa2eb0b6af
--- /dev/null
+++ b/crates/trusted-server-release/src/collection.rs
@@ -0,0 +1,368 @@
+//! Bounded cross-job transfer diagnostics, without release authorization.
+//!
+//! REST metadata corroborates a dependency-selected artifact, never its producer
+//! job. Only a qualified workflow adapter may eventually mint the dependency
+//! capability. Imported documents never reconstruct local recipe, boundary,
+//! composition, or runtime proof types. That production adapter remains closed.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256};
+
+use crate::documents::{Role, lower_hex, parse_json};
+use crate::error::ReleaseError;
+use crate::policy::FIXED_ARTIFACTS;
+
+const ARCHIVE_LIMIT: usize = 768 * 1024 * 1024;
+
+mod archive;
+pub(crate) mod producer;
+mod records;
+pub(crate) mod transfer;
+mod workflow_jobs;
+pub(crate) use records::CollectionDiagnostic;
+#[cfg(test)]
+pub(crate) use records::{ReceiptFacts, check_composition_receipt};
+#[cfg(test)]
+mod tests;
+
+/// Qualification of the dependency adapter is not available yet.
+#[derive(Clone, Copy)]
+pub(crate) enum QualifiedCollection {}
+
+/// Expected invocation identity from the trusted workflow dependency graph.
+#[derive(Clone, Debug)]
+struct Invocation {
+    repository: String,
+    repository_id: u64,
+    run_id: u64,
+    source_commit: String,
+    inventory_sha256: String,
+    profiles: [records::RoleProfile; 2],
+}
+
+/// One upload step output; REST cannot independently prove this job association.
+#[derive(Clone, Debug)]
+struct Upload {
+    asset: String,
+    role: String,
+    job: String,
+    attempt: u64,
+    recipe_sha256: String,
+    elapsed_seconds: u64,
+    deadline_seconds: u64,
+    artifact_name: String,
+    artifact_id: u64,
+    archive_sha256: String,
+    members: BTreeMap<String, u64>,
+}
+
+/// A terminal job conclusion as the trusted dependency adapter observed it.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, serde::Serialize)]
+#[serde(rename_all = "snake_case")]
+enum JobConclusion {
+    Success,
+    Failure,
+    Cancelled,
+    Skipped,
+    TimedOut,
+}
+
+/// What the trusted adapter observed for one optional reproduction job.
+///
+/// `conclusion` is `None` when the job had no terminal conclusion when the
+/// collector's bounded wait reached its deadline. The trusted adapter MUST
+/// wait for a terminal conclusion or for the full deadline before it
+/// constructs a conclusion-less observation; stopping early is not a legal
+/// input, and [`NoUpload::outcome`] rejects one whose elapsed wait is short of
+/// the deadline.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, serde::Serialize)]
+struct ObservedJob {
+    /// At least one job step executed.
+    ///
+    /// This is not GitHub's job `started_at`, which a job skipped or cancelled
+    /// before any step may still carry; the adapter derives it from executed
+    /// steps.
+    started: bool,
+    conclusion: Option<JobConclusion>,
+}
+
+/// An optional reproduction job that produced no upload.
+///
+/// It has no field for an upload ID, name or digest, so none can be supplied
+/// or synthesized for it.
+#[derive(Clone, Debug)]
+struct NoUpload {
+    asset: String,
+    job: ObservedJob,
+    elapsed_seconds: u64,
+    deadline_seconds: u64,
+}
+
+impl NoUpload {
+    /// Derives the spec outcome, or `None` for contradictory or unbounded input.
+    ///
+    /// `unavailable` means no reproduction ran: the job was still queued at the
+    /// deadline, or the scheduler skipped or cancelled it before any step
+    /// started. `failed` means it started and produced no upload, or its own
+    /// conclusion states failure or timeout. The latter stays `failed` even
+    /// without a started step, so a stated failure is never relabeled as an
+    /// absent measurement. A job without a conclusion is accepted only once the
+    /// wait reached the deadline, so the collector cannot cut a reproduction
+    /// short; deadlines are capped, so it cannot wait indefinitely either.
+    fn outcome(&self) -> Option<records::Outcome> {
+        if !bounded(self.elapsed_seconds, self.deadline_seconds) {
+            return None;
+        }
+        let at_deadline = self.elapsed_seconds == self.deadline_seconds;
+        match (self.job.started, self.job.conclusion) {
+            (false, None) if at_deadline => Some(records::Outcome::Unavailable),
+            (true, None) if at_deadline => Some(records::Outcome::Failed),
+            (_, None) => None,
+            (false, Some(JobConclusion::Skipped | JobConclusion::Cancelled)) => {
+                Some(records::Outcome::Unavailable)
+            }
+            (true, Some(JobConclusion::Skipped)) | (false, Some(JobConclusion::Success)) => None,
+            (_, Some(JobConclusion::Failure | JobConclusion::TimedOut))
+            | (true, Some(JobConclusion::Cancelled | JobConclusion::Success)) => {
+                Some(records::Outcome::Failed)
+            }
+        }
+    }
+}
+
+/// A bounded optional job result with no invented artifact identity.
+#[derive(Clone, Debug)]
+enum OptionalBuild {
+    /// An upload, valid only from a started job that concluded successfully.
+    Uploaded {
+        upload: Upload,
+        job: ObservedJob,
+    },
+    NotUploaded(NoUpload),
+}
+
+/// Authenticated dependency outputs; no JSON or caller-field constructor exists.
+#[derive(Debug)]
+pub(crate) struct TrustedDependencies {
+    invocation: Invocation,
+    required: Vec<Upload>,
+    optional: Vec<OptionalBuild>,
+}
+
+impl TrustedDependencies {
+    /// Keeps production closed until a qualified adapter supplies typed inputs.
+    pub(crate) fn from_qualified(qualification: QualifiedCollection) -> Self {
+        match qualification {}
+    }
+}
+
+/// A read-only exact-ID source; the future adapter must enforce transport bounds.
+pub(crate) trait ArtifactSource {
+    /// Fetches REST metadata for this exact artifact ID.
+    fn metadata(
+        &mut self,
+        repository: &str,
+        artifact_id: u64,
+    ) -> Result<Vec<u8>, Report<ReleaseError>>;
+    /// Re-downloads that same artifact's archive and reports any transfer warning.
+    fn download(
+        &mut self,
+        repository: &str,
+        artifact_id: u64,
+    ) -> Result<Download, Report<ReleaseError>>;
+}
+
+/// Downloaded bytes, separate from the final executable digest.
+pub(crate) struct Download {
+    pub(crate) archive: Vec<u8>,
+    pub(crate) transfer_warning: bool,
+}
+
+#[derive(Debug)]
+struct Transfer {
+    upload: Upload,
+    members: BTreeMap<String, Vec<u8>>,
+}
+
+/// Validated transfer bytes; this is not a qualified build or signing proof.
+#[derive(Debug)]
+pub(crate) struct ValidatedTransfers {
+    invocation: Invocation,
+    transfers: Vec<Transfer>,
+    absent: Vec<NoUpload>,
+}
+
+/// Validates current-run metadata and the complete bounded ZIP before use.
+///
+/// # Errors
+///
+/// Rejects mismatched dependency identities, stale REST metadata, transfer
+/// warnings, byte changes, or unsafe/undeclared archive members.
+pub(crate) fn validate_transfers(
+    dependencies: &TrustedDependencies,
+    source: &mut impl ArtifactSource,
+) -> Result<ValidatedTransfers, Report<ReleaseError>> {
+    if dependencies.required.len() > 5 || dependencies.optional.len() > 3 {
+        return Err(collection_error(
+            "dependency transfer count exceeds cohort bounds",
+        ));
+    }
+    let invocation = &dependencies.invocation;
+    if invocation.repository_id == 0
+        || invocation.run_id == 0
+        || !lower_hex(&invocation.source_commit, 40)
+        || !lower_hex(&invocation.inventory_sha256, 64)
+        || !safe_repository(&invocation.repository)
+    {
+        return Err(collection_error("invalid invocation identity"));
+    }
+    let mut ids = BTreeSet::new();
+    let mut roles = BTreeSet::new();
+    let mut transfers = Vec::new();
+    let mut absent = Vec::new();
+    // The mandatory channel carries every canonical build and only the Fastly
+    // reproduction; native reproductions are optional.
+    if dependencies.required.iter().any(|upload| {
+        upload.role != "A" && (upload.role != "B" || upload.asset != FIXED_ARTIFACTS[0].name)
+    }) {
+        return Err(collection_error(
+            "mandatory upload is neither canonical nor the Fastly reproduction",
+        ));
+    }
+    let mut uploads = dependencies.required.iter().collect::<Vec<_>>();
+    for optional in &dependencies.optional {
+        match optional {
+            OptionalBuild::Uploaded { upload, job } => {
+                if *job
+                    != (ObservedJob {
+                        started: true,
+                        conclusion: Some(JobConclusion::Success),
+                    })
+                {
+                    return Err(collection_error(
+                        "optional B claims an upload identity without a successful job",
+                    ));
+                }
+                // The optional channel carries only native reproductions.
+                if upload.role != "B" || upload.asset == FIXED_ARTIFACTS[0].name {
+                    return Err(collection_error(
+                        "optional upload is not a native reproduction",
+                    ));
+                }
+                uploads.push(upload);
+            }
+            OptionalBuild::NotUploaded(no_upload) => {
+                if no_upload.outcome().is_none()
+                    || !roles.insert((no_upload.asset.clone(), "B".to_owned()))
+                {
+                    return Err(collection_error(
+                        "optional B result is not bounded failed/unavailable",
+                    ));
+                }
+                absent.push(no_upload.clone());
+            }
+        }
+    }
+    for upload in uploads {
+        if !bounded_upload(upload)
+            || upload.artifact_id == 0
+            || upload.attempt == 0
+            || upload.job.is_empty()
+            || upload.job.len() > 128
+            || upload.job.chars().any(char::is_control)
+            || !matches!(upload.role.as_str(), "A" | "B")
+            || !lower_hex(&upload.archive_sha256, 64)
+            || !lower_hex(&upload.recipe_sha256, 64)
+            || !ids.insert(upload.artifact_id)
+            || !roles.insert((upload.asset.clone(), upload.role.clone()))
+        {
+            return Err(collection_error(
+                "invalid or reused dependency upload identity",
+            ));
+        }
+        let metadata = parse_json(
+            &source.metadata(&invocation.repository, upload.artifact_id)?,
+            Role::Metadata,
+        )
+        .map_err(|error| error.change_context(ReleaseError::Collection))?;
+        if metadata["id"].as_u64() != Some(upload.artifact_id)
+            || metadata["name"].as_str() != Some(upload.artifact_name.as_str())
+            || metadata["expired"].as_bool() != Some(false)
+            || metadata["digest"].as_str()
+                != Some(format!("sha256:{}", upload.archive_sha256).as_str())
+            || metadata["workflow_run"]["id"].as_u64() != Some(invocation.run_id)
+            || metadata["workflow_run"]["head_sha"].as_str()
+                != Some(invocation.source_commit.as_str())
+            || metadata["workflow_run"]["repository_id"].as_u64() != Some(invocation.repository_id)
+            || metadata["workflow_run"]["head_repository_id"].as_u64()
+                != Some(invocation.repository_id)
+        {
+            return Err(collection_error(
+                "REST artifact metadata disagrees with current invocation",
+            ));
+        }
+        let downloaded = source.download(&invocation.repository, upload.artifact_id)?;
+        if downloaded.transfer_warning
+            || downloaded.archive.len() > ARCHIVE_LIMIT
+            || digest(&downloaded.archive) != upload.archive_sha256
+        {
+            return Err(collection_error(
+                "transfer warning or archive digest mismatch",
+            ));
+        }
+        let members = archive::read(&downloaded.archive, &upload.members)?;
+        transfers.push(Transfer {
+            upload: upload.clone(),
+            members,
+        });
+    }
+    Ok(ValidatedTransfers {
+        invocation: invocation.clone(),
+        transfers,
+        absent,
+    })
+}
+
+/// Measures validated transfer data without constructing release authorization.
+///
+/// # Errors
+///
+/// Rejects missing A, mandatory Fastly B, changed inputs, dishonest observations,
+/// failed mandatory gates, or unequal complete final Wasm bytes.
+pub(crate) fn diagnose_collection(
+    transfers: &ValidatedTransfers,
+) -> Result<CollectionDiagnostic, Report<ReleaseError>> {
+    records::diagnose(transfers)
+}
+
+fn digest(bytes: &[u8]) -> String {
+    hex::encode(Sha256::digest(bytes))
+}
+
+fn collection_error(detail: impl std::fmt::Display) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Collection).attach(detail.to_string())
+}
+
+fn bounded_upload(upload: &Upload) -> bool {
+    bounded(upload.elapsed_seconds, upload.deadline_seconds)
+}
+
+/// Requires a nonzero capped deadline that the observed wait did not exceed.
+fn bounded(elapsed_seconds: u64, deadline_seconds: u64) -> bool {
+    deadline_seconds > 0 && deadline_seconds <= 5400 && elapsed_seconds <= deadline_seconds
+}
+
+fn safe_repository(repository: &str) -> bool {
+    let parts = repository.split('/').collect::<Vec<_>>();
+    parts.len() == 2
+        && parts.iter().all(|part| {
+            !part.is_empty()
+                && part.len() <= 100
+                && !matches!(*part, "." | "..")
+                && part
+                    .bytes()
+                    .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_' | b'.'))
+        })
+}
diff --git a/crates/trusted-server-release/src/collection/archive.rs b/crates/trusted-server-release/src/collection/archive.rs
new file mode 100644
index 0000000000..c204f88127
--- /dev/null
+++ b/crates/trusted-server-release/src/collection/archive.rs
@@ -0,0 +1,317 @@
+//! Deliberately narrow ZIP32 profile: flat regular files, stored or deflated.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use error_stack::Report;
+use flate2::{Crc, Decompress, FlushDecompress, Status};
+
+use super::{ARCHIVE_LIMIT, collection_error};
+
+use crate::error::ReleaseError;
+
+const MEMBER_LIMIT: u64 = 512 * 1024 * 1024;
+const TOTAL_LIMIT: u64 = 768 * 1024 * 1024;
+const MEMBER_COUNT: usize = 32;
+
+type Result<T> = std::result::Result<T, Report<ReleaseError>>;
+
+fn slice(bytes: &[u8], offset: usize, length: usize) -> Result<&[u8]> {
+    let end = offset
+        .checked_add(length)
+        .ok_or_else(|| collection_error("ZIP offset overflow"))?;
+    bytes
+        .get(offset..end)
+        .ok_or_else(|| collection_error("truncated ZIP"))
+}
+fn u16_at(bytes: &[u8], offset: usize) -> Result<u16> {
+    Ok(u16::from_le_bytes(
+        slice(bytes, offset, 2)?
+            .try_into()
+            .map_err(collection_error)?,
+    ))
+}
+fn u32_at(bytes: &[u8], offset: usize) -> Result<u32> {
+    Ok(u32::from_le_bytes(
+        slice(bytes, offset, 4)?
+            .try_into()
+            .map_err(collection_error)?,
+    ))
+}
+fn require(condition: bool, detail: &str) -> Result<()> {
+    if !condition {
+        return Err(collection_error(detail));
+    }
+    Ok(())
+}
+
+struct Entry {
+    name: String,
+    flags: u16,
+    method: u16,
+    crc: u32,
+    compressed: usize,
+    expanded: usize,
+    offset: usize,
+}
+
+fn central(
+    bytes: &[u8],
+    cursor: usize,
+    declared: &BTreeMap<String, u64>,
+) -> Result<(Entry, usize)> {
+    require(
+        u32_at(bytes, cursor)? == 0x02014b50,
+        "missing central ZIP member",
+    )?;
+    let flags = u16_at(bytes, cursor + 8)?;
+    let method = u16_at(bytes, cursor + 10)?;
+    let name_length = usize::from(u16_at(bytes, cursor + 28)?);
+    let extra = usize::from(u16_at(bytes, cursor + 30)?);
+    let comment = usize::from(u16_at(bytes, cursor + 32)?);
+    require(
+        flags & !0x0808 == 0 && matches!(method, 0 | 8),
+        "unsupported ZIP flags or compression",
+    )?;
+    require(
+        u16_at(bytes, cursor + 6)? <= 20
+            && extra == 0
+            && comment == 0
+            && u16_at(bytes, cursor + 34)? == 0,
+        "ZIP64, extras, comments or multidisk ZIP rejected",
+    )?;
+    let mode = u32_at(bytes, cursor + 38)? >> 16;
+    require(
+        mode & 0o170000 == 0 || mode & 0o170000 == 0o100000,
+        "ZIP member is not a regular file",
+    )?;
+    require(
+        u32_at(bytes, cursor + 38)? & 0x10 == 0,
+        "ZIP directory rejected",
+    )?;
+    let name = std::str::from_utf8(slice(bytes, cursor + 46, name_length)?)
+        .map_err(collection_error)?
+        .to_owned();
+    safe_name(&name).map_err(|error| error.change_context(ReleaseError::Collection))?;
+    let expanded = u32_at(bytes, cursor + 24)?;
+    let compressed = u32_at(bytes, cursor + 20)?;
+    require(
+        expanded != u32::MAX
+            && compressed != u32::MAX
+            && u64::from(expanded) <= MEMBER_LIMIT
+            && u64::from(compressed) <= MEMBER_LIMIT,
+        "ZIP member limit exceeded",
+    )?;
+    require(
+        declared.get(&name) == Some(&u64::from(expanded)),
+        "undeclared ZIP member or changed declared length",
+    )?;
+    Ok((
+        Entry {
+            name,
+            flags,
+            method,
+            crc: u32_at(bytes, cursor + 16)?,
+            compressed: compressed as usize,
+            expanded: expanded as usize,
+            offset: u32_at(bytes, cursor + 42)? as usize,
+        },
+        cursor + 46 + name_length,
+    ))
+}
+
+fn local(bytes: &[u8], entry: &Entry, central_start: usize) -> Result<(usize, Vec<u8>)> {
+    let start = entry.offset;
+    require(
+        u32_at(bytes, start)? == 0x04034b50,
+        "missing local ZIP member",
+    )?;
+    require(
+        u16_at(bytes, start + 4)? <= 20
+            && u16_at(bytes, start + 6)? == entry.flags
+            && u16_at(bytes, start + 8)? == entry.method,
+        "local ZIP profile disagrees with central entry",
+    )?;
+    let name_length = usize::from(u16_at(bytes, start + 26)?);
+    require(u16_at(bytes, start + 28)? == 0, "local ZIP extras rejected")?;
+    require(
+        slice(bytes, start + 30, name_length)? == entry.name.as_bytes(),
+        "local ZIP name disagrees",
+    )?;
+    let descriptor = entry.flags & 8 != 0;
+    for (offset, value) in [
+        (14, entry.crc),
+        (18, entry.compressed as u32),
+        (22, entry.expanded as u32),
+    ] {
+        let local = u32_at(bytes, start + offset)?;
+        require(
+            local == value || (descriptor && local == 0),
+            "local ZIP sizes or CRC disagree",
+        )?;
+    }
+    let body_start = start + 30 + name_length;
+    let compressed = slice(bytes, body_start, entry.compressed)?;
+    let mut end = body_start + entry.compressed;
+    if descriptor {
+        if u32_at(bytes, end)? == 0x08074b50 {
+            end += 4;
+        }
+        require(
+            u32_at(bytes, end)? == entry.crc
+                && u32_at(bytes, end + 4)? == entry.compressed as u32
+                && u32_at(bytes, end + 8)? == entry.expanded as u32,
+            "ZIP data descriptor disagrees",
+        )?;
+        end += 12;
+    }
+    require(
+        end <= central_start,
+        "ZIP member overlaps central directory",
+    )?;
+    let body = if entry.method == 0 {
+        require(
+            entry.compressed == entry.expanded,
+            "stored ZIP sizes disagree",
+        )?;
+        compressed.to_vec()
+    } else {
+        inflate(compressed, entry.expanded)?
+    };
+    let mut crc = Crc::new();
+    crc.update(&body);
+    require(
+        body.len() == entry.expanded && crc.sum() == entry.crc,
+        "ZIP member CRC mismatch",
+    )?;
+    Ok((end, body))
+}
+
+pub(super) fn read(
+    bytes: &[u8],
+    declared: &BTreeMap<String, u64>,
+) -> Result<BTreeMap<String, Vec<u8>>> {
+    require(
+        bytes.len() <= ARCHIVE_LIMIT
+            && bytes.len() >= 22
+            && !declared.is_empty()
+            && declared.len() <= MEMBER_COUNT,
+        "ZIP archive/count limit exceeded",
+    )?;
+    let mut total = 0_u64;
+    let mut names = BTreeSet::new();
+    for (name, size) in declared {
+        safe_name(name).map_err(|error| error.change_context(ReleaseError::Collection))?;
+        total = total
+            .checked_add(*size)
+            .ok_or_else(|| collection_error("ZIP expanded limit overflow"))?;
+        require(
+            *size <= MEMBER_LIMIT
+                && total <= TOTAL_LIMIT
+                && names.insert(name.to_ascii_lowercase()),
+            "ZIP declared size or duplicate name rejected",
+        )?;
+    }
+    let end = bytes.len() - 22;
+    require(
+        u32_at(bytes, end)? == 0x06054b50 && u16_at(bytes, end + 20)? == 0,
+        "ZIP end record or trailing data rejected",
+    )?;
+    let count = usize::from(u16_at(bytes, end + 10)?);
+    require(
+        u16_at(bytes, end + 4)? == 0
+            && u16_at(bytes, end + 6)? == 0
+            && usize::from(u16_at(bytes, end + 8)?) == count
+            && count == declared.len(),
+        "ZIP disk/count mismatch",
+    )?;
+    let central_start = u32_at(bytes, end + 16)? as usize;
+    let central_size = u32_at(bytes, end + 12)? as usize;
+    require(
+        central_start.checked_add(central_size) == Some(end),
+        "ZIP central bounds mismatch",
+    )?;
+    let mut cursor = central_start;
+    let mut entries = Vec::new();
+    let mut seen = BTreeSet::new();
+    for _ in 0..count {
+        let (entry, next) = central(bytes, cursor, declared)?;
+        require(
+            seen.insert(entry.name.to_ascii_lowercase()),
+            "duplicate ZIP member",
+        )?;
+        entries.push(entry);
+        cursor = next;
+    }
+    require(cursor == end, "hidden central ZIP members rejected")?;
+    entries.sort_by_key(|entry| entry.offset);
+    let mut expected_offset = 0;
+    let mut members = BTreeMap::new();
+    for entry in entries {
+        require(
+            entry.offset == expected_offset,
+            "overlapping or hidden local ZIP members rejected",
+        )?;
+        let (next, body) = local(bytes, &entry, central_start)?;
+        members.insert(entry.name, body);
+        expected_offset = next;
+    }
+    require(
+        expected_offset == central_start,
+        "hidden data before central ZIP rejected",
+    )?;
+    Ok(members)
+}
+
+fn safe_name(name: &str) -> Result<()> {
+    require(
+        !name.is_empty()
+            && name.len() <= 160
+            && name.as_bytes()[0].is_ascii_alphanumeric()
+            && name.split('.').all(|part| {
+                !part.is_empty()
+                    && part
+                        .bytes()
+                        .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'_' | b'-'))
+            }),
+        "unsafe flat ZIP member name",
+    )
+}
+
+// Exhausted input is not a terminal DEFLATE marker, even with matching output and CRC.
+fn inflate(compressed: &[u8], expanded: usize) -> Result<Vec<u8>> {
+    let mut decoder = Decompress::new(false);
+    let mut body = Vec::new();
+    let mut buffer = [0_u8; 64 * 1024];
+    loop {
+        let before_in = decoder.total_in();
+        let before_out = decoder.total_out();
+        let offset = usize::try_from(before_in).map_err(collection_error)?;
+        let input = compressed
+            .get(offset..)
+            .ok_or_else(|| collection_error("deflated ZIP consumed beyond its member"))?;
+        let remaining = expanded - body.len();
+        let limit = buffer.len().min(remaining + 1);
+        let status = decoder
+            .decompress(input, &mut buffer[..limit], FlushDecompress::None)
+            .map_err(collection_error)?;
+        let written =
+            usize::try_from(decoder.total_out() - before_out).map_err(collection_error)?;
+        require(
+            written <= remaining,
+            "deflated ZIP exceeds declared expanded size",
+        )?;
+        body.extend_from_slice(&buffer[..written]);
+        if status == Status::StreamEnd {
+            require(
+                decoder.total_in() == compressed.len() as u64
+                    && decoder.total_out() == expanded as u64,
+                "deflated ZIP length or compressed consumption mismatch",
+            )?;
+            return Ok(body);
+        }
+        require(
+            decoder.total_in() != before_in || decoder.total_out() != before_out,
+            "deflated ZIP did not reach its final stream marker",
+        )?;
+    }
+}
diff --git a/crates/trusted-server-release/src/collection/producer.rs b/crates/trusted-server-release/src/collection/producer.rs
new file mode 100644
index 0000000000..dcc81bfc9c
--- /dev/null
+++ b/crates/trusted-server-release/src/collection/producer.rs
@@ -0,0 +1,361 @@
+//! Flat diagnostic exports from owning build results, without release authority.
+//!
+//! This candidate format deliberately differs from the strict collector's build
+//! record. Runtime acceptance is retained only from its actual owning run;
+//! pair claims and qualified workflow identity remain unavailable.
+//! [`strict_record`] separately renders the collector's record shape from the
+//! same owners; it is not yet an export member.
+
+use std::collections::BTreeMap;
+use std::fs;
+use std::io::Write as _;
+use std::os::unix::fs::OpenOptionsExt as _;
+use std::path::{Path, PathBuf};
+
+use error_stack::Report;
+use serde_json::json;
+
+use super::{collection_error, digest};
+use crate::documents::hash_bounded_with_check;
+use crate::error::ReleaseError;
+use crate::recipe::{FastlyRuntimeAccepted, NativeStartupAccepted, RecipeCompleted, copy_artifact};
+
+const RECORD: &str = "candidate-build-record.json";
+const COMPOSITION: &str = "composition.json";
+const ARTIFACT: &str = "artifact";
+const INVENTORY: &str = "tsjs-inventory.json";
+const DOCUMENT_LIMIT: u64 = 16 * 1024 * 1024;
+
+pub(crate) mod strict_record;
+
+/// Owned flat candidate files, with no signing or trusted dependency authority.
+#[derive(Debug)]
+pub(crate) struct CandidateBuildExport {
+    directory: tempfile::TempDir,
+    root: PathBuf,
+    members: BTreeMap<String, Member>,
+}
+
+#[derive(Debug)]
+struct Member {
+    size: u64,
+    sha256: String,
+}
+
+enum RuntimeAcceptance<'a> {
+    Fastly(&'a FastlyRuntimeAccepted),
+    Native(&'a NativeStartupAccepted),
+}
+
+impl RuntimeAcceptance<'_> {
+    fn diagnostic_for(
+        &self,
+        completed: &RecipeCompleted,
+    ) -> Result<serde_json::Value, Report<ReleaseError>> {
+        match self {
+            Self::Fastly(accepted) => accepted.diagnostic_for(completed),
+            Self::Native(accepted) => accepted.diagnostic_for(completed),
+        }
+    }
+}
+
+impl CandidateBuildExport {
+    /// Copies measured owning results into a new flat diagnostic handoff.
+    ///
+    /// Actual socket observations and an approved-source recipe definition are
+    /// mandatory. Exact invocation identity remains separate from that shared
+    /// definition. Single-build ambient observations make no A/B variation claim.
+    /// The original owner is checked again after the copy.
+    ///
+    /// # Errors
+    ///
+    /// Rejects missing measured receipts, missing composition, changed owned
+    /// outputs, unsafe paths, oversized documents or changed copied bytes.
+    pub(crate) fn from_completed(
+        completed: &RecipeCompleted,
+    ) -> Result<Self, Report<ReleaseError>> {
+        Self::from_owned(completed, None)
+    }
+
+    /// Copies a candidate with its actual role-bound final-byte Fastly acceptance.
+    ///
+    /// # Errors
+    ///
+    /// Rejects another source, role or artifact, missing required build evidence,
+    /// changed owned files or an oversized diagnostic record.
+    pub(crate) fn with_fastly_runtime(
+        completed: &RecipeCompleted,
+        accepted: &FastlyRuntimeAccepted,
+    ) -> Result<Self, Report<ReleaseError>> {
+        Self::from_owned(completed, Some(RuntimeAcceptance::Fastly(accepted)))
+    }
+
+    /// Copies a candidate with its actual role-bound native startup acceptance.
+    ///
+    /// # Errors
+    ///
+    /// Rejects another source, role, selected CLI package or final artifact,
+    /// missing build evidence, changed owned files or oversized diagnostics.
+    pub(crate) fn with_native_startup(
+        completed: &RecipeCompleted,
+        accepted: &NativeStartupAccepted,
+    ) -> Result<Self, Report<ReleaseError>> {
+        Self::from_owned(completed, Some(RuntimeAcceptance::Native(accepted)))
+    }
+
+    fn from_owned(
+        completed: &RecipeCompleted,
+        accepted: Option<RuntimeAcceptance<'_>>,
+    ) -> Result<Self, Report<ReleaseError>> {
+        let definition = completed.recipe_definition()?;
+        let denial = completed.denial_receipt()?;
+        let composition = completed.composition_export()?;
+        let javascript = completed.javascript_contributions()?;
+        let artifact = completed.artifact();
+        let observed = completed.ambient().observed();
+        let runtime = accepted
+            .map(|accepted| accepted.diagnostic_for(completed))
+            .transpose()?;
+        let gaps = [
+            "runtime-acceptance-not-exported",
+            "ambient-pair-claims-not-exported",
+            "composition-coverage-incomplete",
+            "bootstrap-not-authenticated",
+            "workflow-producer-authority-not-established",
+        ]
+        .into_iter()
+        .filter(|gap| *gap != "runtime-acceptance-not-exported" || runtime.is_none())
+        .collect::<Vec<_>>();
+        let [inventory, settings, js_tools] = completed.js_digests();
+        let record = serde_json::to_vec(&json!({
+            "domain": "trusted-server.release.candidate-build-diagnostic",
+            "schema_version": 1,
+            "release_qualification": false,
+            "source_commit": completed.commit().as_str(),
+            "asset": artifact.name(), "role": completed.role().spec_label(),
+            "recipe_sha256": definition.sha256(),
+            "recipe_definition": definition.descriptor(),
+            "invocation_sha256": completed.plan_digest(),
+            "artifact": {"member": ARTIFACT, "sha256": artifact.sha256(), "size": artifact.size()},
+            "composition": {"member": COMPOSITION, "sha256": composition.sha256(), "summary": composition.summary()},
+            "javascript_inventory": {"member": INVENTORY, "sha256": javascript.inventory_sha256(),
+                "size": javascript.raw_inventory().len()},
+            "inputs": {"cargo_lock": completed.cargo_lock_sha256(),
+                "materials": completed.materials_digest(), "rust_tools": completed.rust_tools_digest(),
+                "js_inventory": inventory, "js_settings": settings, "js_tools": js_tools},
+            "socket_observations": denial,
+            "runtime_acceptance": runtime,
+            "ambient_observation": {
+                "umask": observed.umask, "jobs": observed.jobs,
+                "host_locale": observed.host_locale, "host_timezone": observed.host_timezone,
+                "child_locale": observed.child_locale, "child_timezone": observed.child_timezone,
+                "execution_uid": observed.execution_uid, "checkout_root": observed.checkout_root,
+                "started_at_seconds": observed.started_at_seconds,
+            },
+            "elapsed_seconds": completed.elapsed().as_secs(),
+            "gaps": gaps,
+        }))
+        .map_err(collection_error)?;
+        if record.len() as u64 > DOCUMENT_LIMIT {
+            return Err(collection_error("candidate build record exceeds its bound"));
+        }
+        let directory = tempfile::tempdir().map_err(collection_error)?;
+        let root = fs::canonicalize(directory.path()).map_err(collection_error)?;
+        let copied = copy_artifact(
+            artifact.path(),
+            completed.rehash_for_handoff()?,
+            &root,
+            ARTIFACT,
+            artifact.size(),
+        )?;
+        if copied.size() != artifact.size() || copied.sha256() != artifact.sha256() {
+            return Err(collection_error("candidate artifact copy changed"));
+        }
+        let mut members = BTreeMap::from([(
+            ARTIFACT.to_owned(),
+            Member {
+                size: copied.size(),
+                sha256: copied.sha256().to_owned(),
+            },
+        )]);
+        for (name, bytes) in [
+            (COMPOSITION, composition.bytes()),
+            (INVENTORY, javascript.raw_inventory()),
+            (RECORD, record.as_slice()),
+        ] {
+            write_new(&root.join(name), bytes)?;
+            members.insert(
+                name.to_owned(),
+                Member {
+                    size: bytes.len() as u64,
+                    sha256: digest(bytes),
+                },
+            );
+        }
+        completed.rehash_for_handoff()?;
+        let export = Self {
+            directory,
+            root,
+            members,
+        };
+        export.rehash_for_handoff()?;
+        Ok(export)
+    }
+
+    /// Returns the flat directory after checking every exact retained member.
+    ///
+    /// The owned files survive recipe/source/target cleanup. This verifies their
+    /// integrity only and cannot authenticate a workflow upload or release.
+    ///
+    /// # Errors
+    ///
+    /// Rejects missing, extra, changed, aliased, linked or oversized members.
+    pub(crate) fn rehash_for_handoff(&self) -> Result<&Path, Report<ReleaseError>> {
+        let root = fs::canonicalize(self.directory.path()).map_err(collection_error)?;
+        if root != self.root {
+            return Err(collection_error("candidate export directory changed"));
+        }
+        let names = fs::read_dir(&self.root)
+            .map_err(collection_error)?
+            .map(|entry| entry.map(|entry| entry.file_name()))
+            .collect::<Result<Vec<_>, _>>()
+            .map_err(collection_error)?;
+        if names.len() != self.members.len()
+            || names.iter().any(|name| {
+                !name
+                    .to_str()
+                    .is_some_and(|name| self.members.contains_key(name))
+            })
+        {
+            return Err(collection_error("candidate export members changed"));
+        }
+        for (name, expected) in &self.members {
+            let measured =
+                hash_bounded_with_check(&self.root.join(name), expected.size, &|| Ok(()))
+                    .map_err(|error| error.change_context(ReleaseError::Collection))?;
+            if measured.size != expected.size || measured.sha256 != expected.sha256 {
+                return Err(collection_error("candidate export bytes changed"));
+            }
+        }
+        Ok(&self.root)
+    }
+}
+
+/// Writes `bytes` to a new private file, refusing an existing path or link.
+///
+/// # Errors
+///
+/// Rejects an existing path, a symlink at `path` and any write or sync failure.
+pub(crate) fn write_new(path: &Path, bytes: &[u8]) -> Result<(), Report<ReleaseError>> {
+    let mut file = fs::OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .mode(0o600)
+        .custom_flags(libc::O_NOFOLLOW | libc::O_CLOEXEC)
+        .open(path)
+        .map_err(collection_error)?;
+    file.write_all(bytes)
+        .and_then(|()| file.sync_all())
+        .map_err(collection_error)
+}
+
+#[cfg(test)]
+mod tests {
+    use std::os::unix::fs::symlink;
+
+    use super::*;
+
+    // These files exercise diagnostic-file integrity only. They contain no
+    // measured execution receipts and cannot enter the owning producer path.
+    fn diagnostic_files() -> CandidateBuildExport {
+        let directory = tempfile::tempdir().expect("should create diagnostic storage");
+        let root = fs::canonicalize(directory.path()).expect("should resolve diagnostic storage");
+        let mut members = BTreeMap::new();
+        for (name, bytes) in [
+            (ARTIFACT, b"fictional executable".as_slice()),
+            (COMPOSITION, b"fictional composition".as_slice()),
+            (INVENTORY, b"fictional original inventory".as_slice()),
+            (RECORD, b"fictional record".as_slice()),
+        ] {
+            write_new(&root.join(name), bytes).expect("should retain diagnostic member");
+            members.insert(
+                name.to_owned(),
+                Member {
+                    size: bytes.len() as u64,
+                    sha256: digest(bytes),
+                },
+            );
+        }
+        CandidateBuildExport {
+            directory,
+            root,
+            members,
+        }
+    }
+
+    #[test]
+    fn flat_diagnostic_members_survive_without_original_build_roots() {
+        let export = diagnostic_files();
+        let root = export
+            .rehash_for_handoff()
+            .expect("should verify retained diagnostic files");
+        assert_eq!(
+            fs::read_dir(root).expect("should list export").count(),
+            4,
+            "should retain artifact, original inventory, composition and diagnostic record"
+        );
+        assert!(
+            root.join("tsjs-inventory.json").is_file(),
+            "should retain original JS inventory"
+        );
+    }
+
+    #[test]
+    fn each_changed_export_member_blocks_handoff() {
+        for name in [ARTIFACT, COMPOSITION, INVENTORY, RECORD] {
+            let export = diagnostic_files();
+            fs::write(export.root.join(name), b"changed").expect("should change one member");
+            assert!(
+                export.rehash_for_handoff().is_err(),
+                "should reject changed {name}"
+            );
+        }
+    }
+
+    #[test]
+    fn missing_and_extra_export_members_block_handoff() {
+        let missing = diagnostic_files();
+        fs::remove_file(missing.root.join(COMPOSITION)).expect("should remove composition");
+        assert!(
+            missing.rehash_for_handoff().is_err(),
+            "should reject missing member"
+        );
+        let extra = diagnostic_files();
+        fs::write(extra.root.join("unexpected"), b"extra").expect("should add extra member");
+        assert!(
+            extra.rehash_for_handoff().is_err(),
+            "should reject undeclared member"
+        );
+    }
+
+    #[test]
+    fn linked_export_members_block_handoff_even_when_bytes_match() {
+        for hard_link in [false, true] {
+            let export = diagnostic_files();
+            let outside = tempfile::tempdir().expect("should create separate file storage");
+            let path = outside.path().join("same-bytes");
+            fs::copy(export.root.join(ARTIFACT), &path).expect("should copy matching bytes");
+            fs::remove_file(export.root.join(ARTIFACT)).expect("should remove original member");
+            if hard_link {
+                fs::hard_link(&path, export.root.join(ARTIFACT))
+                    .expect("should hard link matching bytes");
+            } else {
+                symlink(&path, export.root.join(ARTIFACT)).expect("should alias matching bytes");
+            }
+            assert!(
+                export.rehash_for_handoff().is_err(),
+                "should reject linked artifact with matching bytes"
+            );
+        }
+    }
+}
diff --git a/crates/trusted-server-release/src/collection/producer/strict_record.rs b/crates/trusted-server-release/src/collection/producer/strict_record.rs
new file mode 100644
index 0000000000..1cdbe62659
--- /dev/null
+++ b/crates/trusted-server-release/src/collection/producer/strict_record.rs
@@ -0,0 +1,329 @@
+//! Renders the strict collector's `build-record.json` from owning build results.
+//!
+//! [`super::CandidateBuildExport`] keeps its own diagnostic record. This
+//! renderer states the same owned observations in the collector's schema, so
+//! the collector's unchanged checks can run on producer output. It grants no
+//! authority: the collector still binds identity fields to trusted upload
+//! outputs, and the record cannot reconstruct any local proof type.
+//! `composition_sha256` names the producer's own sealed composition receipt,
+//! which the collector parses strictly and binds to this record.
+//!
+//! Remaining gaps before a real producer transfer can pass the collector:
+//!
+//! - Job identity: the producing job's workflow job ID and attempt are not
+//!   owned by the completed build, so the caller must supply [`ProducerJob`].
+//! - Native startup: the collector schema allows no runtime block for native
+//!   builds, so native startup acceptance cannot be represented.
+
+use std::collections::BTreeSet;
+
+use error_stack::Report;
+use serde_json::{Value, json};
+
+use super::{DOCUMENT_LIMIT, collection_error};
+use crate::boundary::DenialReceipt;
+use crate::error::ReleaseError;
+use crate::policy::FIXED_ARTIFACTS;
+use crate::recipe::{
+    AmbientClaim, Dimension, FastlyRuntimeAccepted, ObservedAmbient, RecipeCompleted, Role,
+};
+
+/// Member name the strict collector reads from one build transfer.
+pub(crate) const STRICT_RECORD: &str = "build-record.json";
+/// Longest workflow job ID in bytes, as the collector's upload identity check bounds it.
+const JOB_LIMIT: usize = 128;
+
+type Result<T> = std::result::Result<T, Report<ReleaseError>>;
+
+/// The producing job's workflow job ID and run attempt, as its runner reports them.
+///
+/// This is self-reported context, not authority: the collector requires it to
+/// equal the trusted dependency upload identity of the same transfer.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct ProducerJob {
+    job: String,
+    attempt: u64,
+}
+
+impl ProducerJob {
+    /// Accepts exactly the job IDs and attempts the collector's upload check accepts.
+    ///
+    /// # Errors
+    ///
+    /// Rejects an empty job ID, one over [`JOB_LIMIT`] bytes or holding a
+    /// control character, and attempt `0`.
+    pub(crate) fn new(job: &str, attempt: u64) -> Result<Self> {
+        if job.is_empty()
+            || job.len() > JOB_LIMIT
+            || job.chars().any(char::is_control)
+            || attempt == 0
+        {
+            return Err(collection_error(
+                "producer job identity is empty, unbounded or has no attempt",
+            ));
+        }
+        Ok(Self {
+            job: job.to_owned(),
+            attempt,
+        })
+    }
+}
+
+/// Approved input digests the collector compares across a pair.
+#[derive(Clone, Debug)]
+struct InputDigests {
+    cargo_lock: String,
+    materials: String,
+    rust_tools: String,
+    js_settings: String,
+    js_tools: String,
+}
+
+/// Measured socket controls, boundary identity and exact invocation of one build.
+#[derive(Clone, Debug)]
+struct SocketControls {
+    /// Boundary instance the measured denial receipt names.
+    fingerprint: String,
+    /// Boundary instance that executed the build. Instance identity only: it
+    /// includes a fresh per-instance nonce and says nothing about the invocation.
+    execution_fingerprint: String,
+    /// Exact invocation digest: program, arguments including jobs,
+    /// environment, checkout-root working directory and umask.
+    invocation_digest: String,
+    control_exit: i32,
+    control_accepts: u32,
+    probe_exit: i32,
+    probe_errno: i32,
+    probe_accepts: u32,
+}
+
+impl SocketControls {
+    fn from_owned(completed: &RecipeCompleted, receipt: &DenialReceipt) -> Result<Self> {
+        let count = |accepts: usize| u32::try_from(accepts).map_err(collection_error);
+        let (control_exit, control_accepts) = receipt.control();
+        let (probe_exit, probe_accepts) = receipt.probe();
+        Ok(Self {
+            fingerprint: receipt.fingerprint().to_owned(),
+            execution_fingerprint: hex::encode(completed.boundary_fingerprint()),
+            invocation_digest: completed.plan_digest().to_owned(),
+            control_exit,
+            control_accepts: count(control_accepts)?,
+            probe_exit,
+            probe_errno: receipt.denied_errno(),
+            probe_accepts: count(probe_accepts)?,
+        })
+    }
+}
+
+/// Final-byte Fastly runtime facts taken from this build's own acceptance.
+#[derive(Clone, Debug)]
+struct RuntimeFacts {
+    role: Role,
+    source_commit: String,
+    final_wasm_sha256: String,
+    final_wasm_size: u64,
+    publisher_status: u16,
+    viceroy_version: String,
+}
+
+/// One build's owned observations, in the strict collector's record shape.
+#[derive(Clone, Debug)]
+pub(crate) struct StrictBuildRecord {
+    source_commit: String,
+    recipe_sha256: String,
+    asset: String,
+    role: Role,
+    job: ProducerJob,
+    inputs: InputDigests,
+    inventory_sha256: String,
+    artifact_sha256: String,
+    artifact_size: u64,
+    composition_sha256: String,
+    ambient: ObservedAmbient,
+    boundary: SocketControls,
+    runtime: Option<RuntimeFacts>,
+}
+
+impl StrictBuildRecord {
+    /// Collects the strict record facts from one completed build.
+    ///
+    /// A Fastly build requires its own role-bound final-byte acceptance, which
+    /// is checked against this build before use. A native build carries none:
+    /// the collector schema has no native startup block, so native startup
+    /// acceptance is not represented here.
+    ///
+    /// # Errors
+    ///
+    /// Rejects missing measured socket receipts, recipe definition, composition
+    /// or JS evidence, changed owned outputs, a missing Fastly acceptance, an
+    /// acceptance for another build, and any acceptance on a native build.
+    pub(crate) fn from_owned(
+        completed: &RecipeCompleted,
+        accepted: Option<&FastlyRuntimeAccepted>,
+        job: ProducerJob,
+    ) -> Result<Self> {
+        let definition = completed.recipe_definition()?;
+        let denial = completed.denial_receipt()?;
+        let composition = completed.composition_export()?;
+        let javascript = completed.javascript_contributions()?;
+        let artifact = completed.artifact();
+        let fastly = completed.asset().artifact().name == FIXED_ARTIFACTS[0].name;
+        let runtime = match (fastly, accepted) {
+            (true, Some(accepted)) => {
+                accepted.diagnostic_for(completed)?;
+                let observed = accepted.observed();
+                Some(RuntimeFacts {
+                    role: accepted.role(),
+                    source_commit: accepted.source_commit().as_str().to_owned(),
+                    final_wasm_sha256: observed.artifact_sha256().to_owned(),
+                    final_wasm_size: observed.artifact_size(),
+                    publisher_status: observed.publisher().status,
+                    viceroy_version: observed.viceroy_version().to_owned(),
+                })
+            }
+            (true, None) => {
+                return Err(collection_error(
+                    "a Fastly strict record requires this build's own runtime acceptance",
+                ));
+            }
+            (false, Some(_)) => {
+                return Err(collection_error(
+                    "a native strict record cannot carry a Fastly runtime acceptance",
+                ));
+            }
+            (false, None) => None,
+        };
+        let [_, js_settings, js_tools] = completed.js_digests();
+        let record = Self {
+            source_commit: completed.commit().as_str().to_owned(),
+            recipe_sha256: definition.sha256().to_owned(),
+            asset: artifact.name().to_owned(),
+            role: completed.role(),
+            job,
+            inputs: InputDigests {
+                cargo_lock: completed.cargo_lock_sha256().to_owned(),
+                materials: completed.materials_digest().to_owned(),
+                rust_tools: completed.rust_tools_digest().to_owned(),
+                js_settings: js_settings.to_owned(),
+                js_tools: js_tools.to_owned(),
+            },
+            inventory_sha256: javascript.inventory_sha256().to_owned(),
+            artifact_sha256: artifact.sha256().to_owned(),
+            artifact_size: artifact.size(),
+            composition_sha256: composition.sha256().to_owned(),
+            ambient: completed.ambient().observed().clone(),
+            boundary: SocketControls::from_owned(completed, denial)?,
+            runtime,
+        };
+        completed.rehash_for_handoff()?;
+        Ok(record)
+    }
+
+    /// Renders the exact strict collector record bytes.
+    ///
+    /// # Errors
+    ///
+    /// Rejects a non-UTF-8 checkout root or a record exceeding the metadata bound.
+    pub(crate) fn to_bytes(&self) -> Result<Vec<u8>> {
+        let bytes = serde_json::to_vec(&self.to_value()?).map_err(collection_error)?;
+        if bytes.len() as u64 > DOCUMENT_LIMIT {
+            return Err(collection_error("strict build record exceeds its bound"));
+        }
+        Ok(bytes)
+    }
+
+    fn to_value(&self) -> Result<Value> {
+        let ambient = &self.ambient;
+        let checkout_root = ambient
+            .checkout_root
+            .to_str()
+            .ok_or_else(|| collection_error("observed checkout root is not UTF-8"))?;
+        // The compiled placement policy, not a pair observation: a single build
+        // cannot see its counterpart, and the collector's pair comparison
+        // verifies every varied dimension from both observed records.
+        let claim = AmbientClaim::standard();
+        let boundary = &self.boundary;
+        // A denial receipt exists only after the confined probe was denied, so
+        // its probe run is the confined one.
+        let runtime = self.runtime.as_ref().map(|runtime| {
+            // Acceptance exists only after the publisher page held this run's
+            // origin marker exactly once and exactly one injected script.
+            json!({
+                "role": runtime.role.spec_label(),
+                "source_commit": runtime.source_commit,
+                "final_wasm_sha256": runtime.final_wasm_sha256,
+                "final_wasm_size": runtime.final_wasm_size,
+                "publisher_status": runtime.publisher_status,
+                "injected_scripts": 1,
+                "origin_marker_matched": true,
+                "viceroy_version": runtime.viceroy_version,
+            })
+        });
+        Ok(json!({
+            "schema_version": 1,
+            "source_commit": self.source_commit,
+            "recipe_sha256": self.recipe_sha256,
+            "asset": self.asset,
+            "role": self.role.spec_label(),
+            "job": self.job.job,
+            "attempt": self.job.attempt,
+            "inputs": {
+                "cargo_lock": self.inputs.cargo_lock,
+                "materials": self.inputs.materials,
+                "rust_tools": self.inputs.rust_tools,
+                "js_settings": self.inputs.js_settings,
+                "js_tools": self.inputs.js_tools,
+            },
+            "inventory_sha256": self.inventory_sha256,
+            "artifact_sha256": self.artifact_sha256,
+            "artifact_size": self.artifact_size,
+            "composition_sha256": self.composition_sha256,
+            "ambient": {
+                "umask": ambient.umask,
+                "jobs": ambient.jobs,
+                "checkout_root": checkout_root,
+                "started_at_seconds": ambient.started_at_seconds,
+                "execution_uid": ambient.execution_uid,
+                "host_locale": ambient.host_locale,
+                "host_timezone": ambient.host_timezone,
+                "child_locale": ambient.child_locale,
+                "child_timezone": ambient.child_timezone,
+            },
+            "claim": {
+                "varied": dimension_names(&claim.varied),
+                "normalized": dimension_names(&claim.normalized),
+                "unsupported": dimension_names(&claim.unsupported),
+            },
+            "boundary": {
+                "fingerprint": boundary.fingerprint,
+                "execution_fingerprint": boundary.execution_fingerprint,
+                "invocation_digest": boundary.invocation_digest,
+                "confined": true,
+                "control_exit": boundary.control_exit,
+                "control_accepts": boundary.control_accepts,
+                "probe_exit": boundary.probe_exit,
+                "probe_errno": boundary.probe_errno,
+                "probe_accepts": boundary.probe_accepts,
+            },
+            "runtime": runtime,
+        }))
+    }
+}
+
+fn dimension_names(dimensions: &BTreeSet<Dimension>) -> Vec<&'static str> {
+    dimensions
+        .iter()
+        .map(|dimension| match dimension {
+            Dimension::Umask => "umask",
+            Dimension::Jobs => "jobs",
+            Dimension::CheckoutRoot => "checkout_root",
+            Dimension::StartTime => "start_time",
+            Dimension::Locale => "locale",
+            Dimension::Timezone => "timezone",
+            Dimension::ExecutionUser => "execution_user",
+        })
+        .collect()
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/trusted-server-release/src/collection/producer/strict_record/tests.rs b/crates/trusted-server-release/src/collection/producer/strict_record/tests.rs
new file mode 100644
index 0000000000..f413277bc8
--- /dev/null
+++ b/crates/trusted-server-release/src/collection/producer/strict_record/tests.rs
@@ -0,0 +1,516 @@
+use std::ffi::OsStr;
+use std::os::unix::ffi::OsStrExt as _;
+use std::path::PathBuf;
+
+use serde_json::json;
+
+use super::*;
+use crate::collection::tests::{cohort_fixture, composition_receipt};
+use crate::collection::{ValidatedTransfers, diagnose_collection, digest};
+
+// Fictional facts mirroring what a completed build owns. Pure tests cannot
+// construct measured socket receipts, composition receipts or runtime
+// acceptance, so these exercise the rendering and the unchanged collector only.
+fn observed_ambient(role: Role) -> ObservedAmbient {
+    let (umask, jobs, root, started, locale, timezone) = match role {
+        Role::Canonical => (0o022, 4, "/external-release-A", 100, "C", "UTC"),
+        Role::Reproduction => (
+            0o027,
+            2,
+            "/external-release-B",
+            101,
+            "en_US.UTF-8",
+            "Pacific/Auckland",
+        ),
+    };
+    ObservedAmbient {
+        umask,
+        jobs,
+        host_locale: locale.to_owned(),
+        host_timezone: timezone.to_owned(),
+        child_locale: "C".to_owned(),
+        child_timezone: "UTC".to_owned(),
+        execution_uid: 1000,
+        checkout_root: PathBuf::from(root),
+        started_at_seconds: started,
+    }
+}
+
+/// Producer facts for one fixture transfer, agreeing with its trusted upload.
+fn producer_record(fixture: &ValidatedTransfers, index: usize) -> StrictBuildRecord {
+    let transfer = &fixture.transfers[index];
+    let upload = &transfer.upload;
+    let role = match upload.role.as_str() {
+        "A" => Role::Canonical,
+        "B" => Role::Reproduction,
+        other => panic!("should use a known fixture role, got {other}"),
+    };
+    let artifact = &transfer.members["artifact"];
+    let (fingerprint, invocation_digest) = match role {
+        Role::Canonical => ("3".repeat(64), "5".repeat(64)),
+        Role::Reproduction => ("4".repeat(64), "6".repeat(64)),
+    };
+    let runtime = (upload.asset == FIXED_ARTIFACTS[0].name).then(|| RuntimeFacts {
+        role,
+        source_commit: fixture.invocation.source_commit.clone(),
+        final_wasm_sha256: digest(artifact),
+        final_wasm_size: artifact.len() as u64,
+        publisher_status: 200,
+        viceroy_version: "0.21.0".to_owned(),
+    });
+    StrictBuildRecord {
+        source_commit: fixture.invocation.source_commit.clone(),
+        recipe_sha256: upload.recipe_sha256.clone(),
+        asset: upload.asset.clone(),
+        role,
+        job: ProducerJob::new(&upload.job, upload.attempt)
+            .expect("should accept the fixture job identity"),
+        inputs: InputDigests {
+            cargo_lock: "d".repeat(64),
+            materials: "e".repeat(64),
+            rust_tools: "f".repeat(64),
+            js_settings: "1".repeat(64),
+            js_tools: "2".repeat(64),
+        },
+        inventory_sha256: digest(&transfer.members["tsjs-inventory.json"]),
+        artifact_sha256: digest(artifact),
+        artifact_size: artifact.len() as u64,
+        composition_sha256: digest(&transfer.members["composition.json"]),
+        ambient: observed_ambient(role),
+        boundary: SocketControls {
+            fingerprint: fingerprint.clone(),
+            execution_fingerprint: fingerprint,
+            invocation_digest,
+            control_exit: 0,
+            control_accepts: 1,
+            probe_exit: 3,
+            probe_errno: 1,
+            probe_accepts: 0,
+        },
+        runtime,
+    }
+}
+
+fn install(fixture: &mut ValidatedTransfers, index: usize, record: &StrictBuildRecord) {
+    let bytes = record
+        .to_bytes()
+        .expect("should render the strict build record");
+    fixture.transfers[index]
+        .members
+        .insert(STRICT_RECORD.to_owned(), bytes);
+}
+
+/// The collector fixture cohort with every build record rendered by the producer.
+fn producer_cohort() -> ValidatedTransfers {
+    let mut fixture = cohort_fixture();
+    for index in 0..fixture.transfers.len() {
+        let record = producer_record(&fixture, index);
+        install(&mut fixture, index, &record);
+    }
+    fixture
+}
+
+#[test]
+fn producer_rendered_records_pass_the_unchanged_strict_collector() {
+    let fixture = producer_cohort();
+    for (index, transfer) in fixture.transfers.iter().enumerate() {
+        assert_eq!(
+            transfer.members[STRICT_RECORD],
+            producer_record(&fixture, index)
+                .to_bytes()
+                .expect("should render again"),
+            "should carry the producer rendering for transfer {index}"
+        );
+    }
+    let diagnostic =
+        diagnose_collection(&fixture).expect("should accept every producer-rendered record");
+    assert_eq!(
+        diagnostic.canonical.len(),
+        4,
+        "should retain all four canonical artifacts from producer records"
+    );
+}
+
+#[test]
+fn rendered_claim_and_runtime_follow_owned_policy_and_acceptance() {
+    let fixture = cohort_fixture();
+    let rendered: Value = serde_json::from_slice(
+        &producer_record(&fixture, 0)
+            .to_bytes()
+            .expect("should render Fastly record"),
+    )
+    .expect("should parse rendered record");
+    assert_eq!(
+        rendered["claim"],
+        json!({
+            "varied": ["umask", "jobs", "checkout_root", "start_time"],
+            "normalized": ["locale", "timezone"],
+            "unsupported": ["execution_user"],
+        }),
+        "should render the compiled placement in collector names"
+    );
+    assert_eq!(
+        (
+            &rendered["runtime"]["injected_scripts"],
+            &rendered["runtime"]["origin_marker_matched"],
+            &rendered["boundary"]["confined"],
+        ),
+        (&json!(1), &json!(true), &json!(true)),
+        "should state only facts implied by acceptance and denial receipts"
+    );
+    let native: Value = serde_json::from_slice(
+        &producer_record(&fixture, 2)
+            .to_bytes()
+            .expect("should render native record"),
+    )
+    .expect("should parse native record");
+    assert!(
+        native["runtime"].is_null(),
+        "should render no runtime block for a native build"
+    );
+}
+
+type Mutation = fn(&mut StrictBuildRecord);
+
+#[test]
+fn each_changed_producer_fact_is_rejected_by_the_collector() {
+    let cases: [(&str, usize, Mutation); 22] = [
+        ("missing Fastly runtime", 0, |record| record.runtime = None),
+        ("runtime of the other role", 0, |record| {
+            if let Some(runtime) = &mut record.runtime {
+                runtime.role = Role::Reproduction;
+            }
+        }),
+        ("runtime for other bytes", 0, |record| {
+            if let Some(runtime) = &mut record.runtime {
+                runtime.final_wasm_size += 1;
+            }
+        }),
+        ("failed publisher status", 0, |record| {
+            if let Some(runtime) = &mut record.runtime {
+                runtime.publisher_status = 500;
+            }
+        }),
+        ("unpinned Viceroy", 0, |record| {
+            if let Some(runtime) = &mut record.runtime {
+                runtime.viceroy_version = "0.16.0".to_owned();
+            }
+        }),
+        ("native runtime block", 2, |record| {
+            record.runtime = Some(RuntimeFacts {
+                role: Role::Canonical,
+                source_commit: record.source_commit.clone(),
+                final_wasm_sha256: record.artifact_sha256.clone(),
+                final_wasm_size: record.artifact_size,
+                publisher_status: 200,
+                viceroy_version: "0.21.0".to_owned(),
+            });
+        }),
+        ("unnormalized child locale", 0, |record| {
+            record.ambient.child_locale = "en_US.UTF-8".to_owned();
+        }),
+        ("profile umask of another role", 0, |record| {
+            record.ambient.umask = 0o027;
+        }),
+        ("relative checkout root", 0, |record| {
+            record.ambient.checkout_root = PathBuf::from("external-release-A");
+        }),
+        ("execution outside the measured boundary", 0, |record| {
+            record.boundary.execution_fingerprint = "9".repeat(64);
+        }),
+        ("malformed invocation digest", 0, |record| {
+            record.boundary.invocation_digest = "5".repeat(63);
+        }),
+        ("probe errno other than a denial", 0, |record| {
+            record.boundary.probe_errno = 111;
+        }),
+        ("failed socket control", 0, |record| {
+            record.boundary.control_accepts = 0;
+        }),
+        ("reproduction reusing the canonical boundary", 1, |record| {
+            record.boundary.fingerprint = "3".repeat(64);
+            record.boundary.execution_fingerprint = "3".repeat(64);
+        }),
+        (
+            "reproduction reusing the canonical invocation",
+            1,
+            |record| {
+                record.boundary.invocation_digest = "5".repeat(64);
+            },
+        ),
+        ("reproduction with the canonical start time", 1, |record| {
+            record.ambient.started_at_seconds = 100;
+        }),
+        ("another job", 0, |record| {
+            record.job = ProducerJob::new("another-job", 1).expect("should accept job");
+        }),
+        ("another attempt", 0, |record| {
+            record.job = ProducerJob::new(&record.job.job.clone(), 2).expect("should accept job");
+        }),
+        ("pair input digest", 0, |record| {
+            record.inputs.cargo_lock = "9".repeat(64);
+        }),
+        ("composition digest", 0, |record| {
+            record.composition_sha256 = "9".repeat(64);
+        }),
+        ("role of another upload", 0, |record| {
+            record.role = Role::Reproduction;
+        }),
+        ("inventory digest", 0, |record| {
+            record.inventory_sha256 = "9".repeat(64);
+        }),
+    ];
+    for (name, index, mutate) in cases {
+        let mut fixture = producer_cohort();
+        let mut record = producer_record(&fixture, index);
+        mutate(&mut record);
+        install(&mut fixture, index, &record);
+        let error = format!(
+            "{:?}",
+            diagnose_collection(&fixture).expect_err("should reject a changed producer record")
+        );
+        assert!(
+            error.contains(expected_rejection(name)),
+            "should reject producer record with {name} at its own gate: {error}"
+        );
+    }
+}
+
+/// The collector gate each changed producer fact must reach.
+fn expected_rejection(name: &str) -> &'static str {
+    match name {
+        "missing Fastly runtime" => "missing final-byte runtime proof",
+        "runtime of the other role"
+        | "runtime for other bytes"
+        | "failed publisher status"
+        | "unpinned Viceroy" => "runtime diagnostic is not bound",
+        "native runtime block" => "native transfer carries a Fastly runtime",
+        "unnormalized child locale" | "relative checkout root" => {
+            "child normalization or observed checkout root"
+        }
+        "profile umask of another role" => "observed ambient differs from selected role profile",
+        "execution outside the measured boundary"
+        | "malformed invocation digest"
+        | "probe errno other than a denial"
+        | "failed socket control" => "missing/failed socket controls",
+        "reproduction reusing the canonical boundary" => "A/B share one boundary instance",
+        "reproduction reusing the canonical invocation" => "A/B share one exact invocation",
+        "reproduction with the canonical start time" => "supported A/B variation is missing",
+        "another job" | "another attempt" | "role of another upload" => {
+            "build record differs from trusted dependency identity"
+        }
+        "pair input digest" => "A/B build inputs or recipe differ",
+        "composition digest" => "composition document digest changed",
+        "inventory digest" => "shared JS inventory changed",
+        other => panic!("should name an expected gate for {other}"),
+    }
+}
+
+/// Installs a sealed receipt and the producer record naming its exact digest.
+fn install_receipt(fixture: &mut ValidatedTransfers, index: usize, receipt: Vec<u8>) {
+    let mut record = producer_record(fixture, index);
+    record.composition_sha256 = digest(&receipt);
+    fixture.transfers[index]
+        .members
+        .insert("composition.json".to_owned(), receipt);
+    install(fixture, index, &record);
+}
+
+/// The producer's receipt shape for one fixture transfer, with its own bindings.
+fn producer_receipt(fixture: &ValidatedTransfers, index: usize) -> Value {
+    let transfer = &fixture.transfers[index];
+    let target = FIXED_ARTIFACTS
+        .iter()
+        .find(|asset| asset.name == transfer.upload.asset)
+        .expect("should use a fixed fixture asset")
+        .target
+        .triple();
+    serde_json::from_slice(&composition_receipt(
+        target,
+        &digest(&transfer.members["artifact"]),
+        &fixture.invocation.source_commit,
+        &digest(&transfer.members["tsjs-inventory.json"]),
+    ))
+    .expect("should parse producer receipt")
+}
+
+#[test]
+fn producer_composition_receipt_passes_the_strict_collector() {
+    // The producer's `composition.json` is its sealed normalized receipt
+    // (`metadata_plan_sha256`, `tree_plan_sha256`, `observations`,
+    // `composition`). Each record's `composition_sha256` names its exact bytes.
+    let mut fixture = producer_cohort();
+    for index in 0..fixture.transfers.len() {
+        let receipt = serde_json::to_vec(&producer_receipt(&fixture, index))
+            .expect("should serialize producer receipt");
+        install_receipt(&mut fixture, index, receipt);
+    }
+    for transfer in &fixture.transfers {
+        let receipt: Value = serde_json::from_slice(&transfer.members["composition.json"])
+            .expect("should parse installed receipt");
+        let keys = receipt
+            .as_object()
+            .expect("should be an object")
+            .keys()
+            .map(String::as_str)
+            .collect::<Vec<_>>();
+        assert_eq!(
+            keys,
+            [
+                "composition",
+                "metadata_plan_sha256",
+                "observations",
+                "tree_plan_sha256"
+            ],
+            "should carry exactly the producer receipt members"
+        );
+    }
+    let diagnostic =
+        diagnose_collection(&fixture).expect("should accept producer records and receipts");
+    assert_eq!(
+        diagnostic.canonical.len(),
+        4,
+        "should retain all four canonical artifacts from producer receipts"
+    );
+}
+
+/// Changes one receipt fact, given the dependency and workspace package IDs.
+type ReceiptMutation = fn(&mut Value, &str, &str);
+
+#[test]
+fn each_changed_producer_receipt_fact_is_rejected_by_the_collector() {
+    let dependency = "registry+https://registry.example.com/index#example-dep@1.0.0";
+    let workspace = "path+file:///workspace/crates/example-app#0.1.0";
+    let cases: [(&str, ReceiptMutation, &str); 9] = [
+        (
+            "another artifact",
+            |receipt, _, _| {
+                receipt["composition"]["javascript"]["artifact_sha256"] = json!("9".repeat(64));
+            },
+            "composition receipt is not bound to the final artifact",
+        ),
+        (
+            "another source",
+            |receipt, _, workspace| {
+                receipt["composition"]["package_origins"]["packages"][workspace]["origin"]["source_commit"] =
+                    json!("9".repeat(40));
+            },
+            "composition receipt is not bound to the approved source",
+        ),
+        (
+            "another inventory",
+            |receipt, _, _| {
+                receipt["composition"]["javascript"]["inventory_sha256"] = json!("9".repeat(64));
+            },
+            "composition receipt is not bound to the shared JS inventory",
+        ),
+        (
+            "malformed plan digest",
+            |receipt, _, _| {
+                receipt["metadata_plan_sha256"] = json!("A".repeat(64));
+            },
+            "composition receipt digests are malformed",
+        ),
+        (
+            "malformed origin digest",
+            |receipt, dependency, _| {
+                receipt["composition"]["package_origins"]["packages"][dependency]["prepared_manifest_sha256"] =
+                    json!("b2".repeat(31));
+            },
+            "composition receipt package origins are malformed or ambiguous",
+        ),
+        (
+            "empty observations",
+            |receipt, _, _| {
+                receipt["observations"]["units"] = json!([]);
+            },
+            "composition receipt has no compiled units",
+        ),
+        (
+            "no package origins",
+            |receipt, _, _| {
+                receipt["observations"]["packages"] = json!([]);
+                receipt["composition"]["package_origins"]["packages"] = json!({});
+            },
+            "composition receipt package origins are malformed or ambiguous",
+        ),
+        (
+            "extra field",
+            |receipt, _, _| {
+                receipt["composition"]["coverage_complete"] = json!(true);
+            },
+            "unknown field",
+        ),
+        (
+            "unjoined dependency",
+            |receipt, dependency, _| {
+                receipt["composition"]["package_origins"]["packages"]
+                    .as_object_mut()
+                    .expect("should find package origins")
+                    .remove(dependency);
+            },
+            "composition receipt package origins are malformed or ambiguous",
+        ),
+    ];
+    for (name, mutate, expected) in cases {
+        for index in [0, 2] {
+            let mut fixture = producer_cohort();
+            let mut receipt = producer_receipt(&fixture, index);
+            mutate(&mut receipt, dependency, workspace);
+            let bytes = serde_json::to_vec(&receipt).expect("should serialize changed receipt");
+            install_receipt(&mut fixture, index, bytes);
+            let error = format!(
+                "{:?}",
+                diagnose_collection(&fixture).expect_err("should reject a changed receipt")
+            );
+            assert!(
+                error.contains(expected),
+                "should reject receipt with {name} for transfer {index}: {error}"
+            );
+        }
+    }
+}
+
+#[test]
+fn producer_job_identity_matches_the_collector_upload_check_and_checkout_root_is_bounded() {
+    // The collector accepts a non-empty job ID of at most 128 bytes without
+    // control characters, and a positive attempt; the producer mirrors it.
+    let longest = "j".repeat(128);
+    for job in [
+        "fastly-a",
+        "candidate (macos-14)",
+        "kandidat-ü",
+        longest.as_str(),
+    ] {
+        assert!(
+            ProducerJob::new(job, 1).is_ok(),
+            "should accept collector-valid job {job:?}"
+        );
+    }
+    let oversized = "j".repeat(129);
+    for (job, attempt) in [
+        ("", 1),
+        ("fastly-a", 0),
+        ("fastly-a\n", 1),
+        ("fastly\u{7f}a", 1),
+        ("fastly\u{85}a", 1),
+        (oversized.as_str(), 1),
+    ] {
+        assert!(
+            ProducerJob::new(job, attempt).is_err(),
+            "should reject collector-invalid job {job:?} attempt {attempt}"
+        );
+    }
+    let mut fixture = producer_cohort();
+    fixture.transfers[0].upload.job = "candidate (macos-14)".to_owned();
+    let mut record = producer_record(&fixture, 0);
+    record.job = ProducerJob::new("candidate (macos-14)", 1).expect("should accept spaced job");
+    install(&mut fixture, 0, &record);
+    diagnose_collection(&fixture).expect("should bind a spaced job ID the collector accepts");
+    let mut record = producer_record(&cohort_fixture(), 0);
+    record.ambient.checkout_root = PathBuf::from(OsStr::from_bytes(b"/external-\xff"));
+    assert!(
+        record.to_bytes().is_err(),
+        "should reject a checkout root the collector schema cannot state"
+    );
+}
diff --git a/crates/trusted-server-release/src/collection/records.rs b/crates/trusted-server-release/src/collection/records.rs
new file mode 100644
index 0000000000..d8d1703a52
--- /dev/null
+++ b/crates/trusted-server-release/src/collection/records.rs
@@ -0,0 +1,583 @@
+//! Strict imported diagnostics. None of these structs is a local execution proof.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::path::{Component, Path};
+
+use error_stack::Report;
+use serde::de::DeserializeOwned;
+use serde::{Deserialize, Serialize};
+use serde_json::{Value, json};
+
+use self::receipt::{ReceiptBinding, check_receipt};
+use super::{Transfer, ValidatedTransfers, collection_error, digest};
+use crate::documents::{Role, lower_hex, parse_json};
+use crate::error::ReleaseError;
+use crate::inspect::inspect_wasm;
+use crate::policy::FIXED_ARTIFACTS;
+
+mod receipt;
+
+/// A bounded native reproduction measurement.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Deserialize, Serialize)]
+#[serde(rename_all = "lowercase")]
+pub(crate) enum Outcome {
+    Matched,
+    Mismatched,
+    Failed,
+    Unavailable,
+}
+
+/// The selected profile belongs to the trusted dependency capability.
+#[derive(Clone, Debug)]
+pub(super) struct RoleProfile {
+    umask: u32,
+    jobs: u32,
+    host_locale: String,
+    host_timezone: String,
+}
+
+impl RoleProfile {
+    #[cfg(test)]
+    pub(super) fn fixtures() -> [Self; 2] {
+        [
+            Self {
+                umask: 0o022,
+                jobs: 4,
+                host_locale: "C".to_owned(),
+                host_timezone: "UTC".to_owned(),
+            },
+            Self {
+                umask: 0o027,
+                jobs: 2,
+                host_locale: "en_US.UTF-8".to_owned(),
+                host_timezone: "Pacific/Auckland".to_owned(),
+            },
+        ]
+    }
+
+    /// Selects an arbitrary fictional profile so pair checks can be isolated.
+    #[cfg(test)]
+    pub(super) fn for_tests(umask: u32, jobs: u32, host_locale: &str, host_timezone: &str) -> Self {
+        Self {
+            umask,
+            jobs,
+            host_locale: host_locale.to_owned(),
+            host_timezone: host_timezone.to_owned(),
+        }
+    }
+}
+
+/// Candidate data only; no field authorizes signing or deployment.
+#[derive(Debug)]
+pub(crate) struct CollectionDiagnostic {
+    /// Exact complete canonical artifact bytes.
+    pub(crate) canonical: BTreeMap<String, Vec<u8>>,
+    /// Native B outcomes, including honest no-upload outcomes.
+    pub(crate) native: BTreeMap<String, Outcome>,
+    /// Unqualified rebuild details for future evidence assembly.
+    pub(crate) rebuild: BTreeMap<String, Value>,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct BuildRecord {
+    schema_version: u64,
+    source_commit: String,
+    recipe_sha256: String,
+    asset: String,
+    role: String,
+    job: String,
+    attempt: u64,
+    inputs: BTreeMap<String, String>,
+    inventory_sha256: String,
+    artifact_sha256: String,
+    artifact_size: u64,
+    composition_sha256: String,
+    ambient: Ambient,
+    claim: Claim,
+    boundary: Boundary,
+    runtime: Option<Runtime>,
+}
+
+#[derive(Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+struct Ambient {
+    umask: u32,
+    jobs: u32,
+    checkout_root: String,
+    started_at_seconds: u64,
+    execution_uid: u32,
+    host_locale: String,
+    host_timezone: String,
+    child_locale: String,
+    child_timezone: String,
+}
+
+#[derive(Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+struct Claim {
+    varied: Vec<String>,
+    normalized: Vec<String>,
+    unsupported: Vec<String>,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Boundary {
+    /// Boundary instance the measured socket denial receipt names.
+    fingerprint: String,
+    /// Boundary instance that executed the build; instance identity only,
+    /// including a fresh per-instance nonce, not the invocation content.
+    execution_fingerprint: String,
+    /// SHA-256 of the exact build invocation: program, arguments including
+    /// jobs, environment, working directory (the checkout root) and umask.
+    invocation_digest: String,
+    confined: bool,
+    control_exit: i32,
+    control_accepts: u32,
+    probe_exit: i32,
+    probe_errno: i32,
+    probe_accepts: u32,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Runtime {
+    /// The build role the producer claims for the Viceroy run that accepted
+    /// these final bytes; self-asserted, not an independent run identity.
+    role: String,
+    source_commit: String,
+    final_wasm_sha256: String,
+    final_wasm_size: u64,
+    publisher_status: u16,
+    injected_scripts: u32,
+    origin_marker_matched: bool,
+    viceroy_version: String,
+}
+
+type Result<T> = std::result::Result<T, Report<ReleaseError>>;
+
+/// Build record facts a sealed composition receipt must restate.
+pub(crate) struct ReceiptFacts<'a> {
+    /// Exact final artifact digest.
+    pub(crate) artifact_sha256: &'a str,
+    /// Approved source commit.
+    pub(crate) source_commit: &'a str,
+    /// Shared original JS inventory digest.
+    pub(crate) inventory_sha256: &'a str,
+    /// Prepared Cargo materials tree digest (`inputs.materials`).
+    pub(crate) materials_sha256: &'a str,
+    /// Fixed asset name; selects the target and the Fastly JS rule.
+    pub(crate) asset: &'a str,
+}
+
+/// Checks a sealed composition receipt exactly as the strict collector does.
+///
+/// The collector calls this after binding the receipt bytes to the record's
+/// `composition_sha256`; the real candidate tests call it on actual producer
+/// exports so the collector schema cannot drift from the producer's.
+///
+/// # Errors
+///
+/// Rejects an unknown asset and every receipt rejection of the collector.
+pub(crate) fn check_composition_receipt(bytes: &[u8], facts: &ReceiptFacts<'_>) -> Result<()> {
+    let fixed = FIXED_ARTIFACTS
+        .iter()
+        .find(|asset| asset.name == facts.asset)
+        .ok_or_else(|| collection_error("unknown cohort artifact"))?;
+    check_receipt(
+        bytes,
+        &ReceiptBinding {
+            artifact_sha256: facts.artifact_sha256,
+            source_commit: facts.source_commit,
+            inventory_sha256: facts.inventory_sha256,
+            materials_sha256: facts.materials_sha256,
+            target: fixed.target,
+        },
+    )
+}
+
+fn require(condition: bool, detail: &str) -> Result<()> {
+    if !condition {
+        return Err(collection_error(detail));
+    }
+    Ok(())
+}
+fn parse<T: DeserializeOwned>(bytes: &[u8]) -> Result<T> {
+    let value = parse_json(bytes, Role::Metadata)
+        .map_err(|error| error.change_context(ReleaseError::Collection))?;
+    serde_json::from_value(value).map_err(collection_error)
+}
+fn member<'a>(transfer: &'a Transfer, name: &str) -> Result<&'a [u8]> {
+    transfer
+        .members
+        .get(name)
+        .map(Vec::as_slice)
+        .ok_or_else(|| collection_error(format!("missing declared {name}")))
+}
+fn exact_names(values: &[String], expected: &[&str]) -> bool {
+    values.len() == expected.len()
+        && values.iter().map(String::as_str).collect::<BTreeSet<_>>()
+            == expected.iter().copied().collect()
+}
+fn normal_path(value: &str) -> bool {
+    let path = Path::new(value);
+    path.is_absolute()
+        && path != Path::new("/")
+        && path
+            .components()
+            .all(|part| matches!(part, Component::RootDir | Component::Normal(_)))
+        && path
+            .components()
+            .collect::<std::path::PathBuf>()
+            .as_os_str()
+            == path.as_os_str()
+}
+
+fn check_ambient(record: &BuildRecord, profile: &RoleProfile) -> Result<()> {
+    let ambient = &record.ambient;
+    require(
+        ambient.umask == profile.umask
+            && ambient.jobs == profile.jobs
+            && ambient.host_locale == profile.host_locale
+            && ambient.host_timezone == profile.host_timezone,
+        "observed ambient differs from selected role profile",
+    )?;
+    require(
+        ambient.child_locale == "C"
+            && ambient.child_timezone == "UTC"
+            && normal_path(&ambient.checkout_root),
+        "child normalization or observed checkout root is invalid",
+    )?;
+    require(
+        exact_names(
+            &record.claim.varied,
+            &["umask", "jobs", "checkout_root", "start_time"],
+        ) && exact_names(&record.claim.normalized, &["locale", "timezone"])
+            && exact_names(&record.claim.unsupported, &["execution_user"]),
+        "dishonest or incomplete varied/normalized/unsupported claim",
+    )
+}
+
+fn check_record(transfer: &Transfer, all: &ValidatedTransfers) -> Result<BuildRecord> {
+    require(
+        transfer.members.len() == 4,
+        "unexpected build transfer member set",
+    )?;
+    let record: BuildRecord = parse(member(transfer, "build-record.json")?)?;
+    let upload = &transfer.upload;
+    require(
+        super::bounded_upload(upload),
+        "successful build has no bounded completion metadata",
+    )?;
+    let invocation = &all.invocation;
+    require(
+        record.schema_version == 1
+            && record.source_commit == invocation.source_commit
+            && record.recipe_sha256 == upload.recipe_sha256
+            && record.asset == upload.asset
+            && record.role == upload.role
+            && record.job == upload.job
+            && record.attempt == upload.attempt,
+        "build record differs from trusted dependency identity",
+    )?;
+    let input_names = record
+        .inputs
+        .keys()
+        .map(String::as_str)
+        .collect::<BTreeSet<_>>();
+    require(
+        input_names
+            == BTreeSet::from([
+                "cargo_lock",
+                "materials",
+                "rust_tools",
+                "js_settings",
+                "js_tools",
+            ])
+            && record.inputs.values().all(|value| lower_hex(value, 64)),
+        "missing or invalid build input digests",
+    )?;
+    let artifact = member(transfer, "artifact")?;
+    require(
+        record.artifact_size == artifact.len() as u64 && record.artifact_sha256 == digest(artifact),
+        "final artifact digest or size changed",
+    )?;
+    let inventory = member(transfer, "tsjs-inventory.json")?;
+    parse_json(inventory, Role::Metadata)
+        .map_err(|error| error.change_context(ReleaseError::Collection))?;
+    require(
+        record.inventory_sha256 == invocation.inventory_sha256
+            && digest(inventory) == invocation.inventory_sha256,
+        "shared JS inventory changed",
+    )?;
+    let composition = member(transfer, "composition.json")?;
+    require(
+        digest(composition) == record.composition_sha256,
+        "composition document digest changed",
+    )?;
+    let materials_sha256 = record
+        .inputs
+        .get("materials")
+        .ok_or_else(|| collection_error("missing or invalid build input digests"))?;
+    check_composition_receipt(
+        composition,
+        &ReceiptFacts {
+            artifact_sha256: &record.artifact_sha256,
+            source_commit: &record.source_commit,
+            inventory_sha256: &record.inventory_sha256,
+            materials_sha256,
+            asset: &record.asset,
+        },
+    )?;
+    let boundary = &record.boundary;
+    require(
+        lower_hex(&boundary.fingerprint, 64)
+            && boundary.fingerprint == boundary.execution_fingerprint
+            && lower_hex(&boundary.invocation_digest, 64)
+            && boundary.confined
+            && boundary.control_exit == 0
+            && boundary.control_accepts == 1
+            && boundary.probe_exit == 3
+            && matches!(boundary.probe_errno, 1 | 13)
+            && boundary.probe_accepts == 0,
+        "missing/failed socket controls or unconfined build invocation",
+    )?;
+    let profile = match record.role.as_str() {
+        "A" => &invocation.profiles[0],
+        "B" => &invocation.profiles[1],
+        _ => return Err(collection_error("unknown build role")),
+    };
+    check_ambient(&record, profile)?;
+    if record.asset == FIXED_ARTIFACTS[0].name {
+        let facts = inspect_wasm(artifact)
+            .map_err(|error| error.change_context(ReleaseError::Collection))?;
+        facts
+            .require_fastly_entry_abi()
+            .and_then(|()| facts.require_debug_sections())
+            .map_err(|error| error.change_context(ReleaseError::Collection))?;
+        let runtime = record
+            .runtime
+            .as_ref()
+            .ok_or_else(|| collection_error("missing final-byte runtime proof diagnostic"))?;
+        // A and B final bytes must be equal, so without the role one build's
+        // runtime run could stand in for the other's. The role is asserted by
+        // the producer inside its own record: it catches mix-ups and reuse in
+        // an honest pipeline, not a malicious producer copying A's runtime
+        // object and changing its role. Binding strength comes from the trusted
+        // upload role and job isolation; a per-run Viceroy identity remains a
+        // named gap.
+        require(
+            runtime.role == record.role
+                && runtime.source_commit == record.source_commit
+                && runtime.final_wasm_sha256 == record.artifact_sha256
+                && runtime.final_wasm_size == record.artifact_size
+                && runtime.publisher_status == 200
+                && runtime.injected_scripts == 1
+                && runtime.origin_marker_matched
+                && runtime.viceroy_version == "0.21.0",
+            "runtime diagnostic is not bound to accepted final Wasm bytes and publisher request",
+        )?;
+    } else {
+        require(
+            record.runtime.is_none(),
+            "native transfer carries a Fastly runtime diagnostic",
+        )?;
+    }
+    Ok(record)
+}
+
+fn compare_pair(a: &BuildRecord, b: &BuildRecord) -> Result<()> {
+    require(
+        a.inputs == b.inputs && a.recipe_sha256 == b.recipe_sha256,
+        "A/B build inputs or recipe differ",
+    )?;
+    // The exact invocation digest covers role-specific paths, jobs, environment
+    // and umask, so a reproduction reusing the canonical one did not vary them.
+    require(
+        a.boundary.invocation_digest != b.boundary.invocation_digest,
+        "A/B share one exact invocation",
+    )?;
+    // Each build runs in its own fresh boundary instance. Instance fingerprints
+    // carry a per-instance nonce, so this proves separate instances, not
+    // varied invocation content.
+    require(
+        a.boundary.execution_fingerprint != b.boundary.execution_fingerprint,
+        "A/B share one boundary instance",
+    )?;
+    let a = &a.ambient;
+    let b = &b.ambient;
+    // Normalized dimensions still vary on the host; only the compiler child
+    // observes the fixed normalized values. The spec requires B to differ in
+    // TZ and locale, so a qualified reproduction profile must select values
+    // distinct from canonical; the claim shape cannot express `not-varied`
+    // for them, and such a profile fails here by design.
+    require(
+        a.umask != b.umask
+            && a.jobs != b.jobs
+            && a.started_at_seconds != b.started_at_seconds
+            && a.host_locale != b.host_locale
+            && a.host_timezone != b.host_timezone,
+        "supported A/B variation is missing",
+    )?;
+    let a_root = Path::new(&a.checkout_root);
+    let b_root = Path::new(&b.checkout_root);
+    require(
+        !a_root.starts_with(b_root) && !b_root.starts_with(a_root),
+        "A/B checkout roots overlap",
+    )?;
+    require(
+        a.execution_uid == b.execution_uid,
+        "unsupported execution user variation was claimed",
+    )
+}
+
+pub(super) fn diagnose(all: &ValidatedTransfers) -> Result<CollectionDiagnostic> {
+    let mut builds = BTreeMap::new();
+    for transfer in &all.transfers {
+        require(
+            FIXED_ARTIFACTS
+                .iter()
+                .any(|asset| asset.name == transfer.upload.asset),
+            "unknown cohort artifact",
+        )?;
+        let record = check_record(transfer, all)?;
+        require(
+            builds
+                .insert(
+                    (record.asset.clone(), record.role.clone()),
+                    (record, transfer),
+                )
+                .is_none(),
+            "duplicate asset/role record",
+        )?;
+    }
+    let mut native = BTreeMap::new();
+    for absent in &all.absent {
+        let outcome = absent
+            .outcome()
+            .filter(|_| {
+                FIXED_ARTIFACTS
+                    .iter()
+                    .skip(1)
+                    .any(|fixed| fixed.name == absent.asset)
+                    && !builds.contains_key(&(absent.asset.clone(), "B".to_owned()))
+            })
+            .ok_or_else(|| {
+                collection_error("optional B absence is not a bounded distinct native result")
+            })?;
+        require(
+            native.insert(absent.asset.clone(), outcome).is_none(),
+            "optional B absence is not a bounded distinct native result",
+        )?;
+    }
+    let mut canonical = BTreeMap::new();
+    for asset in FIXED_ARTIFACTS {
+        let (a, a_transfer) = builds
+            .get(&(asset.name.to_owned(), "A".to_owned()))
+            .ok_or_else(|| collection_error(format!("missing mandatory A for {}", asset.name)))?;
+        if let Some((b, b_transfer)) = builds.get(&(asset.name.to_owned(), "B".to_owned())) {
+            compare_pair(a, b)?;
+            let same = member(a_transfer, "artifact")? == member(b_transfer, "artifact")?;
+            if asset.name == FIXED_ARTIFACTS[0].name {
+                require(same, "final Fastly bytes differ")?;
+            } else {
+                require(
+                    native
+                        .insert(
+                            asset.name.to_owned(),
+                            if same {
+                                Outcome::Matched
+                            } else {
+                                Outcome::Mismatched
+                            },
+                        )
+                        .is_none(),
+                    "native B has both uploaded and absent results",
+                )?;
+            }
+        } else if asset.name == FIXED_ARTIFACTS[0].name {
+            return Err(collection_error("missing mandatory Fastly B"));
+        } else {
+            require(
+                native.contains_key(asset.name),
+                "native B has no bounded result",
+            )?;
+        }
+        canonical.insert(
+            asset.name.to_owned(),
+            member(a_transfer, "artifact")?.to_vec(),
+        );
+    }
+    let mut rebuild = BTreeMap::new();
+    for asset in FIXED_ARTIFACTS {
+        let (a, transfer) = builds
+            .get(&(asset.name.to_owned(), "A".to_owned()))
+            .ok_or_else(|| collection_error("canonical diagnostic disappeared"))?;
+        let (outcome, reproduction) =
+            if let Some((b, transfer)) = builds.get(&(asset.name.to_owned(), "B".to_owned())) {
+                let outcome = if asset.name == FIXED_ARTIFACTS[0].name {
+                    Outcome::Matched
+                } else {
+                    *native
+                        .get(asset.name)
+                        .ok_or_else(|| collection_error("native measurement disappeared"))?
+                };
+                (outcome, build_diagnostic(b, transfer)?)
+            } else {
+                all.absent
+                    .iter()
+                    .filter(|absent| absent.asset == asset.name)
+                    .find_map(|absent| {
+                        absent.outcome().map(|outcome| {
+                            (
+                                outcome,
+                                json!({
+                                    "outcome": outcome,
+                                    "job_state": absent.job,
+                                    "elapsed_seconds": absent.elapsed_seconds,
+                                    "deadline_seconds": absent.deadline_seconds,
+                                }),
+                            )
+                        })
+                    })
+                    .ok_or_else(|| collection_error("bounded native absence disappeared"))?
+            };
+        rebuild.insert(
+            asset.name.to_owned(),
+            json!({
+                "schema_version":1,
+                "kind":"candidate-collection-diagnostic",
+                "release_qualification":false,
+                "source_commit":a.source_commit,
+                "recipe_sha256":a.recipe_sha256,
+                "inventory_sha256":a.inventory_sha256,
+                "outcome":outcome,
+                "canonical":build_diagnostic(a,transfer)?,
+                "reproduction":reproduction,
+            }),
+        );
+    }
+    Ok(CollectionDiagnostic {
+        canonical,
+        native,
+        rebuild,
+    })
+}
+
+fn build_diagnostic(record: &BuildRecord, transfer: &Transfer) -> Result<Value> {
+    Ok(json!({
+        "job":transfer.upload.job,
+        "attempt":transfer.upload.attempt,
+        "artifact_id":transfer.upload.artifact_id,
+        "archive_sha256":transfer.upload.archive_sha256,
+        "elapsed_seconds":transfer.upload.elapsed_seconds,
+        "deadline_seconds":transfer.upload.deadline_seconds,
+        "artifact_sha256":record.artifact_sha256,
+        "artifact_size":record.artifact_size,
+        "build_record_sha256":digest(member(transfer,"build-record.json")?),
+        "composition_sha256":record.composition_sha256,
+        "ambient":record.ambient,
+        "claim":record.claim,
+    }))
+}
diff --git a/crates/trusted-server-release/src/collection/records/receipt.rs b/crates/trusted-server-release/src/collection/records/receipt.rs
new file mode 100644
index 0000000000..0d59431354
--- /dev/null
+++ b/crates/trusted-server-release/src/collection/records/receipt.rs
@@ -0,0 +1,548 @@
+//! Strict collector parser for the producer's sealed composition receipt.
+//!
+//! `composition.json` is the exact normalized receipt the producer seals with
+//! its owning build (`RecipeCompleted::composition_export`): the Cargo query
+//! plan digests, the actual compiler observations and the graph, package
+//! origin, native, JavaScript and platform receipts. Every level the collector
+//! checks rejects unknown or missing fields. The installed tool subtrees of the
+//! platform receipt (`rust`, `apple`, `native_tools`, `external_requirements`
+//! runtime facts) are held opaquely; only their artifact and target bindings,
+//! Apple evidence presence and the runtime format tag are checked here.
+//!
+//! The receipt is imported data. These checks bind it to the build record's
+//! artifact, source, inventory, materials and target; they do not prove
+//! complete source coverage or final executable membership.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use serde::Deserialize;
+use serde_json::Value;
+
+use super::{Result, require};
+use crate::collection::collection_error;
+use crate::documents::{Role, lower_hex, parse_json};
+use crate::error::ReleaseError;
+use crate::policy::ReleaseTarget;
+
+/// Most compiler units a receipt may name.
+const UNIT_LIMIT: usize = 65_536;
+/// Most compiled packages, and so package origins, a receipt may name.
+const PACKAGE_LIMIT: usize = 16_384;
+/// Most prepared JS modules the producer's final-byte check accepts.
+const MODULE_LIMIT: usize = 1024;
+/// Classification of a complete module found in the final bytes.
+const EMBEDDED_JS: &str = "conservative_embedded_js";
+/// Classification of a prepared module the final bytes do not contain.
+const JS_BUILD_MATERIAL: &str = "js_build_material";
+
+/// Build record facts, already checked by the collector, that a receipt restates.
+pub(super) struct ReceiptBinding<'a> {
+    /// Exact final artifact digest of the same transfer.
+    pub(super) artifact_sha256: &'a str,
+    /// Approved source commit of the trusted invocation.
+    pub(super) source_commit: &'a str,
+    /// Shared original JS inventory digest.
+    pub(super) inventory_sha256: &'a str,
+    /// Prepared Cargo materials tree digest of the build inputs.
+    pub(super) materials_sha256: &'a str,
+    /// Target of the fixed asset; Fastly (`wasm32-wasip1`) embeds every module.
+    pub(super) target: ReleaseTarget,
+}
+
+// Shape-only fields are deserialized so unknown, missing or mistyped members
+// are rejected; the collector reads only the bindings it checks.
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Receipt {
+    metadata_plan_sha256: String,
+    tree_plan_sha256: String,
+    observations: Observations,
+    composition: Composition,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Observations {
+    packages: Vec<Package>,
+    units: Vec<Unit>,
+    build_scripts: Vec<BuildScript>,
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "snake_case")]
+enum Context {
+    Host,
+    Target,
+}
+
+#[allow(
+    dead_code,
+    reason = "every member is parsed so the strict receipt shape rejects missing or mistyped ones"
+)]
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Package {
+    id: String,
+    name: String,
+    version: String,
+    source: Option<String>,
+    manifest_path: String,
+    license: Option<String>,
+}
+
+#[allow(
+    dead_code,
+    reason = "every member is parsed so the strict receipt shape rejects missing or mistyped ones"
+)]
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Unit {
+    package_id: String,
+    target_name: String,
+    target_kind: Vec<String>,
+    crate_types: Vec<String>,
+    context: Context,
+    features: Vec<String>,
+    profile: Value,
+    filenames: Vec<String>,
+    executable: Option<String>,
+}
+
+#[allow(
+    dead_code,
+    reason = "every member is parsed so the strict receipt shape rejects missing or mistyped ones"
+)]
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct BuildScript {
+    package_id: String,
+    context: Context,
+    out_dir: String,
+    linked_libs: Vec<String>,
+    linked_paths: Vec<String>,
+    cfgs: Vec<String>,
+    environment: Vec<(String, String)>,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Composition {
+    graph: Graph,
+    package_origins: PackageOrigins,
+    native: Native,
+    javascript: Javascript,
+    platform: Platform,
+}
+
+#[allow(
+    dead_code,
+    reason = "every member is parsed so the strict receipt shape rejects missing or mistyped ones"
+)]
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Graph {
+    selected_package_id: String,
+    tree_package_ids: Vec<String>,
+    observed_package_ids: Vec<String>,
+    edges: Vec<Edge>,
+}
+
+#[allow(
+    dead_code,
+    reason = "every member is parsed so the strict receipt shape rejects missing or mistyped ones"
+)]
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Edge {
+    parent: String,
+    dependency: String,
+    kinds: Vec<String>,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct PackageOrigins {
+    source_commit: String,
+    materials_sha256: String,
+    packages: BTreeMap<String, PackageOrigin>,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct PackageOrigin {
+    name: String,
+    version: String,
+    manifest_path: String,
+    prepared_manifest_sha256: String,
+    origin: Original,
+}
+
+#[allow(
+    dead_code,
+    reason = "every member is parsed so the strict receipt shape rejects missing or mistyped ones"
+)]
+#[derive(Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
+enum Original {
+    Workspace {
+        source_commit: String,
+        path: String,
+    },
+    Material {
+        source: String,
+        original: CargoOrigin,
+    },
+}
+
+#[allow(
+    dead_code,
+    reason = "every member is parsed so the strict receipt shape rejects missing or mistyped ones"
+)]
+#[derive(Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
+enum CargoOrigin {
+    Registry {
+        archive_sha256: String,
+    },
+    Git {
+        revision: String,
+        repository_tree: String,
+        package_tree: String,
+        package_path: String,
+        committed_manifest_blob: String,
+        committed_manifest_sha256: String,
+        normalized_manifest_sha256: Option<String>,
+    },
+}
+
+#[allow(
+    dead_code,
+    reason = "every member is parsed so the strict receipt shape rejects missing or mistyped ones"
+)]
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Native {
+    contributors: Vec<Contributor>,
+    build_tool_package_ids: Vec<String>,
+    material_native_coverage_complete: bool,
+}
+
+#[allow(
+    dead_code,
+    reason = "every member is parsed so the strict receipt shape rejects missing or mistyped ones"
+)]
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Contributor {
+    package_id: String,
+    name: String,
+    version: String,
+    context: Context,
+    features: Vec<String>,
+    classification: String,
+    original_sha256: String,
+    source_tree_sha256: String,
+    source_subtrees: Vec<Subtree>,
+    linked_libs: Vec<String>,
+    linked_paths: Vec<String>,
+    archives: Vec<Archive>,
+}
+
+#[allow(
+    dead_code,
+    reason = "every member is parsed so the strict receipt shape rejects missing or mistyped ones"
+)]
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Subtree {
+    path: String,
+    sha256: String,
+}
+
+#[allow(
+    dead_code,
+    reason = "every member is parsed so the strict receipt shape rejects missing or mistyped ones"
+)]
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Archive {
+    path: String,
+    size: u64,
+    sha256: String,
+}
+
+#[allow(
+    dead_code,
+    reason = "every member is parsed so the strict receipt shape rejects missing or mistyped ones"
+)]
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Javascript {
+    artifact_sha256: String,
+    inventory_sha256: String,
+    modules: Vec<ModuleMembership>,
+    method: String,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct ModuleMembership {
+    module: Module,
+    classification: String,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Module {
+    id: String,
+    filename: String,
+    size: u64,
+    sha256: String,
+}
+
+#[allow(
+    dead_code,
+    reason = "every member is parsed so the strict receipt shape rejects missing or mistyped ones"
+)]
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Platform {
+    target: String,
+    artifact_sha256: String,
+    rust: Value,
+    apple: Value,
+    external_requirements: ExternalRequirements,
+    native_tools: Value,
+    material_native_coverage_complete: bool,
+}
+
+#[allow(
+    dead_code,
+    reason = "every member is parsed so the strict receipt shape rejects missing or mistyped ones"
+)]
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct ExternalRequirements {
+    target: String,
+    artifact_sha256: String,
+    runtime: Value,
+}
+
+/// Parses one sealed receipt strictly and binds it to its checked build record.
+///
+/// # Errors
+///
+/// Rejects oversized, duplicate-key, non-finite or mistyped JSON, unknown or
+/// missing members, malformed digests, another artifact, source, inventory,
+/// materials tree or target, Apple evidence or a runtime format foreign to the
+/// target, a complete native coverage claim, no compiled units, malformed or unjoined package
+/// origins, malformed JS membership, and a Fastly receipt that does not embed
+/// every prepared module.
+pub(super) fn check_receipt(bytes: &[u8], binding: &ReceiptBinding<'_>) -> Result<()> {
+    let value = parse_json(bytes, Role::CargoObservation)
+        .map_err(|error| error.change_context(ReleaseError::Collection))?;
+    let receipt: Receipt = serde_json::from_value(value).map_err(collection_error)?;
+    let composition = &receipt.composition;
+    let platform = &composition.platform;
+    let javascript = &composition.javascript;
+    let origins = &composition.package_origins;
+    require(
+        [
+            &receipt.metadata_plan_sha256,
+            &receipt.tree_plan_sha256,
+            &origins.materials_sha256,
+        ]
+        .into_iter()
+        .all(|digest| lower_hex(digest, 64))
+            && native_digests_are_valid(&composition.native),
+        "composition receipt digests are malformed",
+    )?;
+    require(
+        javascript.artifact_sha256 == binding.artifact_sha256
+            && platform.artifact_sha256 == binding.artifact_sha256
+            && platform.external_requirements.artifact_sha256 == binding.artifact_sha256,
+        "composition receipt is not bound to the final artifact",
+    )?;
+    require(
+        origins.source_commit == binding.source_commit
+            && origins
+                .packages
+                .values()
+                .all(|package| match &package.origin {
+                    Original::Workspace { source_commit, .. } => {
+                        source_commit == binding.source_commit
+                    }
+                    Original::Material { .. } => true,
+                }),
+        "composition receipt is not bound to the approved source",
+    )?;
+    require(
+        javascript.inventory_sha256 == binding.inventory_sha256,
+        "composition receipt is not bound to the shared JS inventory",
+    )?;
+    require(
+        origins.materials_sha256 == binding.materials_sha256,
+        "composition receipt is not bound to the build materials",
+    )?;
+    let target = binding.target.triple();
+    require(
+        platform.target == target && platform.external_requirements.target == target,
+        "composition receipt names another target",
+    )?;
+    check_platform_shape(platform, binding.target)?;
+    require(
+        !composition.native.material_native_coverage_complete
+            && !platform.material_native_coverage_complete,
+        "composition receipt claims complete material native coverage",
+    )?;
+    let units = &receipt.observations.units;
+    require(
+        !units.is_empty() && units.len() <= UNIT_LIMIT,
+        "composition receipt has no compiled units within its bound",
+    )?;
+    require(
+        origins_are_joined(&receipt),
+        "composition receipt package origins are malformed or ambiguous",
+    )?;
+    check_javascript(javascript, binding.target == ReleaseTarget::Wasm32Wasip1)
+}
+
+/// Apple evidence and the runtime format follow the target, as the producer writes them.
+///
+/// `PlatformEvidence::collect` retains Apple tool evidence exactly for Darwin
+/// targets, and `ExternalRequirements` is built from the inspected executable
+/// format (`from_wasm`, `from_elf`, `from_macho`), serialized with tag
+/// `format` as `wasm`, `elf` or `macho`.
+fn check_platform_shape(platform: &Platform, target: ReleaseTarget) -> Result<()> {
+    require(
+        platform.apple.is_null() != target.is_darwin(),
+        "composition receipt Apple evidence does not match its target",
+    )?;
+    let format = match target {
+        ReleaseTarget::Wasm32Wasip1 => "wasm",
+        ReleaseTarget::X86_64UnknownLinuxGnu => "elf",
+        ReleaseTarget::Aarch64AppleDarwin | ReleaseTarget::X86_64AppleDarwin => "macho",
+    };
+    require(
+        platform.external_requirements.runtime["format"] == format,
+        "composition receipt runtime format does not match its target",
+    )
+}
+
+/// Native measurement digests are exact SHA-256 identities.
+fn native_digests_are_valid(native: &Native) -> bool {
+    native.contributors.iter().all(|contributor| {
+        lower_hex(&contributor.original_sha256, 64)
+            && lower_hex(&contributor.source_tree_sha256, 64)
+            && contributor
+                .source_subtrees
+                .iter()
+                .all(|subtree| lower_hex(&subtree.sha256, 64))
+            && contributor
+                .archives
+                .iter()
+                .all(|archive| lower_hex(&archive.sha256, 64))
+    })
+}
+
+/// Every observed package has exactly one well-formed origin, and nothing else does.
+///
+/// Package IDs are unique because duplicate object keys are rejected at parse
+/// time and observed IDs must be distinct; prepared manifest paths must also be
+/// distinct, as the producer's origin join requires.
+fn origins_are_joined(receipt: &Receipt) -> bool {
+    let observed = &receipt.observations.packages;
+    let origins = &receipt.composition.package_origins.packages;
+    let observed_ids = observed
+        .iter()
+        .map(|package| package.id.as_str())
+        .collect::<BTreeSet<_>>();
+    let manifests = origins
+        .values()
+        .map(|origin| origin.manifest_path.as_str())
+        .collect::<BTreeSet<_>>();
+    let joined = |id: &str| origins.contains_key(id);
+    !origins.is_empty()
+        && origins.len() <= PACKAGE_LIMIT
+        && observed_ids.len() == observed.len()
+        && observed_ids.len() == origins.len()
+        && manifests.len() == origins.len()
+        && observed.iter().all(|package| {
+            origins.get(&package.id).is_some_and(|origin| {
+                origin.name == package.name && origin.version == package.version
+            })
+        })
+        && origins.values().all(origin_is_well_formed)
+        && receipt
+            .observations
+            .units
+            .iter()
+            .all(|unit| joined(&unit.package_id))
+        && receipt
+            .observations
+            .build_scripts
+            .iter()
+            .all(|script| joined(&script.package_id))
+        && receipt
+            .composition
+            .native
+            .contributors
+            .iter()
+            .all(|contributor| joined(&contributor.package_id))
+        && joined(&receipt.composition.graph.selected_package_id)
+}
+
+fn origin_is_well_formed(origin: &PackageOrigin) -> bool {
+    lower_hex(&origin.prepared_manifest_sha256, 64)
+        && !origin.manifest_path.is_empty()
+        && match &origin.origin {
+            Original::Workspace { path, .. } => path == &origin.manifest_path,
+            Original::Material { source, original } => {
+                !source.is_empty()
+                    && match original {
+                        CargoOrigin::Registry { archive_sha256 } => lower_hex(archive_sha256, 64),
+                        CargoOrigin::Git {
+                            committed_manifest_sha256,
+                            normalized_manifest_sha256,
+                            ..
+                        } => {
+                            lower_hex(committed_manifest_sha256, 64)
+                                && normalized_manifest_sha256
+                                    .as_deref()
+                                    .is_none_or(|digest| lower_hex(digest, 64))
+                        }
+                    }
+            }
+        }
+}
+
+fn check_javascript(javascript: &Javascript, fastly: bool) -> Result<()> {
+    let modules = &javascript.modules;
+    let ids = modules
+        .iter()
+        .map(|entry| entry.module.id.as_str())
+        .collect::<BTreeSet<_>>();
+    let filenames = modules
+        .iter()
+        .map(|entry| entry.module.filename.as_str())
+        .collect::<BTreeSet<_>>();
+    require(
+        !modules.is_empty()
+            && modules.len() <= MODULE_LIMIT
+            && ids.len() == modules.len()
+            && filenames.len() == modules.len()
+            && modules.iter().all(|entry| {
+                entry.module.size > 0
+                    && lower_hex(&entry.module.sha256, 64)
+                    && [EMBEDDED_JS, JS_BUILD_MATERIAL].contains(&entry.classification.as_str())
+            }),
+        "composition receipt JS membership is malformed",
+    )?;
+    require(
+        !fastly
+            || modules
+                .iter()
+                .all(|entry| entry.classification == EMBEDDED_JS),
+        "composition receipt omits a complete Fastly JS module",
+    )
+}
diff --git a/crates/trusted-server-release/src/collection/tests.rs b/crates/trusted-server-release/src/collection/tests.rs
new file mode 100644
index 0000000000..fed7ee88b2
--- /dev/null
+++ b/crates/trusted-server-release/src/collection/tests.rs
@@ -0,0 +1,1925 @@
+use std::collections::BTreeMap;
+use std::io::Write as _;
+
+use flate2::Crc;
+use serde_json::{Value, json};
+
+use super::*;
+
+pub(super) fn zip(members: &[(&str, &[u8])], descriptor: bool) -> Vec<u8> {
+    let mut bytes = Vec::new();
+    let mut central = Vec::new();
+    for (name, body) in members {
+        let offset = bytes.len() as u32;
+        let mut crc = Crc::new();
+        crc.update(body);
+        let crc = crc.sum();
+        let size = body.len() as u32;
+        let flags = if descriptor { 8_u16 } else { 0 };
+        bytes.extend(0x04034b50_u32.to_le_bytes());
+        bytes.extend(20_u16.to_le_bytes());
+        bytes.extend(flags.to_le_bytes());
+        bytes.extend([0; 6]);
+        for field in if descriptor {
+            [0, 0, 0]
+        } else {
+            [crc, size, size]
+        } {
+            bytes.extend(field.to_le_bytes());
+        }
+        bytes.extend((name.len() as u16).to_le_bytes());
+        bytes.extend(0_u16.to_le_bytes());
+        bytes.extend(name.as_bytes());
+        bytes.extend(*body);
+        if descriptor {
+            for field in [0x08074b50, crc, size, size] {
+                bytes.extend(field.to_le_bytes());
+            }
+        }
+        central.extend(0x02014b50_u32.to_le_bytes());
+        central.extend(20_u16.to_le_bytes());
+        central.extend(20_u16.to_le_bytes());
+        central.extend(flags.to_le_bytes());
+        central.extend([0; 6]);
+        for field in [crc, size, size] {
+            central.extend(field.to_le_bytes());
+        }
+        central.extend((name.len() as u16).to_le_bytes());
+        central.extend([0; 12]);
+        central.extend(offset.to_le_bytes());
+        central.extend(name.as_bytes());
+    }
+    let offset = bytes.len() as u32;
+    let size = central.len() as u32;
+    bytes.extend(central);
+    bytes.extend(0x06054b50_u32.to_le_bytes());
+    bytes.extend([0; 4]);
+    for _ in 0..2 {
+        bytes.extend((members.len() as u16).to_le_bytes());
+    }
+    bytes.extend(size.to_le_bytes());
+    bytes.extend(offset.to_le_bytes());
+    bytes.extend([0; 2]);
+    bytes
+}
+
+#[test]
+fn bounded_zip_accepts_exact_members_and_streaming_descriptor() {
+    for descriptor in [false, true] {
+        let bytes = zip(&[("artifact", b"final bytes")], descriptor);
+        let declared = BTreeMap::from([("artifact".to_owned(), 11)]);
+        let members = archive::read(&bytes, &declared).expect("should validate bounded ZIP");
+        assert_eq!(
+            members["artifact"], b"final bytes",
+            "should retain exact bytes"
+        );
+    }
+}
+
+#[test]
+fn zip_rejects_paths_duplicates_hidden_data_and_corrupt_descriptors() {
+    for name in [
+        "../artifact",
+        "/artifact",
+        "a/artifact",
+        "a\\artifact",
+        "Artifact",
+        ".",
+        "",
+    ] {
+        let bytes = zip(&[(name, b"x")], false);
+        assert!(
+            archive::read(&bytes, &BTreeMap::from([("artifact".to_owned(), 1)])).is_err(),
+            "should reject unsafe or undeclared {name:?}"
+        );
+    }
+    for descriptor in [false, true] {
+        let bytes = zip(&[("artifact", b"x"), ("artifact", b"x")], descriptor);
+        assert!(
+            archive::read(&bytes, &BTreeMap::from([("artifact".to_owned(), 1)])).is_err(),
+            "should reject duplicate members"
+        );
+    }
+    let mut bytes = zip(&[("artifact", b"x")], true);
+    bytes[38] ^= 1;
+    assert!(
+        archive::read(&bytes, &BTreeMap::from([("artifact".to_owned(), 1)])).is_err(),
+        "should reject corrupt member bytes"
+    );
+    let mut bytes = zip(&[("artifact", b"x")], true);
+    bytes[43] ^= 1;
+    assert!(
+        archive::read(&bytes, &BTreeMap::from([("artifact".to_owned(), 1)])).is_err(),
+        "should reject descriptor mismatch"
+    );
+    let mut bytes = zip(&[("artifact", b"x")], false);
+    bytes.insert(0, 0);
+    assert!(
+        archive::read(&bytes, &BTreeMap::from([("artifact".to_owned(), 1)])).is_err(),
+        "should reject leading hidden bytes"
+    );
+    let mut bytes = zip(&[("artifact", b"x")], false);
+    bytes.push(0);
+    assert!(
+        archive::read(&bytes, &BTreeMap::from([("artifact".to_owned(), 1)])).is_err(),
+        "should reject trailing hidden bytes"
+    );
+}
+
+#[test]
+fn zip_rejects_oversized_declarations_and_unsupported_features() {
+    let declared = BTreeMap::from([("artifact".to_owned(), 1)]);
+    for index in [6, 8] {
+        let mut bytes = zip(&[("artifact", b"x")], false);
+        bytes[index] = 1;
+        assert!(
+            archive::read(&bytes, &declared).is_err(),
+            "should reject encryption or unsupported method"
+        );
+    }
+    let bytes = zip(&[("artifact", b"x")], false);
+    assert!(
+        archive::read(&bytes, &BTreeMap::from([("artifact".to_owned(), u64::MAX)])).is_err(),
+        "should reject declaration before allocation"
+    );
+    for length in 0..bytes.len() {
+        assert!(
+            archive::read(&bytes[..length], &declared).is_err(),
+            "should reject truncation at {length}"
+        );
+    }
+}
+
+struct FakeSource {
+    metadata: Value,
+    archive: Vec<u8>,
+    warning: bool,
+    requested: Vec<u64>,
+    repositories: Vec<String>,
+}
+
+impl ArtifactSource for FakeSource {
+    fn metadata(&mut self, repository: &str, id: u64) -> Result<Vec<u8>, Report<ReleaseError>> {
+        self.repositories.push(repository.to_owned());
+        self.requested.push(id);
+        Ok(serde_json::to_vec(&self.metadata).expect("should serialize metadata"))
+    }
+    fn download(&mut self, repository: &str, id: u64) -> Result<Download, Report<ReleaseError>> {
+        self.repositories.push(repository.to_owned());
+        self.requested.push(id);
+        Ok(Download {
+            archive: self.archive.clone(),
+            transfer_warning: self.warning,
+        })
+    }
+}
+
+fn transfer_fixture() -> (TrustedDependencies, FakeSource) {
+    let archive = zip(&[("artifact", b"x")], false);
+    let dependencies = TrustedDependencies {
+        invocation: Invocation {
+            repository: "example/project".to_owned(),
+            repository_id: 17,
+            run_id: 29,
+            source_commit: "a".repeat(40),
+            inventory_sha256: "b".repeat(64),
+            profiles: records::RoleProfile::fixtures(),
+        },
+        required: vec![Upload {
+            asset: "trusted-server-fastly.wasm".to_owned(),
+            role: "A".to_owned(),
+            job: "fastly-a".to_owned(),
+            attempt: 1,
+            recipe_sha256: "c".repeat(64),
+            elapsed_seconds: 10,
+            deadline_seconds: 1800,
+            artifact_name: "upload".to_owned(),
+            artifact_id: 41,
+            archive_sha256: digest(&archive),
+            members: BTreeMap::from([("artifact".to_owned(), 1)]),
+        }],
+        optional: vec![],
+    };
+    let source = FakeSource {
+        metadata: json!({"id":41,"name":"upload","expired":false,"digest":format!("sha256:{}",digest(&archive)),"workflow_run":{"id":29,"head_sha":"a".repeat(40),"repository_id":17,"head_repository_id":17}}),
+        archive,
+        warning: false,
+        requested: vec![],
+        repositories: vec![],
+    };
+    (dependencies, source)
+}
+
+#[test]
+fn transfer_checks_exact_dependency_id_and_archive_bytes() {
+    let (dependencies, mut source) = transfer_fixture();
+    let checked = validate_transfers(&dependencies, &mut source).expect("should validate transfer");
+    assert_eq!(
+        checked.transfers[0].members["artifact"], b"x",
+        "should retain exact bytes"
+    );
+    assert_eq!(
+        source.requested,
+        [41, 41],
+        "should re-fetch exact selected ID"
+    );
+    assert_eq!(
+        source.repositories,
+        ["example/project", "example/project"],
+        "should use trusted repository for metadata and download"
+    );
+}
+
+#[test]
+fn transfer_rejects_stale_metadata_warnings_reused_ids_and_changed_bytes() {
+    let mut cases = Vec::new();
+    for (pointer, value) in [
+        ("/id", json!(42)),
+        ("/name", json!("other-upload")),
+        ("/expired", json!(true)),
+        ("/workflow_run/id", json!(30)),
+        ("/workflow_run/head_sha", json!("d".repeat(40))),
+        ("/workflow_run/repository_id", json!(18)),
+        ("/workflow_run/head_repository_id", json!(18)),
+        ("/digest", json!(format!("sha256:{}", "e".repeat(64)))),
+    ] {
+        let (dependencies, mut source) = transfer_fixture();
+        *source
+            .metadata
+            .pointer_mut(pointer)
+            .expect("should find fixture field") = value;
+        cases.push((dependencies, source));
+    }
+    let (dependencies, mut source) = transfer_fixture();
+    source.warning = true;
+    cases.push((dependencies, source));
+    let (dependencies, mut source) = transfer_fixture();
+    source.archive[0] ^= 1;
+    cases.push((dependencies, source));
+    let (mut dependencies, source) = transfer_fixture();
+    let mut reused = dependencies.required[0].clone();
+    reused.role = "B".to_owned();
+    dependencies.required.push(reused);
+    cases.push((dependencies, source));
+    for (dependencies, mut source) in cases {
+        assert!(
+            validate_transfers(&dependencies, &mut source).is_err(),
+            "should reject transfer substitution"
+        );
+    }
+}
+
+fn wasm() -> Vec<u8> {
+    let mut bytes = crate::inspect::tests::builders::command_module(
+        &[("fastly_http_req", "call"), ("fastly_http_resp", "call")],
+        crate::inspect::tests::builders::Entry::Nullary,
+        true,
+    );
+    for name in [".debug_info", ".debug_line"] {
+        bytes.extend([0, (name.len() + 2) as u8, name.len() as u8]);
+        bytes.extend(name.as_bytes());
+        bytes.push(1);
+    }
+    bytes
+}
+
+/// Fills the fictional sealed composition receipt with one build's bindings.
+///
+/// The fixture has the producer's `composition_export()` shape; only the
+/// target, final artifact, approved source and shared inventory vary per build.
+pub(super) fn composition_receipt(
+    target: &str,
+    artifact_sha256: &str,
+    source_commit: &str,
+    inventory_sha256: &str,
+) -> Vec<u8> {
+    let mut receipt: Value = serde_json::from_str(include_str!(
+        "../../tests/fixtures/collection/composition.json"
+    ))
+    .expect("should parse fictional composition receipt");
+    for (pointer, value) in [
+        ("/composition/platform/target", target),
+        ("/composition/platform/rust/target", target),
+        ("/composition/platform/external_requirements/target", target),
+        ("/composition/javascript/artifact_sha256", artifact_sha256),
+        ("/composition/platform/artifact_sha256", artifact_sha256),
+        (
+            "/composition/platform/external_requirements/artifact_sha256",
+            artifact_sha256,
+        ),
+        ("/composition/javascript/inventory_sha256", inventory_sha256),
+        ("/composition/package_origins/source_commit", source_commit),
+    ] {
+        *receipt
+            .pointer_mut(pointer)
+            .expect("should find receipt binding") = json!(value);
+    }
+    let platform = &mut receipt["composition"]["platform"];
+    if target.ends_with("-apple-darwin") {
+        platform["apple"] = json!({"sdk_version": "15.0", "qualification": "unqualified"});
+        platform["external_requirements"]["runtime"] = json!({
+            "format": "macho",
+            "loader": "/usr/lib/dyld",
+            "cpu": "fictional",
+            "dylibs": ["/usr/lib/libSystem.B.dylib"],
+            "minimum_os": "13.0",
+            "sdk": "15.0",
+        });
+    } else if target.ends_with("-linux-gnu") {
+        platform["external_requirements"]["runtime"] = json!({
+            "format": "elf",
+            "interpreter": "/lib64/ld-linux-x86-64.so.2",
+            "needed": ["libc.so.6"],
+            "version_requirements": [],
+            "max_glibc": "2.34",
+        });
+    }
+    let packages = receipt
+        .pointer_mut("/composition/package_origins/packages")
+        .and_then(Value::as_object_mut)
+        .expect("should find package origins");
+    for origin in packages.values_mut().map(|package| &mut package["origin"]) {
+        if origin["kind"] == "workspace" {
+            origin["source_commit"] = json!(source_commit);
+        }
+    }
+    serde_json::to_vec(&receipt).expect("should serialize composition receipt")
+}
+
+pub(super) fn cohort_fixture() -> ValidatedTransfers {
+    let inventory = b"{\"schema_version\":1}".to_vec();
+    let mut invocation = transfer_fixture().0.invocation;
+    invocation.inventory_sha256 = digest(&inventory);
+    let mut transfers = Vec::new();
+    for (index, asset) in crate::policy::FIXED_ARTIFACTS.iter().enumerate() {
+        for role in if index == 0 {
+            vec!["A", "B"]
+        } else {
+            vec!["A"]
+        } {
+            let artifact = if index == 0 {
+                wasm()
+            } else {
+                b"native final bytes".to_vec()
+            };
+            let composition = composition_receipt(
+                asset.target.triple(),
+                &digest(&artifact),
+                &invocation.source_commit,
+                &invocation.inventory_sha256,
+            );
+            let mut record: Value = serde_json::from_str(include_str!(
+                "../../tests/fixtures/collection/build-record.json"
+            ))
+            .expect("should parse fictional build record");
+            record["asset"] = json!(asset.name);
+            record["role"] = json!(role);
+            record["job"] = json!(format!("job-{index}-{role}"));
+            record["artifact_sha256"] = json!(digest(&artifact));
+            record["artifact_size"] = json!(artifact.len());
+            record["inventory_sha256"] = json!(digest(&inventory));
+            record["composition_sha256"] = json!(digest(&composition));
+            if role == "B" {
+                record["boundary"]["fingerprint"] = json!("4".repeat(64));
+                record["boundary"]["execution_fingerprint"] = json!("4".repeat(64));
+                record["boundary"]["invocation_digest"] = json!("6".repeat(64));
+                record["ambient"]["umask"] = json!(23);
+                record["ambient"]["jobs"] = json!(2);
+                record["ambient"]["checkout_root"] = json!("/external-release-B");
+                record["ambient"]["started_at_seconds"] = json!(101);
+                record["ambient"]["host_locale"] = json!("en_US.UTF-8");
+                record["ambient"]["host_timezone"] = json!("Pacific/Auckland");
+            }
+            if index == 0 {
+                record["runtime"] = json!({"role":role,"source_commit":invocation.source_commit,"final_wasm_sha256":digest(&artifact),"final_wasm_size":artifact.len(),"publisher_status":200,"injected_scripts":1,"origin_marker_matched":true,"viceroy_version":"0.21.0"});
+            }
+            let upload = Upload {
+                asset: asset.name.to_owned(),
+                role: role.to_owned(),
+                job: format!("job-{index}-{role}"),
+                attempt: 1,
+                recipe_sha256: "c".repeat(64),
+                elapsed_seconds: 10,
+                deadline_seconds: 1800,
+                artifact_name: "upload".to_owned(),
+                artifact_id: (transfers.len() + 1) as u64,
+                archive_sha256: "f".repeat(64),
+                members: BTreeMap::new(),
+            };
+            transfers.push(Transfer {
+                upload,
+                members: BTreeMap::from([
+                    ("artifact".to_owned(), artifact),
+                    (
+                        "build-record.json".to_owned(),
+                        serde_json::to_vec(&record).expect("should serialize build record"),
+                    ),
+                    ("tsjs-inventory.json".to_owned(), inventory.clone()),
+                    ("composition.json".to_owned(), composition),
+                ]),
+            });
+        }
+    }
+    let absent = crate::policy::FIXED_ARTIFACTS
+        .iter()
+        .skip(1)
+        .map(|asset| no_upload(asset.name, QUEUED, 1800))
+        .collect();
+    ValidatedTransfers {
+        invocation,
+        transfers,
+        absent,
+    }
+}
+
+/// Still queued, with no runner and no conclusion, when the collector deadline expired.
+const QUEUED: ObservedJob = ObservedJob {
+    started: false,
+    conclusion: None,
+};
+
+/// A started job ended by its own failure before the upload step.
+const FAILED_BEFORE_UPLOAD: ObservedJob = ObservedJob {
+    started: true,
+    conclusion: Some(JobConclusion::Failure),
+};
+
+/// A no-upload optional reproduction observed within a fictional 1800 s deadline.
+fn no_upload(asset: &str, job: ObservedJob, elapsed_seconds: u64) -> NoUpload {
+    NoUpload {
+        asset: asset.to_owned(),
+        job,
+        elapsed_seconds,
+        deadline_seconds: 1800,
+    }
+}
+
+fn mutate_record(transfers: &mut ValidatedTransfers, index: usize, pointer: &str, value: Value) {
+    let bytes = transfers.transfers[index]
+        .members
+        .get_mut("build-record.json")
+        .expect("should find record");
+    let mut record: Value = serde_json::from_slice(bytes).expect("should parse record");
+    *record
+        .pointer_mut(pointer)
+        .expect("should find record field") = value;
+    *bytes = serde_json::to_vec(&record).expect("should serialize changed record");
+}
+
+#[test]
+fn mandatory_fastly_and_native_a_pass_with_never_started_native_b_absent() {
+    let checked =
+        diagnose_collection(&cohort_fixture()).expect("should diagnose complete mandatory cohort");
+    assert_eq!(
+        checked.canonical.len(),
+        4,
+        "should retain exactly four canonical artifacts"
+    );
+    assert_eq!(
+        checked.native.len(),
+        3,
+        "should record all three native measurements"
+    );
+    assert!(
+        checked
+            .native
+            .values()
+            .all(|outcome| *outcome == records::Outcome::Unavailable),
+        "should honestly retain never-started native B as unavailable"
+    );
+}
+
+#[test]
+fn collection_rejects_missing_a_and_every_mandatory_gate_even_with_optional_b_absent() {
+    let mut missing = cohort_fixture();
+    missing.transfers.remove(2);
+    assert!(
+        diagnose_collection(&missing).is_err(),
+        "should reject missing native A"
+    );
+    for (pointer, value) in [
+        ("/inventory_sha256", json!("9".repeat(64))),
+        ("/composition_sha256", json!("9".repeat(64))),
+        ("/boundary/confined", json!(false)),
+        ("/boundary/control_exit", json!(1)),
+        ("/boundary/control_accepts", json!(0)),
+        ("/boundary/probe_exit", json!(0)),
+        ("/boundary/probe_accepts", json!(1)),
+        ("/boundary/execution_fingerprint", json!("9".repeat(64))),
+        ("/boundary/invocation_digest", json!("5".repeat(63))),
+        ("/boundary/invocation_digest", json!("A".repeat(64))),
+        ("/runtime", Value::Null),
+        ("/runtime/final_wasm_sha256", json!("9".repeat(64))),
+        ("/runtime/publisher_status", json!(500)),
+        ("/runtime/injected_scripts", json!(0)),
+        ("/runtime/origin_marker_matched", json!(false)),
+        ("/source_commit", json!("9".repeat(40))),
+        ("/job", json!("wrong-job")),
+        ("/attempt", json!(2)),
+    ] {
+        let mut fixture = cohort_fixture();
+        mutate_record(&mut fixture, 0, pointer, value);
+        assert!(
+            diagnose_collection(&fixture).is_err(),
+            "should reject mandatory gate {pointer}"
+        );
+    }
+    let mut fixture = cohort_fixture();
+    fixture.transfers[3]
+        .members
+        .get_mut("artifact")
+        .expect("should have native A")
+        .push(0);
+    assert!(
+        diagnose_collection(&fixture).is_err(),
+        "should not hide native A byte changes behind optional B absence"
+    );
+}
+
+#[test]
+fn collection_rejects_unchanged_supported_variations_and_dishonest_claims() {
+    for (pointer, value) in [
+        ("/ambient/umask", json!(18)),
+        ("/ambient/jobs", json!(4)),
+        ("/ambient/checkout_root", json!("/external-release-A")),
+        ("/ambient/started_at_seconds", json!(100)),
+        ("/ambient/child_locale", json!("en_US.UTF-8")),
+        ("/ambient/child_timezone", json!("Pacific/Auckland")),
+        ("/ambient/execution_uid", json!(1001)),
+        ("/claim/varied", json!(["umask", "jobs", "checkout_root"])),
+        (
+            "/claim/normalized",
+            json!(["locale", "timezone", "start_time"]),
+        ),
+        ("/claim/unsupported", json!(["execution_user", "jobs"])),
+    ] {
+        let mut fixture = cohort_fixture();
+        mutate_record(&mut fixture, 1, pointer, value);
+        assert!(
+            diagnose_collection(&fixture).is_err(),
+            "should reject dishonest or unchanged variation {pointer}"
+        );
+    }
+}
+
+#[test]
+fn collection_compares_complete_fastly_final_bytes_without_exclusions() {
+    let mut fixture = cohort_fixture();
+    let artifact = fixture.transfers[1]
+        .members
+        .get_mut("artifact")
+        .expect("should find Fastly B");
+    *artifact.last_mut().expect("should have bytes") ^= 1;
+    let sha = digest(artifact);
+    let size = artifact.len();
+    mutate_record(&mut fixture, 1, "/artifact_sha256", json!(sha));
+    mutate_record(&mut fixture, 1, "/runtime/final_wasm_sha256", json!(sha));
+    mutate_record(&mut fixture, 1, "/runtime/final_wasm_size", json!(size));
+    let composition = composition_receipt(
+        crate::policy::FIXED_ARTIFACTS[0].target.triple(),
+        &sha,
+        &fixture.invocation.source_commit,
+        &fixture.invocation.inventory_sha256,
+    );
+    let composition_sha = digest(&composition);
+    fixture.transfers[1]
+        .members
+        .insert("composition.json".to_owned(), composition);
+    mutate_record(
+        &mut fixture,
+        1,
+        "/composition_sha256",
+        json!(composition_sha),
+    );
+    let error = diagnose_collection(&fixture).expect_err("should reject one changed final byte");
+    assert!(
+        format!("{error:?}").contains("final Fastly bytes differ"),
+        "should reach complete final-byte equality gate"
+    );
+}
+
+#[test]
+fn zip_deflate_preserves_full_bytes_and_rejects_extra_compressed_data() {
+    let body = vec![b'x'; 128 * 1024 + 17];
+    for descriptor in [false, true] {
+        let mut encoder =
+            flate2::write::DeflateEncoder::new(Vec::new(), flate2::Compression::fast());
+        encoder.write_all(&body).expect("should compress fixture");
+        let compressed = encoder.finish().expect("should finish compression");
+        let mut bytes = zip(&[("artifact", &body)], descriptor);
+        bytes.splice(38..38 + body.len(), compressed.iter().copied());
+        let central = 38 + compressed.len() + if descriptor { 16 } else { 0 };
+        bytes[8..10].copy_from_slice(&8_u16.to_le_bytes());
+        bytes[18..22].copy_from_slice(
+            &(if descriptor {
+                0
+            } else {
+                compressed.len() as u32
+            })
+            .to_le_bytes(),
+        );
+        bytes[central + 10..central + 12].copy_from_slice(&8_u16.to_le_bytes());
+        bytes[central + 20..central + 24].copy_from_slice(&(compressed.len() as u32).to_le_bytes());
+        if descriptor {
+            bytes[38 + compressed.len() + 8..38 + compressed.len() + 12]
+                .copy_from_slice(&(compressed.len() as u32).to_le_bytes());
+        }
+        let end = bytes.len() - 22;
+        bytes[end + 16..end + 20].copy_from_slice(&(central as u32).to_le_bytes());
+        let declared = BTreeMap::from([("artifact".to_owned(), body.len() as u64)]);
+        assert_eq!(
+            archive::read(&bytes, &declared).expect("should validate deflated stream")["artifact"],
+            body,
+            "should decompress exact full bytes"
+        );
+        bytes[central + 24..central + 28].copy_from_slice(&1_u32.to_le_bytes());
+        assert!(
+            archive::read(&bytes, &BTreeMap::from([("artifact".to_owned(), 1)])).is_err(),
+            "should reject expanded bytes beyond declared bound"
+        );
+    }
+}
+
+#[test]
+fn native_b_records_match_mismatch_failed_and_unavailable_without_masking_a() {
+    for same in [true, false] {
+        let fixture = with_uploaded_native_b(same);
+        let diagnostic = diagnose_collection(&fixture)
+            .expect("should measure native B without requiring equality");
+        assert_eq!(
+            diagnostic.native[crate::policy::FIXED_ARTIFACTS[1].name],
+            if same {
+                records::Outcome::Matched
+            } else {
+                records::Outcome::Mismatched
+            },
+            "should report actual complete-byte native result"
+        );
+    }
+    for (job, elapsed, outcome) in [
+        (FAILED_BEFORE_UPLOAD, 7, records::Outcome::Failed),
+        (QUEUED, 1800, records::Outcome::Unavailable),
+    ] {
+        let mut fixture = cohort_fixture();
+        fixture.absent[0] = no_upload(crate::policy::FIXED_ARTIFACTS[1].name, job, elapsed);
+        assert_eq!(
+            diagnose_collection(&fixture)
+                .expect("should retain bounded native B failure")
+                .native[crate::policy::FIXED_ARTIFACTS[1].name],
+            outcome,
+            "should report honest bounded outcome"
+        );
+        fixture.absent[0].elapsed_seconds = 1801;
+        assert!(
+            diagnose_collection(&fixture).is_err(),
+            "should reject unbounded optional B outcome"
+        );
+    }
+}
+
+#[test]
+fn uploaded_build_deadlines_are_bounded_before_rest_or_comparison() {
+    let (mut dependencies, mut source) = transfer_fixture();
+    dependencies.required[0].elapsed_seconds = 1801;
+    assert!(
+        validate_transfers(&dependencies, &mut source).is_err(),
+        "should reject a successful upload outside its job deadline"
+    );
+    assert!(
+        source.requested.is_empty(),
+        "should reject before fetching any unbounded result"
+    );
+    let mut fixture = cohort_fixture();
+    fixture.transfers[1].upload.deadline_seconds = 0;
+    assert!(
+        diagnose_collection(&fixture).is_err(),
+        "should reject missing bounded completion metadata"
+    );
+}
+
+#[test]
+fn optional_native_b_cannot_hide_any_canonical_composition_or_js_failure() {
+    for index in [0, 2, 3, 4] {
+        for pointer in ["/composition_sha256", "/inventory_sha256"] {
+            let mut fixture = cohort_fixture();
+            mutate_record(&mut fixture, index, pointer, json!("9".repeat(64)));
+            assert!(
+                diagnose_collection(&fixture).is_err(),
+                "should block failed mandatory A {index} {pointer}"
+            );
+        }
+        let mut fixture = cohort_fixture();
+        fixture.transfers[index]
+            .members
+            .insert("tsjs-inventory.json".to_owned(), b"{}".to_vec());
+        assert!(
+            diagnose_collection(&fixture).is_err(),
+            "should reject changed actual shared inventory bytes in A {index}"
+        );
+        let mut fixture = cohort_fixture();
+        fixture.transfers[index].members.remove("composition.json");
+        assert!(
+            diagnose_collection(&fixture).is_err(),
+            "should reject absent canonical composition despite optional B unavailability"
+        );
+    }
+}
+
+#[test]
+fn zip_rejects_symlinks_zip64_and_local_central_disagreement() {
+    let original = zip(&[("artifact", b"x")], false);
+    let central = 39;
+    let declared = BTreeMap::from([("artifact".to_owned(), 1)]);
+    for (offset, bytes) in [
+        (central + 38, (0o120777_u32 << 16).to_le_bytes().to_vec()),
+        (central + 20, u32::MAX.to_le_bytes().to_vec()),
+        (central + 42, 1_u32.to_le_bytes().to_vec()),
+        (central + 6, 45_u16.to_le_bytes().to_vec()),
+        (14, 1_u32.to_le_bytes().to_vec()),
+        (30, b"different".to_vec()),
+    ] {
+        let mut changed = original.clone();
+        changed[offset..offset + bytes.len()].copy_from_slice(&bytes);
+        assert!(
+            archive::read(&changed, &declared).is_err(),
+            "should reject ZIP ambiguity at offset {offset}"
+        );
+    }
+    let bytes = zip(&[("artifact", b"x"), ("Artifact", b"x")], false);
+    let declared = BTreeMap::from([("artifact".to_owned(), 1), ("Artifact".to_owned(), 1)]);
+    assert!(
+        archive::read(&bytes, &declared).is_err(),
+        "should reject case-colliding declared identities"
+    );
+}
+
+#[test]
+fn dependency_repository_cannot_change_the_fixed_api_path() {
+    for repository in [
+        "../project",
+        "example/..",
+        "example/project?other=1",
+        "example/project#fragment",
+        "example/project%2fother",
+        "example/",
+        "/project",
+    ] {
+        let (mut dependencies, mut source) = transfer_fixture();
+        dependencies.invocation.repository = repository.to_owned();
+        let result = validate_transfers(&dependencies, &mut source);
+        assert!(
+            result.is_err(),
+            "should reject unsafe repository endpoint {repository}"
+        );
+        assert!(
+            source.requested.is_empty(),
+            "should reject before any endpoint call"
+        );
+    }
+}
+
+#[test]
+fn candidate_rebuild_details_preserve_observations_and_absence_without_authority() {
+    let checked = diagnose_collection(&cohort_fixture()).expect("should derive candidate details");
+    let fastly = checked
+        .rebuild
+        .get(crate::policy::FIXED_ARTIFACTS[0].name)
+        .expect("should retain Fastly rebuild diagnostic");
+    assert_eq!(
+        fastly["release_qualification"], false,
+        "should never imply official qualification"
+    );
+    assert_eq!(
+        fastly["outcome"], "matched",
+        "should report complete Fastly equality"
+    );
+    assert_eq!(
+        fastly["canonical"]["artifact_id"], 1,
+        "should retain trusted A upload identity"
+    );
+    assert_eq!(
+        fastly["reproduction"]["artifact_id"], 2,
+        "should retain trusted B upload identity"
+    );
+    assert_eq!(
+        fastly["reproduction"]["ambient"]["jobs"], 2,
+        "should retain checked observed B profile"
+    );
+    let native = checked
+        .rebuild
+        .get(crate::policy::FIXED_ARTIFACTS[1].name)
+        .expect("should retain native rebuild diagnostic");
+    assert_eq!(
+        native["outcome"], "unavailable",
+        "should retain never-started outcome"
+    );
+    let b = native["reproduction"]
+        .as_object()
+        .expect("should retain honest bounded absence");
+    assert_eq!(
+        b.len(),
+        4,
+        "should emit only outcome, observed job state, elapsed and deadline without invented identity or observations"
+    );
+    assert_eq!(
+        b["job_state"],
+        json!({"started": false, "conclusion": null}),
+        "should retain the observed never-started job state honestly"
+    );
+    for field in [
+        "artifact_id",
+        "artifact_name",
+        "job",
+        "attempt",
+        "archive_sha256",
+        "ambient",
+        "artifact_sha256",
+    ] {
+        assert!(!b.contains_key(field), "should omit unavailable B {field}");
+    }
+}
+
+struct FakeRun(BTreeMap<u64, FakeSource>);
+impl ArtifactSource for FakeRun {
+    fn metadata(&mut self, repository: &str, id: u64) -> Result<Vec<u8>, Report<ReleaseError>> {
+        self.0
+            .get_mut(&id)
+            .expect("should request exact current-run ID")
+            .metadata(repository, id)
+    }
+    fn download(&mut self, repository: &str, id: u64) -> Result<Download, Report<ReleaseError>> {
+        self.0
+            .get_mut(&id)
+            .expect("should request exact current-run ID")
+            .download(repository, id)
+    }
+}
+
+#[test]
+fn exact_current_run_archives_feed_the_complete_candidate_comparison() {
+    let fixture = cohort_fixture();
+    let mut dependencies = TrustedDependencies {
+        invocation: fixture.invocation,
+        required: Vec::new(),
+        optional: fixture
+            .absent
+            .into_iter()
+            .map(OptionalBuild::NotUploaded)
+            .collect(),
+    };
+    let mut source = FakeRun(BTreeMap::new());
+    for transfer in fixture.transfers {
+        let mut upload = transfer.upload;
+        let members = transfer
+            .members
+            .iter()
+            .map(|(name, body)| (name.as_str(), body.as_slice()))
+            .collect::<Vec<_>>();
+        let archive = zip(&members, true);
+        upload.archive_sha256 = digest(&archive);
+        upload.members = transfer
+            .members
+            .iter()
+            .map(|(name, body)| (name.clone(), body.len() as u64))
+            .collect();
+        source.0.insert(upload.artifact_id,FakeSource {metadata:json!({"id":upload.artifact_id,"name":upload.artifact_name,"expired":false,"digest":format!("sha256:{}",upload.archive_sha256),"workflow_run":{"id":dependencies.invocation.run_id,"head_sha":dependencies.invocation.source_commit,"repository_id":dependencies.invocation.repository_id,"head_repository_id":dependencies.invocation.repository_id}}),archive,warning:false,requested:Vec::new(),repositories:Vec::new()});
+        dependencies.required.push(upload);
+    }
+    let transfers = validate_transfers(&dependencies, &mut source)
+        .expect("should re-download exact complete current-run transfers");
+    let checked = diagnose_collection(&transfers)
+        .expect("should compare declared full final bytes from validated archives");
+    assert_eq!(
+        checked.canonical.len(),
+        4,
+        "should retain full canonical cohort"
+    );
+    assert!(
+        source.0.values().all(|source| source.requested.len() == 2),
+        "should corroborate REST and re-download every exact-ID upload"
+    );
+}
+
+fn raw_deflate_zip(body: &[u8], compressed: &[u8], descriptor: bool) -> Vec<u8> {
+    let mut bytes = zip(&[("artifact", body)], descriptor);
+    bytes.splice(38..38 + body.len(), compressed.iter().copied());
+    let central = 38 + compressed.len() + if descriptor { 16 } else { 0 };
+    bytes[8..10].copy_from_slice(&8_u16.to_le_bytes());
+    bytes[18..22].copy_from_slice(
+        &(if descriptor {
+            0
+        } else {
+            compressed.len() as u32
+        })
+        .to_le_bytes(),
+    );
+    bytes[central + 10..central + 12].copy_from_slice(&8_u16.to_le_bytes());
+    bytes[central + 20..central + 24].copy_from_slice(&(compressed.len() as u32).to_le_bytes());
+    if descriptor {
+        bytes[38 + compressed.len() + 8..38 + compressed.len() + 12]
+            .copy_from_slice(&(compressed.len() as u32).to_le_bytes());
+    }
+    let end = bytes.len() - 22;
+    bytes[end + 16..end + 20].copy_from_slice(&(central as u32).to_le_bytes());
+    bytes
+}
+
+#[test]
+fn unix_zip32_deflate_upload_profile_accepts_flat_files_and_rejects_nested_names() {
+    let body = b"x";
+    let compressed = b"\x01\x01\x00\xfe\xffx";
+    let mut bytes = raw_deflate_zip(body, compressed, true);
+    let end = bytes.len() - 22;
+    let central = u32::from_le_bytes(
+        bytes[end + 16..end + 20]
+            .try_into()
+            .expect("should hold the central directory offset"),
+    ) as usize;
+    bytes[central + 4..central + 6].copy_from_slice(&0x032d_u16.to_le_bytes());
+    let attributes = (0o100644_u32 << 16) | 0x20;
+    bytes[central + 38..central + 42].copy_from_slice(&attributes.to_le_bytes());
+    let declared = BTreeMap::from([("artifact".to_owned(), body.len() as u64)]);
+
+    assert_eq!(
+        archive::read(&bytes, &declared)
+            .expect("should accept regular Unix files with ZIP32 signed streaming descriptors")["artifact"],
+        body,
+        "should retain exact fictional member bytes"
+    );
+
+    bytes[30..38].copy_from_slice(b"a/binary");
+    bytes[central + 46..central + 54].copy_from_slice(b"a/binary");
+    let nested = BTreeMap::from([("a/binary".to_owned(), body.len() as u64)]);
+    assert!(
+        archive::read(&bytes, &nested).is_err(),
+        "should reject nested member names without relaxing the flat-file policy"
+    );
+}
+
+#[test]
+fn zip_requires_deflate_stream_end_even_when_crc_size_and_consumption_match() {
+    for descriptor in [false, true] {
+        for (body, nonfinal) in [
+            (b"x".as_slice(), b"\x00\x01\x00\xfe\xffx".as_slice()),
+            (b"".as_slice(), b"\x00\x00\x00\xff\xff".as_slice()),
+        ] {
+            let declared = BTreeMap::from([("artifact".to_owned(), body.len() as u64)]);
+            let truncated = raw_deflate_zip(body, nonfinal, descriptor);
+            assert!(
+                archive::read(&truncated, &declared).is_err(),
+                "should reject nonfinal raw DEFLATE block despite exact output, CRC and consumed bytes"
+            );
+            let mut final_block = nonfinal.to_vec();
+            final_block[0] |= 1;
+            let valid = raw_deflate_zip(body, &final_block, descriptor);
+            let mut trailing = final_block.clone();
+            trailing.push(0);
+            assert!(
+                archive::read(&raw_deflate_zip(body, &trailing, descriptor), &declared).is_err(),
+                "should reject compressed bytes after the final DEFLATE marker"
+            );
+            for length in 0..final_block.len() {
+                assert!(
+                    archive::read(
+                        &raw_deflate_zip(body, &final_block[..length], descriptor),
+                        &declared
+                    )
+                    .is_err(),
+                    "should reject every truncated final DEFLATE block"
+                );
+            }
+            assert_eq!(
+                archive::read(&valid, &declared)
+                    .expect("should accept explicit final DEFLATE block")["artifact"],
+                body,
+                "should retain exact terminated stream output"
+            );
+        }
+    }
+}
+
+/// Selects one reproduction profile and makes Fastly B observe it exactly, so
+/// only the A/B pair comparison can reject the record.
+fn fixture_with_selected_reproduction(
+    profile: records::RoleProfile,
+    ambient: &Value,
+) -> ValidatedTransfers {
+    let mut fixture = cohort_fixture();
+    fixture.invocation.profiles[1] = profile;
+    for (field, value) in ambient.as_object().expect("should hold ambient fields") {
+        mutate_record(&mut fixture, 1, &format!("/ambient/{field}"), value.clone());
+    }
+    fixture
+}
+
+#[test]
+fn reproduction_selected_without_a_supported_variation_is_rejected_by_the_pair_check() {
+    for (dimension, profile, ambient) in [
+        (
+            "umask",
+            records::RoleProfile::for_tests(18, 2, "en_US.UTF-8", "Pacific/Auckland"),
+            json!({"umask": 18}),
+        ),
+        (
+            "jobs",
+            records::RoleProfile::for_tests(23, 4, "en_US.UTF-8", "Pacific/Auckland"),
+            json!({"jobs": 4}),
+        ),
+        (
+            "host locale",
+            records::RoleProfile::for_tests(23, 2, "C", "Pacific/Auckland"),
+            json!({"host_locale": "C"}),
+        ),
+        (
+            "host timezone",
+            records::RoleProfile::for_tests(23, 2, "en_US.UTF-8", "UTC"),
+            json!({"host_timezone": "UTC"}),
+        ),
+        (
+            "start time",
+            records::RoleProfile::for_tests(23, 2, "en_US.UTF-8", "Pacific/Auckland"),
+            json!({"started_at_seconds": 100}),
+        ),
+    ] {
+        let fixture = fixture_with_selected_reproduction(profile, &ambient);
+        let error = diagnose_collection(&fixture)
+            .expect_err("should reject a reproduction that omits a supported variation");
+        assert!(
+            format!("{error:?}").contains("A/B variation is missing"),
+            "should reach the pair check for unvaried {dimension}: {error:?}"
+        );
+    }
+}
+
+#[test]
+fn reproduction_reusing_the_canonical_exact_invocation_is_rejected() {
+    // Distinct boundary instances do not make one exact invocation two.
+    let mut fixture = cohort_fixture();
+    mutate_record(
+        &mut fixture,
+        1,
+        "/boundary/invocation_digest",
+        json!("5".repeat(64)),
+    );
+    let error = diagnose_collection(&fixture)
+        .expect_err("should reject identical role-specific invocation digests");
+    assert!(
+        format!("{error:?}").contains("A/B share one exact invocation"),
+        "should reject a reproduction claiming the canonical invocation: {error:?}"
+    );
+}
+
+#[test]
+fn reproduction_reusing_the_canonical_boundary_instance_is_rejected() {
+    let mut fixture = cohort_fixture();
+    for pointer in ["/boundary/fingerprint", "/boundary/execution_fingerprint"] {
+        mutate_record(&mut fixture, 1, pointer, json!("3".repeat(64)));
+    }
+    let error = diagnose_collection(&fixture)
+        .expect_err("should reject one boundary instance serving both builds");
+    assert!(
+        format!("{error:?}").contains("A/B share one boundary instance"),
+        "should reject a reproduction run in the canonical boundary: {error:?}"
+    );
+}
+
+/// Rebinds a changed imported composition summary so only its content is wrong.
+fn rebind_composition(fixture: &mut ValidatedTransfers, index: usize, pointer: &str, value: Value) {
+    let members = &mut fixture.transfers[index].members;
+    let mut composition: Value = serde_json::from_slice(&members["composition.json"])
+        .expect("should parse fictional composition");
+    *composition
+        .pointer_mut(pointer)
+        .expect("should find composition field") = value;
+    let bytes = serde_json::to_vec(&composition).expect("should serialize changed composition");
+    let hash = digest(&bytes);
+    members.insert("composition.json".to_owned(), bytes);
+    mutate_record(fixture, index, "/composition_sha256", json!(hash));
+}
+
+/// Adds an uploaded first-native reproduction with matched or mismatched bytes.
+fn with_uploaded_native_b(same: bool) -> ValidatedTransfers {
+    let mut fixture = cohort_fixture();
+    let mut reproduction = Transfer {
+        upload: fixture.transfers[2].upload.clone(),
+        members: fixture.transfers[2].members.clone(),
+    };
+    reproduction.upload.role = "B".to_owned();
+    reproduction.upload.job = "native-b".to_owned();
+    reproduction.upload.artifact_id = 99;
+    fixture.transfers.push(reproduction);
+    fixture.absent.remove(0);
+    let index = fixture.transfers.len() - 1;
+    for (pointer, value) in [
+        ("/role", json!("B")),
+        ("/job", json!("native-b")),
+        ("/boundary/fingerprint", json!("4".repeat(64))),
+        ("/boundary/execution_fingerprint", json!("4".repeat(64))),
+        ("/boundary/invocation_digest", json!("6".repeat(64))),
+        ("/ambient/umask", json!(23)),
+        ("/ambient/jobs", json!(2)),
+        ("/ambient/checkout_root", json!("/external-release-B")),
+        ("/ambient/started_at_seconds", json!(101)),
+        ("/ambient/host_locale", json!("en_US.UTF-8")),
+        ("/ambient/host_timezone", json!("Pacific/Auckland")),
+    ] {
+        mutate_record(&mut fixture, index, pointer, value);
+    }
+    if !same {
+        let artifact = fixture.transfers[index]
+            .members
+            .get_mut("artifact")
+            .expect("should find native B");
+        artifact.push(1);
+        let (hash, size) = (digest(artifact), artifact.len());
+        mutate_record(&mut fixture, index, "/artifact_sha256", json!(hash));
+        mutate_record(&mut fixture, index, "/artifact_size", json!(size));
+        for pointer in RECEIPT_ARTIFACT_BINDINGS {
+            rebind_composition(&mut fixture, index, pointer, json!(hash));
+        }
+    }
+    fixture
+}
+
+/// Every receipt field the producer binds to the exact final artifact digest.
+const RECEIPT_ARTIFACT_BINDINGS: [&str; 3] = [
+    "/composition/javascript/artifact_sha256",
+    "/composition/platform/artifact_sha256",
+    "/composition/platform/external_requirements/artifact_sha256",
+];
+
+/// Fixture receipt pointer to the registry dependency's package origin.
+const DEPENDENCY_ORIGIN: &str = "/composition/package_origins/packages/registry+https:~1~1registry.example.com~1index#example-dep@1.0.0";
+/// Fixture receipt pointer to the workspace package's origin.
+const WORKSPACE_ORIGIN: &str =
+    "/composition/package_origins/packages/path+file:~1~1~1workspace~1crates~1example-app#0.1.0";
+
+/// Receipt changes that each break one collector composition check.
+fn composition_gates() -> Vec<(String, Value)> {
+    let mut gates = RECEIPT_ARTIFACT_BINDINGS
+        .iter()
+        .map(|pointer| ((*pointer).to_owned(), json!("9".repeat(64))))
+        .collect::<Vec<_>>();
+    gates.extend([
+        (
+            "/composition/package_origins/source_commit".to_owned(),
+            json!("9".repeat(40)),
+        ),
+        (
+            format!("{WORKSPACE_ORIGIN}/origin/source_commit"),
+            json!("9".repeat(40)),
+        ),
+        (
+            "/composition/javascript/inventory_sha256".to_owned(),
+            json!("9".repeat(64)),
+        ),
+        (
+            "/composition/package_origins/materials_sha256".to_owned(),
+            json!("9".repeat(64)),
+        ),
+        (
+            "/composition/platform/target".to_owned(),
+            json!("example-unknown-none"),
+        ),
+        (
+            "/composition/platform/external_requirements/target".to_owned(),
+            json!("example-unknown-none"),
+        ),
+        (
+            "/composition/native/material_native_coverage_complete".to_owned(),
+            json!(true),
+        ),
+        (
+            "/composition/platform/material_native_coverage_complete".to_owned(),
+            json!(true),
+        ),
+        ("/observations/units".to_owned(), json!([])),
+        (
+            "/composition/package_origins/packages".to_owned(),
+            json!({}),
+        ),
+        (
+            format!("{DEPENDENCY_ORIGIN}/manifest_path"),
+            json!("crates/example-app/Cargo.toml"),
+        ),
+        (
+            format!("{DEPENDENCY_ORIGIN}/prepared_manifest_sha256"),
+            json!("not-a-digest"),
+        ),
+        ("/metadata_plan_sha256".to_owned(), json!("7".repeat(63))),
+        ("/tree_plan_sha256".to_owned(), json!("8".repeat(65))),
+        (
+            "/composition/javascript/modules/0/module/sha256".to_owned(),
+            json!("not-a-digest"),
+        ),
+        ("/composition/javascript/modules".to_owned(), json!([])),
+        (
+            "/composition/graph/selected_package_id".to_owned(),
+            json!("path+file:///workspace/crates/another#0.1.0"),
+        ),
+        (
+            "/observations/units/0/package_id".to_owned(),
+            json!("path+file:///workspace/crates/another#0.1.0"),
+        ),
+        (
+            "/composition/native/contributors/0/original_sha256".to_owned(),
+            json!("c3".repeat(31)),
+        ),
+    ]);
+    gates
+}
+
+#[test]
+fn every_composition_receipt_gate_rejects_its_changed_fact() {
+    for (pointer, value) in composition_gates() {
+        let mut fixture = cohort_fixture();
+        rebind_composition(&mut fixture, 0, &pointer, value);
+        let error = diagnose_collection(&fixture)
+            .expect_err("should reject a changed composition receipt fact");
+        assert!(
+            format!("{error:?}").contains("composition receipt"),
+            "should reject receipt {pointer} at a composition receipt gate: {error:?}"
+        );
+    }
+}
+
+#[test]
+fn composition_receipt_shape_is_strict() {
+    let fixture = cohort_fixture();
+    let receipt: Value = serde_json::from_slice(&fixture.transfers[0].members["composition.json"])
+        .expect("should parse fixture receipt");
+    let summary = json!({
+        "artifact_sha256": digest(&fixture.transfers[0].members["artifact"]),
+        "source_commit": fixture.invocation.source_commit,
+        "inventory_sha256": fixture.invocation.inventory_sha256,
+        "contributing_sources": ["d".repeat(64)],
+        "compiled_units": 1,
+    });
+    let mut extra_top = receipt.clone();
+    extra_top["coverage_complete"] = json!(true);
+    let mut extra_nested = receipt.clone();
+    extra_nested["composition"]["javascript"]["function_reachability"] = json!(true);
+    let mut missing = receipt.clone();
+    missing["composition"]
+        .as_object_mut()
+        .expect("should find composition")
+        .remove("native");
+    let mut extra_origin = receipt.clone();
+    extra_origin
+        .pointer_mut(&format!("{DEPENDENCY_ORIGIN}/origin/original"))
+        .and_then(Value::as_object_mut)
+        .expect("should find the registry original")
+        .insert("verified".to_owned(), json!(true));
+    let mut missing_apple = receipt.clone();
+    missing_apple["composition"]["platform"]
+        .as_object_mut()
+        .expect("should find platform")
+        .remove("apple");
+    let serialized = |value: &Value| serde_json::to_vec(value).expect("should serialize receipt");
+    let text = String::from_utf8(serialized(&receipt)).expect("should be UTF-8");
+    let duplicate = text
+        .replacen(
+            "\"metadata_plan_sha256\"",
+            &format!(
+                "\"metadata_plan_sha256\":\"{}\",\"metadata_plan_sha256\"",
+                "7".repeat(64)
+            ),
+            1,
+        )
+        .into_bytes();
+    for (name, bytes) in [
+        ("collector summary", serialized(&summary)),
+        ("extra top-level field", serialized(&extra_top)),
+        ("extra nested field", serialized(&extra_nested)),
+        ("missing component", serialized(&missing)),
+        ("extra tagged origin field", serialized(&extra_origin)),
+        ("missing opaque platform member", serialized(&missing_apple)),
+        ("duplicate key", duplicate),
+    ] {
+        let mut changed = cohort_fixture();
+        let hash = digest(&bytes);
+        changed.transfers[0]
+            .members
+            .insert("composition.json".to_owned(), bytes);
+        mutate_record(&mut changed, 0, "/composition_sha256", json!(hash));
+        let error = format!(
+            "{:?}",
+            diagnose_collection(&changed).expect_err("should reject a malformed receipt")
+        );
+        assert!(
+            !error.contains("composition receipt") && !error.contains("digest changed"),
+            "should reject a receipt with {name} while parsing it: {error}"
+        );
+    }
+}
+
+#[test]
+fn receipt_coverage_claims_apple_evidence_and_runtime_format_follow_the_target() {
+    // Transfers 0, 2, 3 and 4 are Fastly, both Darwin CLIs and the Linux CLI.
+    let cases = [
+        (
+            0,
+            "/composition/native/material_native_coverage_complete",
+            json!(true),
+            "claims complete material native coverage",
+        ),
+        (
+            4,
+            "/composition/platform/material_native_coverage_complete",
+            json!(true),
+            "claims complete material native coverage",
+        ),
+        (
+            0,
+            "/composition/platform/apple",
+            json!({"sdk_version": "15.0"}),
+            "Apple evidence does not match its target",
+        ),
+        (
+            4,
+            "/composition/platform/apple",
+            json!({"sdk_version": "15.0"}),
+            "Apple evidence does not match its target",
+        ),
+        (
+            2,
+            "/composition/platform/apple",
+            Value::Null,
+            "Apple evidence does not match its target",
+        ),
+        (
+            0,
+            "/composition/platform/external_requirements/runtime/format",
+            json!("elf"),
+            "runtime format does not match its target",
+        ),
+        (
+            3,
+            "/composition/platform/external_requirements/runtime/format",
+            json!("wasm"),
+            "runtime format does not match its target",
+        ),
+        (
+            4,
+            "/composition/platform/external_requirements/runtime/format",
+            json!("macho"),
+            "runtime format does not match its target",
+        ),
+    ];
+    for (index, pointer, value, expected) in cases {
+        let mut fixture = cohort_fixture();
+        rebind_composition(&mut fixture, index, pointer, value);
+        let error = diagnose_collection(&fixture).expect_err("should reject the receipt");
+        assert!(
+            format!("{error:?}").contains(expected),
+            "should reject transfer {index} receipt {pointer} with {expected}: {error:?}"
+        );
+    }
+}
+
+#[test]
+fn receipt_entry_point_binds_producer_facts_for_every_fixed_asset() {
+    let (artifact, source, inventory, materials) = (
+        "a".repeat(64),
+        "b".repeat(40),
+        "c".repeat(64),
+        "e".repeat(64),
+    );
+    let facts = |asset: &'static str| ReceiptFacts {
+        artifact_sha256: &artifact,
+        source_commit: &source,
+        inventory_sha256: &inventory,
+        materials_sha256: &materials,
+        asset,
+    };
+    for fixed in &crate::policy::FIXED_ARTIFACTS {
+        let receipt = composition_receipt(fixed.target.triple(), &artifact, &source, &inventory);
+        check_composition_receipt(&receipt, &facts(fixed.name)).unwrap_or_else(|error| {
+            panic!("should accept the receipt for {}: {error:?}", fixed.name)
+        });
+        let other_materials = "9".repeat(64);
+        let error = check_composition_receipt(
+            &receipt,
+            &ReceiptFacts {
+                materials_sha256: &other_materials,
+                ..facts(fixed.name)
+            },
+        )
+        .expect_err("should reject other build materials");
+        assert!(
+            format!("{error:?}").contains("not bound to the build materials"),
+            "should reject {} receipt for other materials: {error:?}",
+            fixed.name
+        );
+    }
+    let fastly = &crate::policy::FIXED_ARTIFACTS[0];
+    let receipt = composition_receipt(fastly.target.triple(), &artifact, &source, &inventory);
+    let error = check_composition_receipt(&receipt, &facts(crate::policy::FIXED_ARTIFACTS[3].name))
+        .expect_err("should reject a receipt for another asset target");
+    assert!(
+        format!("{error:?}").contains("composition receipt names another target"),
+        "should derive the target from the asset: {error:?}"
+    );
+    let error = check_composition_receipt(&receipt, &facts("unknown-asset"))
+        .expect_err("should reject an unknown asset");
+    assert!(
+        format!("{error:?}").contains("unknown cohort artifact"),
+        "should reject an asset outside the fixed set: {error:?}"
+    );
+}
+
+#[test]
+fn fastly_receipt_must_embed_every_js_module_while_native_may_not() {
+    let pointer = "/composition/javascript/modules/0/classification";
+    let mut fastly = cohort_fixture();
+    rebind_composition(&mut fastly, 0, pointer, json!("js_build_material"));
+    let error = diagnose_collection(&fastly).expect_err("should reject unembedded Fastly JS");
+    assert!(
+        format!("{error:?}").contains("composition receipt omits a complete Fastly JS module"),
+        "should reject a Fastly receipt with an unembedded module: {error:?}"
+    );
+    let mut native = cohort_fixture();
+    rebind_composition(&mut native, 2, pointer, json!("js_build_material"));
+    diagnose_collection(&native).expect("should accept CLI-discarded JS build material");
+}
+
+/// Every optional reproduction state: never started, failed, matched, mismatched.
+fn every_optional_reproduction_state() -> Vec<(&'static str, ValidatedTransfers)> {
+    let mut failed = cohort_fixture();
+    for absent in &mut failed.absent {
+        absent.job = FAILED_BEFORE_UPLOAD;
+        absent.elapsed_seconds = 7;
+    }
+    vec![
+        ("unavailable", cohort_fixture()),
+        ("failed", failed),
+        ("matched", with_uploaded_native_b(true)),
+        ("mismatched", with_uploaded_native_b(false)),
+    ]
+}
+
+#[test]
+fn every_optional_reproduction_state_is_accepted_with_honest_outcomes() {
+    for (state, fixture) in every_optional_reproduction_state() {
+        let diagnostic = diagnose_collection(&fixture)
+            .unwrap_or_else(|error| panic!("should accept optional B state {state}: {error:?}"));
+        assert_eq!(
+            serde_json::to_value(diagnostic.native[crate::policy::FIXED_ARTIFACTS[1].name])
+                .expect("should serialize outcome"),
+            json!(state),
+            "should record exactly the {state} outcome"
+        );
+        assert_eq!(
+            diagnostic.canonical.len(),
+            4,
+            "should preserve all canonical artifacts once mandatory gates pass"
+        );
+    }
+}
+
+#[test]
+fn no_optional_reproduction_state_hides_a_mandatory_canonical_failure() {
+    let record_gates = [
+        ("/boundary/confined", json!(false)),
+        ("/boundary/control_exit", json!(1)),
+        ("/boundary/control_accepts", json!(0)),
+        ("/boundary/control_accepts", json!(2)),
+        ("/boundary/probe_exit", json!(0)),
+        ("/boundary/probe_errno", json!(111)),
+        ("/boundary/probe_errno", json!(0)),
+        ("/boundary/probe_accepts", json!(1)),
+        ("/boundary/execution_fingerprint", json!("9".repeat(64))),
+        ("/boundary/invocation_digest", json!("5".repeat(63))),
+        ("/inventory_sha256", json!("9".repeat(64))),
+        ("/composition_sha256", json!("9".repeat(64))),
+        ("/recipe_sha256", json!("9".repeat(64))),
+        ("/artifact_size", json!(1)),
+        ("/ambient/child_locale", json!("en_US.UTF-8")),
+        ("/claim/varied", json!(["umask", "jobs", "checkout_root"])),
+    ];
+    let composition_gates = composition_gates();
+    for canonical in [0, 2, 3, 4] {
+        for (state, fixture) in every_optional_reproduction_state() {
+            for (pointer, value) in &record_gates {
+                let mut changed = fixture_clone(&fixture);
+                mutate_record(&mut changed, canonical, pointer, value.clone());
+                assert!(
+                    diagnose_collection(&changed).is_err(),
+                    "should block canonical {canonical} {pointer} with optional B {state}"
+                );
+            }
+            for (pointer, value) in &composition_gates {
+                let mut changed = fixture_clone(&fixture);
+                rebind_composition(&mut changed, canonical, pointer, value.clone());
+                assert!(
+                    diagnose_collection(&changed).is_err(),
+                    "should block canonical {canonical} composition {pointer} with optional B {state}"
+                );
+            }
+            let mut changed = fixture_clone(&fixture);
+            changed.transfers[canonical]
+                .members
+                .insert("tsjs-inventory.json".to_owned(), b"{}".to_vec());
+            assert!(
+                diagnose_collection(&changed).is_err(),
+                "should block changed JS inventory bytes in canonical {canonical} with optional B {state}"
+            );
+            let mut changed = fixture_clone(&fixture);
+            changed.transfers[canonical]
+                .members
+                .get_mut("artifact")
+                .expect("should find canonical artifact")
+                .push(0);
+            assert!(
+                diagnose_collection(&changed).is_err(),
+                "should block changed final bytes in canonical {canonical} with optional B {state}"
+            );
+        }
+    }
+}
+
+#[test]
+fn fastly_runtime_proof_is_required_for_both_roles_and_absent_from_native() {
+    for index in [0, 1] {
+        for (pointer, value) in [
+            ("/runtime", Value::Null),
+            ("/runtime/source_commit", json!("9".repeat(40))),
+            ("/runtime/final_wasm_size", json!(1)),
+            ("/runtime/viceroy_version", json!("0.0.0")),
+            ("/runtime/viceroy_version", json!("0.17.0")),
+        ] {
+            let mut fixture = cohort_fixture();
+            mutate_record(&mut fixture, index, pointer, value);
+            assert!(
+                diagnose_collection(&fixture).is_err(),
+                "should reject Fastly role {index} without bound final-byte runtime {pointer}"
+            );
+        }
+    }
+    let runtime = serde_json::from_slice::<Value>(
+        &cohort_fixture().transfers[0].members["build-record.json"],
+    )
+    .expect("should parse Fastly record")["runtime"]
+        .clone();
+    for index in [2, 3, 4] {
+        let mut fixture = cohort_fixture();
+        mutate_record(&mut fixture, index, "/runtime", runtime.clone());
+        assert!(
+            diagnose_collection(&fixture).is_err(),
+            "should reject a native record carrying a Fastly runtime diagnostic"
+        );
+    }
+}
+
+#[test]
+fn fastly_runtime_proof_must_belong_to_its_own_build_role() {
+    let runtime_of = |fixture: &ValidatedTransfers, index: usize| {
+        serde_json::from_slice::<Value>(&fixture.transfers[index].members["build-record.json"])
+            .expect("should parse Fastly record")["runtime"]
+            .clone()
+    };
+    let fixture = cohort_fixture();
+    assert_eq!(
+        runtime_of(&fixture, 0)["role"],
+        "A",
+        "should bind the canonical runtime proof to Role::Canonical"
+    );
+    assert_eq!(
+        runtime_of(&fixture, 1)["role"],
+        "B",
+        "should bind the reproduction runtime proof to Role::Reproduction"
+    );
+    // Equal final bytes make the proofs otherwise interchangeable, so each
+    // case swaps in the other role's run or an unbound role.
+    for (index, other) in [(0, 1), (1, 0)] {
+        let mut fixture = cohort_fixture();
+        let reused = runtime_of(&fixture, other);
+        mutate_record(&mut fixture, index, "/runtime", reused);
+        let error = diagnose_collection(&fixture)
+            .expect_err("should reject one role's runtime run reused for the other");
+        assert!(
+            format!("{error:?}").contains("runtime diagnostic"),
+            "should reject reused runtime proof at the runtime gate: {error:?}"
+        );
+        for role in [json!("C"), json!(""), Value::Null] {
+            let mut fixture = cohort_fixture();
+            mutate_record(&mut fixture, index, "/runtime/role", role.clone());
+            assert!(
+                diagnose_collection(&fixture).is_err(),
+                "should reject Fastly record {index} with runtime role {role}"
+            );
+        }
+        let mut fixture = cohort_fixture();
+        let mut unbound = runtime_of(&fixture, index);
+        unbound
+            .as_object_mut()
+            .expect("should hold runtime fields")
+            .remove("role");
+        mutate_record(&mut fixture, index, "/runtime", unbound);
+        assert!(
+            diagnose_collection(&fixture).is_err(),
+            "should reject Fastly record {index} whose runtime proof carries no role"
+        );
+    }
+}
+
+/// Optional reproduction jobs that never uploaded, with their spec outcomes.
+///
+/// `unavailable` means no reproduction ran: still queued at the deadline, or
+/// skipped/cancelled by the scheduler before any step started. `failed` means
+/// the job started, or its observed conclusion itself states failure.
+fn no_upload_job_states() -> Vec<(&'static str, ObservedJob, u64, records::Outcome)> {
+    let started = |conclusion| ObservedJob {
+        started: true,
+        conclusion,
+    };
+    let not_started = |conclusion| ObservedJob {
+        started: false,
+        conclusion,
+    };
+    vec![
+        (
+            "queued at deadline",
+            QUEUED,
+            1800,
+            records::Outcome::Unavailable,
+        ),
+        (
+            "scheduler skipped",
+            not_started(Some(JobConclusion::Skipped)),
+            3,
+            records::Outcome::Unavailable,
+        ),
+        (
+            "scheduler cancelled before start",
+            not_started(Some(JobConclusion::Cancelled)),
+            3,
+            records::Outcome::Unavailable,
+        ),
+        (
+            "failed before any step",
+            not_started(Some(JobConclusion::Failure)),
+            3,
+            records::Outcome::Failed,
+        ),
+        (
+            "timed out before any step",
+            not_started(Some(JobConclusion::TimedOut)),
+            1800,
+            records::Outcome::Failed,
+        ),
+        (
+            "failed before upload",
+            FAILED_BEFORE_UPLOAD,
+            7,
+            records::Outcome::Failed,
+        ),
+        (
+            "cancelled after start",
+            started(Some(JobConclusion::Cancelled)),
+            7,
+            records::Outcome::Failed,
+        ),
+        (
+            "timed out after start",
+            started(Some(JobConclusion::TimedOut)),
+            1800,
+            records::Outcome::Failed,
+        ),
+        (
+            "succeeded without upload output",
+            started(Some(JobConclusion::Success)),
+            7,
+            records::Outcome::Failed,
+        ),
+        (
+            "still running at deadline",
+            started(None),
+            1800,
+            records::Outcome::Failed,
+        ),
+    ]
+}
+
+#[test]
+fn optional_reproduction_job_states_map_to_bounded_honest_outcomes() {
+    for (state, job, elapsed, expected) in no_upload_job_states() {
+        let mut fixture = cohort_fixture();
+        fixture.absent[0] = no_upload(crate::policy::FIXED_ARTIFACTS[1].name, job, elapsed);
+        let diagnostic = diagnose_collection(&fixture)
+            .unwrap_or_else(|error| panic!("should accept optional B {state}: {error:?}"));
+        assert_eq!(
+            diagnostic.native[crate::policy::FIXED_ARTIFACTS[1].name],
+            expected,
+            "should map optional B {state} to its spec outcome"
+        );
+        assert_eq!(
+            diagnostic.canonical.len(),
+            4,
+            "should keep every canonical artifact with optional B {state}"
+        );
+        let reproduction =
+            &diagnostic.rebuild[crate::policy::FIXED_ARTIFACTS[1].name]["reproduction"];
+        assert_eq!(
+            reproduction["outcome"],
+            serde_json::to_value(expected).expect("should serialize outcome"),
+            "should record the derived outcome for {state}"
+        );
+        assert_eq!(
+            reproduction["job_state"]["started"], job.started,
+            "should record whether {state} started"
+        );
+        for field in ["artifact_id", "artifact_name", "archive_sha256", "ambient"] {
+            assert!(
+                reproduction.get(field).is_none(),
+                "should not synthesize {field} for optional B {state}"
+            );
+        }
+    }
+}
+
+#[test]
+fn contradictory_premature_or_unbounded_optional_job_states_are_rejected() {
+    let cases = [
+        (
+            "success without starting",
+            ObservedJob {
+                started: false,
+                conclusion: Some(JobConclusion::Success),
+            },
+            7,
+            1800,
+        ),
+        (
+            "skipped after starting",
+            ObservedJob {
+                started: true,
+                conclusion: Some(JobConclusion::Skipped),
+            },
+            7,
+            1800,
+        ),
+        ("queued before the deadline", QUEUED, 1799, 1800),
+        (
+            "running before the deadline",
+            ObservedJob {
+                started: true,
+                conclusion: None,
+            },
+            1799,
+            1800,
+        ),
+        ("waited past the deadline", QUEUED, 1801, 1800),
+        ("missing deadline", FAILED_BEFORE_UPLOAD, 0, 0),
+        ("deadline beyond the cohort cap", QUEUED, 5401, 5401),
+    ];
+    for (state, job, elapsed, deadline) in cases {
+        let absent = NoUpload {
+            asset: crate::policy::FIXED_ARTIFACTS[1].name.to_owned(),
+            job,
+            elapsed_seconds: elapsed,
+            deadline_seconds: deadline,
+        };
+        let mut fixture = cohort_fixture();
+        fixture.absent[0] = absent.clone();
+        assert!(
+            diagnose_collection(&fixture).is_err(),
+            "should reject optional B {state} in the measurement"
+        );
+        let (mut dependencies, mut source) = transfer_fixture();
+        dependencies.optional = vec![OptionalBuild::NotUploaded(absent)];
+        assert!(
+            validate_transfers(&dependencies, &mut source).is_err(),
+            "should reject optional B {state} before any transfer"
+        );
+        assert!(
+            source.requested.is_empty(),
+            "should reject optional B {state} before fetching any artifact"
+        );
+    }
+}
+
+#[test]
+fn optional_upload_identity_requires_a_started_successful_job() {
+    let uploaded_as_optional = |job| {
+        let (mut dependencies, source) = transfer_fixture();
+        let mut upload = dependencies.required.remove(0);
+        upload.role = "B".to_owned();
+        upload.asset = crate::policy::FIXED_ARTIFACTS[1].name.to_owned();
+        dependencies.optional = vec![OptionalBuild::Uploaded { upload, job }];
+        (dependencies, source)
+    };
+    let (dependencies, mut source) = uploaded_as_optional(ObservedJob {
+        started: true,
+        conclusion: Some(JobConclusion::Success),
+    });
+    validate_transfers(&dependencies, &mut source)
+        .expect("should accept an upload from a started successful optional job");
+    for (state, job, _, _) in no_upload_job_states()
+        .into_iter()
+        .filter(|(state, ..)| *state != "succeeded without upload output")
+    {
+        let (dependencies, mut source) = uploaded_as_optional(job);
+        assert!(
+            validate_transfers(&dependencies, &mut source).is_err(),
+            "should reject an upload identity claimed by optional B {state}"
+        );
+        assert!(
+            source.requested.is_empty(),
+            "should reject the claimed upload for {state} before fetching it"
+        );
+    }
+}
+
+#[test]
+fn dependency_channels_only_accept_their_own_build_roles() {
+    let succeeded = ObservedJob {
+        started: true,
+        conclusion: Some(JobConclusion::Success),
+    };
+    let native = crate::policy::FIXED_ARTIFACTS[1].name;
+    let fastly = crate::policy::FIXED_ARTIFACTS[0].name;
+    // The optional channel carries only native reproductions.
+    for (asset, role) in [(native, "A"), (fastly, "B"), (fastly, "A")] {
+        let (mut dependencies, mut source) = transfer_fixture();
+        let mut upload = dependencies.required.remove(0);
+        upload.asset = asset.to_owned();
+        upload.role = role.to_owned();
+        dependencies.optional = vec![OptionalBuild::Uploaded {
+            upload,
+            job: succeeded,
+        }];
+        assert!(
+            validate_transfers(&dependencies, &mut source).is_err(),
+            "should reject {asset} role {role} supplied through the optional channel"
+        );
+        assert!(
+            source.requested.is_empty(),
+            "should reject optional {asset} role {role} before any fetch"
+        );
+    }
+    // The mandatory channel carries every A and only the Fastly reproduction.
+    let (dependencies, mut source) = transfer_fixture();
+    validate_transfers(&dependencies, &mut source).expect("should accept a mandatory Fastly A");
+    for (asset, role, accepted) in [(fastly, "B", true), (native, "B", false)] {
+        let (mut dependencies, mut source) = transfer_fixture();
+        dependencies.required[0].asset = asset.to_owned();
+        dependencies.required[0].role = role.to_owned();
+        let result = validate_transfers(&dependencies, &mut source);
+        assert_eq!(
+            result.is_ok(),
+            accepted,
+            "should only accept mandatory B for the Fastly asset ({asset})"
+        );
+        if !accepted {
+            assert!(
+                source.requested.is_empty(),
+                "should reject mandatory native B before any fetch"
+            );
+        }
+    }
+}
+
+#[test]
+fn missing_mandatory_canonical_rejects_under_every_optional_reproduction_state() {
+    let mut states = every_optional_reproduction_state();
+    for (state, job, elapsed, _) in no_upload_job_states() {
+        let mut fixture = cohort_fixture();
+        for absent in &mut fixture.absent {
+            absent.job = job;
+            absent.elapsed_seconds = elapsed;
+        }
+        states.push((state, fixture));
+    }
+    for (state, fixture) in &states {
+        for asset in crate::policy::FIXED_ARTIFACTS {
+            let mut changed = fixture_clone(fixture);
+            changed.transfers.retain(|transfer| {
+                transfer.upload.asset != asset.name || transfer.upload.role != "A"
+            });
+            let error = diagnose_collection(&changed)
+                .expect_err("should reject a missing, failed or cancelled mandatory A");
+            assert!(
+                format!("{error:?}").contains("missing mandatory A"),
+                "should block missing A {} with optional B {state}: {error:?}",
+                asset.name
+            );
+        }
+    }
+}
+
+/// Copies one fixture so each mandatory gate mutates an independent cohort.
+fn fixture_clone(fixture: &ValidatedTransfers) -> ValidatedTransfers {
+    ValidatedTransfers {
+        invocation: fixture.invocation.clone(),
+        transfers: fixture
+            .transfers
+            .iter()
+            .map(|transfer| Transfer {
+                upload: transfer.upload.clone(),
+                members: transfer.members.clone(),
+            })
+            .collect(),
+        absent: fixture.absent.clone(),
+    }
+}
diff --git a/crates/trusted-server-release/src/collection/transfer.rs b/crates/trusted-server-release/src/collection/transfer.rs
new file mode 100644
index 0000000000..42c421cdeb
--- /dev/null
+++ b/crates/trusted-server-release/src/collection/transfer.rs
@@ -0,0 +1,649 @@
+//! Fixed-origin read-only artifact transport; dependency qualification stays separate.
+//!
+//! Each operation owns an async runtime and uses asynchronous DNS, built-in
+//! `WebPKI` roots, no proxies and no automatic redirects. Host DNS configuration
+//! remains a bootstrap OS input; this transport does not authenticate that OS or
+//! confer workflow, source, tool-acquisition or signing authority.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::fmt;
+use std::future::Future;
+use std::time::{Duration, Instant};
+
+use error_stack::Report;
+use reqwest::header::{
+    ACCEPT, ACCEPT_ENCODING, AUTHORIZATION, CONTENT_ENCODING, HeaderValue, LOCATION,
+};
+use reqwest::{Client, ClientBuilder, Response, StatusCode, Url};
+use sha2::{Digest as _, Sha256};
+
+use super::{
+    ARCHIVE_LIMIT, ArtifactSource, Download, OptionalBuild, TrustedDependencies, collection_error,
+};
+use crate::documents::{Role, lower_hex, parse_json};
+use crate::error::ReleaseError;
+use crate::process::Cancellation;
+
+const REPOSITORY: &str = "IABTechLab/trusted-server";
+const REPOSITORY_ID: u64 = 950860906;
+const API_ROOT: &str = "https://api.github.com/repos/IABTechLab/trusted-server/"; // allow-domain: api.github.com
+// The documented Actions artifact storage suffix is accepted only in a
+// Location returned by the exact authenticated API download request.
+const STORAGE_SUFFIX: &str = ".blob.core.windows.net";
+const RESPONSE_WALL: Duration = Duration::from_secs(120);
+const MAX_ATTEMPT: Duration = Duration::from_secs(900);
+const CANCEL_POLL: Duration = Duration::from_millis(20);
+const SHUTDOWN_GRACE: Duration = Duration::from_millis(100);
+const URL_LIMIT: usize = 8192;
+const BODY_CHUNK: usize = 64 * 1024;
+
+type Result<T> = core::result::Result<T, Report<ReleaseError>>;
+
+struct Endpoints {
+    api: Url,
+    storage_suffix: &'static str,
+    storage_port: Option<u16>,
+    #[cfg(test)]
+    addresses: Vec<(&'static str, std::net::SocketAddr)>,
+    #[cfg(test)]
+    resolver: Option<std::sync::Arc<dyn reqwest::dns::Resolve>>,
+}
+
+impl Endpoints {
+    fn official() -> Result<Self> {
+        Ok(Self {
+            api: Url::parse(API_ROOT)
+                .map_err(|_| collection_error("compiled artifact API origin is invalid"))?,
+            storage_suffix: STORAGE_SUFFIX,
+            storage_port: None,
+            #[cfg(test)]
+            addresses: Vec::new(),
+            #[cfg(test)]
+            resolver: None,
+        })
+    }
+
+    fn signed_location(&self, text: &str) -> Result<Url> {
+        if text.len() > URL_LIMIT
+            || text
+                .bytes()
+                .any(|byte| !byte.is_ascii_graphic() || byte == b'\\')
+        {
+            return Err(collection_error("artifact download location is invalid"));
+        }
+        let url = Url::parse(text)
+            .map_err(|_| collection_error("artifact download location is invalid"))?;
+        let account = url
+            .host_str()
+            .and_then(|host| host.strip_suffix(self.storage_suffix));
+        if url.scheme() != self.api.scheme()
+            || !url.username().is_empty()
+            || url.password().is_some()
+            || url.fragment().is_some()
+            || url.port() != self.storage_port
+            || !account.is_some_and(|account| {
+                !account.is_empty()
+                    && account
+                        .bytes()
+                        .all(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit())
+            })
+        {
+            return Err(collection_error(
+                "artifact download location has an unapproved origin",
+            ));
+        }
+        Ok(url)
+    }
+
+    fn client(&self) -> Result<Client> {
+        let builder = Client::builder()
+            .use_rustls_tls()
+            .tls_built_in_root_certs(false)
+            .tls_built_in_webpki_certs(true)
+            .hickory_dns(true)
+            .https_only(self.api.scheme() == "https")
+            .no_proxy()
+            .redirect(reqwest::redirect::Policy::none())
+            .referer(false)
+            .no_gzip()
+            .no_brotli()
+            .no_deflate()
+            .no_zstd()
+            .pool_max_idle_per_host(0)
+            .connect_timeout(Duration::from_secs(15))
+            .user_agent("trusted-server-release");
+        self.build_client(builder)
+    }
+
+    #[cfg(not(test))]
+    fn build_client(&self, builder: ClientBuilder) -> Result<Client> {
+        builder
+            .build()
+            .map_err(|_| collection_error("cannot initialize artifact HTTPS client"))
+    }
+
+    #[cfg(test)]
+    fn build_client(&self, mut builder: ClientBuilder) -> Result<Client> {
+        for (host, address) in &self.addresses {
+            builder = builder.resolve(host, *address);
+        }
+        if let Some(resolver) = &self.resolver {
+            builder = builder.dns_resolver2(std::sync::Arc::clone(resolver));
+        }
+        builder
+            .build()
+            .map_err(|_| collection_error("cannot initialize artifact HTTPS client"))
+    }
+
+    #[cfg(test)]
+    fn fixture(api: &str, storage_suffix: &'static str, storage_port: Option<u16>) -> Self {
+        Self {
+            api: Url::parse(api).expect("should parse fictional API endpoint"),
+            storage_suffix,
+            storage_port,
+            addresses: Vec::new(),
+            resolver: None,
+        }
+    }
+}
+
+struct Credential(HeaderValue);
+
+impl Credential {
+    fn new(token: &str) -> Result<Self> {
+        if token.is_empty()
+            || token.len() > URL_LIMIT
+            || !token.bytes().all(|byte| byte.is_ascii_graphic())
+        {
+            return Err(collection_error("artifact API credential is invalid"));
+        }
+        let mut value = HeaderValue::from_str(&format!("Bearer {token}"))
+            .map_err(|_| collection_error("artifact API credential is invalid"))?;
+        value.set_sensitive(true);
+        Ok(Self(value))
+    }
+}
+
+impl fmt::Debug for Credential {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("Credential([REDACTED])")
+    }
+}
+
+struct SelectedArtifact {
+    name: String,
+    sha256: String,
+}
+
+struct Selection {
+    repository: String,
+    repository_id: u64,
+    run_id: u64,
+    source_commit: String,
+    artifacts: BTreeMap<u64, SelectedArtifact>,
+}
+
+impl Selection {
+    fn from_dependencies(dependencies: &TrustedDependencies) -> Result<Self> {
+        let invocation = &dependencies.invocation;
+        if invocation.repository != REPOSITORY || invocation.repository_id != REPOSITORY_ID {
+            return Err(collection_error(
+                "artifact dependency has another repository identity",
+            ));
+        }
+        let mut artifacts = BTreeMap::new();
+        for upload in dependencies
+            .required
+            .iter()
+            .chain(
+                dependencies
+                    .optional
+                    .iter()
+                    .filter_map(|optional| match optional {
+                        OptionalBuild::Uploaded { upload, .. } => Some(upload),
+                        OptionalBuild::NotUploaded(_) => None,
+                    }),
+            )
+        {
+            if artifacts
+                .insert(
+                    upload.artifact_id,
+                    SelectedArtifact {
+                        name: upload.artifact_name.clone(),
+                        sha256: upload.archive_sha256.clone(),
+                    },
+                )
+                .is_some()
+            {
+                return Err(collection_error("artifact dependency ID is reused"));
+            }
+        }
+        let selection = Self {
+            repository: invocation.repository.clone(),
+            repository_id: invocation.repository_id,
+            run_id: invocation.run_id,
+            source_commit: invocation.source_commit.clone(),
+            artifacts,
+        };
+        selection.check()?;
+        Ok(selection)
+    }
+
+    fn check(&self) -> Result<()> {
+        if self.repository_id == 0
+            || self.run_id == 0
+            || !lower_hex(&self.source_commit, 40)
+            || self.artifacts.is_empty()
+            || self.artifacts.len() > 8
+            || self.artifacts.iter().any(|(id, artifact)| {
+                *id == 0
+                    || !lower_hex(&artifact.sha256, 64)
+                    || artifact.name.is_empty()
+                    || artifact.name.len() > 128
+                    || artifact.name.chars().any(char::is_control)
+            })
+        {
+            return Err(collection_error(
+                "artifact selection has invalid bounded identities",
+            ));
+        }
+        Ok(())
+    }
+
+    fn selected(&self, repository: &str, id: u64) -> Result<&SelectedArtifact> {
+        if repository != self.repository {
+            return Err(collection_error("artifact request has another repository"));
+        }
+        self.artifacts
+            .get(&id)
+            .ok_or_else(|| collection_error("artifact request ID was not selected"))
+    }
+
+    fn metadata(&self, id: u64, raw: &[u8]) -> Result<()> {
+        let expected = self.selected(&self.repository, id)?;
+        let value = parse_json(raw, Role::Metadata)
+            .map_err(|_| collection_error("artifact metadata is not strict bounded JSON"))?;
+        if value["id"].as_u64() != Some(id)
+            || value["name"].as_str() != Some(expected.name.as_str())
+            || value["expired"].as_bool() != Some(false)
+            || value["digest"].as_str() != Some(format!("sha256:{}", expected.sha256).as_str())
+            || value["workflow_run"]["id"].as_u64() != Some(self.run_id)
+            || value["workflow_run"]["head_sha"].as_str() != Some(self.source_commit.as_str())
+            || value["workflow_run"]["repository_id"].as_u64() != Some(self.repository_id)
+            || value["workflow_run"]["head_repository_id"].as_u64() != Some(self.repository_id)
+        {
+            return Err(collection_error(
+                "artifact REST metadata differs from selected invocation",
+            ));
+        }
+        Ok(())
+    }
+}
+
+/// Bounded fixed-origin source; it cannot construct trusted workflow dependencies.
+pub(crate) struct HttpArtifactSource {
+    selection: Selection,
+    credential: Credential,
+    endpoints: Endpoints,
+    deadline: Instant,
+    cancellation: Cancellation,
+    verified_metadata: BTreeSet<u64>,
+}
+
+impl fmt::Debug for HttpArtifactSource {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("HttpArtifactSource")
+            .field("selected_artifacts", &self.selection.artifacts.len())
+            .field("credential", &self.credential)
+            .finish_non_exhaustive()
+    }
+}
+
+impl HttpArtifactSource {
+    /// Binds transport to dependency-selected exact identities and an explicit token.
+    ///
+    /// Qualified dependency creation remains unavailable. Token possession alone
+    /// cannot establish producer job/attempt, source or workflow authority.
+    ///
+    /// # Errors
+    ///
+    /// Rejects invalid fixed repository/selection identities, credentials or bounds.
+    pub(crate) fn from_dependencies(
+        dependencies: &TrustedDependencies,
+        token: &str,
+        deadline: Instant,
+        cancellation: Cancellation,
+    ) -> Result<Self> {
+        Self::new(
+            Selection::from_dependencies(dependencies)?,
+            token,
+            deadline,
+            cancellation,
+            Endpoints::official()?,
+        )
+    }
+
+    fn new(
+        selection: Selection,
+        token: &str,
+        deadline: Instant,
+        cancellation: Cancellation,
+        endpoints: Endpoints,
+    ) -> Result<Self> {
+        selection.check()?;
+        if deadline
+            .checked_duration_since(Instant::now())
+            .is_none_or(|remaining| remaining > MAX_ATTEMPT)
+            || cancellation.is_cancelled()
+        {
+            return Err(collection_error(
+                "artifact transport attempt is expired or cancelled",
+            ));
+        }
+        Ok(Self {
+            selection,
+            credential: Credential::new(token)?,
+            endpoints,
+            deadline,
+            cancellation,
+            verified_metadata: BTreeSet::new(),
+        })
+    }
+
+    fn run<T>(&self, operation: impl Future<Output = Result<T>>) -> Result<T> {
+        if self.cancellation.is_cancelled() || Instant::now() >= self.deadline {
+            return Err(collection_error(
+                "artifact transport attempt is expired or cancelled",
+            ));
+        }
+        if tokio::runtime::Handle::try_current().is_ok() {
+            return Err(collection_error(
+                "synchronous artifact transport cannot run inside another async runtime",
+            ));
+        }
+        let runtime = tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .map_err(|_| collection_error("cannot initialize artifact transport runtime"))?;
+        let deadline = self.deadline.min(Instant::now() + RESPONSE_WALL);
+        let result = runtime.block_on(async {
+            tokio::select! {
+                biased;
+                () = wait_for_cancel(&self.cancellation) => Err(collection_error("artifact transport was cancelled")),
+                () = tokio::time::sleep_until(tokio::time::Instant::from_std(deadline)) => Err(collection_error("artifact transport exceeded its deadline")),
+                result = operation => result,
+            }
+        });
+        // Asynchronous DNS/HTTP tasks belong to this operation's runtime. No
+        // blocking OS resolver is selected, and no pool spans operations.
+        runtime.shutdown_timeout(SHUTDOWN_GRACE);
+        result
+    }
+
+    fn api_url(&self, id: u64, download: bool) -> Result<Url> {
+        self.endpoints
+            .api
+            .join(&format!(
+                "actions/artifacts/{id}{}",
+                if download { "/zip" } else { "" }
+            ))
+            .map_err(|_| collection_error("artifact API path is invalid"))
+    }
+
+    async fn api_request(&self, id: u64, download: bool) -> Result<Response> {
+        let url = self.api_url(id, download)?;
+        let response = self
+            .endpoints
+            .client()?
+            .get(url.clone())
+            .header(AUTHORIZATION, self.credential.0.clone())
+            .header(ACCEPT, "application/vnd.github+json")
+            .header(ACCEPT_ENCODING, "identity")
+            .header("X-GitHub-Api-Version", "2022-11-28")
+            .send()
+            .await
+            .map_err(|_| collection_error("artifact API HTTPS request failed"))?;
+        if response.url() != &url {
+            return Err(collection_error(
+                "artifact API changed its fixed request URL",
+            ));
+        }
+        Ok(response)
+    }
+}
+
+impl ArtifactSource for HttpArtifactSource {
+    fn metadata(&mut self, repository: &str, id: u64) -> Result<Vec<u8>> {
+        self.selection.selected(repository, id)?;
+        self.verified_metadata.remove(&id);
+        let raw = self.run(async {
+            let response = self.api_request(id, false).await?;
+            require_status(&response, StatusCode::OK)?;
+            read_response(response, Role::Metadata.limit() as usize, self).await
+        })?;
+        self.selection.metadata(id, &raw.bytes)?;
+        self.verified_metadata.insert(id);
+        Ok(raw.bytes)
+    }
+
+    fn download(&mut self, repository: &str, id: u64) -> Result<Download> {
+        let expected = &self.selection.selected(repository, id)?.sha256;
+        if !self.verified_metadata.remove(&id) {
+            return Err(collection_error(
+                "artifact download lacks checked exact-ID REST metadata",
+            ));
+        }
+        let raw = self.run(async {
+            let response = self.api_request(id, true).await?;
+            require_status(&response, StatusCode::FOUND)?;
+            let mut locations = response.headers().get_all(LOCATION).iter();
+            let text = locations
+                .next()
+                .and_then(|location| location.to_str().ok())
+                .ok_or_else(|| {
+                    collection_error("artifact API omitted its single download location")
+                })?;
+            if locations.next().is_some() {
+                return Err(collection_error(
+                    "artifact API returned duplicate download locations",
+                ));
+            }
+            let location = self.endpoints.signed_location(text)?;
+            drop(response);
+            let response = self
+                .endpoints
+                .client()?
+                .get(location.clone())
+                .header(ACCEPT_ENCODING, "identity")
+                .send()
+                .await
+                .map_err(|_| collection_error("artifact storage HTTPS request failed"))?;
+            if response.url() != &location {
+                return Err(collection_error(
+                    "artifact storage changed its approved request URL",
+                ));
+            }
+            require_status(&response, StatusCode::OK)?;
+            read_response(response, ARCHIVE_LIMIT, self).await
+        })?;
+        if raw.sha256 != *expected {
+            return Err(collection_error(
+                "artifact archive differs from the selected upload digest",
+            ));
+        }
+        Ok(Download {
+            archive: raw.bytes,
+            transfer_warning: false,
+        })
+    }
+}
+
+struct Body {
+    bytes: Vec<u8>,
+    sha256: String,
+}
+
+fn require_status(response: &Response, expected: StatusCode) -> Result<()> {
+    if response.status() != expected {
+        return Err(collection_error(format!(
+            "artifact endpoint returned unexpected HTTP status {}",
+            response.status().as_u16()
+        )));
+    }
+    Ok(())
+}
+
+async fn read_response(
+    mut response: Response,
+    limit: usize,
+    owner: &HttpArtifactSource,
+) -> Result<Body> {
+    if response
+        .content_length()
+        .is_some_and(|size| size > limit as u64)
+        || response.headers().get_all(CONTENT_ENCODING).iter().count() > 1
+        || response
+            .headers()
+            .get_all(CONTENT_ENCODING)
+            .iter()
+            .any(|encoding| encoding != "identity")
+    {
+        return Err(collection_error(
+            "artifact response has an oversized, ambiguous or transformed body",
+        ));
+    }
+    let mut bytes = Vec::new();
+    let mut hash = Sha256::new();
+    while let Some(chunk) = response
+        .chunk()
+        .await
+        .map_err(|_| collection_error("artifact response body is truncated or unreadable"))?
+    {
+        for part in chunk.chunks(BODY_CHUNK) {
+            if owner.cancellation.is_cancelled() || Instant::now() >= owner.deadline {
+                return Err(collection_error(
+                    "artifact streaming attempt expired or was cancelled",
+                ));
+            }
+            append_chunk(&mut bytes, &mut hash, part, limit)?;
+        }
+    }
+    Ok(Body {
+        bytes,
+        sha256: hex::encode(hash.finalize()),
+    })
+}
+
+fn append_chunk(bytes: &mut Vec<u8>, hash: &mut Sha256, chunk: &[u8], limit: usize) -> Result<()> {
+    if bytes.len() > limit || chunk.len() > limit.saturating_sub(bytes.len()) {
+        return Err(collection_error(
+            "artifact response exceeds its streaming byte bound",
+        ));
+    }
+    let required = bytes.len() + chunk.len();
+    if required > bytes.capacity() {
+        let capacity = bytes
+            .capacity()
+            .saturating_mul(2)
+            .max(BODY_CHUNK)
+            .min(limit)
+            .max(required);
+        bytes
+            .try_reserve_exact(capacity - bytes.len())
+            .map_err(|_| collection_error("cannot allocate bounded artifact response"))?;
+    }
+    bytes.extend_from_slice(chunk);
+    hash.update(chunk);
+    Ok(())
+}
+
+async fn wait_for_cancel(cancellation: &Cancellation) {
+    while !cancellation.is_cancelled() {
+        tokio::time::sleep(CANCEL_POLL).await;
+    }
+}
+
+#[cfg(test)]
+mod ordinary;
+#[cfg(test)]
+mod tests;
+
+/// Explicit ordinary-CI request; this test-only data cannot mint dependencies.
+#[cfg(test)]
+pub(crate) struct OrdinaryArtifactSelection {
+    /// Run whose REST head identity is independently supplied by the CI context.
+    pub(crate) run_id: u64,
+    /// REST run head, distinct from a PR's checked-out merge source.
+    pub(crate) run_head_commit: String,
+    /// Exact ID returned by the selected upload step.
+    pub(crate) artifact_id: u64,
+    /// Exact artifact name selected by that upload step.
+    pub(crate) artifact_name: String,
+    /// Original ZIP digest returned by that upload step.
+    pub(crate) archive_sha256: String,
+}
+
+/// Raw corroborated ordinary-CI bytes, without workflow or signing authority.
+#[cfg(test)]
+pub(crate) struct OrdinaryArtifactTransfer {
+    metadata: Vec<u8>,
+    archive: Vec<u8>,
+}
+
+#[cfg(test)]
+impl OrdinaryArtifactTransfer {
+    /// Returns exact original REST body bytes rather than a reserialization.
+    pub(crate) fn metadata(&self) -> &[u8] {
+        &self.metadata
+    }
+    /// Checks flat ZIP members under the unchanged collector archive contract.
+    ///
+    /// # Errors
+    ///
+    /// Rejects unsafe, undeclared, truncated or oversized ZIP members.
+    pub(crate) fn members(
+        &self,
+        expected: &BTreeMap<String, u64>,
+    ) -> Result<BTreeMap<String, Vec<u8>>> {
+        super::archive::read(&self.archive, expected)
+    }
+}
+
+/// Exercises the actual fixed-origin backend with unqualified CI selections.
+///
+/// # Errors
+///
+/// Rejects changed identity, transport, metadata or archive-digest bindings. This
+/// returns diagnostic bytes only and cannot construct [`TrustedDependencies`].
+#[cfg(test)]
+pub(crate) fn retrieve_ordinary_ci(
+    selection: OrdinaryArtifactSelection,
+    token: &str,
+    deadline: Instant,
+    cancellation: Cancellation,
+) -> Result<OrdinaryArtifactTransfer> {
+    let id = selection.artifact_id;
+    let mut source = HttpArtifactSource::new(
+        Selection {
+            repository: REPOSITORY.to_owned(),
+            repository_id: REPOSITORY_ID,
+            run_id: selection.run_id,
+            source_commit: selection.run_head_commit,
+            artifacts: BTreeMap::from([(
+                id,
+                SelectedArtifact {
+                    name: selection.artifact_name,
+                    sha256: selection.archive_sha256,
+                },
+            )]),
+        },
+        token,
+        deadline,
+        cancellation,
+        Endpoints::official()?,
+    )?;
+    let metadata = source.metadata(REPOSITORY, id)?;
+    let archive = source.download(REPOSITORY, id)?.archive;
+    Ok(OrdinaryArtifactTransfer { metadata, archive })
+}
diff --git a/crates/trusted-server-release/src/collection/transfer/ordinary.rs b/crates/trusted-server-release/src/collection/transfer/ordinary.rs
new file mode 100644
index 0000000000..d14671bc70
--- /dev/null
+++ b/crates/trusted-server-release/src/collection/transfer/ordinary.rs
@@ -0,0 +1,104 @@
+//! Actual ordinary-CI upload/archive interoperability, without release authority.
+
+use std::collections::BTreeMap;
+use std::time::{Duration, Instant};
+
+use super::{OrdinaryArtifactSelection, retrieve_ordinary_ci};
+use crate::documents::{Role, lower_hex, parse_json};
+use crate::process::Cancellation;
+
+const MEMBERS: [(&str, &[u8]); 4] = [
+    ("artifact", b"fictional transfer executable bytes\n"),
+    (
+        "build-record.json",
+        b"{\"kind\":\"fictional-build-record\",\"release_qualification\":false}\n",
+    ),
+    (
+        "composition.json",
+        b"{\"kind\":\"fictional-composition\",\"complete\":false}\n",
+    ),
+    (
+        "tsjs-inventory.json",
+        b"{\"kind\":\"fictional-javascript-inventory\",\"modules\":[]}\n",
+    ),
+];
+
+fn required(name: &str) -> String {
+    std::env::var(name).expect("should provide the explicitly selected ordinary-CI fixture input")
+}
+
+#[test]
+#[ignore = "requires the explicit ordinary-CI four-file upload, exact upload outputs and read-only Actions token"]
+fn real_uploaded_archive() {
+    assert_eq!(
+        std::env::var("GITHUB_ACTIONS").as_deref(),
+        Ok("true"),
+        "should run only in the explicit hosted ordinary-CI fixture"
+    );
+    let run_id = required("TS_RELEASE_TRANSFER_RUN_ID")
+        .parse::<u64>()
+        .expect("should select an exact numeric workflow run ID");
+    assert_eq!(
+        required("GITHUB_RUN_ID")
+            .parse::<u64>()
+            .expect("should observe the current workflow run ID"),
+        run_id,
+        "should select the current ordinary-CI workflow run"
+    );
+    let head = required("TS_RELEASE_TRANSFER_RUN_HEAD_SHA");
+    let artifact_id = required("TS_RELEASE_TRANSFER_ARTIFACT_ID")
+        .parse::<u64>()
+        .expect("should select the exact numeric upload artifact ID");
+    let name = required("TS_RELEASE_TRANSFER_ARTIFACT_NAME");
+    let digest = required("TS_RELEASE_TRANSFER_ARCHIVE_SHA256");
+    let digest = digest.strip_prefix("sha256:").unwrap_or(&digest);
+    assert!(
+        lower_hex(&head, 40) && lower_hex(digest, 64),
+        "should provide exact run-head and original archive identities"
+    );
+    let token = required("GH_TOKEN");
+    let expected: BTreeMap<String, u64> = MEMBERS
+        .iter()
+        .map(|(name, bytes)| ((*name).to_owned(), bytes.len() as u64))
+        .collect();
+    let deadline = Instant::now() + Duration::from_secs(5 * 60);
+    for _ in 0..2 {
+        // Each call creates an independent transport and downloads the original
+        // selected ZIP again; no action-extracted directory substitutes for it.
+        let observed = retrieve_ordinary_ci(
+            OrdinaryArtifactSelection {
+                run_id,
+                run_head_commit: head.clone(),
+                artifact_id,
+                artifact_name: name.clone(),
+                archive_sha256: digest.to_owned(),
+            },
+            &token,
+            deadline,
+            Cancellation::default(),
+        )
+        .expect("should retrieve the exact ordinary-CI upload through the bounded real backend");
+        let metadata = parse_json(observed.metadata(), Role::Metadata)
+            .expect("should parse the exact original REST response bytes");
+        assert_eq!(
+            metadata["id"].as_u64(),
+            Some(artifact_id),
+            "should corroborate the exact upload ID in raw REST metadata"
+        );
+        let members = observed.members(&expected).expect(
+            "should accept the original upload ZIP under the unchanged flat archive contract",
+        );
+        assert_eq!(
+            members.len(),
+            MEMBERS.len(),
+            "should retain exactly four fictional flat members"
+        );
+        for (name, bytes) in MEMBERS {
+            assert_eq!(
+                members.get(name).map(Vec::as_slice),
+                Some(bytes),
+                "should retain the exact fictional bytes for {name}"
+            );
+        }
+    }
+}
diff --git a/crates/trusted-server-release/src/collection/transfer/tests.rs b/crates/trusted-server-release/src/collection/transfer/tests.rs
new file mode 100644
index 0000000000..73b74bb2d9
--- /dev/null
+++ b/crates/trusted-server-release/src/collection/transfer/tests.rs
@@ -0,0 +1,836 @@
+use super::*;
+
+#[test]
+fn signed_download_location_rejects_unapproved_authority_and_normalization() {
+    let endpoints = Endpoints::fixture(
+        "https://api.example.com/repos/example/project/",
+        ".blob.example.com",
+        None,
+    );
+    for text in [
+        "http://account.blob.example.com/archive.zip?sig=fictional",
+        "https://account.blob.example.com:444/archive.zip",
+        "https://user:secret@account.blob.example.com/archive.zip",
+        "https://account.blob.example.com/archive.zip#fragment",
+        "https://account.blob.example.com.evil.example.com/archive.zip",
+        "https://nested.account.blob.example.com/archive.zip",
+        "https://127.0.0.1/archive.zip",
+        r"https://account.blob.example.com\archive.zip",
+        " https://account.blob.example.com/archive.zip",
+        "https://account.blob.example.com/archive.zip ",
+    ] {
+        assert!(
+            endpoints.signed_location(text).is_err(),
+            "should reject unapproved signed URL"
+        );
+    }
+    assert!(
+        endpoints
+            .signed_location("https://account.blob.example.com/archive.zip?sig=fictional")
+            .is_ok(),
+        "should accept one authenticated storage hop within reviewed host scope"
+    );
+}
+
+#[test]
+fn streamed_append_rejects_a_byte_over_limit_before_growing_buffer() {
+    let mut body = Vec::new();
+    let mut hash = Sha256::new();
+    append_chunk(&mut body, &mut hash, b"1234", 4).expect("should allow exact bound");
+    assert!(
+        append_chunk(&mut body, &mut hash, b"5", 4).is_err(),
+        "should reject one extra byte"
+    );
+    assert_eq!(body, b"1234", "should not append excess bytes");
+}
+
+fn selection(archive: &[u8]) -> Selection {
+    Selection {
+        repository: "example/project".to_owned(),
+        repository_id: 17,
+        run_id: 29,
+        source_commit: "a".repeat(40),
+        artifacts: BTreeMap::from([(
+            41,
+            SelectedArtifact {
+                name: "upload".to_owned(),
+                sha256: hex::encode(Sha256::digest(archive)),
+            },
+        )]),
+    }
+}
+
+fn metadata(archive: &[u8]) -> Vec<u8> {
+    serde_json::to_vec_pretty(&serde_json::json!({"id":41,"name":"upload","expired":false,"digest":format!("sha256:{}",hex::encode(Sha256::digest(archive))),"workflow_run":{"id":29,"repository_id":17,"head_repository_id":17,"head_sha":"a".repeat(40)}})).expect("should encode raw API fixture")
+}
+
+#[test]
+fn exact_raw_metadata_correlates_repository_run_source_id_and_digest() {
+    let archive = b"fictional archive";
+    let expected = selection(archive);
+    let raw = metadata(archive);
+    expected
+        .metadata(41, &raw)
+        .expect("should accept exact selected metadata");
+    for (pointer, replacement) in [
+        ("/id", serde_json::json!(42)),
+        ("/name", serde_json::json!("other")),
+        ("/expired", serde_json::json!(true)),
+        ("/digest", serde_json::json!("sha256:changed")),
+        ("/workflow_run/id", serde_json::json!(30)),
+        ("/workflow_run/head_sha", serde_json::json!("c".repeat(40))),
+        ("/workflow_run/repository_id", serde_json::json!(18)),
+        ("/workflow_run/head_repository_id", serde_json::json!(18)),
+    ] {
+        let mut value: serde_json::Value =
+            serde_json::from_slice(&raw).expect("should parse fixture");
+        *value.pointer_mut(pointer).expect("should select field") = replacement;
+        let changed = serde_json::to_vec(&value).expect("should encode changed fixture");
+        assert!(
+            expected.metadata(41, &changed).is_err(),
+            "should reject changed metadata identity"
+        );
+    }
+    assert!(
+        expected.metadata(41, b"{\"id\":41,\"id\":41}").is_err(),
+        "should reject duplicate JSON keys"
+    );
+}
+
+struct Plan {
+    wire: Vec<u8>,
+    stall: Duration,
+}
+
+fn response(status: &str, headers: &[(&str, String)], body: &[u8]) -> Plan {
+    let mut wire = format!(
+        "HTTP/1.1 {status}\r\nContent-Length: {}\r\nConnection: close\r\n",
+        body.len()
+    )
+    .into_bytes();
+    for (name, value) in headers {
+        wire.extend_from_slice(format!("{name}: {value}\r\n").as_bytes());
+    }
+    wire.extend_from_slice(b"\r\n");
+    wire.extend_from_slice(body);
+    Plan {
+        wire,
+        stall: Duration::ZERO,
+    }
+}
+
+struct Server {
+    address: std::net::SocketAddr,
+    requests: std::sync::mpsc::Receiver<String>,
+    stop: std::sync::Arc<std::sync::atomic::AtomicBool>,
+    thread: Option<std::thread::JoinHandle<()>>,
+}
+
+impl Server {
+    fn start(plans: Vec<Plan>) -> Self {
+        let listener = std::net::TcpListener::bind((std::net::Ipv4Addr::LOCALHOST, 0))
+            .expect("should bind transport fixture");
+        let address = listener.local_addr().expect("should read fixture address");
+        listener
+            .set_nonblocking(true)
+            .expect("should bound fixture accepts");
+        let stop = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
+        let shutdown = std::sync::Arc::clone(&stop);
+        let (sender, requests) = std::sync::mpsc::channel();
+        let thread = std::thread::spawn(move || {
+            let mut plans = plans.into_iter();
+            while !shutdown.load(std::sync::atomic::Ordering::SeqCst) {
+                let mut stream = match listener.accept() {
+                    Ok((stream, _)) => stream,
+                    Err(error) if error.kind() == std::io::ErrorKind::WouldBlock => {
+                        std::thread::sleep(Duration::from_millis(2));
+                        continue;
+                    }
+                    Err(_) => return,
+                };
+                // Accepted sockets inherit the listener's nonblocking mode on macOS.
+                stream
+                    .set_nonblocking(false)
+                    .expect("should read complete fixture requests in blocking mode");
+                stream
+                    .set_read_timeout(Some(Duration::from_secs(2)))
+                    .expect("should bound fixture reads");
+                stream
+                    .set_write_timeout(Some(Duration::from_secs(2)))
+                    .expect("should bound fixture writes");
+                let mut raw = Vec::new();
+                let mut byte = [0; 1];
+                while raw.len() < 16 * 1024 && !raw.ends_with(b"\r\n\r\n") {
+                    match std::io::Read::read(&mut stream, &mut byte) {
+                        Ok(1) => raw.push(byte[0]),
+                        _ => break,
+                    }
+                }
+                if !raw.ends_with(b"\r\n\r\n") {
+                    continue;
+                }
+                sender
+                    .send(String::from_utf8_lossy(&raw).into_owned())
+                    .expect("should capture request");
+                if let Some(plan) = plans.next() {
+                    let _ = std::io::Write::write_all(&mut stream, &plan.wire);
+                    let until = Instant::now() + plan.stall;
+                    while Instant::now() < until
+                        && !shutdown.load(std::sync::atomic::Ordering::SeqCst)
+                    {
+                        std::thread::sleep(Duration::from_millis(2));
+                    }
+                }
+            }
+        });
+        Self {
+            address,
+            requests,
+            stop,
+            thread: Some(thread),
+        }
+    }
+
+    fn request(&self) -> String {
+        self.requests
+            .recv_timeout(Duration::from_secs(2))
+            .expect("should receive fixture request")
+    }
+}
+
+impl Drop for Server {
+    fn drop(&mut self) {
+        self.stop.store(true, std::sync::atomic::Ordering::SeqCst);
+        if let Some(thread) = self.thread.take() {
+            thread.join().expect("should join fixture server");
+        }
+    }
+}
+
+#[test]
+fn fixture_waits_for_fragmented_request_headers() {
+    let server = Server::start(vec![response("200 OK", &[], b"complete")]);
+    let mut client = std::net::TcpStream::connect(server.address)
+        .expect("should connect fragmented request fixture");
+    client
+        .set_read_timeout(Some(Duration::from_secs(2)))
+        .expect("should bound fragmented response read");
+    std::io::Write::write_all(&mut client, b"GET / HTTP/1.1\r\n")
+        .expect("should send first header fragment");
+    assert!(
+        matches!(
+            server.requests.recv_timeout(Duration::from_millis(100)),
+            Err(std::sync::mpsc::RecvTimeoutError::Timeout)
+        ),
+        "should wait for complete headers before capturing request or consuming response"
+    );
+    std::io::Write::write_all(
+        &mut client,
+        b"Host: api.example.com\r\nAuthorization: Bearer fictional\r\n\r\n",
+    )
+    .expect("should send final header fragment");
+    let request = server.request();
+    assert!(
+        request.ends_with("Authorization: Bearer fictional\r\n\r\n"),
+        "should capture final header fragment: {request:?}"
+    );
+    let mut reply = String::new();
+    std::io::Read::read_to_string(&mut client, &mut reply)
+        .expect("should receive response after complete headers");
+    assert!(reply.ends_with("complete"), "should preserve response plan");
+}
+
+#[test]
+fn fixture_does_not_consume_response_for_aborted_headers() {
+    let server = Server::start(vec![response("200 OK", &[], b"complete")]);
+    let mut aborted = std::net::TcpStream::connect(server.address)
+        .expect("should connect aborted request fixture");
+    std::io::Write::write_all(&mut aborted, b"GET /incomplete HTTP/1.1\r\n")
+        .expect("should send incomplete headers");
+    aborted
+        .shutdown(std::net::Shutdown::Both)
+        .expect("should abort incomplete request");
+    let mut client = std::net::TcpStream::connect(server.address)
+        .expect("should connect complete request fixture");
+    client
+        .set_read_timeout(Some(Duration::from_secs(2)))
+        .expect("should bound complete response read");
+    std::io::Write::write_all(
+        &mut client,
+        b"GET /complete HTTP/1.1\r\nHost: api.example.com\r\n\r\n",
+    )
+    .expect("should send complete request");
+    assert!(
+        server.request().starts_with("GET /complete "),
+        "should capture complete requests only"
+    );
+    let mut reply = String::new();
+    std::io::Read::read_to_string(&mut client, &mut reply)
+        .expect("should receive unconsumed response");
+    assert!(
+        reply.ends_with("complete"),
+        "should preserve response after aborted headers"
+    );
+}
+
+fn endpoints(api: &Server, storage: Option<&Server>) -> Endpoints {
+    let mut endpoints = Endpoints::fixture(
+        &format!(
+            "http://api.example.com:{}/repos/example/project/",
+            api.address.port()
+        ),
+        ".blob.example.com",
+        storage.map(|server| server.address.port()),
+    );
+    endpoints.addresses.push(("api.example.com", api.address));
+    if let Some(storage) = storage {
+        endpoints
+            .addresses
+            .push(("account.blob.example.com", storage.address));
+    }
+    endpoints
+}
+
+fn source(archive: &[u8], endpoints: Endpoints) -> HttpArtifactSource {
+    HttpArtifactSource::new(
+        selection(archive),
+        "fictional-api-token",
+        Instant::now() + Duration::from_secs(5),
+        Cancellation::default(),
+        endpoints,
+    )
+    .expect("should construct diagnostic test source")
+}
+
+#[test]
+fn actual_transport_preserves_raw_metadata_and_separates_storage_credentials() {
+    let archive = b"fictional archive";
+    let raw = metadata(archive);
+    let storage = Server::start(vec![response("200 OK", &[], archive)]);
+    let location = format!(
+        "http://account.blob.example.com:{}/archive.zip?sig=fictional-signed-query",
+        storage.address.port()
+    );
+    let api = Server::start(vec![
+        response("200 OK", &[], &raw),
+        response("302 Found", &[("Location", location)], b""),
+    ]);
+    let mut source = source(archive, endpoints(&api, Some(&storage)));
+    assert_eq!(
+        source
+            .metadata("example/project", 41)
+            .expect("should fetch exact metadata"),
+        raw,
+        "should return exact original response bytes"
+    );
+    assert_eq!(
+        source
+            .download("example/project", 41)
+            .expect("should download selected archive")
+            .archive,
+        archive,
+        "should bind exact archive bytes"
+    );
+    for request in [api.request(), api.request()] {
+        let request = request.to_ascii_lowercase();
+        assert!(
+            request.contains("authorization: bearer fictional-api-token"),
+            "should authenticate fixed API requests only: {request:?}"
+        );
+        assert!(
+            request.contains("accept-encoding: identity"),
+            "should request original transfer bytes"
+        );
+    }
+    let request = storage.request().to_ascii_lowercase();
+    assert!(
+        !request.contains("authorization:") && !request.contains("fictional-api-token"),
+        "should omit GitHub credential on signed storage hop"
+    );
+    assert!(
+        !format!("{source:?}").contains("fictional-api-token"),
+        "should redact credential in source Debug"
+    );
+    assert!(
+        source.download("example/project", 41).is_err(),
+        "should require fresh checked metadata before another download"
+    );
+}
+
+#[test]
+fn unexpected_repository_or_artifact_id_and_missing_metadata_make_no_network_request() {
+    let api = Server::start(vec![]);
+    let mut source = source(b"archive", endpoints(&api, None));
+    assert!(
+        source.metadata("other/project", 41).is_err(),
+        "should reject another repository"
+    );
+    assert!(
+        source.metadata("example/project", 42).is_err(),
+        "should reject an unselected artifact ID"
+    );
+    assert!(
+        source.download("example/project", 41).is_err(),
+        "should require exact checked metadata before download"
+    );
+    assert!(
+        api.requests.try_recv().is_err(),
+        "should not contact server for invalid selection"
+    );
+}
+
+#[test]
+fn transport_rejects_redirects_wrong_status_truncation_and_oversized_body_declarations() {
+    let oversized = format!(
+        "HTTP/1.1 200 OK\r\nContent-Length: {}\r\nConnection: close\r\n\r\n",
+        Role::Metadata.limit() + 1
+    )
+    .into_bytes();
+    for plan in [
+        response(
+            "302 Found",
+            &[("Location", "http://other.example.com/metadata".to_owned())],
+            b"",
+        ),
+        response("410 Gone", &[], b"gone"),
+        Plan {
+            wire: b"HTTP/1.1 200 OK\r\nContent-Length: 99\r\nConnection: close\r\n\r\nshort"
+                .to_vec(),
+            stall: Duration::ZERO,
+        },
+        Plan {
+            wire: oversized,
+            stall: Duration::ZERO,
+        },
+        response(
+            "200 OK",
+            &[("Content-Encoding", "gzip".to_owned())],
+            b"encoded",
+        ),
+        response(
+            "200 OK",
+            &[
+                ("Content-Encoding", "identity".to_owned()),
+                ("Content-Encoding", "gzip".to_owned()),
+            ],
+            &metadata(b"archive"),
+        ),
+    ] {
+        let api = Server::start(vec![plan]);
+        let mut source = source(b"archive", endpoints(&api, None));
+        assert!(
+            source.metadata("example/project", 41).is_err(),
+            "should reject unsafe or incomplete API response"
+        );
+        assert!(
+            source.download("example/project", 41).is_err(),
+            "should not authorize download after rejected metadata"
+        );
+    }
+}
+
+#[test]
+fn transport_bounds_chunked_body_without_trusting_content_length() {
+    let mut wire =
+        b"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nConnection: close\r\n\r\n".to_vec();
+    let chunk = vec![b'x'; Role::Metadata.limit() as usize + 1];
+    wire.extend_from_slice(format!("{:x}\r\n", chunk.len()).as_bytes());
+    wire.extend_from_slice(&chunk);
+    wire.extend_from_slice(b"\r\n0\r\n\r\n");
+    let api = Server::start(vec![Plan {
+        wire,
+        stall: Duration::ZERO,
+    }]);
+    let mut source = source(b"archive", endpoints(&api, None));
+    assert!(
+        source.metadata("example/project", 41).is_err(),
+        "should reject one byte over role bound without Content-Length"
+    );
+}
+
+#[test]
+fn cancellation_and_attempt_deadline_bound_header_and_body_stalls() {
+    for (cancel, wire) in [
+        (false, Vec::new()),
+        (true, Vec::new()),
+        (
+            false,
+            b"HTTP/1.1 200 OK\r\nContent-Length: 10\r\nConnection: close\r\n\r\nx".to_vec(),
+        ),
+        (
+            true,
+            b"HTTP/1.1 200 OK\r\nContent-Length: 10\r\nConnection: close\r\n\r\nx".to_vec(),
+        ),
+    ] {
+        let api = Server::start(vec![Plan {
+            wire,
+            stall: Duration::from_secs(2),
+        }]);
+        let mut source = source(b"archive", endpoints(&api, None));
+        source.deadline = Instant::now() + Duration::from_millis(if cancel { 1000 } else { 80 });
+        let flag = source.cancellation.clone();
+        let trigger = cancel.then(|| {
+            std::thread::spawn(move || {
+                std::thread::sleep(Duration::from_millis(80));
+                flag.cancel();
+            })
+        });
+        let started = Instant::now();
+        assert!(
+            source.metadata("example/project", 41).is_err(),
+            "should reject stalled response"
+        );
+        assert!(
+            started.elapsed() < Duration::from_secs(1),
+            "should cancel or time out while headers/body are pending"
+        );
+        if let Some(trigger) = trigger {
+            trigger.join().expect("should join cancellation trigger");
+        }
+    }
+}
+
+#[test]
+fn storage_redirect_loops_duplicate_locations_and_digest_changes_fail_closed() {
+    for mode in ["second-hop", "duplicate", "digest"] {
+        let archive = b"selected archive";
+        let storage = Server::start(vec![if mode == "second-hop" {
+            response(
+                "302 Found",
+                &[(
+                    "Location",
+                    "http://other.example.com/archive.zip?sig=fictional-hidden-query".to_owned(),
+                )],
+                b"",
+            )
+        } else {
+            response("200 OK", &[], b"changed archive")
+        }]);
+        let location = format!(
+            "http://account.blob.example.com:{}/archive.zip?sig=fictional-hidden-query",
+            storage.address.port()
+        );
+        let mut locations = vec![("Location", location.clone())];
+        if mode == "duplicate" {
+            locations.push(("Location", location));
+        }
+        let api = Server::start(vec![
+            response("200 OK", &[], &metadata(archive)),
+            response("302 Found", &locations, b""),
+        ]);
+        let mut source = source(archive, endpoints(&api, Some(&storage)));
+        source
+            .metadata("example/project", 41)
+            .expect("should fetch exact metadata");
+        let error = source
+            .download("example/project", 41)
+            .err()
+            .expect("should reject unsafe or changed archive");
+        let text = format!("{error:?} {source:?}");
+        assert!(
+            !text.contains("fictional-hidden-query") && !text.contains("fictional-api-token"),
+            "should redact signed query and API credential from errors and Debug"
+        );
+        if mode == "duplicate" {
+            assert!(
+                storage.requests.try_recv().is_err(),
+                "should reject ambiguous Location before storage contact"
+            );
+        }
+    }
+}
+
+struct PendingDns {
+    dropped: std::sync::Arc<std::sync::atomic::AtomicBool>,
+}
+
+struct DnsGuard(std::sync::Arc<std::sync::atomic::AtomicBool>);
+
+impl Drop for DnsGuard {
+    fn drop(&mut self) {
+        self.0.store(true, std::sync::atomic::Ordering::SeqCst);
+    }
+}
+
+impl reqwest::dns::Resolve for PendingDns {
+    fn resolve(&self, _: reqwest::dns::Name) -> reqwest::dns::Resolving {
+        let guard = DnsGuard(std::sync::Arc::clone(&self.dropped));
+        Box::pin(async move {
+            let _guard = guard;
+            std::future::pending().await
+        })
+    }
+}
+
+#[test]
+fn cancellation_during_dns_drops_resolution_with_the_operation_runtime() {
+    let dropped = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
+    let mut endpoints = Endpoints::fixture(
+        "https://api.example.com/repos/example/project/",
+        ".blob.example.com",
+        None,
+    );
+    endpoints.resolver = Some(std::sync::Arc::new(PendingDns {
+        dropped: std::sync::Arc::clone(&dropped),
+    }));
+    let mut source = source(b"archive", endpoints);
+    let cancellation = source.cancellation.clone();
+    let trigger = std::thread::spawn(move || {
+        std::thread::sleep(Duration::from_millis(80));
+        cancellation.cancel();
+    });
+    let started = Instant::now();
+    assert!(
+        source.metadata("example/project", 41).is_err(),
+        "should cancel a pending async DNS operation"
+    );
+    assert!(
+        started.elapsed() < Duration::from_secs(1),
+        "should bound DNS cancellation and runtime shutdown"
+    );
+    assert!(
+        dropped.load(std::sync::atomic::Ordering::SeqCst),
+        "should drop resolver work before returning from operation"
+    );
+    trigger.join().expect("should join cancellation trigger");
+}
+
+#[test]
+fn source_rejects_bad_credentials_expired_attempts_and_invalid_identity_sets() {
+    for token in ["", "fictional token", "fictional\ncredential"] {
+        assert!(
+            Credential::new(token).is_err(),
+            "should reject invalid explicit credential"
+        );
+    }
+    let api = Server::start(vec![]);
+    assert!(
+        HttpArtifactSource::new(
+            selection(b"archive"),
+            "fictional-token",
+            Instant::now() - Duration::from_secs(1),
+            Cancellation::default(),
+            endpoints(&api, None)
+        )
+        .is_err(),
+        "should reject expired attempt before transport"
+    );
+    let mut invalid = selection(b"archive");
+    invalid.run_id = 0;
+    assert!(
+        invalid.check().is_err(),
+        "should reject missing current run identity"
+    );
+    let cancellation = Cancellation::default();
+    cancellation.cancel();
+    assert!(
+        HttpArtifactSource::new(
+            selection(b"archive"),
+            "fictional-token",
+            Instant::now() + Duration::from_secs(1),
+            cancellation,
+            endpoints(&api, None)
+        )
+        .is_err(),
+        "should reject cancelled attempt before transport"
+    );
+    assert!(
+        api.requests.try_recv().is_err(),
+        "should not contact API for invalid attempt"
+    );
+}
+
+struct TlsEndpoint {
+    address: std::net::SocketAddr,
+    stop: std::sync::Arc<std::sync::atomic::AtomicBool>,
+    thread: Option<std::thread::JoinHandle<()>>,
+}
+
+impl TlsEndpoint {
+    fn start(
+        cert: rustls::pki_types::CertificateDer<'static>,
+        key: rustls::pki_types::PrivateKeyDer<'static>,
+    ) -> Self {
+        let config = rustls::ServerConfig::builder_with_provider(std::sync::Arc::new(
+            rustls::crypto::ring::default_provider(),
+        ))
+        .with_safe_default_protocol_versions()
+        .expect("should select test TLS protocols")
+        .with_no_client_auth()
+        .with_single_cert(vec![cert], key)
+        .expect("should configure fictional TLS endpoint");
+        let listener = std::net::TcpListener::bind((std::net::Ipv4Addr::LOCALHOST, 0))
+            .expect("should bind fictional TLS endpoint");
+        let address = listener.local_addr().expect("should read TLS address");
+        listener
+            .set_nonblocking(true)
+            .expect("should bound TLS accept");
+        let stop = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
+        let shutdown = std::sync::Arc::clone(&stop);
+        let thread = std::thread::spawn(move || {
+            while !shutdown.load(std::sync::atomic::Ordering::SeqCst) {
+                let stream = match listener.accept() {
+                    Ok((stream, _)) => stream,
+                    Err(error) if error.kind() == std::io::ErrorKind::WouldBlock => {
+                        std::thread::sleep(Duration::from_millis(2));
+                        continue;
+                    }
+                    Err(_) => return,
+                };
+                stream
+                    .set_nonblocking(false)
+                    .expect("should perform fixture TLS handshake in blocking mode");
+                stream
+                    .set_read_timeout(Some(Duration::from_secs(2)))
+                    .expect("should bound TLS reads");
+                stream
+                    .set_write_timeout(Some(Duration::from_secs(2)))
+                    .expect("should bound TLS writes");
+                let connection = rustls::ServerConnection::new(std::sync::Arc::new(config.clone()))
+                    .expect("should create test TLS session");
+                let mut stream = rustls::StreamOwned::new(connection, stream);
+                let mut raw = Vec::new();
+                let mut byte = [0; 1];
+                while raw.len() < 16 * 1024 && !raw.ends_with(b"\r\n\r\n") {
+                    match std::io::Read::read(&mut stream, &mut byte) {
+                        Ok(1) => raw.push(byte[0]),
+                        _ => break,
+                    }
+                }
+                if raw.ends_with(b"\r\n\r\n") {
+                    let plan = response("200 OK", &[], &metadata(b"archive"));
+                    let _ = std::io::Write::write_all(&mut stream, &plan.wire);
+                    let _ = std::io::Write::flush(&mut stream);
+                }
+            }
+        });
+        Self {
+            address,
+            stop,
+            thread: Some(thread),
+        }
+    }
+}
+
+impl Drop for TlsEndpoint {
+    fn drop(&mut self) {
+        self.stop.store(true, std::sync::atomic::Ordering::SeqCst);
+        if let Some(thread) = self.thread.take() {
+            thread.join().expect("should join TLS endpoint");
+        }
+    }
+}
+
+#[test]
+fn isolated_child_ignores_proxy_config_cwd_and_ambient_ca_roots() {
+    let root = tempfile::tempdir().expect("should create poisoned configuration fixture");
+    let certificate = rcgen::generate_simple_self_signed(vec!["api.example.com".to_owned()])
+        .expect("should generate fictional CA fixture");
+    let ca = root.path().join("fictional-ca.pem");
+    std::fs::write(&ca, certificate.cert.pem()).expect("should write fictional CA");
+    std::fs::create_dir(root.path().join("gh")).expect("should create poisoned gh config");
+    std::fs::write(
+        root.path().join("gh/config.yml"),
+        "http_unix_socket: /fictional/socket\napi_host: other.example.com\n",
+    )
+    .expect("should write ignored config");
+    let tls = TlsEndpoint::start(
+        certificate.cert.der().clone(),
+        rustls::pki_types::PrivateKeyDer::Pkcs8(certificate.key_pair.serialize_der().into()),
+    );
+    let program = std::env::current_exe().expect("should locate test binary");
+    let mut command = crate::process::BoundedCommand::new(
+        &program,
+        root.path(),
+        crate::process::ProcessLimits {
+            wall: Duration::from_secs(10),
+            stdout_max: 16 * 1024,
+            stderr_max: 16 * 1024,
+        },
+    )
+    .expect("should create bounded child")
+    .arguments(
+        [
+            "--ignored",
+            "--exact",
+            "collection::transfer::tests::environment_configuration_child",
+            "--nocapture",
+        ]
+        .map(std::ffi::OsString::from),
+    );
+    for (name, value) in [
+        ("TS_RELEASE_TRANSFER_ENV_CHILD", "1".to_owned()),
+        (
+            "TS_RELEASE_TRANSFER_TLS_PORT",
+            tls.address.port().to_string(),
+        ),
+        ("HTTP_PROXY", "http://proxy.example.com:9".to_owned()),
+        ("HTTPS_PROXY", "http://proxy.example.com:9".to_owned()),
+        ("ALL_PROXY", "http://proxy.example.com:9".to_owned()),
+        ("NO_PROXY", String::new()),
+        ("SSL_CERT_FILE", ca.display().to_string()),
+        ("SSL_CERT_DIR", root.path().display().to_string()),
+        ("CURL_CA_BUNDLE", ca.display().to_string()),
+        ("REQUESTS_CA_BUNDLE", ca.display().to_string()),
+        ("GH_HOST", "other.example.com".to_owned()),
+        ("GH_REPO", "other/project".to_owned()),
+        (
+            "GH_CONFIG_DIR",
+            root.path().join("gh").display().to_string(),
+        ),
+        ("HOME", root.path().display().to_string()),
+    ] {
+        command = command
+            .environment(name, value)
+            .expect("should set child-only poison environment");
+    }
+    command
+        .run()
+        .expect("should supervise isolated policy test")
+        .require_success()
+        .expect("should reject ambient CA and ignore proxy/config channels");
+}
+
+#[test]
+#[ignore = "invoked only by isolated_child_ignores_proxy_config_cwd_and_ambient_ca_roots"]
+fn environment_configuration_child() {
+    assert_eq!(
+        std::env::var("TS_RELEASE_TRANSFER_ENV_CHILD").expect("should receive child marker"),
+        "1",
+        "should run only isolated environment fixture"
+    );
+    let api = Server::start(vec![response("200 OK", &[], &metadata(b"archive"))]);
+    let mut plain = source(b"archive", endpoints(&api, None));
+    plain
+        .metadata("example/project", 41)
+        .expect("should ignore ambient proxies and gh/config/cwd");
+    let port = std::env::var("TS_RELEASE_TRANSFER_TLS_PORT")
+        .expect("should receive TLS fixture port")
+        .parse::<u16>()
+        .expect("should parse TLS fixture port");
+    let mut endpoints = Endpoints::fixture(
+        &format!("https://api.example.com:{port}/repos/example/project/"),
+        ".blob.example.com",
+        None,
+    );
+    endpoints.addresses.push((
+        "api.example.com",
+        std::net::SocketAddr::from((std::net::Ipv4Addr::LOCALHOST, port)),
+    ));
+    let mut tls = source(b"archive", endpoints);
+    assert!(
+        tls.metadata("example/project", 41).is_err(),
+        "should reject fictional TLS certificate even when ambient CA variables name it"
+    );
+}
+
+#[test]
+fn streaming_allocation_capacity_stays_inside_selected_byte_bound() {
+    let mut bytes = Vec::new();
+    let mut hash = Sha256::new();
+    append_chunk(&mut bytes, &mut hash, b"1234", 4).expect("should append bounded body");
+    assert!(
+        bytes.capacity() <= 4,
+        "should not grow allocation beyond selected body bound"
+    );
+}
diff --git a/crates/trusted-server-release/src/collection/workflow_jobs.rs b/crates/trusted-server-release/src/collection/workflow_jobs.rs
new file mode 100644
index 0000000000..6bfd8f316e
--- /dev/null
+++ b/crates/trusted-server-release/src/collection/workflow_jobs.rs
@@ -0,0 +1,430 @@
+//! Pure GitHub Actions jobs adapter for the trusted collector, without authority.
+//!
+//! It turns one bounded raw "list jobs for a workflow run attempt" REST body,
+//! the upload step outputs and the collector's own wait clock into the typed
+//! [`Upload`] and [`OptionalBuild`] inputs of [`TrustedDependencies`]. Every
+//! expected job name, its asset, role and recipe come from an explicit
+//! [`ExpectedTopology`], never from the response. Nothing here performs HTTP,
+//! reads workflow files or constructs [`TrustedDependencies`]: that constructor
+//! stays closed behind the uninhabited [`QualifiedCollection`].
+//!
+//! Parsing follows the REST precedent of [`super::transfer`]: the body passes
+//! the strict bounded [`parse_json`] (UTF-8, metadata byte limit, no duplicate
+//! keys, nesting limit) and only the fields read here are checked; other
+//! fields, such as `started_at`, are ignored.
+//!
+//! [`TrustedDependencies`]: super::TrustedDependencies
+//! [`QualifiedCollection`]: super::QualifiedCollection
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use error_stack::Report;
+use serde_json::Value;
+
+use super::{
+    JobConclusion, NoUpload, ObservedJob, OptionalBuild, Upload, bounded, collection_error,
+};
+use crate::documents::{self, lower_hex, parse_json};
+use crate::error::ReleaseError;
+use crate::policy::{FIXED_ARTIFACTS, ReleaseTarget};
+use crate::recipe::Role;
+
+#[cfg(test)]
+mod tests;
+
+/// One REST page; a larger or paginated run is rejected rather than merged.
+const JOB_PAGE_LIMIT: usize = 100;
+/// GitHub's documented maximum number of steps in one job.
+const STEP_LIMIT: usize = 1000;
+/// Same bound the collector applies to an upload's job name.
+const JOB_NAME_LIMIT: usize = 128;
+
+/// The only job state that may carry an upload identity.
+const SUCCEEDED: ObservedJob = ObservedJob {
+    started: true,
+    conclusion: Some(JobConclusion::Success),
+};
+
+type Result<T> = core::result::Result<T, Report<ReleaseError>>;
+
+/// The exact workflow run attempt and source the collector belongs to.
+#[derive(Clone, Debug)]
+pub(super) struct RunIdentity {
+    run_id: u64,
+    run_attempt: u64,
+    head_sha: String,
+}
+
+/// One build job the trusted workflow topology expects.
+#[derive(Clone, Debug)]
+pub(super) struct ExpectedJob {
+    asset: String,
+    role: Role,
+    name: String,
+    recipe_sha256: String,
+}
+
+impl ExpectedJob {
+    /// Every canonical build and the Fastly reproduction are mandatory.
+    ///
+    /// The Fastly asset is identified by its compiled
+    /// [`ReleaseTarget::Wasm32Wasip1`] target, not by its position in
+    /// [`FIXED_ARTIFACTS`]. Native reproductions are optional measurements
+    /// (spec R-REPEAT): they record an outcome but never block their asset.
+    fn mandatory(&self) -> bool {
+        self.role == Role::Canonical
+            || FIXED_ARTIFACTS.iter().any(|fixed| {
+                fixed.name == self.asset && fixed.target == ReleaseTarget::Wasm32Wasip1
+            })
+    }
+}
+
+/// The complete expected build-job topology for one run attempt.
+#[derive(Clone, Debug)]
+pub(super) struct ExpectedTopology {
+    run: RunIdentity,
+    jobs: Vec<ExpectedJob>,
+    deadline_seconds: u64,
+}
+
+impl ExpectedTopology {
+    /// Checks that the topology names each fixed build exactly once.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Collection`] for a zero run ID or attempt, a
+    /// malformed source commit or recipe digest, an uncapped deadline, an
+    /// unknown asset, an unsafe or reused job name, or a topology that does
+    /// not contain exactly one canonical and one reproduction job per
+    /// [`FIXED_ARTIFACTS`] entry.
+    pub(super) fn new(
+        run: RunIdentity,
+        jobs: Vec<ExpectedJob>,
+        deadline_seconds: u64,
+    ) -> Result<Self> {
+        if run.run_id == 0 || run.run_attempt == 0 || !lower_hex(&run.head_sha, 40) {
+            return Err(collection_error("expected run identity is invalid"));
+        }
+        if !bounded(0, deadline_seconds) {
+            return Err(collection_error("collector deadline is not bounded"));
+        }
+        let mut names = BTreeSet::new();
+        let mut slots = BTreeSet::new();
+        for job in &jobs {
+            if !safe_job_name(&job.name)
+                || !lower_hex(&job.recipe_sha256, 64)
+                || !FIXED_ARTIFACTS.iter().any(|fixed| fixed.name == job.asset)
+                || !names.insert(job.name.as_str())
+                || !slots.insert((job.asset.as_str(), job.role.spec_label()))
+            {
+                return Err(collection_error(
+                    "expected job is invalid, unknown or not unique",
+                ));
+            }
+        }
+        if slots.len() != FIXED_ARTIFACTS.len() * 2 {
+            return Err(collection_error(
+                "expected topology must name every fixed canonical and reproduction job",
+            ));
+        }
+        Ok(Self {
+            run,
+            jobs,
+            deadline_seconds,
+        })
+    }
+}
+
+/// The upload step outputs of one job: exact ID, name, digest and members.
+///
+/// The adapter passes these through unchanged and never derives them from the
+/// jobs response; [`super::validate_transfers`] then corroborates them.
+#[derive(Clone, Debug)]
+pub(super) struct UploadOutput {
+    artifact_id: u64,
+    artifact_name: String,
+    archive_sha256: String,
+    members: BTreeMap<String, u64>,
+}
+
+/// Upload step outputs keyed by the expected job name that produced them.
+#[derive(Clone, Debug)]
+pub(super) struct JobUpload {
+    job: String,
+    output: UploadOutput,
+}
+
+/// Typed collector inputs; deliberately not [`super::TrustedDependencies`].
+#[derive(Debug)]
+pub(super) struct AdaptedJobs {
+    required: Vec<Upload>,
+    optional: Vec<OptionalBuild>,
+}
+
+/// Binds every expected job to one observed job and its upload outputs.
+///
+/// `elapsed_seconds` is the collector's own bounded wait when it fetched
+/// `response`. A job without a terminal conclusion is accepted only once that
+/// wait reached the topology deadline, and only for an optional native
+/// reproduction. Mandatory jobs must have started, succeeded and uploaded.
+///
+/// An optional native reproduction never blocks (spec R-REPEAT). Its upload
+/// output is used only when the job started and succeeded. Otherwise that
+/// output is dropped unused and the job becomes a [`NoUpload`] with its
+/// derived outcome (`failed` for a started or self-failed job), so a
+/// reproduction that did not succeed can never lend its upload identity to
+/// the collection.
+///
+/// Only a single fresh attempt is attestable: every expected job must have
+/// run in the expected attempt, which holds for attempt 1 and for "re-run all
+/// jobs". A "re-run failed jobs" attempt is rejected, because GitHub lists
+/// its carried-over jobs with their older `run_attempt` (or omits them), and
+/// their uploads were not produced by this attempt.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Collection`] for a non-strict, oversized or
+/// incomplete response; a job from another run, attempt or source; a missing,
+/// duplicated or reused expected job; an unknown or contradictory GitHub
+/// state; a premature or unbounded wait; a mandatory job without a successful
+/// upload; or upload outputs naming no expected job or one twice.
+pub(super) fn adapt_jobs(
+    topology: &ExpectedTopology,
+    response: &[u8],
+    uploads: &[JobUpload],
+    elapsed_seconds: u64,
+) -> Result<AdaptedJobs> {
+    if !bounded(elapsed_seconds, topology.deadline_seconds) {
+        return Err(collection_error("collector wait exceeds its deadline"));
+    }
+    let observed = observe_jobs(topology, response)?;
+    let mut outputs = BTreeMap::new();
+    for upload in uploads {
+        if !topology.jobs.iter().any(|job| job.name == upload.job)
+            || outputs
+                .insert(upload.job.as_str(), &upload.output)
+                .is_some()
+        {
+            return Err(collection_error(
+                "upload output does not name exactly one expected job",
+            ));
+        }
+    }
+    let at_deadline = elapsed_seconds == topology.deadline_seconds;
+    let mut required = Vec::new();
+    let mut optional = Vec::new();
+    for expected in &topology.jobs {
+        let job = *observed
+            .get(expected.name.as_str())
+            .ok_or_else(|| collection_error("expected job is missing from the run"))?;
+        if job.conclusion.is_none() && !at_deadline {
+            return Err(collection_error(
+                "job has no terminal conclusion before the collector deadline",
+            ));
+        }
+        let output = outputs.get(expected.name.as_str()).copied();
+        if expected.mandatory() {
+            let output = output
+                .filter(|_| job == SUCCEEDED)
+                .ok_or_else(|| collection_error("mandatory job did not succeed with an upload"))?;
+            required.push(upload(topology, expected, output, elapsed_seconds));
+        } else if let Some(output) = output.filter(|_| job == SUCCEEDED) {
+            optional.push(OptionalBuild::Uploaded {
+                upload: upload(topology, expected, output, elapsed_seconds),
+                job,
+            });
+        } else {
+            // Any upload output of an unsuccessful optional job is dropped
+            // here: it never becomes upload identity.
+            let absent = NoUpload {
+                asset: expected.asset.clone(),
+                job,
+                elapsed_seconds,
+                deadline_seconds: topology.deadline_seconds,
+            };
+            if absent.outcome().is_none() {
+                return Err(collection_error(
+                    "optional job state has no honest failed or unavailable outcome",
+                ));
+            }
+            optional.push(OptionalBuild::NotUploaded(absent));
+        }
+    }
+    Ok(AdaptedJobs { required, optional })
+}
+
+fn upload(
+    topology: &ExpectedTopology,
+    expected: &ExpectedJob,
+    output: &UploadOutput,
+    elapsed_seconds: u64,
+) -> Upload {
+    Upload {
+        asset: expected.asset.clone(),
+        role: expected.role.spec_label().to_owned(),
+        job: expected.name.clone(),
+        attempt: topology.run.run_attempt,
+        recipe_sha256: expected.recipe_sha256.clone(),
+        elapsed_seconds,
+        deadline_seconds: topology.deadline_seconds,
+        artifact_name: output.artifact_name.clone(),
+        artifact_id: output.artifact_id,
+        archive_sha256: output.archive_sha256.clone(),
+        members: output.members.clone(),
+    }
+}
+
+/// Parses the strict jobs page and observes each expected job exactly once.
+///
+/// The page must be complete: `total_count` must equal the listed jobs and at
+/// most [`JOB_PAGE_LIMIT`] may be listed. The future fetch must therefore
+/// request `per_page=100`; GitHub's default page of 30 would be rejected as
+/// incomplete for a larger run rather than merged across pages.
+///
+/// `run_attempt` is optional in GitHub's job schema but required here on every
+/// listed job, together with the exact `run_id` and `head_sha`. A job listed
+/// with another attempt, as a "re-run failed jobs" attempt lists its
+/// carried-over jobs, rejects the whole response: only a single fresh attempt
+/// is attestable (see [`adapt_jobs`]).
+fn observe_jobs<'topology>(
+    topology: &'topology ExpectedTopology,
+    response: &[u8],
+) -> Result<BTreeMap<&'topology str, ObservedJob>> {
+    let value = parse_json(response, documents::Role::Metadata)
+        .map_err(|_| collection_error("workflow jobs response is not strict bounded JSON"))?;
+    let jobs = value["jobs"]
+        .as_array()
+        .filter(|jobs| jobs.len() <= JOB_PAGE_LIMIT)
+        .filter(|jobs| value["total_count"].as_u64() == Some(jobs.len() as u64))
+        .ok_or_else(|| collection_error("workflow jobs response is not one complete page"))?;
+    let run = &topology.run;
+    let mut ids = BTreeSet::new();
+    let mut observed = BTreeMap::new();
+    for job in jobs {
+        let name = job["name"]
+            .as_str()
+            .ok_or_else(|| collection_error("workflow job has no name"))?;
+        let id = job["id"]
+            .as_u64()
+            .filter(|id| *id > 0)
+            .ok_or_else(|| collection_error("workflow job has no valid ID"))?;
+        // Every listed job must belong to this run attempt and source, so a
+        // response for another run cannot be mixed in through unrelated jobs.
+        if !ids.insert(id)
+            || job["run_id"].as_u64() != Some(run.run_id)
+            || job["head_sha"].as_str() != Some(run.head_sha.as_str())
+        {
+            return Err(collection_error(
+                "workflow job is reused or belongs to another run or source",
+            ));
+        }
+        match job["run_attempt"].as_u64() {
+            Some(attempt) if attempt == run.run_attempt => {}
+            Some(_) => {
+                return Err(collection_error(
+                    "workflow job ran in another attempt; only a single fresh attempt is attestable",
+                ));
+            }
+            None => return Err(collection_error("workflow job has no run_attempt")),
+        }
+        let Some(expected) = topology.jobs.iter().find(|expected| expected.name == name) else {
+            continue;
+        };
+        if observed
+            .insert(expected.name.as_str(), observe_job(job)?)
+            .is_some()
+        {
+            return Err(collection_error("expected job name occurs more than once"));
+        }
+    }
+    Ok(observed)
+}
+
+/// Derives the started flag from executed steps and maps the conclusion.
+///
+/// GitHub's `started_at` is ignored: a job skipped or cancelled before any
+/// step may carry it.
+fn observe_job(job: &Value) -> Result<ObservedJob> {
+    let status = job["status"]
+        .as_str()
+        .ok_or_else(|| collection_error("workflow job has no status"))?;
+    let waiting = match status {
+        "queued" | "pending" | "waiting" | "requested" => true,
+        "in_progress" | "completed" => false,
+        _ => return Err(collection_error("workflow job status is unknown")),
+    };
+    let conclusion = match (status, &job["conclusion"]) {
+        ("completed", Value::String(text)) => Some(job_conclusion(text)?),
+        (_, Value::Null) if status != "completed" => None,
+        _ => {
+            return Err(collection_error(
+                "workflow job status and conclusion disagree",
+            ));
+        }
+    };
+    let steps = job["steps"]
+        .as_array()
+        .filter(|steps| steps.len() <= STEP_LIMIT)
+        .ok_or_else(|| collection_error("workflow job has no bounded step list"))?;
+    let mut numbers = BTreeSet::new();
+    let mut started = false;
+    for step in steps {
+        let number = step["number"].as_u64();
+        if step["name"].as_str().is_none() || !number.is_some_and(|number| numbers.insert(number)) {
+            return Err(collection_error("workflow step is unnamed or renumbered"));
+        }
+        started |= step_executed(step)?;
+    }
+    if started && waiting {
+        return Err(collection_error(
+            "waiting workflow job reports an executed step",
+        ));
+    }
+    Ok(ObservedJob {
+        started,
+        conclusion,
+    })
+}
+
+/// Maps a GitHub job conclusion to [`JobConclusion`].
+///
+/// `neutral`, `action_required`, `stale`, `startup_failure` and any other value
+/// are rejected: the spec defines no failed/unavailable meaning for them, so
+/// the collector fails closed rather than guessing an outcome.
+fn job_conclusion(text: &str) -> Result<JobConclusion> {
+    match text {
+        "success" => Ok(JobConclusion::Success),
+        "failure" => Ok(JobConclusion::Failure),
+        "cancelled" => Ok(JobConclusion::Cancelled),
+        "skipped" => Ok(JobConclusion::Skipped),
+        "timed_out" => Ok(JobConclusion::TimedOut),
+        _ => Err(collection_error(
+            "workflow job conclusion has no collector meaning",
+        )),
+    }
+}
+
+/// Reports whether one step actually ran.
+///
+/// A step ran when it is in progress or completed with any conclusion other
+/// than `skipped`. Unknown or contradictory step states are rejected.
+fn step_executed(step: &Value) -> Result<bool> {
+    match (step["status"].as_str(), &step["conclusion"]) {
+        (Some("queued" | "pending"), Value::Null) => Ok(false),
+        (Some("in_progress"), Value::Null) => Ok(true),
+        (Some("completed"), Value::String(conclusion)) => match conclusion.as_str() {
+            "skipped" => Ok(false),
+            "success" | "failure" | "cancelled" => Ok(true),
+            _ => Err(collection_error(
+                "workflow step conclusion has no collector meaning",
+            )),
+        },
+        _ => Err(collection_error(
+            "workflow step status and conclusion disagree",
+        )),
+    }
+}
+
+fn safe_job_name(name: &str) -> bool {
+    !name.is_empty() && name.len() <= JOB_NAME_LIMIT && !name.chars().any(char::is_control)
+}
diff --git a/crates/trusted-server-release/src/collection/workflow_jobs/tests.rs b/crates/trusted-server-release/src/collection/workflow_jobs/tests.rs
new file mode 100644
index 0000000000..4933fa72d8
--- /dev/null
+++ b/crates/trusted-server-release/src/collection/workflow_jobs/tests.rs
@@ -0,0 +1,644 @@
+use serde_json::{Value, json};
+
+use super::*;
+use crate::collection::records::Outcome;
+
+mod support;
+mod transfer;
+
+use support::{
+    DEADLINE, RUN_ATTEMPT, RUN_ID, all_uploads, archive, assert_rejected, executed_steps,
+    expected_jobs, head_sha, job, optional_outcomes, response, run_identity, skipped_steps, step,
+    successful_jobs, topology, upload, with_native_reproductions,
+};
+
+#[test]
+fn successful_run_binds_every_fixed_asset_to_its_exact_job_and_upload() {
+    let adapted = adapt_jobs(
+        &topology(),
+        &response(&successful_jobs()),
+        &all_uploads(),
+        600,
+    )
+    .expect("should adapt a complete successful run");
+
+    assert_eq!(
+        adapted.required.len(),
+        5,
+        "should require four canonical builds and the Fastly reproduction"
+    );
+    assert_eq!(
+        adapted.optional.len(),
+        3,
+        "should carry one optional native reproduction per native asset"
+    );
+    for upload in &adapted.required {
+        assert_eq!(upload.attempt, RUN_ATTEMPT, "should bind the run attempt");
+        assert_eq!(upload.elapsed_seconds, 600, "should keep the observed wait");
+        assert_eq!(
+            upload.deadline_seconds, DEADLINE,
+            "should keep the deadline"
+        );
+        assert!(
+            upload.role == "A" || upload.asset == FIXED_ARTIFACTS[0].name,
+            "should place only canonical builds and the Fastly reproduction in the mandatory channel"
+        );
+        let expected = all_uploads()
+            .into_iter()
+            .find(|candidate| candidate.job == upload.job)
+            .expect("should find the upload supplied for this job");
+        assert_eq!(
+            upload.artifact_id, expected.output.artifact_id,
+            "should keep the exact upload step identity"
+        );
+    }
+    assert!(
+        adapted.optional.iter().all(|build| matches!(
+            build,
+            OptionalBuild::Uploaded { upload, job: ObservedJob { started: true, conclusion: Some(JobConclusion::Success) } }
+                if upload.role == "B" && upload.asset != FIXED_ARTIFACTS[0].name
+        )),
+        "should feed successful native reproduction uploads into the optional channel"
+    );
+}
+
+#[test]
+fn only_the_wasm_asset_reproduction_is_mandatory() {
+    for expected in expected_jobs() {
+        let wasm = FIXED_ARTIFACTS.iter().any(|fixed| {
+            fixed.name == expected.asset && fixed.target == ReleaseTarget::Wasm32Wasip1
+        });
+        assert_eq!(
+            expected.mandatory(),
+            expected.role == Role::Canonical || wasm,
+            "should make every canonical build and only the Wasm reproduction mandatory"
+        );
+    }
+}
+
+/// Label, job status, conclusion, steps, elapsed wait and derived outcome.
+type NativeReproductionState = (&'static str, &'static str, Value, Vec<Value>, u64, Outcome);
+
+/// Every native reproduction job state with its derived outcome.
+fn native_reproduction_states() -> Vec<NativeReproductionState> {
+    let partially_cancelled = vec![
+        step(1, "completed", json!("success")),
+        step(2, "completed", json!("cancelled")),
+        step(3, "completed", json!("skipped")),
+    ];
+    let running = vec![
+        step(1, "completed", json!("success")),
+        step(2, "in_progress", Value::Null),
+    ];
+    vec![
+        (
+            "succeeded without an upload",
+            "completed",
+            json!("success"),
+            executed_steps(),
+            600,
+            Outcome::Failed,
+        ),
+        (
+            "failed",
+            "completed",
+            json!("failure"),
+            executed_steps(),
+            600,
+            Outcome::Failed,
+        ),
+        (
+            "timed out",
+            "completed",
+            json!("timed_out"),
+            executed_steps(),
+            600,
+            Outcome::Failed,
+        ),
+        (
+            "started then cancelled",
+            "completed",
+            json!("cancelled"),
+            partially_cancelled,
+            600,
+            Outcome::Failed,
+        ),
+        (
+            "skipped by the scheduler",
+            "completed",
+            json!("skipped"),
+            Vec::new(),
+            600,
+            Outcome::Unavailable,
+        ),
+        (
+            "cancelled before any step",
+            "completed",
+            json!("cancelled"),
+            skipped_steps(),
+            600,
+            Outcome::Unavailable,
+        ),
+        (
+            "still queued at the deadline",
+            "queued",
+            Value::Null,
+            Vec::new(),
+            DEADLINE,
+            Outcome::Unavailable,
+        ),
+        (
+            "still running at the deadline",
+            "in_progress",
+            Value::Null,
+            running,
+            DEADLINE,
+            Outcome::Failed,
+        ),
+    ]
+}
+
+#[test]
+fn native_reproduction_job_states_derive_bounded_honest_outcomes() {
+    for (label, status, conclusion, steps, elapsed, outcome) in native_reproduction_states() {
+        let (jobs, uploads) = with_native_reproductions(status, &conclusion, &steps);
+        let adapted = adapt_jobs(&topology(), &response(&jobs), &uploads, elapsed)
+            .unwrap_or_else(|error| panic!("should adapt native reproduction {label}: {error:?}"));
+        assert_eq!(
+            adapted.required.len(),
+            5,
+            "should keep every mandatory job when native reproduction {label}"
+        );
+        assert_eq!(
+            optional_outcomes(&adapted),
+            vec![Some(outcome); 3],
+            "should derive the expected outcome when native reproduction {label}"
+        );
+    }
+}
+
+#[test]
+fn started_at_without_an_executed_step_is_not_started() {
+    // GitHub sets `started_at` on these jobs; only executed steps count.
+    for steps in [Vec::new(), skipped_steps()] {
+        let (jobs, uploads) = with_native_reproductions("completed", &json!("cancelled"), &steps);
+        let adapted = adapt_jobs(&topology(), &response(&jobs), &uploads, 600)
+            .expect("should adapt cancelled native reproductions");
+        assert!(
+            adapted.optional.iter().all(|build| matches!(
+                build,
+                OptionalBuild::NotUploaded(absent) if !absent.job.started
+            )),
+            "should not treat started_at as an executed step"
+        );
+    }
+}
+
+#[test]
+fn a_job_without_a_conclusion_is_rejected_before_the_deadline_and_accepted_at_it() {
+    for (status, steps) in [
+        ("queued", Vec::new()),
+        (
+            "in_progress",
+            vec![
+                step(1, "completed", json!("success")),
+                step(2, "in_progress", Value::Null),
+            ],
+        ),
+    ] {
+        let (jobs, uploads) = with_native_reproductions(status, &Value::Null, &steps);
+        assert_rejected(
+            adapt_jobs(&topology(), &response(&jobs), &uploads, DEADLINE - 1),
+            "before the collector deadline",
+        );
+        adapt_jobs(&topology(), &response(&jobs), &uploads, DEADLINE)
+            .expect("should accept a conclusion-less observation at the deadline");
+    }
+    assert_rejected(
+        adapt_jobs(
+            &topology(),
+            &response(&successful_jobs()),
+            &all_uploads(),
+            DEADLINE + 1,
+        ),
+        "exceeds its deadline",
+    );
+}
+
+#[test]
+fn mandatory_jobs_must_start_succeed_and_upload_under_every_wait() {
+    let mut cases = Vec::new();
+    for (status, conclusion, steps) in [
+        ("completed", json!("failure"), executed_steps()),
+        ("completed", json!("cancelled"), skipped_steps()),
+        ("completed", json!("skipped"), Vec::new()),
+        ("queued", Value::Null, Vec::new()),
+        ("waiting", Value::Null, Vec::new()),
+        ("requested", Value::Null, Vec::new()),
+    ] {
+        for index in [0, 1, 2] {
+            let mut jobs = successful_jobs();
+            let name = expected_jobs()[index].name.clone();
+            jobs[index] = job(
+                100 + index as u64,
+                &name,
+                status,
+                conclusion.clone(),
+                steps.clone(),
+            );
+            cases.push((jobs, all_uploads()));
+        }
+    }
+    for index in [0, 1, 2] {
+        let mut uploads = all_uploads();
+        uploads.remove(index);
+        cases.push((successful_jobs(), uploads));
+    }
+    for (jobs, uploads) in cases {
+        let unconcluded = jobs.iter().any(|job| job["conclusion"].is_null());
+        for elapsed in [600, DEADLINE] {
+            let reason = if unconcluded && elapsed < DEADLINE {
+                "before the collector deadline"
+            } else {
+                "mandatory job did not succeed with an upload"
+            };
+            assert_rejected(
+                adapt_jobs(&topology(), &response(&jobs), &uploads, elapsed),
+                reason,
+            );
+        }
+    }
+}
+
+#[test]
+fn completed_job_without_a_conclusion_is_rejected_for_every_role() {
+    for index in [0, 1, 3] {
+        let mut jobs = successful_jobs();
+        jobs[index]["conclusion"] = Value::Null;
+        for elapsed in [600, DEADLINE] {
+            assert_rejected(
+                adapt_jobs(&topology(), &response(&jobs), &all_uploads(), elapsed),
+                "job status and conclusion disagree",
+            );
+        }
+    }
+}
+
+#[test]
+fn jobs_from_another_run_or_source_are_rejected() {
+    for (field, value) in [
+        ("run_id", json!(RUN_ID + 1)),
+        ("head_sha", json!("d".repeat(40))),
+    ] {
+        for index in [0, 3, 8] {
+            let mut jobs = successful_jobs();
+            jobs[index][field] = value.clone();
+            assert_rejected(
+                adapt_jobs(&topology(), &response(&jobs), &all_uploads(), 600),
+                "another run or source",
+            );
+        }
+    }
+}
+
+#[test]
+fn only_a_single_fresh_attempt_is_attestable() {
+    // A "re-run failed jobs" attempt lists carried-over jobs with their older
+    // attempt, whether they are expected or unrelated.
+    for index in [0, 3, 8] {
+        let mut carried_over = successful_jobs();
+        carried_over[index]["run_attempt"] = json!(RUN_ATTEMPT - 1);
+        assert_rejected(
+            adapt_jobs(&topology(), &response(&carried_over), &all_uploads(), 600),
+            "only a single fresh attempt is attestable",
+        );
+        let mut unattributed = successful_jobs();
+        unattributed[index]
+            .as_object_mut()
+            .expect("should be a job object")
+            .remove("run_attempt");
+        assert_rejected(
+            adapt_jobs(&topology(), &response(&unattributed), &all_uploads(), 600),
+            "has no run_attempt",
+        );
+    }
+}
+
+#[test]
+fn duplicate_missing_or_extra_job_names_are_rejected() {
+    let expected = expected_jobs();
+    let mut duplicate = successful_jobs();
+    duplicate.push(job(
+        901,
+        &expected[0].name,
+        "completed",
+        json!("success"),
+        executed_steps(),
+    ));
+    let mut extra_skipped = successful_jobs();
+    extra_skipped.push(job(
+        902,
+        &expected[3].name,
+        "completed",
+        json!("skipped"),
+        Vec::new(),
+    ));
+    let mut missing_mandatory = successful_jobs();
+    missing_mandatory.remove(0);
+    let mut missing_optional = successful_jobs();
+    missing_optional.remove(3);
+    let mut reused_id = successful_jobs();
+    reused_id[1]["id"] = json!(100);
+    for (jobs, reason) in [
+        (duplicate, "occurs more than once"),
+        (extra_skipped, "occurs more than once"),
+        (missing_mandatory, "missing from the run"),
+        (missing_optional, "missing from the run"),
+        (reused_id, "is reused"),
+    ] {
+        assert_rejected(
+            adapt_jobs(&topology(), &response(&jobs), &all_uploads(), 600),
+            reason,
+        );
+    }
+}
+
+#[test]
+fn upload_outputs_must_name_exactly_one_expected_job() {
+    let mut unknown = all_uploads();
+    unknown.push(upload("unrelated JavaScript job", 990));
+    let mut duplicate = all_uploads();
+    duplicate.push(upload(&expected_jobs()[0].name, 991));
+    for uploads in [unknown, duplicate] {
+        assert_rejected(
+            adapt_jobs(&topology(), &response(&successful_jobs()), &uploads, 600),
+            "does not name exactly one expected job",
+        );
+    }
+}
+
+#[test]
+fn unsuccessful_optional_reproduction_upload_output_is_dropped_without_blocking() {
+    for (status, conclusion, steps, elapsed, outcome) in [
+        (
+            "completed",
+            json!("failure"),
+            executed_steps(),
+            600,
+            Outcome::Failed,
+        ),
+        (
+            "completed",
+            json!("timed_out"),
+            executed_steps(),
+            600,
+            Outcome::Failed,
+        ),
+        (
+            "in_progress",
+            Value::Null,
+            vec![step(1, "in_progress", Value::Null)],
+            DEADLINE,
+            Outcome::Failed,
+        ),
+        (
+            "completed",
+            json!("cancelled"),
+            skipped_steps(),
+            600,
+            Outcome::Unavailable,
+        ),
+        (
+            "queued",
+            Value::Null,
+            Vec::new(),
+            DEADLINE,
+            Outcome::Unavailable,
+        ),
+    ] {
+        let (jobs, _) = with_native_reproductions(status, &conclusion, &steps);
+        let adapted = adapt_jobs(&topology(), &response(&jobs), &all_uploads(), elapsed)
+            .expect("should not let an optional reproduction block the collection");
+        assert_eq!(
+            adapted.required.len(),
+            5,
+            "should keep every mandatory upload"
+        );
+        assert_eq!(
+            optional_outcomes(&adapted),
+            vec![Some(outcome); 3],
+            "should record the derived outcome instead of the upload identity"
+        );
+    }
+}
+
+#[test]
+fn unknown_or_inconsistent_github_states_are_rejected() {
+    let mut cases = Vec::new();
+    for conclusion in [
+        "neutral",
+        "action_required",
+        "stale",
+        "startup_failure",
+        "SUCCESS",
+    ] {
+        cases.push((
+            with_native_reproductions("completed", &json!(conclusion), &executed_steps()),
+            "job conclusion has no collector meaning",
+        ));
+    }
+    for (status, conclusion, steps, reason) in [
+        (
+            "completed",
+            Value::Null,
+            executed_steps(),
+            "job status and conclusion disagree",
+        ),
+        (
+            "in_progress",
+            json!("success"),
+            executed_steps(),
+            "job status and conclusion disagree",
+        ),
+        (
+            "queued",
+            Value::Null,
+            executed_steps(),
+            "waiting workflow job reports an executed step",
+        ),
+        ("unknown", Value::Null, Vec::new(), "job status is unknown"),
+        (
+            "completed",
+            json!("failure"),
+            vec![step(1, "completed", json!("neutral"))],
+            "step conclusion has no collector meaning",
+        ),
+        (
+            "completed",
+            json!("failure"),
+            vec![step(1, "completed", Value::Null)],
+            "step status and conclusion disagree",
+        ),
+        (
+            "completed",
+            json!("failure"),
+            vec![step(1, "queued", json!("success"))],
+            "step status and conclusion disagree",
+        ),
+        (
+            "completed",
+            json!("failure"),
+            vec![
+                step(1, "completed", json!("success")),
+                step(1, "completed", json!("success")),
+            ],
+            "unnamed or renumbered",
+        ),
+    ] {
+        cases.push((
+            with_native_reproductions(status, &conclusion, &steps),
+            reason,
+        ));
+    }
+    let (mut jobs, uploads) = with_native_reproductions("completed", &json!("failure"), &[]);
+    jobs[3]
+        .as_object_mut()
+        .expect("should be a job object")
+        .remove("steps");
+    cases.push(((jobs, uploads), "no bounded step list"));
+    for ((jobs, uploads), reason) in cases {
+        assert_rejected(
+            adapt_jobs(&topology(), &response(&jobs), &uploads, DEADLINE),
+            reason,
+        );
+    }
+}
+
+#[test]
+fn a_truncated_default_page_is_rejected_as_incomplete() {
+    // A fetch without `per_page=100` lists at most 30 of a larger run.
+    let jobs = successful_jobs();
+    let truncated = serde_json::to_vec(&json!({"total_count": jobs.len() + 31, "jobs": jobs}))
+        .expect("should serialize fictional jobs response");
+    assert_rejected(
+        adapt_jobs(&topology(), &truncated, &all_uploads(), 600),
+        "not one complete page",
+    );
+}
+
+#[test]
+fn malformed_oversized_incomplete_or_duplicate_key_responses_are_rejected() {
+    const STRICT: &str = "not strict bounded JSON";
+    const PAGE: &str = "not one complete page";
+    let mut cases = vec![
+        (b"not json".to_vec(), STRICT),
+        (
+            b"{\"total_count\":0,\"jobs\":[],\"jobs\":[]}".to_vec(),
+            STRICT,
+        ),
+        (
+            serde_json::to_vec(&json!({"jobs": successful_jobs()})).expect("should serialize"),
+            PAGE,
+        ),
+        (
+            serde_json::to_vec(&json!({"total_count": 99, "jobs": successful_jobs()}))
+                .expect("should serialize"),
+            PAGE,
+        ),
+        (
+            serde_json::to_vec(&json!([successful_jobs()])).expect("should serialize"),
+            PAGE,
+        ),
+    ];
+    let mut oversized = response(&successful_jobs());
+    oversized.extend(vec![b' '; 1024 * 1024]);
+    cases.push((oversized, STRICT));
+    let many = (0..101)
+        .map(|index| {
+            job(
+                2000 + index,
+                &format!("unrelated {index}"),
+                "completed",
+                json!("success"),
+                Vec::new(),
+            )
+        })
+        .collect::<Vec<_>>();
+    cases.push((response(&many), PAGE));
+    let duplicate_job_key = String::from_utf8(response(&successful_jobs()))
+        .expect("should be UTF-8 fixture")
+        .replacen("\"name\":", "\"name\":\"shadow\",\"name\":", 1);
+    cases.push((duplicate_job_key.into_bytes(), STRICT));
+    for (body, reason) in cases {
+        assert_rejected(adapt_jobs(&topology(), &body, &all_uploads(), 600), reason);
+    }
+}
+
+#[test]
+fn expected_topology_must_name_every_fixed_build_exactly_once() {
+    let mut missing = expected_jobs();
+    missing.pop();
+    assert_rejected(
+        ExpectedTopology::new(run_identity(), missing, DEADLINE),
+        "must name every fixed canonical and reproduction job",
+    );
+    let mut cases = Vec::new();
+    let mut duplicate_slot = expected_jobs();
+    duplicate_slot[7].role = Role::Canonical;
+    cases.push(duplicate_slot);
+    let mut duplicate_name = expected_jobs();
+    duplicate_name[7].name = duplicate_name[6].name.clone();
+    cases.push(duplicate_name);
+    let mut unknown_asset = expected_jobs();
+    unknown_asset[7].asset = "trusted-server-other".to_owned();
+    cases.push(unknown_asset);
+    for name in [String::new(), "x".repeat(129), "line\nbreak".to_owned()] {
+        let mut invalid_name = expected_jobs();
+        invalid_name[7].name = name;
+        cases.push(invalid_name);
+    }
+    let mut invalid_recipe = expected_jobs();
+    invalid_recipe[7].recipe_sha256 = "C".repeat(64);
+    cases.push(invalid_recipe);
+    for jobs in cases {
+        assert_rejected(
+            ExpectedTopology::new(run_identity(), jobs, DEADLINE),
+            "expected job is invalid, unknown or not unique",
+        );
+    }
+    const IDENTITY: &str = "expected run identity is invalid";
+    const DEADLINE_BOUND: &str = "collector deadline is not bounded";
+    for (identity, deadline, reason) in [
+        (
+            RunIdentity {
+                run_id: 0,
+                ..run_identity()
+            },
+            DEADLINE,
+            IDENTITY,
+        ),
+        (
+            RunIdentity {
+                run_attempt: 0,
+                ..run_identity()
+            },
+            DEADLINE,
+            IDENTITY,
+        ),
+        (
+            RunIdentity {
+                head_sha: "a".repeat(39),
+                ..run_identity()
+            },
+            DEADLINE,
+            IDENTITY,
+        ),
+        (run_identity(), 0, DEADLINE_BOUND),
+        (run_identity(), 5401, DEADLINE_BOUND),
+    ] {
+        assert_rejected(
+            ExpectedTopology::new(identity, expected_jobs(), deadline),
+            reason,
+        );
+    }
+}
diff --git a/crates/trusted-server-release/src/collection/workflow_jobs/tests/support.rs b/crates/trusted-server-release/src/collection/workflow_jobs/tests/support.rs
new file mode 100644
index 0000000000..1c3f79d45b
--- /dev/null
+++ b/crates/trusted-server-release/src/collection/workflow_jobs/tests/support.rs
@@ -0,0 +1,216 @@
+//! Fictional GitHub Actions jobs fixtures shared by the adapter tests.
+
+use std::collections::BTreeMap;
+
+use serde_json::{Value, json};
+
+use crate::collection::records::Outcome;
+use crate::collection::tests::zip;
+use crate::collection::workflow_jobs::{
+    AdaptedJobs, ExpectedJob, ExpectedTopology, JobUpload, Result, RunIdentity, UploadOutput,
+};
+use crate::collection::{OptionalBuild, digest};
+use crate::policy::FIXED_ARTIFACTS;
+use crate::recipe::Role;
+
+/// Fictional run identity used by every fixture job.
+pub(super) const RUN_ID: u64 = 7001;
+pub(super) const RUN_ATTEMPT: u64 = 2;
+pub(super) const DEADLINE: u64 = 1800;
+
+pub(super) fn head_sha() -> String {
+    "a".repeat(40)
+}
+
+fn job_name(asset: &str, role: Role) -> String {
+    let label = match role {
+        Role::Canonical => "canonical",
+        Role::Reproduction => "reproduction",
+    };
+    format!("build {asset} {label}")
+}
+
+pub(super) fn expected_jobs() -> Vec<ExpectedJob> {
+    FIXED_ARTIFACTS
+        .iter()
+        .flat_map(|asset| {
+            [Role::Canonical, Role::Reproduction].map(|role| ExpectedJob {
+                asset: asset.name.to_owned(),
+                role,
+                name: job_name(asset.name, role),
+                recipe_sha256: "c".repeat(64),
+            })
+        })
+        .collect()
+}
+
+pub(super) fn run_identity() -> RunIdentity {
+    RunIdentity {
+        run_id: RUN_ID,
+        run_attempt: RUN_ATTEMPT,
+        head_sha: head_sha(),
+    }
+}
+
+pub(super) fn topology() -> ExpectedTopology {
+    ExpectedTopology::new(run_identity(), expected_jobs(), DEADLINE)
+        .expect("should accept the complete fictional topology")
+}
+
+pub(super) fn step(number: u64, status: &str, conclusion: Value) -> Value {
+    let mut step = json!({
+        "name": format!("Step {number}"),
+        "status": status,
+        "number": number,
+        "started_at": "2026-01-01T00:00:00Z",
+        "completed_at": "2026-01-01T00:01:00Z",
+    });
+    step["conclusion"] = conclusion;
+    step
+}
+
+pub(super) fn executed_steps() -> Vec<Value> {
+    (1..=3)
+        .map(|number| step(number, "completed", json!("success")))
+        .collect()
+}
+
+pub(super) fn skipped_steps() -> Vec<Value> {
+    (1..=3)
+        .map(|number| step(number, "completed", json!("skipped")))
+        .collect()
+}
+
+pub(super) fn job(
+    id: u64,
+    name: &str,
+    status: &str,
+    conclusion: Value,
+    steps: Vec<Value>,
+) -> Value {
+    let mut job = json!({
+        "id": id,
+        "name": name,
+        "run_id": RUN_ID,
+        "run_attempt": RUN_ATTEMPT,
+        "head_sha": head_sha(),
+        "status": status,
+        "started_at": "2026-01-01T00:00:00Z",
+        "completed_at": "2026-01-01T00:05:00Z",
+        "html_url": "https://example.com/job",
+    });
+    job["conclusion"] = conclusion;
+    job["steps"] = Value::Array(steps);
+    job
+}
+
+/// Every expected job succeeded with executed steps, plus one unrelated job.
+pub(super) fn successful_jobs() -> Vec<Value> {
+    let mut jobs = expected_jobs()
+        .iter()
+        .enumerate()
+        .map(|(index, expected)| {
+            job(
+                100 + index as u64,
+                &expected.name,
+                "completed",
+                json!("success"),
+                executed_steps(),
+            )
+        })
+        .collect::<Vec<_>>();
+    jobs.push(job(
+        900,
+        "unrelated JavaScript job",
+        "completed",
+        json!("success"),
+        executed_steps(),
+    ));
+    jobs
+}
+
+pub(super) fn response(jobs: &[Value]) -> Vec<u8> {
+    serde_json::to_vec(&json!({"total_count": jobs.len(), "jobs": jobs}))
+        .expect("should serialize fictional jobs response")
+}
+
+pub(super) fn upload(name: &str, artifact_id: u64) -> JobUpload {
+    JobUpload {
+        job: name.to_owned(),
+        output: UploadOutput {
+            artifact_id,
+            artifact_name: format!("upload-{artifact_id}"),
+            archive_sha256: digest(&archive()),
+            members: BTreeMap::from([("artifact".to_owned(), 1)]),
+        },
+    }
+}
+
+pub(super) fn archive() -> Vec<u8> {
+    zip(&[("artifact", b"x")], false)
+}
+
+pub(super) fn all_uploads() -> Vec<JobUpload> {
+    expected_jobs()
+        .iter()
+        .enumerate()
+        .map(|(index, expected)| upload(&expected.name, 500 + index as u64))
+        .collect()
+}
+
+pub(super) fn is_native_reproduction(expected: &ExpectedJob) -> bool {
+    expected.role == Role::Reproduction && !expected.mandatory()
+}
+
+/// Replaces every native reproduction job and drops its upload.
+pub(super) fn with_native_reproductions(
+    status: &str,
+    conclusion: &Value,
+    steps: &[Value],
+) -> (Vec<Value>, Vec<JobUpload>) {
+    let expected = expected_jobs();
+    let mut jobs = successful_jobs();
+    for (index, slot) in expected.iter().enumerate() {
+        if is_native_reproduction(slot) {
+            jobs[index] = job(
+                100 + index as u64,
+                &slot.name,
+                status,
+                conclusion.clone(),
+                steps.to_vec(),
+            );
+        }
+    }
+    let uploads = all_uploads()
+        .into_iter()
+        .filter(|upload| {
+            !expected
+                .iter()
+                .any(|slot| slot.name == upload.job && is_native_reproduction(slot))
+        })
+        .collect();
+    (jobs, uploads)
+}
+
+/// Requires a rejection whose report names the expected reason.
+///
+/// A rejection for an unrelated reason would let a mutated fixture pass
+/// without exercising the check under test.
+pub(super) fn assert_rejected<T: std::fmt::Debug>(result: Result<T>, reason: &str) {
+    let error = result.expect_err("should reject the observation");
+    assert!(
+        format!("{error:?}").contains(reason),
+        "should reject because {reason:?}, got {error:?}"
+    );
+}
+
+pub(super) fn optional_outcomes(adapted: &AdaptedJobs) -> Vec<Option<Outcome>> {
+    adapted
+        .optional
+        .iter()
+        .map(|build| match build {
+            OptionalBuild::Uploaded { .. } => None,
+            OptionalBuild::NotUploaded(absent) => absent.outcome(),
+        })
+        .collect()
+}
diff --git a/crates/trusted-server-release/src/collection/workflow_jobs/tests/transfer.rs b/crates/trusted-server-release/src/collection/workflow_jobs/tests/transfer.rs
new file mode 100644
index 0000000000..1b8185accc
--- /dev/null
+++ b/crates/trusted-server-release/src/collection/workflow_jobs/tests/transfer.rs
@@ -0,0 +1,99 @@
+//! Adapter output fed through the existing exact-ID transfer validation.
+
+use super::*;
+use crate::collection::records::RoleProfile;
+use crate::collection::{
+    ArtifactSource, Download, Invocation, TrustedDependencies, digest, validate_transfers,
+};
+
+struct RecordingSource {
+    archive: Vec<u8>,
+    requested: Vec<u64>,
+}
+
+impl ArtifactSource for RecordingSource {
+    fn metadata(&mut self, _repository: &str, id: u64) -> Result<Vec<u8>> {
+        self.requested.push(id);
+        Ok(serde_json::to_vec(&json!({
+            "id": id,
+            "name": format!("upload-{id}"),
+            "expired": false,
+            "digest": format!("sha256:{}", digest(&self.archive)),
+            "workflow_run": {
+                "id": RUN_ID,
+                "head_sha": head_sha(),
+                "repository_id": 17,
+                "head_repository_id": 17,
+            },
+        }))
+        .expect("should serialize fictional metadata"))
+    }
+
+    fn download(&mut self, _repository: &str, id: u64) -> Result<Download> {
+        self.requested.push(id);
+        Ok(Download {
+            archive: self.archive.clone(),
+            transfer_warning: false,
+        })
+    }
+}
+
+#[test]
+fn adapted_jobs_feed_exact_uploads_and_absent_reproductions_into_transfer_validation() {
+    let (never_started, mandatory_uploads) = with_native_reproductions("queued", &Value::Null, &[]);
+    let (failed, _) = with_native_reproductions("completed", &json!("failure"), &executed_steps());
+    // The failed native reproductions also report upload outputs, which the
+    // adapter must drop rather than fetch.
+    for (label, jobs, uploads, elapsed) in [
+        (
+            "never started",
+            never_started,
+            mandatory_uploads.clone(),
+            DEADLINE,
+        ),
+        ("failed with upload output", failed, all_uploads(), 600),
+    ] {
+        let adapted = adapt_jobs(&topology(), &response(&jobs), &uploads, elapsed)
+            .unwrap_or_else(|error| panic!("should adapt native reproductions {label}: {error:?}"));
+        let dependencies = TrustedDependencies {
+            invocation: Invocation {
+                repository: "example/project".to_owned(),
+                repository_id: 17,
+                run_id: RUN_ID,
+                source_commit: head_sha(),
+                inventory_sha256: "b".repeat(64),
+                profiles: RoleProfile::fixtures(),
+            },
+            required: adapted.required,
+            optional: adapted.optional,
+        };
+        let mut source = RecordingSource {
+            archive: archive(),
+            requested: Vec::new(),
+        };
+
+        let validated = validate_transfers(&dependencies, &mut source)
+            .expect("should validate adapted exact-ID transfers");
+
+        assert_eq!(
+            validated.transfers.len(),
+            5,
+            "should fetch every mandatory upload when native reproductions {label}"
+        );
+        assert_eq!(
+            validated.absent.len(),
+            3,
+            "should keep absent native reproductions when {label}"
+        );
+        let mut fetched = source.requested.clone();
+        fetched.dedup();
+        let mandatory = mandatory_uploads
+            .iter()
+            .map(|upload| upload.output.artifact_id);
+        assert_eq!(
+            fetched,
+            mandatory.collect::<Vec<_>>(),
+            "should fetch only mandatory upload identities when native reproductions {label}"
+        );
+    }
+}
diff --git a/crates/trusted-server-release/src/composition.rs b/crates/trusted-server-release/src/composition.rs
new file mode 100644
index 0000000000..c2ca4bcf7e
--- /dev/null
+++ b/crates/trusted-server-release/src/composition.rs
@@ -0,0 +1,500 @@
+//! Observed Cargo compilation units, without granting material or release authority.
+//!
+//! Metadata describes package identities and potential graph membership. Only
+//! compiler messages describe compiled units and their effective features.
+//! Native output validation and final executable membership are separate gates.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::path::{Component, Path, PathBuf};
+
+use error_stack::Report;
+use serde::Serialize;
+use serde_json::{Value, json};
+
+use crate::documents::{Role, parse_json};
+use crate::error::ReleaseError;
+use crate::policy::ReleaseTarget;
+use crate::recipe::observed_cargo_messages;
+
+mod capture;
+pub(crate) mod external;
+pub(crate) mod graph;
+pub(crate) mod javascript;
+pub(crate) mod native;
+pub(crate) mod origin;
+pub(crate) mod platform;
+pub(crate) use capture::{CargoCapture, CompositionView, RetainedCompositionExport};
+
+const MAX_PACKAGES: usize = 16_384;
+const MAX_MESSAGES: usize = 65_536;
+
+fn composition_error(detail: impl std::fmt::Display) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Composition).attach(detail.to_string())
+}
+
+fn text<'a>(value: &'a Value, label: &str) -> Result<&'a str, Report<ReleaseError>> {
+    value
+        .as_str()
+        .filter(|text| {
+            !text.is_empty() && text.len() <= 8192 && !text.chars().any(char::is_control)
+        })
+        .ok_or_else(|| composition_error(format!("{label} is not bounded plain text")))
+}
+
+fn array<'a>(value: &'a Value, label: &str) -> Result<&'a [Value], Report<ReleaseError>> {
+    value
+        .as_array()
+        .map(Vec::as_slice)
+        .ok_or_else(|| composition_error(format!("{label} is not an array")))
+}
+
+fn strings(value: &Value, label: &str, unique: bool) -> Result<Vec<String>, Report<ReleaseError>> {
+    let values = array(value, label)?
+        .iter()
+        .map(|value| text(value, label).map(str::to_owned))
+        .collect::<Result<Vec<_>, _>>()?;
+    if unique && values.iter().collect::<BTreeSet<_>>().len() != values.len() {
+        return Err(composition_error(format!("{label} contains duplicates")));
+    }
+    Ok(values)
+}
+
+fn normal_path(path: &Path) -> Result<(), Report<ReleaseError>> {
+    if !path.is_absolute()
+        || path == Path::new("/")
+        || path.components().collect::<PathBuf>().as_os_str() != path.as_os_str()
+        || path
+            .components()
+            .any(|part| matches!(part, Component::ParentDir))
+    {
+        return Err(composition_error(
+            "observation path is not absolute and normal",
+        ));
+    }
+    Ok(())
+}
+
+fn path(value: &Value, label: &str) -> Result<PathBuf, Report<ReleaseError>> {
+    let path = PathBuf::from(text(value, label)?);
+    normal_path(&path)?;
+    Ok(path)
+}
+
+/// Explicit-target output layout of one already selected build.
+pub(crate) struct CargoLayout {
+    target: ReleaseTarget,
+    target_dir: PathBuf,
+    checkout: PathBuf,
+}
+
+impl CargoLayout {
+    /// Checks the namespace paths used to classify compiler outputs.
+    ///
+    /// # Errors
+    ///
+    /// Rejects relative, root-only, overlapping or non-normal directories.
+    pub(crate) fn new(
+        target: ReleaseTarget,
+        target_dir: PathBuf,
+        checkout: PathBuf,
+    ) -> Result<Self, Report<ReleaseError>> {
+        normal_path(&target_dir)?;
+        normal_path(&checkout)?;
+        if target_dir.starts_with(&checkout) || checkout.starts_with(&target_dir) {
+            return Err(composition_error("composition roots overlap"));
+        }
+        Ok(Self {
+            target,
+            target_dir,
+            checkout,
+        })
+    }
+
+    fn context(&self, path: &Path) -> Result<UnitContext, Report<ReleaseError>> {
+        normal_path(path)?;
+        for (context, root) in [
+            (
+                UnitContext::Target,
+                self.target_dir.join(self.target.triple()).join("release"),
+            ),
+            (UnitContext::Host, self.target_dir.join("release")),
+        ] {
+            if path
+                .strip_prefix(&root)
+                .is_ok_and(|relative| !relative.as_os_str().is_empty())
+            {
+                return Ok(context);
+            }
+        }
+        Err(composition_error(
+            "compiler output is outside both selected release layouts",
+        ))
+    }
+}
+
+/// The host or explicit target context observed in Cargo's output paths.
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub(crate) enum UnitContext {
+    Host,
+    Target,
+}
+
+/// A package observed in actual compilation, identified by its exact Cargo ID.
+#[derive(Debug, Serialize)]
+pub(crate) struct RustPackage {
+    id: String,
+    name: String,
+    version: String,
+    source: Option<String>,
+    manifest_path: PathBuf,
+    license: Option<String>,
+}
+
+/// One compiler observation, including its actual features and output context.
+#[derive(Debug, Serialize)]
+pub(crate) struct RustUnit {
+    package_id: String,
+    target_name: String,
+    target_kind: Vec<String>,
+    crate_types: Vec<String>,
+    context: UnitContext,
+    features: Vec<String>,
+    profile: Value,
+    filenames: Vec<PathBuf>,
+    executable: Option<PathBuf>,
+}
+
+/// A build-script execution observation, without invented per-unit feature joins.
+#[derive(Debug, Serialize)]
+pub(crate) struct BuildScriptObservation {
+    package_id: String,
+    context: UnitContext,
+    out_dir: PathBuf,
+    linked_libs: Vec<String>,
+    linked_paths: Vec<String>,
+    cfgs: Vec<String>,
+    environment: Vec<(String, String)>,
+}
+
+/// Conservative observed membership; not a verified material-origin inventory.
+#[derive(Debug, Serialize)]
+pub(crate) struct CargoObservations {
+    packages: Vec<RustPackage>,
+    units: Vec<RustUnit>,
+    build_scripts: Vec<BuildScriptObservation>,
+}
+
+impl CargoObservations {
+    /// Returns packages actually observed in compiler messages.
+    pub(crate) fn packages(&self) -> &[RustPackage] {
+        &self.packages
+    }
+
+    /// Returns actual units without promoting metadata feature unions.
+    pub(crate) fn units(&self) -> &[RustUnit] {
+        &self.units
+    }
+
+    /// Returns observed build-script executions.
+    pub(crate) fn build_scripts(&self) -> &[BuildScriptObservation] {
+        &self.build_scripts
+    }
+}
+
+impl RustPackage {
+    /// Returns the exact opaque Cargo package identity.
+    pub(crate) fn id(&self) -> &str {
+        &self.id
+    }
+
+    /// Returns the checked package name.
+    pub(crate) fn name(&self) -> &str {
+        &self.name
+    }
+
+    /// Returns the checked package version.
+    pub(crate) fn version(&self) -> &str {
+        &self.version
+    }
+
+    /// Returns the metadata license declaration, without a license conclusion.
+    pub(crate) fn license(&self) -> Option<&str> {
+        self.license.as_deref()
+    }
+}
+
+impl RustUnit {
+    /// Returns the exact observed package identity.
+    pub(crate) fn package_id(&self) -> &str {
+        &self.package_id
+    }
+
+    /// Returns the compiler target name.
+    pub(crate) fn target_name(&self) -> &str {
+        &self.target_name
+    }
+
+    /// Returns compiler target kinds, including host proc macros and build scripts.
+    pub(crate) fn target_kind(&self) -> &[String] {
+        &self.target_kind
+    }
+
+    /// Returns the observed crate types.
+    pub(crate) fn crate_types(&self) -> &[String] {
+        &self.crate_types
+    }
+
+    /// Returns the observed host or selected target output context.
+    pub(crate) fn context(&self) -> UnitContext {
+        self.context
+    }
+
+    /// Returns effective features from this compiler message only.
+    pub(crate) fn features(&self) -> &[String] {
+        &self.features
+    }
+}
+
+fn package(value: &Value) -> Result<RustPackage, Report<ReleaseError>> {
+    let optional = |key: &str| match value.get(key) {
+        Some(Value::Null) => Ok(None),
+        Some(value) => text(value, key).map(|text| Some(text.to_owned())),
+        None => Err(composition_error(format!("package has no {key}"))),
+    };
+    Ok(RustPackage {
+        id: text(&value["id"], "package ID")?.to_owned(),
+        name: text(&value["name"], "package name")?.to_owned(),
+        version: text(&value["version"], "package version")?.to_owned(),
+        source: optional("source")?,
+        manifest_path: path(&value["manifest_path"], "package manifest")?,
+        license: optional("license")?,
+    })
+}
+
+fn unit(
+    message: &Value,
+    package: &Value,
+    layout: &CargoLayout,
+) -> Result<RustUnit, Report<ReleaseError>> {
+    if message["fresh"].as_bool() != Some(false)
+        || message["profile"]["test"].as_bool() != Some(false)
+    {
+        return Err(composition_error(
+            "compiler unit is cached or is not a non-test build",
+        ));
+    }
+    if path(&message["manifest_path"], "unit manifest")?
+        != path(&package["manifest_path"], "package manifest")?
+    {
+        return Err(composition_error(
+            "compiler unit manifest differs from its package",
+        ));
+    }
+    let target = &message["target"];
+    let target_name = text(&target["name"], "target name")?.to_owned();
+    let target_kind = strings(&target["kind"], "target kinds", true)?;
+    let crate_types = strings(&target["crate_types"], "crate types", true)?;
+    if target_kind.is_empty() || crate_types.is_empty() {
+        return Err(composition_error(
+            "compiler target has no kind or crate type",
+        ));
+    }
+    let matching = array(&package["targets"], "metadata targets")?
+        .iter()
+        .filter(|candidate| {
+            ["name", "kind", "crate_types", "src_path"]
+                .into_iter()
+                .all(|field| candidate[field] == target[field])
+        })
+        .count();
+    path(&target["src_path"], "target source")?;
+    if matching != 1 {
+        return Err(composition_error(
+            "compiler target has no unique metadata target",
+        ));
+    }
+    let filenames = array(&message["filenames"], "compiler filenames")?
+        .iter()
+        .map(|value| path(value, "compiler filename"))
+        .collect::<Result<Vec<_>, _>>()?;
+    let first = filenames
+        .first()
+        .ok_or_else(|| composition_error("compiler unit has no output"))?;
+    let context = layout.context(first)?;
+    for filename in &filenames {
+        if layout.context(filename)? != context {
+            return Err(composition_error(
+                "one compiler unit spans host and target layouts",
+            ));
+        }
+    }
+    if target_kind
+        .iter()
+        .any(|kind| matches!(kind.as_str(), "custom-build" | "proc-macro"))
+        && context != UnitContext::Host
+    {
+        return Err(composition_error(
+            "build script or proc macro is not a host unit",
+        ));
+    }
+    let executable = match &message["executable"] {
+        Value::Null => None,
+        value => {
+            let executable = path(value, "unit executable")?;
+            if layout.context(&executable)? != context || !filenames.contains(&executable) {
+                return Err(composition_error("executable is outside its unit outputs"));
+            }
+            Some(executable)
+        }
+    };
+    let mut features = strings(&message["features"], "effective features", true)?;
+    features.sort();
+    Ok(RustUnit {
+        package_id: text(&message["package_id"], "unit package ID")?.to_owned(),
+        target_name,
+        target_kind,
+        crate_types,
+        context,
+        features,
+        profile: message["profile"].clone(),
+        filenames,
+        executable,
+    })
+}
+
+fn build_script(
+    message: &Value,
+    layout: &CargoLayout,
+) -> Result<BuildScriptObservation, Report<ReleaseError>> {
+    let out_dir = path(&message["out_dir"], "build script OUT_DIR")?;
+    let context = layout.context(&out_dir)?;
+    let environment = array(&message["env"], "build script environment")?
+        .iter()
+        .map(|entry| {
+            let fields = array(entry, "build script environment pair")?;
+            let [name, value] = fields else {
+                return Err(composition_error("environment entry is not one pair"));
+            };
+            let name = text(name, "build script environment name")?.to_owned();
+            let value = value
+                .as_str()
+                .filter(|value| value.len() <= 65_536 && !value.contains('\0'))
+                .ok_or_else(|| composition_error("build script environment value is invalid"))?
+                .to_owned();
+            Ok((name, value))
+        })
+        .collect::<Result<Vec<_>, Report<ReleaseError>>>()?;
+    Ok(BuildScriptObservation {
+        package_id: text(&message["package_id"], "build script package ID")?.to_owned(),
+        context,
+        out_dir,
+        linked_libs: strings(&message["linked_libs"], "linked libraries", false)?,
+        linked_paths: strings(&message["linked_paths"], "link search paths", false)?,
+        cfgs: strings(&message["cfgs"], "build script cfg", false)?,
+        environment,
+    })
+}
+
+/// Joins strict build observations with exact metadata package/target identities.
+///
+/// Only compiler messages supply unit features and contributor membership.
+/// Metadata graph unions and uncompiled packages never create units. The
+/// result describes observations, not verified native/material coverage.
+///
+/// # Errors
+///
+/// Rejects malformed/bounded-input violations, ambiguous joins, cached/test
+/// units, invalid output contexts, duplicate units or unobserved build scripts.
+pub(crate) fn observe_cargo(
+    metadata: &[u8],
+    stdout: &[u8],
+    layout: &CargoLayout,
+) -> Result<CargoObservations, Report<ReleaseError>> {
+    let meta = parse_json(metadata, Role::CargoObservation)
+        .map_err(|error| error.change_context(ReleaseError::Composition))?;
+    if meta["version"].as_u64() != Some(1)
+        || path(&meta["workspace_root"], "metadata workspace")? != layout.checkout
+        || path(&meta["target_directory"], "metadata target directory")? != layout.target_dir
+    {
+        return Err(composition_error(
+            "metadata version or build layout differs from selection",
+        ));
+    }
+    let records = array(&meta["packages"], "metadata packages")?;
+    if records.len() > MAX_PACKAGES {
+        return Err(composition_error("too many metadata packages"));
+    }
+    let mut packages = BTreeMap::new();
+    for record in records {
+        let id = text(&record["id"], "metadata package ID")?;
+        if packages.insert(id, record).is_some() {
+            return Err(composition_error("duplicate metadata package ID"));
+        }
+    }
+    let messages = observed_cargo_messages(stdout)
+        .map_err(|error| error.change_context(ReleaseError::Composition))?;
+    if messages.len() > MAX_MESSAGES {
+        return Err(composition_error("too many Cargo messages"));
+    }
+    let mut units = BTreeMap::new();
+    let mut scripts = Vec::new();
+    let mut observed_packages = BTreeSet::new();
+    for message in &messages {
+        match message["reason"].as_str() {
+            Some("compiler-artifact") => {
+                let id = text(&message["package_id"], "unit package ID")?;
+                let package = packages.get(id).ok_or_else(|| {
+                    composition_error(format!(
+                        "compiled package {id:?} is absent from metadata catalog ({} packages)",
+                        packages.len()
+                    ))
+                })?;
+                let unit = unit(message, package, layout)?;
+                let key = serde_json::to_vec(&json!([
+                    unit.package_id,
+                    unit.target_name,
+                    unit.target_kind,
+                    unit.crate_types,
+                    unit.context,
+                    unit.features,
+                    unit.profile
+                ]))
+                .map_err(composition_error)?;
+                if units.insert(key, unit).is_some() {
+                    return Err(composition_error("duplicate compiler unit identity"));
+                }
+                observed_packages.insert(id);
+            }
+            Some("build-script-executed") => scripts.push(build_script(message, layout)?),
+            Some("compiler-message" | "build-finished") => {}
+            _ => return Err(composition_error("unknown Cargo observation reason")),
+        }
+    }
+    let mut script_ids = BTreeSet::new();
+    for script in &scripts {
+        if !units.values().any(|unit| {
+            unit.package_id == script.package_id
+                && unit.context == UnitContext::Host
+                && unit.target_kind.iter().any(|kind| kind == "custom-build")
+        }) || !script_ids.insert((&script.package_id, &script.out_dir))
+        {
+            return Err(composition_error(
+                "build script execution has no unique observed compilation",
+            ));
+        }
+    }
+    scripts.sort_by(|a, b| (&a.package_id, &a.out_dir).cmp(&(&b.package_id, &b.out_dir)));
+    let packages = observed_packages
+        .into_iter()
+        .map(|id| package(packages[id]))
+        .collect::<Result<Vec<_>, _>>()?;
+    Ok(CargoObservations {
+        packages,
+        units: units.into_values().collect(),
+        build_scripts: scripts,
+    })
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/trusted-server-release/src/composition/capture.rs b/crates/trusted-server-release/src/composition/capture.rs
new file mode 100644
index 0000000000..3c6e077b0c
--- /dev/null
+++ b/crates/trusted-server-release/src/composition/capture.rs
@@ -0,0 +1,376 @@
+//! Retained raw observations and their normalized conservative unit inventory.
+
+use std::fs;
+use std::io::Write as _;
+use std::os::unix::fs::OpenOptionsExt as _;
+use std::path::Path;
+
+use error_stack::Report;
+use serde_json::{Value, json};
+use sha2::{Digest as _, Sha256};
+
+use super::graph::{self, GraphEvidence};
+use super::javascript::JsMembership;
+use super::native::NativeInventory;
+use super::origin::VerifiedPackageOrigins;
+use super::platform::PlatformEvidence;
+use super::{CargoLayout, CargoObservations, composition_error, observe_cargo};
+use crate::documents::{hash_bounded_with_check, lower_hex};
+use crate::error::ReleaseError;
+
+const LIMIT: u64 = 16 * 1024 * 1024;
+const METADATA: &str = "cargo-metadata.json";
+const TREE: &str = "cargo-tree.txt";
+const NORMALIZED: &str = "cargo-observations.json";
+
+/// Raw Cargo observations bound to their checked unit normalization.
+///
+/// This records observations only; verified material/native coverage remains
+/// a separate requirement before a build composition can be attested.
+pub(crate) struct CargoCapture {
+    metadata: Vec<u8>,
+    tree: Vec<u8>,
+    normalized: Vec<u8>,
+    digests: [String; 3],
+    observations: CargoObservations,
+    query_plan_digests: [String; 2],
+    receipt: Option<CompositionReceipt>,
+}
+
+#[derive(serde::Serialize)]
+struct CompositionReceipt {
+    graph: GraphEvidence,
+    package_origins: VerifiedPackageOrigins,
+    native: NativeInventory,
+    javascript: JsMembership,
+    platform: PlatformEvidence,
+}
+
+/// Borrowed sealed observations after their retained bytes have been rechecked.
+///
+/// This grants read access only. Potential graph membership and incomplete
+/// native, tool and platform coverage retain their existing meanings.
+pub(crate) struct CompositionView<'a> {
+    observations: &'a CargoObservations,
+    receipt: &'a CompositionReceipt,
+    receipt_sha256: &'a str,
+}
+
+impl CompositionView<'_> {
+    /// Returns the exact retained normalized receipt identity without reserialization.
+    pub(crate) fn receipt_sha256(&self) -> &str {
+        self.receipt_sha256
+    }
+
+    /// Returns actual compiler observations, including unit context and features.
+    pub(crate) fn observations(&self) -> &CargoObservations {
+        self.observations
+    }
+
+    /// Returns potential graph evidence separately from compiler observations.
+    pub(crate) fn graph(&self) -> &GraphEvidence {
+        &self.receipt.graph
+    }
+
+    /// Returns exact observed package IDs joined to verified originals.
+    pub(crate) fn package_origins(&self) -> &VerifiedPackageOrigins {
+        &self.receipt.package_origins
+    }
+
+    /// Returns candidate native measurements with their existing coverage gaps.
+    pub(crate) fn native(&self) -> &NativeInventory {
+        &self.receipt.native
+    }
+
+    /// Returns final-byte JavaScript module observations.
+    pub(crate) fn javascript(&self) -> &JsMembership {
+        &self.receipt.javascript
+    }
+
+    /// Returns candidate platform measurements without acquisition authority.
+    pub(crate) fn platform(&self) -> &PlatformEvidence {
+        &self.receipt.platform
+    }
+}
+
+/// Exact retained composition bytes, without a claim of complete coverage.
+///
+/// Only the owning capture can construct this diagnostic export. It retains
+/// sealed observations after working source and native output roots are removed.
+#[derive(Debug)]
+pub(crate) struct RetainedCompositionExport {
+    bytes: Vec<u8>,
+    sha256: String,
+    summary: Value,
+}
+
+impl RetainedCompositionExport {
+    /// Returns the original normalized receipt bytes without reserialization.
+    pub(crate) fn bytes(&self) -> &[u8] {
+        &self.bytes
+    }
+
+    /// Returns the SHA-256 of these exact retained bytes.
+    pub(crate) fn sha256(&self) -> &str {
+        &self.sha256
+    }
+
+    /// Returns observation counts and explicit incomplete coverage diagnostics.
+    pub(crate) fn summary(&self) -> &Value {
+        &self.summary
+    }
+}
+
+impl core::fmt::Debug for CargoCapture {
+    fn fmt(&self, formatter: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        formatter
+            .debug_struct("CargoCapture")
+            .field("digests", &self.digests)
+            .field("has_composition_receipt", &self.receipt.is_some())
+            .finish_non_exhaustive()
+    }
+}
+
+impl CargoCapture {
+    /// Borrows sealed typed evidence after rechecking all retained observations.
+    ///
+    /// # Errors
+    ///
+    /// Rejects changed retained bytes or observations without sealed receipts.
+    pub(crate) fn view(
+        &self,
+        directory: &Path,
+    ) -> Result<CompositionView<'_>, Report<ReleaseError>> {
+        self.rehash(directory)?;
+        let receipt = self.receipt.as_ref().ok_or_else(|| {
+            composition_error("composition view requires actual sealed component receipts")
+        })?;
+        Ok(CompositionView {
+            observations: &self.observations,
+            receipt,
+            receipt_sha256: &self.digests[2],
+        })
+    }
+
+    /// Normalizes a successful build and its same-boundary query output.
+    ///
+    /// # Errors
+    ///
+    /// Rejects invalid unit/metadata joins, non-text or oversized tree output,
+    /// or normalization exceeding the internal observation bound.
+    pub(crate) fn new(
+        metadata: Vec<u8>,
+        tree: Vec<u8>,
+        stdout: &[u8],
+        layout: &CargoLayout,
+        query_plan_digests: [String; 2],
+    ) -> Result<Self, Report<ReleaseError>> {
+        if query_plan_digests
+            .iter()
+            .any(|digest| !lower_hex(digest, 64))
+        {
+            return Err(composition_error(
+                "query plans have no exact SHA-256 identities",
+            ));
+        }
+        if tree.is_empty()
+            || tree.len() as u64 > LIMIT
+            || tree.contains(&0)
+            || std::str::from_utf8(&tree).is_err()
+            || !tree.ends_with(b"\n")
+        {
+            return Err(composition_error(
+                "Cargo tree output is not bounded newline-terminated text",
+            ));
+        }
+        let observations = observe_cargo(&metadata, stdout, layout)?;
+        let normalized = serde_json::to_vec(&json!({
+            "metadata_plan_sha256": query_plan_digests[0],
+            "tree_plan_sha256": query_plan_digests[1],
+            "observations": observations,
+        }))
+        .map_err(composition_error)?;
+        if normalized.len() as u64 > LIMIT {
+            return Err(composition_error(
+                "normalized observations exceed their bound",
+            ));
+        }
+        let digests =
+            [&metadata, &tree, &normalized].map(|bytes| hex::encode(Sha256::digest(bytes)));
+        Ok(Self {
+            metadata,
+            tree,
+            normalized,
+            digests,
+            observations,
+            query_plan_digests,
+            receipt: None,
+        })
+    }
+
+    /// The observed units whose inputs must be joined before sealing evidence.
+    pub(crate) fn observations(&self) -> &CargoObservations {
+        &self.observations
+    }
+
+    /// Seals checked component receipts while their working inputs still exist.
+    ///
+    /// Native sources and archives are rehashed here. Later handoffs verify the
+    /// retained receipt bytes, allowing completed working roots to be cleaned.
+    /// Full tool/platform coverage and qualification remain separate gates.
+    ///
+    /// # Errors
+    ///
+    /// Rejects changed native inputs or oversized serialized evidence.
+    pub(crate) fn with_evidence(
+        mut self,
+        selected_package_id: &str,
+        package_origins: VerifiedPackageOrigins,
+        native: NativeInventory,
+        javascript: JsMembership,
+        platform: PlatformEvidence,
+    ) -> Result<Self, Report<ReleaseError>> {
+        let graph = graph::reconcile(
+            &self.metadata,
+            &self.tree,
+            &self.observations,
+            selected_package_id,
+        )?;
+        native.rehash(&|| Ok(()))?;
+        let receipt = CompositionReceipt {
+            graph,
+            package_origins,
+            native,
+            javascript,
+            platform,
+        };
+        let normalized = serde_json::to_vec(&json!({
+            "metadata_plan_sha256": self.query_plan_digests[0],
+            "tree_plan_sha256": self.query_plan_digests[1],
+            "observations": self.observations,
+            "composition": receipt,
+        }))
+        .map_err(composition_error)?;
+        if normalized.len() as u64 > LIMIT {
+            return Err(composition_error(
+                "normalized composition exceeds its bound",
+            ));
+        }
+        self.digests[2] = hex::encode(Sha256::digest(&normalized));
+        self.normalized = normalized;
+        self.receipt = Some(receipt);
+        Ok(self)
+    }
+
+    /// Returns the exact package identity of the binary accepted by the recipe.
+    ///
+    /// # Errors
+    ///
+    /// Rejects missing or ambiguous binary membership and mismatched manifests.
+    pub(crate) fn require_binary(
+        &self,
+        manifest: &Path,
+        bin: &str,
+        executable: &Path,
+    ) -> Result<String, Report<ReleaseError>> {
+        let matching = self
+            .observations
+            .units
+            .iter()
+            .filter(|unit| {
+                unit.target_name == bin
+                    && unit.target_kind == ["bin"]
+                    && unit.context == super::UnitContext::Target
+                    && unit.executable.as_deref() == Some(executable)
+                    && self.observations.packages.iter().any(|package| {
+                        package.id == unit.package_id && package.manifest_path == manifest
+                    })
+            })
+            .collect::<Vec<_>>();
+        if matching.len() != 1 {
+            return Err(composition_error(
+                "composition does not name the exact accepted binary",
+            ));
+        }
+        Ok(matching[0].package_id.clone())
+    }
+
+    /// Retains every raw/normalized observation as a new private file.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error on existing files or failed writes/synchronization.
+    pub(crate) fn retain(&self, directory: &Path) -> Result<(), Report<ReleaseError>> {
+        for (name, bytes) in [
+            (METADATA, &self.metadata),
+            (TREE, &self.tree),
+            (NORMALIZED, &self.normalized),
+        ] {
+            let mut file = fs::OpenOptions::new()
+                .write(true)
+                .create_new(true)
+                .mode(0o600)
+                .open(directory.join(name))
+                .map_err(composition_error)?;
+            file.write_all(bytes)
+                .and_then(|()| file.sync_all())
+                .map_err(composition_error)?;
+        }
+        Ok(())
+    }
+
+    /// Verifies retained observations immediately before a later handoff.
+    ///
+    /// # Errors
+    ///
+    /// Rejects changed, aliased, linked, missing or oversized retained observations.
+    pub(crate) fn rehash(&self, directory: &Path) -> Result<(), Report<ReleaseError>> {
+        for (name, expected) in [METADATA, TREE, NORMALIZED].into_iter().zip(&self.digests) {
+            let measured = hash_bounded_with_check(&directory.join(name), LIMIT, &|| Ok(()))
+                .map_err(|error| error.change_context(ReleaseError::Composition))?;
+            if &measured.sha256 != expected {
+                return Err(composition_error(format!("retained {name} changed")));
+            }
+        }
+        Ok(())
+    }
+
+    /// Exports exact sealed composition bytes after checking every retained input.
+    ///
+    /// # Errors
+    ///
+    /// Rejects changed retained files or observations without actual graph,
+    /// origin, native, JavaScript and platform receipts. Existing coverage gaps
+    /// remain explicit; this cannot construct complete or qualified evidence.
+    pub(crate) fn export(
+        &self,
+        directory: &Path,
+    ) -> Result<RetainedCompositionExport, Report<ReleaseError>> {
+        self.rehash(directory)?;
+        if self.receipt.is_none() {
+            return Err(composition_error(
+                "composition export requires actual sealed component receipts",
+            ));
+        }
+        Ok(RetainedCompositionExport {
+            bytes: self.normalized.clone(),
+            sha256: self.digests[2].clone(),
+            summary: self.summary(),
+        })
+    }
+
+    /// Describes internal observations without claiming complete native/material coverage.
+    pub(crate) fn summary(&self) -> Value {
+        json!({
+            "metadata_sha256": self.digests[0], "tree_sha256": self.digests[1],
+            "metadata_plan_sha256": self.query_plan_digests[0],
+            "tree_plan_sha256": self.query_plan_digests[1],
+            "normalized_sha256": self.digests[2],
+            "observed_packages": self.observations.packages.len(),
+            "observed_units": self.observations.units.len(),
+            "build_script_executions": self.observations.build_scripts.len(),
+            "composition_receipts_retained": self.receipt.is_some(),
+            "material_native_coverage_complete": false,
+        })
+    }
+}
diff --git a/crates/trusted-server-release/src/composition/external.rs b/crates/trusted-server-release/src/composition/external.rs
new file mode 100644
index 0000000000..f96def1e6e
--- /dev/null
+++ b/crates/trusted-server-release/src/composition/external.rs
@@ -0,0 +1,113 @@
+//! Logical runtime requirements observed in inspected final executable bytes.
+
+use serde::{Serialize, Serializer};
+
+use crate::inspect::{ElfFacts, MachoCpu, MachoFacts, VersionRequirement, WasmFacts};
+use crate::policy::ReleaseTarget;
+
+/// Observed external requirements, without installed-runtime provenance claims.
+#[derive(Debug, Serialize)]
+pub(crate) struct ExternalRequirements {
+    #[serde(serialize_with = "serialize_target")]
+    target: ReleaseTarget,
+    artifact_sha256: String,
+    runtime: Runtime,
+}
+
+#[derive(Debug, Serialize)]
+#[serde(tag = "format", rename_all = "snake_case")]
+pub(crate) enum Runtime {
+    Elf {
+        interpreter: String,
+        needed: Vec<String>,
+        version_requirements: Vec<VersionRequirement>,
+        max_glibc: String,
+    },
+    Macho {
+        loader: String,
+        cpu: String,
+        dylibs: Vec<String>,
+        minimum_os: String,
+        sdk: String,
+    },
+    Wasm {
+        import_modules: Vec<String>,
+    },
+}
+
+fn serialize_target<S: Serializer>(
+    target: &ReleaseTarget,
+    serializer: S,
+) -> Result<S::Ok, S::Error> {
+    serializer.serialize_str(target.triple())
+}
+
+impl ExternalRequirements {
+    /// Borrows exact logical requirements without installed-runtime identity.
+    pub(crate) fn runtime(&self) -> &Runtime {
+        &self.runtime
+    }
+    /// Returns the SDK recorded in a Mach-O executable, when present.
+    pub(crate) fn macho_sdk(&self) -> Option<&str> {
+        match &self.runtime {
+            Runtime::Macho { sdk, .. } => Some(sdk),
+            Runtime::Elf { .. } | Runtime::Wasm { .. } => None,
+        }
+    }
+
+    /// Retains logical requirements from accepted GNU/Linux executable facts.
+    pub(crate) fn from_elf(facts: &ElfFacts) -> Self {
+        Self {
+            target: ReleaseTarget::X86_64UnknownLinuxGnu,
+            artifact_sha256: facts.sha256().to_owned(),
+            runtime: Runtime::Elf {
+                interpreter: facts.interpreter().to_owned(),
+                needed: facts.needed().to_vec(),
+                version_requirements: facts.version_requirements().to_vec(),
+                max_glibc: facts.max_glibc().to_string(),
+            },
+        }
+    }
+
+    /// Retains logical requirements from accepted macOS executable facts.
+    pub(crate) fn from_macho(facts: &MachoFacts) -> Self {
+        Self {
+            target: match facts.cpu() {
+                MachoCpu::Arm64 => ReleaseTarget::Aarch64AppleDarwin,
+                MachoCpu::X86_64 => ReleaseTarget::X86_64AppleDarwin,
+            },
+            artifact_sha256: facts.sha256().to_owned(),
+            runtime: Runtime::Macho {
+                loader: facts.loader().to_owned(),
+                cpu: facts.cpu().to_string(),
+                dylibs: facts.dylibs().to_vec(),
+                minimum_os: facts.minos().to_string(),
+                sdk: facts.sdk().to_string(),
+            },
+        }
+    }
+
+    /// Retains logical host imports from accepted Fastly core Wasm facts.
+    pub(crate) fn from_wasm(facts: &WasmFacts) -> Self {
+        Self {
+            target: ReleaseTarget::Wasm32Wasip1,
+            artifact_sha256: facts.sha256().to_owned(),
+            runtime: Runtime::Wasm {
+                import_modules: facts.import_modules().to_vec(),
+            },
+        }
+    }
+
+    /// Target derived from the accepted executable format and CPU.
+    pub(crate) fn target(&self) -> ReleaseTarget {
+        self.target
+    }
+
+    /// SHA-256 computed by the inspector over the accepted executable bytes.
+    pub(crate) fn artifact_sha256(&self) -> &str {
+        &self.artifact_sha256
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/trusted-server-release/src/composition/external/tests.rs b/crates/trusted-server-release/src/composition/external/tests.rs
new file mode 100644
index 0000000000..15797928f6
--- /dev/null
+++ b/crates/trusted-server-release/src/composition/external/tests.rs
@@ -0,0 +1,170 @@
+use object::macho as macho_format;
+use serde_json::{Value, json};
+
+use super::*;
+use crate::inspect::tests::builders::{ElfSpec, MachoSpec, elf, macho, wasm_module};
+use crate::inspect::{ElfPolicy, MachoPolicy, inspect_elf, inspect_macho, inspect_wasm};
+
+fn encoded(requirements: &ExternalRequirements) -> Value {
+    serde_json::to_value(requirements).expect("should encode typed runtime requirements")
+}
+
+#[test]
+fn elf_requirements_retain_only_inspected_loader_libraries_and_versions() {
+    let mut spec = ElfSpec::conforming();
+    spec.needed.retain(|library| *library != "libm.so.6");
+    let facts = inspect_elf(&elf(&spec), &ElfPolicy::linux_x86_64_gnu())
+        .expect("should accept ELF fixture");
+    let requirements = ExternalRequirements::from_elf(&facts);
+    assert_eq!(
+        requirements.target(),
+        ReleaseTarget::X86_64UnknownLinuxGnu,
+        "should derive supported GNU target"
+    );
+    assert_eq!(
+        requirements.artifact_sha256(),
+        facts.sha256(),
+        "should bind inspector artifact digest"
+    );
+    let value = encoded(&requirements);
+    assert_eq!(
+        value["runtime"]["interpreter"],
+        facts.interpreter(),
+        "should retain actual ELF interpreter"
+    );
+    assert_eq!(
+        value["runtime"]["needed"],
+        json!(["libgcc_s.so.1", "libc.so.6"]),
+        "should not add allowed but absent libraries"
+    );
+    assert_eq!(
+        value["runtime"]["max_glibc"], "2.34",
+        "should retain observed GLIBC maximum"
+    );
+    assert_eq!(
+        value["runtime"]["version_requirements"]
+            .as_array()
+            .expect("should hold versions")
+            .len(),
+        5,
+        "should retain every library/version pair"
+    );
+    assert!(
+        value["runtime"]["version_requirements"]
+            .as_array()
+            .expect("should hold versions")
+            .contains(&json!({"file":"libc.so.6","name":"GLIBC_2.34"})),
+        "should bind symbol version to its observed library"
+    );
+}
+
+#[test]
+fn macho_requirements_retain_actual_loader_cpu_and_deployment_versions() {
+    let facts = inspect_macho(
+        &macho(&MachoSpec::conforming()),
+        &MachoPolicy::macos(MachoCpu::Arm64),
+    )
+    .expect("should accept Mach-O fixture");
+    let requirements = ExternalRequirements::from_macho(&facts);
+    assert_eq!(
+        requirements.target(),
+        ReleaseTarget::Aarch64AppleDarwin,
+        "should derive Apple CPU target"
+    );
+    assert_eq!(
+        requirements.artifact_sha256(),
+        facts.sha256(),
+        "should bind inspector artifact digest"
+    );
+    let value = encoded(&requirements);
+    assert_eq!(
+        value["runtime"]["loader"], "/usr/lib/dyld",
+        "should retain validated observed loader"
+    );
+    assert_eq!(
+        value["runtime"]["dylibs"],
+        json!(facts.dylibs()),
+        "should retain only observed dylibs"
+    );
+    assert_eq!(
+        value["runtime"]["minimum_os"], "13.0.0",
+        "should retain observed minimum OS"
+    );
+    assert_eq!(
+        value["runtime"]["sdk"], "15.5.0",
+        "should retain observed SDK"
+    );
+    assert_eq!(
+        value["runtime"]["cpu"], "arm64",
+        "should retain observed CPU"
+    );
+}
+
+#[test]
+fn wasm_requirements_retain_only_observed_modules_and_inspector_digest() {
+    for imports in [
+        vec![],
+        vec![
+            ("wasi_snapshot_preview1", "fd_write"),
+            ("fastly_http_req", "send"),
+        ],
+    ] {
+        let facts = inspect_wasm(&wasm_module(&imports)).expect("should accept core Wasm fixture");
+        let requirements = ExternalRequirements::from_wasm(&facts);
+        assert_eq!(
+            requirements.target(),
+            ReleaseTarget::Wasm32Wasip1,
+            "should derive only supported Wasm release target"
+        );
+        assert_eq!(
+            requirements.artifact_sha256(),
+            facts.sha256(),
+            "should bind inspector artifact digest"
+        );
+        let value = encoded(&requirements);
+        assert_eq!(
+            value["runtime"]["import_modules"],
+            json!(facts.import_modules()),
+            "should not add assumed host modules"
+        );
+        assert!(
+            value["runtime"].get("needed").is_none(),
+            "should not claim native dynamic libraries for Wasm"
+        );
+    }
+}
+
+#[test]
+fn x86_64_macho_facts_cannot_be_relabelled_as_arm64() {
+    let mut spec = MachoSpec::conforming();
+    spec.cputype = macho_format::CPU_TYPE_X86_64;
+    spec.cpusubtype = macho_format::CPU_SUBTYPE_X86_64_ALL;
+    let facts = inspect_macho(&macho(&spec), &MachoPolicy::macos(MachoCpu::X86_64))
+        .expect("should accept x86_64 Mach-O fixture");
+    let requirements = ExternalRequirements::from_macho(&facts);
+    assert_eq!(
+        requirements.target(),
+        ReleaseTarget::X86_64AppleDarwin,
+        "should retain supported CPU mapping"
+    );
+    assert_eq!(
+        encoded(&requirements)["runtime"]["cpu"],
+        "x86_64",
+        "should retain inspected CPU"
+    );
+}
+
+#[test]
+fn changed_accepted_bytes_produce_different_artifact_bindings() {
+    let mut spec = ElfSpec::conforming();
+    let original = inspect_elf(&elf(&spec), &ElfPolicy::linux_x86_64_gnu())
+        .expect("should accept original ELF");
+    spec.payload = b"different fictional payload";
+    let changed = inspect_elf(&elf(&spec), &ElfPolicy::linux_x86_64_gnu())
+        .expect("should accept changed ELF");
+    assert_ne!(
+        ExternalRequirements::from_elf(&original).artifact_sha256(),
+        ExternalRequirements::from_elf(&changed).artifact_sha256(),
+        "should bind final bytes rather than only equal loader requirements"
+    );
+}
diff --git a/crates/trusted-server-release/src/composition/graph.rs b/crates/trusted-server-release/src/composition/graph.rs
new file mode 100644
index 0000000000..6f8b11c0b4
--- /dev/null
+++ b/crates/trusted-server-release/src/composition/graph.rs
@@ -0,0 +1,413 @@
+//! Conservative package graph checks; compiler observations retain unit authority.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use error_stack::Report;
+use serde::Serialize;
+use serde_json::Value;
+
+use super::{
+    CargoObservations, MAX_PACKAGES, UnitContext, array, composition_error, package, strings, text,
+};
+use crate::documents::{Role, parse_json};
+use crate::error::ReleaseError;
+
+// A non-deduplicated tree repeats package paths far more often than compilation
+// emits units. Keep this independent of the compiler-message count limit.
+const MAX_TREE_OCCURRENCES: usize = 1_048_576;
+
+/// Reconciled package membership, without claiming a compiler unit dependency DAG.
+#[derive(Debug, Serialize)]
+pub(crate) struct GraphEvidence {
+    selected_package_id: String,
+    tree_package_ids: Vec<String>,
+    observed_package_ids: Vec<String>,
+    edges: Vec<GraphEdge>,
+}
+
+/// A potential metadata dependency edge, without compiled-unit authority.
+#[derive(Debug, Serialize)]
+pub(crate) struct GraphEdge {
+    parent: String,
+    dependency: String,
+    kinds: Vec<String>,
+}
+
+impl GraphEvidence {
+    /// Returns the exact selected binary's Cargo package identity.
+    pub(crate) fn selected_package_id(&self) -> &str {
+        &self.selected_package_id
+    }
+
+    /// Returns potential package membership from the reconciled Cargo tree.
+    pub(crate) fn tree_package_ids(&self) -> &[String] {
+        &self.tree_package_ids
+    }
+
+    /// Returns package membership proved by actual compiler messages.
+    pub(crate) fn observed_package_ids(&self) -> &[String] {
+        &self.observed_package_ids
+    }
+
+    /// Returns potential metadata edges, without claiming a compiled unit DAG.
+    pub(crate) fn potential_edges(&self) -> &[GraphEdge] {
+        &self.edges
+    }
+}
+
+impl GraphEdge {
+    /// Returns the exact potential parent package identity.
+    pub(crate) fn parent(&self) -> &str {
+        &self.parent
+    }
+
+    /// Returns the exact potential dependency package identity.
+    pub(crate) fn dependency(&self) -> &str {
+        &self.dependency
+    }
+
+    /// Returns declared dependency kinds without inferring embedded membership.
+    pub(crate) fn kinds(&self) -> &[String] {
+        &self.kinds
+    }
+}
+
+type Edges<'a> = BTreeMap<(&'a str, &'a str), BTreeSet<&'a str>>;
+type IdentityIndex<'a> = BTreeMap<(&'a str, &'a str), Vec<&'a str>>;
+
+struct ResolvedGraph<'a> {
+    nodes: BTreeSet<&'a str>,
+    edges: Edges<'a>,
+}
+
+fn metadata_edges<'a>(
+    metadata: &'a Value,
+    catalog: &BTreeMap<&str, &Value>,
+) -> Result<ResolvedGraph<'a>, Report<ReleaseError>> {
+    let nodes = array(&metadata["resolve"]["nodes"], "resolve nodes")?;
+    if nodes.len() > MAX_PACKAGES {
+        return Err(composition_error("too many resolve nodes"));
+    }
+    let mut node_ids = BTreeSet::new();
+    let mut edges = BTreeMap::new();
+    for node in nodes {
+        let id = text(&node["id"], "resolve node ID")?;
+        if !catalog.contains_key(id) || !node_ids.insert(id) {
+            return Err(composition_error("unknown or duplicate resolve node"));
+        }
+        let dependencies = strings(&node["dependencies"], "resolve dependencies", true)?
+            .into_iter()
+            .collect::<BTreeSet<_>>();
+        let mut endpoints = BTreeSet::new();
+        for dep in array(&node["deps"], "resolve dependency edges")? {
+            text(&dep["name"], "resolve dependency name")?;
+            let endpoint = text(&dep["pkg"], "resolve dependency package")?;
+            if !catalog.contains_key(endpoint) {
+                return Err(composition_error(
+                    "resolve edge has unknown package endpoint",
+                ));
+            }
+            endpoints.insert(endpoint.to_owned());
+            let kinds = array(&dep["dep_kinds"], "dependency kinds")?;
+            if kinds.is_empty() {
+                return Err(composition_error("resolve dependency has no kinds"));
+            }
+            let edge = edges.entry((id, endpoint)).or_insert_with(BTreeSet::new);
+            for kind in kinds {
+                match kind.get("target") {
+                    Some(Value::Null) => {}
+                    Some(target) => {
+                        text(target, "dependency target condition")?;
+                    }
+                    None => {
+                        return Err(composition_error("dependency kind lacks target condition"));
+                    }
+                }
+                let kind = match kind.get("kind") {
+                    Some(Value::Null) => "normal",
+                    Some(Value::String(kind)) if matches!(kind.as_str(), "build" | "dev") => {
+                        kind.as_str()
+                    }
+                    _ => return Err(composition_error("unknown dependency kind")),
+                };
+                edge.insert(kind);
+            }
+        }
+        if endpoints != dependencies {
+            return Err(composition_error(
+                "resolve dependency endpoint lists disagree",
+            ));
+        }
+    }
+    if edges
+        .keys()
+        .any(|(_, dependency)| !node_ids.contains(dependency))
+    {
+        return Err(composition_error("resolve dependency has no node"));
+    }
+    Ok(ResolvedGraph {
+        nodes: node_ids,
+        edges,
+    })
+}
+
+fn tree_identity<'a>(
+    display: &str,
+    catalog: &BTreeMap<&'a str, &Value>,
+    identities: &IdentityIndex<'a>,
+) -> Result<&'a str, Report<ReleaseError>> {
+    if display.ends_with(" (*)") {
+        return Err(composition_error("tree contains a deduplicated subtree"));
+    }
+    let (name, rest) = display
+        .split_once(" v")
+        .ok_or_else(|| composition_error("tree package lacks name/version"))?;
+    let (version, presentation) = rest.split_once(' ').unwrap_or((rest, ""));
+    let candidates = identities
+        .get(&(name, version))
+        .map(Vec::as_slice)
+        .unwrap_or_default();
+    let [id] = candidates else {
+        return Err(composition_error(
+            "tree package has no unique catalog identity",
+        ));
+    };
+    let candidate = catalog[id];
+    if candidate["source"].is_null() {
+        let manifest = package(candidate)?.manifest_path;
+        let parent = manifest
+            .parent()
+            .ok_or_else(|| composition_error("tree path package has no manifest parent"))?;
+        if presentation != format!("({})", parent.display()) {
+            return Err(composition_error(
+                "tree path presentation differs from metadata manifest",
+            ));
+        }
+    } else if !(presentation.is_empty()
+        || presentation.starts_with('(') && presentation.ends_with(')'))
+    {
+        return Err(composition_error("tree source presentation is malformed"));
+    }
+    Ok(id)
+}
+
+fn contexts(parent: &[UnitContext], kinds: &BTreeSet<&str>, proc_macro: bool) -> Vec<UnitContext> {
+    let mut result = Vec::new();
+    for context in parent {
+        for kind in kinds {
+            let context = if *kind == "build" || proc_macro {
+                UnitContext::Host
+            } else {
+                *context
+            };
+            if *kind != "dev" && !result.contains(&context) {
+                result.push(context);
+            }
+        }
+    }
+    result
+}
+
+/// Reconciles explicit-target tree edges with the catalog and actual compilation.
+///
+/// # Errors
+///
+/// Rejects ambiguous package joins, invalid tree/metadata edges, and observations
+/// without selected normal/build graph reachability in their compiler context.
+pub(crate) fn reconcile(
+    metadata: &[u8],
+    tree: &[u8],
+    observed: &CargoObservations,
+    selected_package_id: &str,
+) -> Result<GraphEvidence, Report<ReleaseError>> {
+    let metadata = parse_json(metadata, Role::CargoObservation)
+        .map_err(|error| error.change_context(ReleaseError::Composition))?;
+    if metadata["version"].as_u64() != Some(1) {
+        return Err(composition_error("unsupported metadata version"));
+    }
+    let packages = array(&metadata["packages"], "metadata packages")?;
+    if packages.len() > MAX_PACKAGES {
+        return Err(composition_error("too many metadata packages"));
+    }
+    let mut catalog = BTreeMap::new();
+    let mut identities = IdentityIndex::new();
+    for value in packages {
+        let id = text(&value["id"], "catalog package ID")?;
+        package(value)?;
+        if catalog.insert(id, value).is_some() {
+            return Err(composition_error("duplicate catalog package ID"));
+        }
+        identities
+            .entry((
+                text(&value["name"], "catalog package name")?,
+                text(&value["version"], "catalog package version")?,
+            ))
+            .or_default()
+            .push(id);
+    }
+    let metadata_edges = metadata_edges(&metadata, &catalog)?;
+    if !catalog.contains_key(selected_package_id) {
+        return Err(composition_error("selected package is absent from catalog"));
+    }
+    if tree.is_empty() || tree.len() > 16 * 1024 * 1024 || !tree.ends_with(b"\n") {
+        return Err(composition_error(
+            "tree is not bounded newline-terminated text",
+        ));
+    }
+    let tree = std::str::from_utf8(tree).map_err(composition_error)?;
+    let mut stack: Vec<(&str, Vec<UnitContext>)> = Vec::new();
+    let mut reachable: BTreeMap<&str, Vec<UnitContext>> = BTreeMap::new();
+    let mut selected_edges = BTreeMap::new();
+    for (line_index, line) in tree.lines().enumerate() {
+        if line_index >= MAX_TREE_OCCURRENCES
+            || line.len() > 16_384
+            || line.chars().any(char::is_control)
+        {
+            return Err(composition_error("tree line violates bounds"));
+        }
+        let prefix = line.bytes().take_while(u8::is_ascii_digit).count();
+        let depth = line[..prefix].parse::<usize>().map_err(composition_error)?;
+        if depth > stack.len() || (line_index != 0 && depth == 0) || (line_index == 0 && depth != 0)
+        {
+            return Err(composition_error(
+                "tree depth does not describe one selected root",
+            ));
+        }
+        let id = tree_identity(&line[prefix..], &catalog, &identities)?;
+        if !metadata_edges.nodes.contains(id) {
+            return Err(composition_error("tree package has no resolve node"));
+        }
+        stack.truncate(depth);
+        if stack.iter().any(|(ancestor, _)| *ancestor == id) {
+            return Err(composition_error("tree dependency cycle"));
+        }
+        let unit_contexts = if let Some((parent, parent_contexts)) = stack.last() {
+            let kinds = metadata_edges
+                .edges
+                .get(&(*parent, id))
+                .ok_or_else(|| composition_error("tree edge is absent from metadata resolve"))?;
+            let kinds = kinds
+                .iter()
+                .copied()
+                .filter(|kind| *kind != "dev")
+                .collect::<BTreeSet<_>>();
+            if kinds.is_empty() {
+                return Err(composition_error("tree edge is dev-only"));
+            }
+            let proc_macro = array(&catalog[id]["targets"], "package targets")?
+                .iter()
+                .any(|target| {
+                    target["kind"].as_array().is_some_and(|kinds| {
+                        kinds.iter().any(|kind| kind.as_str() == Some("proc-macro"))
+                    })
+                });
+            selected_edges.insert((*parent, id), kinds.clone());
+            contexts(parent_contexts, &kinds, proc_macro)
+        } else {
+            if id != selected_package_id {
+                return Err(composition_error("tree root differs from selected package"));
+            }
+            vec![UnitContext::Target]
+        };
+        let all = reachable.entry(id).or_default();
+        for context in &unit_contexts {
+            if !all.contains(context) {
+                all.push(*context);
+            }
+        }
+        stack.push((id, unit_contexts));
+    }
+    let mut observed_ids = BTreeSet::new();
+    for package in &observed.packages {
+        if !reachable.contains_key(package.id.as_str()) || !observed_ids.insert(package.id.as_str())
+        {
+            return Err(composition_error(
+                "compiled package lacks unique selected tree membership",
+            ));
+        }
+    }
+    let mut compiled_ids = BTreeSet::new();
+    let mut custom_build_ids = BTreeSet::new();
+    let mut consumer_contexts = BTreeSet::new();
+    let mut binaries = 0;
+    for unit in &observed.units {
+        let contexts = reachable
+            .get(unit.package_id.as_str())
+            .ok_or_else(|| composition_error("compiler unit is absent from selected tree"))?;
+        if !observed_ids.contains(unit.package_id.as_str()) {
+            return Err(composition_error("compiler unit has no observed package"));
+        }
+        let custom_build = unit.target_kind.iter().any(|kind| kind == "custom-build");
+        if custom_build {
+            custom_build_ids.insert(unit.package_id.as_str());
+        } else {
+            consumer_contexts.insert((
+                unit.package_id.as_str(),
+                unit.context == UnitContext::Target,
+            ));
+        }
+        if (custom_build && unit.context != UnitContext::Host)
+            || (!custom_build && !contexts.contains(&unit.context))
+        {
+            return Err(composition_error(
+                "compiler context is unreachable through normal/build graph",
+            ));
+        }
+        if unit.target_kind.iter().any(|kind| kind == "bin") {
+            binaries += 1;
+            if unit.package_id != selected_package_id || unit.context != UnitContext::Target {
+                return Err(composition_error(
+                    "compiler binary is outside selected target package",
+                ));
+            }
+        }
+        compiled_ids.insert(unit.package_id.as_str());
+    }
+    if binaries != 1 || compiled_ids != observed_ids {
+        return Err(composition_error(
+            "observed membership differs from compiled selected binary graph",
+        ));
+    }
+    let executed_ids: BTreeSet<_> = observed
+        .build_scripts
+        .iter()
+        .map(|script| script.package_id.as_str())
+        .collect();
+    if executed_ids != custom_build_ids {
+        return Err(composition_error(
+            "compiled build scripts differ from observed executions",
+        ));
+    }
+    let executed_contexts: BTreeSet<_> = observed
+        .build_scripts
+        .iter()
+        .map(|script| {
+            (
+                script.package_id.as_str(),
+                script.context == UnitContext::Target,
+            )
+        })
+        .collect();
+    consumer_contexts.retain(|(id, _)| custom_build_ids.contains(id));
+    if executed_contexts != consumer_contexts {
+        return Err(composition_error(
+            "build-script execution contexts differ from observed consumers",
+        ));
+    }
+    Ok(GraphEvidence {
+        selected_package_id: selected_package_id.to_owned(),
+        tree_package_ids: reachable.keys().map(|id| (*id).to_owned()).collect(),
+        observed_package_ids: observed_ids.into_iter().map(str::to_owned).collect(),
+        edges: selected_edges
+            .into_iter()
+            .map(|((parent, dependency), kinds)| GraphEdge {
+                parent: parent.to_owned(),
+                dependency: dependency.to_owned(),
+                kinds: kinds.into_iter().map(str::to_owned).collect(),
+            })
+            .collect(),
+    })
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/trusted-server-release/src/composition/graph/tests.rs b/crates/trusted-server-release/src/composition/graph/tests.rs
new file mode 100644
index 0000000000..48be302d81
--- /dev/null
+++ b/crates/trusted-server-release/src/composition/graph/tests.rs
@@ -0,0 +1,492 @@
+use std::path::PathBuf;
+
+use serde_json::{Value, json};
+
+use super::*;
+use crate::composition::{CargoLayout, UnitContext, observe_cargo};
+use crate::policy::ReleaseTarget;
+
+const METADATA: &[u8] =
+    include_bytes!("../../../tests/fixtures/composition/cargo-1.95-cross-host-metadata.json");
+const TREE: &[u8] = include_bytes!("../../../tests/fixtures/composition/cargo-1.95-cross-tree.txt");
+const MESSAGES: &[u8] =
+    include_bytes!("../../../tests/fixtures/composition/cargo-1.95-cross-messages.jsonl");
+const ROOT: &str = "path+file:///build/source/app#example-app@0.1.0";
+
+fn observed() -> CargoObservations {
+    let layout = CargoLayout::new(
+        ReleaseTarget::Wasm32Wasip1,
+        PathBuf::from("/build/target"),
+        PathBuf::from("/build/source"),
+    )
+    .expect("should accept fixture layout");
+    observe_cargo(METADATA, MESSAGES, &layout).expect("should observe actual compiler units")
+}
+
+#[test]
+fn compiled_build_script_requires_its_execution_observation() {
+    let mut messages = std::str::from_utf8(MESSAGES)
+        .expect("should read actual Cargo fixture")
+        .lines()
+        .filter(|line| {
+            let message: Value = serde_json::from_str(line).expect("should parse Cargo message");
+            message["reason"] != "build-script-executed"
+        })
+        .collect::<Vec<_>>()
+        .join("\n");
+    messages.push('\n');
+    let layout = CargoLayout::new(
+        ReleaseTarget::Wasm32Wasip1,
+        PathBuf::from("/build/target"),
+        PathBuf::from("/build/source"),
+    )
+    .expect("should accept fixture layout");
+    let observed = observe_cargo(METADATA, messages.as_bytes(), &layout)
+        .expect("should parse the remaining compiler observations");
+    assert!(
+        reconcile(METADATA, TREE, &observed, ROOT).is_err(),
+        "should not seal a graph that loses build-script cfg, environment and link evidence"
+    );
+}
+
+#[test]
+fn build_script_execution_requires_a_matching_consumer_context() {
+    let messages = std::str::from_utf8(MESSAGES)
+        .expect("should read Cargo messages")
+        .replace(
+            "/build/target/wasm32-wasip1/release/build/example-app-f1024798a111146f/out",
+            "/build/target/release/build/example-app-f1024798a111146f/out",
+        );
+    let layout = CargoLayout::new(
+        ReleaseTarget::Wasm32Wasip1,
+        PathBuf::from("/build/target"),
+        PathBuf::from("/build/source"),
+    )
+    .expect("should accept fixture layout");
+    let observed = observe_cargo(METADATA, messages.as_bytes(), &layout)
+        .expect("should parse host-context script execution");
+    assert!(
+        reconcile(METADATA, TREE, &observed, ROOT).is_err(),
+        "should reject a host execution when only a target consumer was observed"
+    );
+}
+
+#[test]
+fn dual_role_build_scripts_require_execution_evidence_for_each_consumer_context() {
+    let helper = "path+file:///build/source/host-helper#example-host-helper@0.1.0";
+    let mut metadata: Value =
+        serde_json::from_slice(METADATA).expect("should parse fixture metadata");
+    metadata["resolve"]["nodes"][0]["deps"][0]["dep_kinds"]
+        .as_array_mut()
+        .expect("should hold dependency kinds")
+        .push(json!({"kind":null,"target":null}));
+    let metadata = serde_json::to_vec(&metadata).expect("should encode dual-role metadata");
+    let mut observations = observed();
+    let script_index = observations
+        .units
+        .iter()
+        .position(|unit| unit.target_kind.iter().any(|kind| kind == "custom-build"))
+        .expect("should contain script compilation");
+    let mut script_unit = observed().units.remove(script_index);
+    script_unit.package_id = helper.to_owned();
+    observations.units.push(script_unit);
+    let helper_execution = |context, out_dir| {
+        let mut execution = observed().build_scripts.remove(0);
+        execution.package_id = helper.to_owned();
+        execution.context = context;
+        execution.out_dir = PathBuf::from(out_dir);
+        execution
+    };
+    let execution = helper_execution(
+        UnitContext::Host,
+        "/build/target/release/build/example-helper/out",
+    );
+    observations.build_scripts.push(execution);
+    reconcile(&metadata, TREE, &observations, ROOT)
+        .expect("should accept matching host-only script and consumer");
+
+    let helper_index = observations
+        .units
+        .iter()
+        .position(|unit| unit.package_id == helper && unit.target_kind == ["lib"])
+        .expect("should contain host helper consumer");
+    let mut target_unit = observed().units.remove(helper_index);
+    target_unit.context = UnitContext::Target;
+    target_unit.features = vec!["target-feature".to_owned()];
+    observations.units.push(target_unit);
+    assert!(
+        reconcile(&metadata, TREE, &observations, ROOT).is_err(),
+        "should reject missing execution evidence for the second consuming context"
+    );
+
+    observations.build_scripts.push(helper_execution(
+        UnitContext::Target,
+        "/build/target/wasm32-wasip1/release/build/example-helper/out",
+    ));
+    reconcile(&metadata, TREE, &observations, ROOT)
+        .expect("should accept separate host and target executions without merging features");
+    observations.build_scripts.push(helper_execution(
+        UnitContext::Target,
+        "/build/target/wasm32-wasip1/release/build/example-helper-other/out",
+    ));
+    reconcile(&metadata, TREE, &observations, ROOT)
+        .expect("should allow distinct executions within the same consuming context");
+}
+
+#[test]
+fn actual_cross_build_preserves_host_only_dependencies_and_observed_units() {
+    let observed = observed();
+    let graph = reconcile(METADATA, TREE, &observed, ROOT)
+        .expect("should reconcile actual cross-build graph");
+    assert_eq!(
+        graph.observed_package_ids().len(),
+        3,
+        "should retain observed membership"
+    );
+    assert_eq!(
+        graph.potential_edges().len(),
+        2,
+        "should retain potential package edges"
+    );
+    assert_eq!(
+        graph.potential_edges()[0].kinds(),
+        ["build"],
+        "should record build dependency transition"
+    );
+    assert!(
+        observed
+            .units
+            .iter()
+            .any(|unit| unit.context == UnitContext::Host
+                && unit.package_id.contains("example-host-unix")),
+        "should preserve observed host-only unit"
+    );
+}
+
+#[test]
+fn invalid_tree_structure_and_missing_observed_membership_are_rejected() {
+    for tree in [b"".as_slice(), b"0example-app v0.1.0 (/build/source/app)", b"1example-app v0.1.0 (/build/source/app)\n", b"0example-app v0.1.0 (/build/source/app)\n2example-host-helper v0.1.0 (/build/source/host-helper)\n", b"0example-app v0.1.0 (/build/source/app)\n", b"0example-app v0.1.0 (/wrong)\n", b"0example-app v0.1.0 (/build/source/app)\n0example-app v0.1.0 (/build/source/app)\n"] {
+        assert!(reconcile(METADATA, tree, &observed(), ROOT).is_err(), "should reject invalid tree or missing compiled nodes");
+    }
+}
+
+#[test]
+fn unknown_duplicate_and_dev_only_metadata_edges_are_rejected() {
+    for case in [
+        "unknown-node",
+        "duplicate-node",
+        "unknown-endpoint",
+        "missing-edge",
+        "dev-only",
+        "ambiguous-source",
+        "dependencies-disagree",
+    ] {
+        let mut meta: Value =
+            serde_json::from_slice(METADATA).expect("should parse fixture metadata");
+        match case {
+            "unknown-node" => meta["resolve"]["nodes"][0]["id"] = json!("unknown"),
+            "duplicate-node" => {
+                let duplicate = meta["resolve"]["nodes"][0].clone();
+                meta["resolve"]["nodes"]
+                    .as_array_mut()
+                    .expect("should hold nodes")
+                    .push(duplicate);
+            }
+            "unknown-endpoint" => meta["resolve"]["nodes"][0]["deps"][0]["pkg"] = json!("unknown"),
+            "missing-edge" => {
+                meta["resolve"]["nodes"][0]["deps"] = json!([]);
+                meta["resolve"]["nodes"][0]["dependencies"] = json!([]);
+            }
+            "dev-only" => {
+                meta["resolve"]["nodes"][0]["deps"][0]["dep_kinds"][0]["kind"] = json!("dev")
+            }
+            "ambiguous-source" => {
+                let mut duplicate = meta["packages"][0].clone();
+                duplicate["id"] = json!("opaque-other-source");
+                duplicate["source"] = json!("registry+https://example.com/index");
+                meta["packages"]
+                    .as_array_mut()
+                    .expect("should hold packages")
+                    .push(duplicate);
+            }
+            "dependencies-disagree" => meta["resolve"]["nodes"][0]["dependencies"] = json!([]),
+            _ => unreachable!(),
+        }
+        let bytes = serde_json::to_vec(&meta).expect("should encode changed metadata");
+        assert!(
+            reconcile(&bytes, TREE, &observed(), ROOT).is_err(),
+            "should reject {case}"
+        );
+    }
+}
+
+#[test]
+fn ordinary_compiler_units_need_reachable_host_or_target_context() {
+    let mut observed = observed();
+    let host = observed
+        .units
+        .iter_mut()
+        .find(|unit| unit.package_id.contains("example-host-unix"))
+        .expect("should contain host dependency");
+    host.context = UnitContext::Target;
+    assert!(
+        reconcile(METADATA, TREE, &observed, ROOT).is_err(),
+        "should reject target unit reachable only through build dependency"
+    );
+}
+
+#[test]
+fn tree_only_packages_never_create_compiler_membership() {
+    let mut observed = observed();
+    observed.packages.retain(|package| package.id == ROOT);
+    observed.units.retain(|unit| unit.package_id == ROOT);
+    let graph = reconcile(METADATA, TREE, &observed, ROOT)
+        .expect("should retain potential graph without inventing units");
+    assert_eq!(
+        graph.tree_package_ids.len(),
+        3,
+        "should retain potential graph"
+    );
+    assert_eq!(
+        graph.observed_package_ids,
+        [ROOT],
+        "should retain only actual compiler membership"
+    );
+}
+
+#[test]
+fn catalog_dev_only_entries_never_create_contributors() {
+    let mut meta: Value = serde_json::from_slice(METADATA).expect("should parse fixture metadata");
+    let mut dev = meta["packages"][1].clone();
+    dev["id"] = json!("opaque-dev-only");
+    dev["name"] = json!("example-dev-only");
+    meta["packages"]
+        .as_array_mut()
+        .expect("should hold packages")
+        .push(dev);
+    meta["resolve"]["nodes"]
+        .as_array_mut()
+        .expect("should hold nodes")
+        .push(json!({"id":"opaque-dev-only", "dependencies":[], "deps":[], "features":["unused"]}));
+    meta["resolve"]["nodes"][0]["dependencies"]
+        .as_array_mut()
+        .expect("should hold dependencies")
+        .push(json!("opaque-dev-only"));
+    meta["resolve"]["nodes"][0]["deps"].as_array_mut().expect("should hold edges").push(json!({"name":"example_dev_only", "pkg":"opaque-dev-only", "dep_kinds":[{"kind":"dev", "target":null}]}));
+    let graph = reconcile(
+        &serde_json::to_vec(&meta).expect("should encode metadata"),
+        TREE,
+        &observed(),
+        ROOT,
+    )
+    .expect("should exclude uncompiled dev dependency");
+    assert!(
+        !graph
+            .tree_package_ids
+            .iter()
+            .any(|id| id == "opaque-dev-only"),
+        "should not treat catalog as observed graph"
+    );
+}
+
+#[test]
+fn disconnected_compiler_membership_is_rejected() {
+    let mut observed = observed();
+    observed.packages[0].id = "opaque-extra-compiler-package".to_owned();
+    assert!(
+        reconcile(METADATA, TREE, &observed, ROOT).is_err(),
+        "should reject unjoined compiled package identity"
+    );
+}
+
+#[test]
+fn unused_ambiguous_catalog_names_do_not_reject_selected_tree() {
+    let mut metadata: Value =
+        serde_json::from_slice(METADATA).expect("should parse fixture metadata");
+    for id in ["opaque-unused-source-a", "opaque-unused-source-b"] {
+        let mut package = metadata["packages"][0].clone();
+        package["name"] = json!("example-unused");
+        package["id"] = json!(id);
+        metadata["packages"]
+            .as_array_mut()
+            .expect("should hold packages")
+            .push(package);
+    }
+    reconcile(
+        &serde_json::to_vec(&metadata).expect("should encode catalog"),
+        TREE,
+        &observed(),
+        ROOT,
+    )
+    .expect("should reject ambiguous identities only when tree membership uses them");
+}
+
+#[test]
+fn dual_role_packages_keep_compiler_features_and_both_contexts() {
+    let mut meta: Value = serde_json::from_slice(METADATA).expect("should parse fixture metadata");
+    meta["resolve"]["nodes"][0]["deps"][0]["dep_kinds"]
+        .as_array_mut()
+        .expect("should hold dependency kinds")
+        .push(json!({"kind":null,"target":null}));
+    meta["resolve"]["nodes"][1]["features"] = json!(["unused-package-union"]);
+    let mut messages: Vec<Value> = std::str::from_utf8(MESSAGES)
+        .expect("should hold JSONL")
+        .lines()
+        .map(|line| serde_json::from_str(line).expect("should parse compiler message"))
+        .collect();
+    let mut target_unit = messages
+        .iter()
+        .find(|message| {
+            message["reason"] == "compiler-artifact"
+                && message["package_id"]
+                    .as_str()
+                    .is_some_and(|id| id.contains("example-host-helper"))
+        })
+        .expect("should contain helper compilation")
+        .clone();
+    target_unit["filenames"] =
+        json!(["/build/target/wasm32-wasip1/release/deps/libexample_host_helper.rlib"]);
+    target_unit["features"] = json!(["target-feature"]);
+    messages.insert(0, target_unit);
+    let stdout: Vec<u8> = messages
+        .iter()
+        .flat_map(|message| {
+            let mut bytes = serde_json::to_vec(message).expect("should encode message");
+            bytes.push(b'\n');
+            bytes
+        })
+        .collect();
+    let layout = CargoLayout::new(
+        ReleaseTarget::Wasm32Wasip1,
+        PathBuf::from("/build/target"),
+        PathBuf::from("/build/source"),
+    )
+    .expect("should accept fixture layout");
+    let metadata = serde_json::to_vec(&meta).expect("should encode metadata");
+    let observed =
+        observe_cargo(&metadata, &stdout, &layout).expect("should observe dual-role compilation");
+    reconcile(&metadata, TREE, &observed, ROOT)
+        .expect("should reconcile both contexts without fabricating a unit DAG");
+    assert!(
+        observed
+            .units
+            .iter()
+            .any(|unit| unit.features == ["target-feature"] && unit.context == UnitContext::Target),
+        "should preserve effective target features"
+    );
+    assert!(
+        !observed.units.iter().any(|unit| unit
+            .features
+            .iter()
+            .any(|feature| feature == "unused-package-union")),
+        "should never substitute package union features"
+    );
+}
+
+#[test]
+fn proc_macro_normal_dependency_switches_its_dependencies_to_host() {
+    let mut meta: Value = serde_json::from_slice(METADATA).expect("should parse fixture metadata");
+    meta["resolve"]["nodes"][0]["deps"][0]["dep_kinds"][0]["kind"] = Value::Null;
+    meta["packages"][1]["targets"][0]["kind"] = json!(["proc-macro"]);
+    let mut observed = observed();
+    let helper = observed
+        .units
+        .iter_mut()
+        .find(|unit| unit.package_id.contains("example-host-helper"))
+        .expect("should contain helper compilation");
+    helper.target_kind = vec!["proc-macro".to_owned()];
+    reconcile(
+        &serde_json::to_vec(&meta).expect("should encode metadata"),
+        TREE,
+        &observed,
+        ROOT,
+    )
+    .expect("should retain host context below proc macro");
+}
+
+#[test]
+fn registry_deduplication_marker_is_not_a_source_presentation() {
+    let mut meta: Value = serde_json::from_slice(METADATA).expect("should parse fixture metadata");
+    meta["packages"][1]["source"] = json!("registry+https://example.com/index");
+    let tree = String::from_utf8(TREE.to_vec())
+        .expect("should hold tree text")
+        .replace("(/build/source/host-helper)", "(*)");
+    assert!(
+        reconcile(
+            &serde_json::to_vec(&meta).expect("should encode metadata"),
+            tree.as_bytes(),
+            &observed(),
+            ROOT
+        )
+        .is_err(),
+        "should require complete non-deduplicated tree"
+    );
+}
+
+#[test]
+fn selected_tree_root_requires_a_resolve_node() {
+    let mut meta: Value = serde_json::from_slice(METADATA).expect("should parse fixture metadata");
+    meta["resolve"]["nodes"] = json!([]);
+    let mut observed = observed();
+    observed.packages.retain(|package| package.id == ROOT);
+    observed.units.retain(|unit| unit.package_id == ROOT);
+    assert!(
+        reconcile(
+            &serde_json::to_vec(&meta).expect("should encode metadata"),
+            b"0example-app v0.1.0 (/build/source/app)\n",
+            &observed,
+            ROOT
+        )
+        .is_err(),
+        "should reject tree root without resolve node"
+    );
+}
+
+#[test]
+fn repeated_tree_occurrences_have_a_separate_bound_from_compiler_messages() {
+    let mut tree = TREE.to_vec();
+    for _ in 0..65_536 {
+        tree.extend_from_slice(b"1example-host-helper v0.1.0 (/build/source/host-helper)\n");
+    }
+    let graph = reconcile(METADATA, &tree, &observed(), ROOT)
+        .expect("should accept large non-deduplicated dependency trees");
+    assert_eq!(
+        graph.edges.len(),
+        2,
+        "should store unique package edges instead of repeated occurrences"
+    );
+}
+
+#[test]
+fn tree_occurrence_bound_is_enforced_independently_of_byte_bound() {
+    let mut metadata: Value =
+        serde_json::from_slice(METADATA).expect("should parse fixture metadata");
+    for (package, name) in metadata["packages"]
+        .as_array_mut()
+        .expect("should hold packages")
+        .iter_mut()
+        .zip(["a", "b", "c"])
+    {
+        package["name"] = json!(name);
+        package["version"] = json!("1");
+        package["source"] = json!("registry+https://example.com/index");
+    }
+    let mut tree = b"0a v1\n1b v1\n2c v1\n".to_vec();
+    for _ in 0..1_048_576 {
+        tree.extend_from_slice(b"1b v1\n");
+    }
+    assert!(
+        tree.len() < 16 * 1024 * 1024,
+        "should exercise occurrence bound before byte bound"
+    );
+    assert!(
+        reconcile(
+            &serde_json::to_vec(&metadata).expect("should encode compact metadata"),
+            &tree,
+            &observed(),
+            ROOT
+        )
+        .is_err(),
+        "should reject excessive tree occurrences"
+    );
+}
diff --git a/crates/trusted-server-release/src/composition/javascript.rs b/crates/trusted-server-release/src/composition/javascript.rs
new file mode 100644
index 0000000000..1b96648d93
--- /dev/null
+++ b/crates/trusted-server-release/src/composition/javascript.rs
@@ -0,0 +1,169 @@
+//! Conservative final-byte membership for verified uncompressed JS modules.
+
+use std::collections::BTreeSet;
+use std::fs;
+use std::path::Path;
+
+use error_stack::Report;
+use serde::Serialize;
+use sha2::{Digest as _, Sha256};
+
+use super::composition_error;
+use crate::documents::{Role, lower_hex, read_bounded};
+use crate::error::ReleaseError;
+use crate::javascript::RetainedJsModule;
+
+/// Selected fixed recipe's required final JS coverage.
+#[derive(Clone, Copy)]
+pub(crate) enum JsRetentionPolicy {
+    /// Fastly can serve each prepared module and must retain its complete bytes.
+    FastlyAll,
+    /// The operator CLI may discard modules it does not use.
+    ObserveCli,
+}
+
+/// Checked JS handoff inputs selected by the recipe.
+pub(crate) struct JsInputs<'a> {
+    /// Retained root owned by the successful two-build JS handoff.
+    pub(crate) retained_root: &'a Path,
+    /// Module facts exported from that rehashed owning handoff.
+    pub(crate) modules: &'a [RetainedJsModule],
+    /// Exact raw handoff inventory identity.
+    pub(crate) inventory_sha256: &'a str,
+    /// Required coverage of the fixed asset recipe.
+    pub(crate) policy: JsRetentionPolicy,
+}
+
+/// Per-artifact retained-module observations, without function reachability claims.
+#[derive(Debug, Serialize)]
+pub(crate) struct JsMembership {
+    artifact_sha256: String,
+    inventory_sha256: String,
+    modules: Vec<ModuleMembership>,
+    method: &'static str,
+}
+
+#[derive(Debug, Serialize)]
+struct ModuleMembership {
+    module: RetainedJsModule,
+    classification: &'static str,
+}
+
+/// Checks complete prepared modules against the exact inspected final bytes.
+///
+/// # Errors
+///
+/// Rejects changed modules, invalid bindings, incomplete module sets or a
+/// Fastly executable missing any required complete module.
+pub(crate) fn collect_js(
+    bytes: &[u8],
+    artifact_sha256: &str,
+    inputs: &JsInputs<'_>,
+) -> Result<JsMembership, Report<ReleaseError>> {
+    if bytes.is_empty()
+        || bytes.len() as u64 > Role::Executable.limit()
+        || !lower_hex(artifact_sha256, 64)
+        || !lower_hex(inputs.inventory_sha256, 64)
+        || hex::encode(Sha256::digest(bytes)) != artifact_sha256
+        || inputs.modules.is_empty()
+        || inputs.modules.len() > 1024
+    {
+        return Err(composition_error(
+            "invalid final executable or JS input binding",
+        ));
+    }
+    let bundles = inputs.retained_root.join("bundles");
+    for directory in [inputs.retained_root, bundles.as_path()] {
+        if fs::canonicalize(directory).map_err(composition_error)? != directory {
+            return Err(composition_error("retained JS directory is aliased"));
+        }
+    }
+    let inventory = read_bounded(
+        &inputs.retained_root.join("tsjs-inventory.json"),
+        Role::Metadata,
+    )
+    .map_err(|error| error.change_context(ReleaseError::Composition))?;
+    if inventory.sha256 != inputs.inventory_sha256 {
+        return Err(composition_error(
+            "retained JS inventory differs from the bound identity",
+        ));
+    }
+    let mut ids = BTreeSet::new();
+    let mut filenames = BTreeSet::new();
+    for module in inputs.modules {
+        if !ids.insert(module.id()) || !filenames.insert(module.filename()) {
+            return Err(composition_error("duplicate prepared JS module identity"));
+        }
+    }
+    let actual = fs::read_dir(&bundles)
+        .map_err(composition_error)?
+        .map(|entry| {
+            entry
+                .map_err(composition_error)?
+                .file_name()
+                .into_string()
+                .map_err(|_| composition_error("JS filename is not UTF-8"))
+        })
+        .collect::<Result<BTreeSet<_>, _>>()?;
+    if actual.iter().map(String::as_str).collect::<BTreeSet<_>>() != filenames {
+        return Err(composition_error(
+            "prepared JS file set differs from checked module facts",
+        ));
+    }
+    let mut modules = Vec::with_capacity(inputs.modules.len());
+    for module in inputs.modules {
+        let raw = read_bounded(&bundles.join(module.filename()), Role::Bundle)
+            .map_err(|error| error.change_context(ReleaseError::Composition))?;
+        if raw.bytes.is_empty()
+            || raw.sha256 != module.sha256()
+            || raw.bytes.len() as u64 != module.size()
+        {
+            return Err(composition_error(
+                "prepared JS module changed before final-byte inspection",
+            ));
+        }
+        let retained = bytes
+            .windows(raw.bytes.len())
+            .any(|window| window == raw.bytes);
+        if !retained && matches!(inputs.policy, JsRetentionPolicy::FastlyAll) {
+            return Err(composition_error(format!(
+                "Fastly executable omits complete module {}",
+                module.id()
+            )));
+        }
+        modules.push(ModuleMembership {
+            module: module.clone(),
+            classification: if retained {
+                "conservative_embedded_js"
+            } else {
+                "js_build_material"
+            },
+        });
+    }
+    Ok(JsMembership {
+        artifact_sha256: artifact_sha256.to_owned(),
+        inventory_sha256: inputs.inventory_sha256.to_owned(),
+        modules,
+        method: "complete-uncompressed-module-substring; no function reachability claim",
+    })
+}
+
+#[cfg(test)]
+mod tests;
+
+impl JsMembership {
+    /// Returns the exact inspected executable identity.
+    pub(crate) fn artifact_sha256(&self) -> &str {
+        &self.artifact_sha256
+    }
+    /// Returns the checked original collector inventory identity.
+    pub(crate) fn inventory_sha256(&self) -> &str {
+        &self.inventory_sha256
+    }
+    /// Returns every prepared module with final artifact classification.
+    pub(crate) fn modules(&self) -> impl Iterator<Item = (&RetainedJsModule, &str)> {
+        self.modules
+            .iter()
+            .map(|entry| (&entry.module, entry.classification))
+    }
+}
diff --git a/crates/trusted-server-release/src/composition/javascript/tests.rs b/crates/trusted-server-release/src/composition/javascript/tests.rs
new file mode 100644
index 0000000000..a16188c459
--- /dev/null
+++ b/crates/trusted-server-release/src/composition/javascript/tests.rs
@@ -0,0 +1,151 @@
+use std::fs;
+use std::os::unix::fs::symlink;
+
+use sha2::Sha256;
+
+use super::*;
+use crate::javascript::JsBuildCompleted;
+
+fn collect(bytes: &[u8], policy: JsRetentionPolicy) -> Result<JsMembership, Report<ReleaseError>> {
+    let completed = JsBuildCompleted::fixture_for_tests(&"a".repeat(40));
+    let modules = completed
+        .retained_modules()
+        .expect("should export rehashed module facts");
+    let root = fs::canonicalize(
+        completed
+            .rehash_for_handoff()
+            .expect("should retain checked handoff"),
+    )
+    .expect("should use recipe's canonical handoff path");
+    collect_js(
+        bytes,
+        &hex::encode(Sha256::digest(bytes)),
+        &JsInputs {
+            retained_root: &root,
+            modules: &modules,
+            inventory_sha256: completed.inventory_sha256(),
+            policy,
+        },
+    )
+}
+
+#[test]
+fn complete_module_bytes_are_conservative_embedded_contributors() {
+    let found = collect(
+        b"binary-prefix\0fictional module\0binary-suffix",
+        JsRetentionPolicy::FastlyAll,
+    )
+    .expect("should find the complete final module");
+    assert_eq!(
+        found.modules[0].classification, "conservative_embedded_js",
+        "should label retained bytes conservatively"
+    );
+    assert_eq!(
+        found.artifact_sha256,
+        hex::encode(Sha256::digest(
+            b"binary-prefix\0fictional module\0binary-suffix"
+        )),
+        "should bind exact final executable bytes"
+    );
+}
+
+#[test]
+fn absent_or_partial_cli_modules_remain_build_material() {
+    for bytes in [
+        b"operator binary".as_slice(),
+        b"fictional modul",
+        b"ictional module",
+        b"fictional modUle",
+    ] {
+        let absent = collect(bytes, JsRetentionPolicy::ObserveCli)
+            .expect("should record honestly absent module");
+        assert_eq!(
+            absent.modules[0].classification, "js_build_material",
+            "should not infer embedding from partial or changed bytes"
+        );
+        assert!(
+            collect(bytes, JsRetentionPolicy::FastlyAll).is_err(),
+            "should reject a Fastly artifact missing a complete prepared module"
+        );
+    }
+}
+
+#[test]
+fn final_js_membership_rejects_an_unrelated_inventory_identity() {
+    let completed = JsBuildCompleted::fixture_for_tests(&"a".repeat(40));
+    let modules = completed
+        .retained_modules()
+        .expect("should export checked module facts");
+    let root = fs::canonicalize(
+        completed
+            .rehash_for_handoff()
+            .expect("should retain handoff"),
+    )
+    .expect("should use canonical handoff root");
+    let bytes = b"fictional module";
+    let digest = hex::encode(Sha256::digest(bytes));
+    let mut inputs = JsInputs {
+        retained_root: &root,
+        modules: &modules,
+        inventory_sha256: &"b".repeat(64),
+        policy: JsRetentionPolicy::ObserveCli,
+    };
+    assert!(
+        collect_js(bytes, &digest, &inputs).is_err(),
+        "should reject a digest that does not identify the retained original inventory"
+    );
+    inputs.inventory_sha256 = completed.inventory_sha256();
+    collect_js(bytes, &digest, &inputs)
+        .expect("should accept the exact same bytes with their actual inventory binding");
+}
+
+#[test]
+fn changed_bundle_wrong_final_digest_duplicates_and_aliases_are_rejected() {
+    let completed = JsBuildCompleted::fixture_for_tests(&"a".repeat(40));
+    let modules = completed
+        .retained_modules()
+        .expect("should export checked facts");
+    let root = fs::canonicalize(
+        completed
+            .rehash_for_handoff()
+            .expect("should retain handoff"),
+    )
+    .expect("should use canonical handoff root");
+    let bytes = b"fictional module";
+    let digest = hex::encode(Sha256::digest(bytes));
+    let inputs = |modules| JsInputs {
+        retained_root: &root,
+        modules,
+        inventory_sha256: completed.inventory_sha256(),
+        policy: JsRetentionPolicy::ObserveCli,
+    };
+    assert!(
+        collect_js(bytes, &"b".repeat(64), &inputs(&modules)).is_err(),
+        "should reject a mismatched final byte identity"
+    );
+    assert!(
+        collect_js(bytes, &digest, &inputs(&[])).is_err(),
+        "should reject an omitted prepared module set"
+    );
+    let mut duplicates = modules.clone();
+    duplicates.push(modules[0].clone());
+    assert!(
+        collect_js(bytes, &digest, &inputs(&duplicates)).is_err(),
+        "should reject duplicated module identities"
+    );
+    let bundle = root.join("bundles/tsjs-core.js");
+    fs::write(&bundle, b"changed").expect("should change prepared module");
+    assert!(
+        collect_js(bytes, &digest, &inputs(&modules)).is_err(),
+        "should reject changed prepared module bytes"
+    );
+    fs::remove_file(&bundle).expect("should remove changed bundle");
+    let other = tempfile::tempdir().expect("should own external replacement");
+    fs::write(other.path().join("module.js"), bytes)
+        .expect("should write identical replacement bytes");
+    symlink(other.path().join("module.js"), &bundle).expect("should create final-file alias");
+    assert!(
+        collect_js(bytes, &digest, &inputs(&modules)).is_err(),
+        "should reject aliased prepared module"
+    );
+}
diff --git a/crates/trusted-server-release/src/composition/native.rs b/crates/trusted-server-release/src/composition/native.rs
new file mode 100644
index 0000000000..df23044a37
--- /dev/null
+++ b/crates/trusted-server-release/src/composition/native.rs
@@ -0,0 +1,682 @@
+//! Candidate native source and archive observations, without release authority.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::fs::{self, Metadata, OpenOptions};
+use std::io::Read as _;
+use std::os::unix::fs::{MetadataExt as _, OpenOptionsExt as _};
+use std::path::{Path, PathBuf};
+
+use error_stack::Report;
+use serde::Serialize;
+use sha2::{Digest as _, Sha256};
+
+use super::{
+    BuildScriptObservation, CargoObservations, RustPackage, UnitContext, composition_error,
+    normal_path,
+};
+use crate::documents::lower_hex;
+use crate::error::ReleaseError;
+use crate::policy::ReleaseTarget;
+use crate::tool_tree::tool_tree_digest;
+
+const ARCHIVE_LIMIT: u64 = 512 * 1024 * 1024;
+
+/// A source root supplied only by the verified exact-Cargo-ID origin join.
+pub(crate) struct NativeSource {
+    /// SHA-256 of the verified original registry distribution.
+    pub(crate) original_sha256: String,
+    /// Host path of the verified prepared package.
+    pub(crate) source_root: PathBuf,
+}
+
+/// Inputs selected by the recipe, rather than deserialized caller assertions.
+pub(crate) struct NativeInputs<'a> {
+    /// Exact observed Cargo package IDs joined to verified originals.
+    pub(crate) origins: &'a BTreeMap<String, NativeSource>,
+    /// Cargo target root as seen by the confined child.
+    pub(crate) execution_output_root: &'a Path,
+    /// The same Cargo target root in the host namespace.
+    pub(crate) host_output_root: &'a Path,
+    /// Fixed release target of the recipe.
+    pub(crate) target: ReleaseTarget,
+    /// Actual selected build environment, including anti-substitution controls.
+    pub(crate) environment: &'a BTreeMap<String, String>,
+    /// Owning attempt's cancellation/deadline check.
+    pub(crate) check: &'a dyn Fn() -> Result<(), Report<ReleaseError>>,
+}
+
+/// Candidate native measurements; never an attestation or qualification token.
+#[derive(Debug, Serialize)]
+pub(crate) struct NativeInventory {
+    contributors: Vec<NativeContributor>,
+    build_tool_package_ids: Vec<String>,
+    material_native_coverage_complete: bool,
+}
+
+#[derive(Debug, Serialize)]
+#[cfg_attr(test, derive(Clone))]
+pub(crate) struct NativeContributor {
+    package_id: String,
+    name: String,
+    version: String,
+    context: UnitContext,
+    features: Vec<String>,
+    classification: &'static str,
+    original_sha256: String,
+    source_tree_sha256: String,
+    source_subtrees: Vec<SourceSubtree>,
+    linked_libs: Vec<String>,
+    linked_paths: Vec<String>,
+    archives: Vec<NativeArchive>,
+    #[serde(skip)]
+    source_root: PathBuf,
+}
+
+#[derive(Debug, Serialize)]
+#[cfg_attr(test, derive(Clone))]
+pub(crate) struct SourceSubtree {
+    path: &'static str,
+    sha256: String,
+}
+
+#[derive(Debug, Serialize)]
+#[cfg_attr(test, derive(Clone))]
+pub(crate) struct NativeArchive {
+    path: PathBuf,
+    size: u64,
+    sha256: String,
+    #[serde(skip)]
+    host_path: PathBuf,
+    #[serde(skip)]
+    output_root: PathBuf,
+}
+
+/// Source-reviewed rules for the locked native implementations.
+struct ReviewedNative {
+    version: &'static str,
+    allowed_features: &'static [&'static str],
+    required_features: &'static [&'static str],
+    libraries: &'static [&'static str],
+    source_subtrees: &'static [&'static str],
+}
+
+fn reviewed(name: &str) -> Option<ReviewedNative> {
+    Some(match name {
+        "aws-lc-sys" => ReviewedNative {
+            version: "0.42.0",
+            // The locked Rust wrapper disables default bindings. Its NASM
+            // feature can select prebuilt objects only on Windows x86_64,
+            // outside the selected Linux and macOS build platforms.
+            allowed_features: &["all-bindings", "default", "prebuilt-nasm"],
+            required_features: &[],
+            libraries: &["aws_lc_0_42_0_crypto"],
+            source_subtrees: &["aws-lc"],
+        },
+        "ring" => ReviewedNative {
+            version: "0.17.14",
+            allowed_features: &["alloc", "default", "dev_urandom_fallback", "std"],
+            required_features: &["alloc"],
+            // The reviewed ring build script always builds and links its test
+            // archive, including for release builds. Neither archive's presence
+            // proves that every member survives final linking.
+            libraries: &["ring_core_0_17_14_", "ring_core_0_17_14__test"],
+            source_subtrees: &["crypto", "include", "pregenerated"],
+        },
+        "libsqlite3-sys" => ReviewedNative {
+            version: "0.38.2",
+            allowed_features: &[
+                "bundled",
+                "bundled_bindings",
+                "cc",
+                "default",
+                "min_sqlite_version_3_34_1",
+                "pkg-config",
+                "vcpkg",
+                "unlock_notify",
+            ],
+            required_features: &["bundled", "bundled_bindings", "cc"],
+            libraries: &["sqlite3"],
+            source_subtrees: &["sqlite3"],
+        },
+        _ => return None,
+    })
+}
+
+fn real_directory(path: &Path) -> Result<(), Report<ReleaseError>> {
+    normal_path(path)?;
+    let metadata = fs::symlink_metadata(path).map_err(composition_error)?;
+    let resolved = fs::canonicalize(path).map_err(composition_error)?;
+    if !metadata.is_dir() || resolved != path {
+        return Err(composition_error(
+            "native directory is aliased or not a directory",
+        ));
+    }
+    Ok(())
+}
+
+fn archive_parent(root: &Path, file: &Path) -> Result<(), Report<ReleaseError>> {
+    normal_path(file)?;
+    real_directory(root)?;
+    let parent = file
+        .parent()
+        .ok_or_else(|| composition_error("native archive has no parent"))?;
+    let relative = parent.strip_prefix(root).map_err(composition_error)?;
+    let mut current = root.to_owned();
+    for component in relative.components() {
+        current.push(component);
+        real_directory(&current)?;
+    }
+    Ok(())
+}
+
+fn same_archive(before: &Metadata, after: &Metadata) -> bool {
+    after.is_file()
+        && before.dev() == after.dev()
+        && before.ino() == after.ino()
+        && before.nlink() == after.nlink()
+        && before.len() == after.len()
+        && before.mode() == after.mode()
+        && before.mtime() == after.mtime()
+        && before.mtime_nsec() == after.mtime_nsec()
+        && before.ctime() == after.ctime()
+        && before.ctime_nsec() == after.ctime_nsec()
+}
+
+fn archive_digest(
+    root: &Path,
+    path: &Path,
+    check: &dyn Fn() -> Result<(), Report<ReleaseError>>,
+) -> Result<crate::documents::FileDigest, Report<ReleaseError>> {
+    archive_parent(root, path)?;
+    let mut file = OpenOptions::new()
+        .read(true)
+        .custom_flags(libc::O_NOFOLLOW | libc::O_NONBLOCK | libc::O_CLOEXEC)
+        .open(path)
+        .map_err(composition_error)?;
+    let before = file.metadata().map_err(composition_error)?;
+    if !before.is_file() || before.nlink() != 1 || before.len() > ARCHIVE_LIMIT {
+        return Err(composition_error(
+            "native archive is not a bounded regular single-link file",
+        ));
+    }
+    let mut magic = [0; 8];
+    file.read_exact(&mut magic).map_err(composition_error)?;
+    if &magic != b"!<arch>\n" {
+        return Err(composition_error("native output is not a regular archive"));
+    }
+    // Format and content identity must describe the same held descriptor.
+    let mut hash = Sha256::new();
+    hash.update(magic);
+    let mut size = magic.len() as u64;
+    let mut buffer = [0_u8; 64 * 1024];
+    loop {
+        check()?;
+        let count = file.read(&mut buffer).map_err(composition_error)?;
+        if count == 0 {
+            break;
+        }
+        size += count as u64;
+        if size > before.len() || size > ARCHIVE_LIMIT {
+            return Err(composition_error("native archive grows while hashing"));
+        }
+        hash.update(&buffer[..count]);
+    }
+    check()?;
+    if size != before.len()
+        || !same_archive(&before, &file.metadata().map_err(composition_error)?)
+        || !same_archive(
+            &before,
+            &fs::symlink_metadata(path).map_err(composition_error)?,
+        )
+    {
+        return Err(composition_error(
+            "native archive content, metadata or path changes while hashing",
+        ));
+    }
+    archive_parent(root, path)?;
+    Ok(crate::documents::FileDigest {
+        sha256: hex::encode(hash.finalize()),
+        size,
+        mode: before.mode(),
+    })
+}
+
+fn source_digest(
+    path: &Path,
+    check: &dyn Fn() -> Result<(), Report<ReleaseError>>,
+) -> Result<String, Report<ReleaseError>> {
+    real_directory(path)?;
+    let sha256 = tool_tree_digest(path, check)
+        .map_err(|error| error.change_context(ReleaseError::Composition))?;
+    real_directory(path)?;
+    Ok(sha256)
+}
+
+fn check_environment(name: &str, inputs: &NativeInputs<'_>) -> Result<(), Report<ReleaseError>> {
+    if name == "aws-lc-sys" {
+        let target_control = format!(
+            "AWS_LC_SYS_USE_SYSTEM_{}",
+            inputs.target.triple().replace('-', "_")
+        );
+        for control in ["AWS_LC_SYS_USE_SYSTEM", target_control.as_str()] {
+            if inputs.environment.get(control).map(String::as_str) != Some("0") {
+                return Err(composition_error(
+                    "AWS-LC system discovery is not explicitly disabled",
+                ));
+            }
+        }
+        if inputs.environment.iter().any(|(key, value)| {
+            key.starts_with("AWS_LC_SYS_")
+                && !(key.starts_with("AWS_LC_SYS_USE_SYSTEM") && value == "0")
+                && !(inputs.target == ReleaseTarget::X86_64UnknownLinuxGnu
+                    && matches!(
+                        key.as_str(),
+                        "AWS_LC_SYS_CMAKE_BUILDER"
+                            | "AWS_LC_SYS_CMAKE_BUILDER_x86_64_unknown_linux_gnu"
+                    )
+                    && value == "0")
+        }) {
+            return Err(composition_error(
+                "AWS-LC has an unreviewed environment selection",
+            ));
+        }
+    }
+    if name == "libsqlite3-sys" {
+        if inputs
+            .environment
+            .get("LIBSQLITE3_SYS_USE_PKG_CONFIG")
+            .map(String::as_str)
+            != Some("0")
+        {
+            return Err(composition_error(
+                "SQLite system discovery is not explicitly disabled",
+            ));
+        }
+        if inputs.environment.keys().any(|key| {
+            key.starts_with("SQLITE3_")
+                || key.starts_with("SQLCIPHER_")
+                || key.starts_with("LIBSQLITE3_") && key != "LIBSQLITE3_SYS_USE_PKG_CONFIG"
+        }) {
+            return Err(composition_error(
+                "SQLite has an unreviewed environment selection",
+            ));
+        }
+    }
+    Ok(())
+}
+
+fn features_for(
+    observations: &CargoObservations,
+    package: &RustPackage,
+    script: &BuildScriptObservation,
+    rule: &ReviewedNative,
+) -> Result<Vec<String>, Report<ReleaseError>> {
+    let mut matches = observations.units.iter().filter(|unit| {
+        unit.package_id == script.package_id
+            && unit.context == script.context
+            && !unit.target_kind.iter().any(|kind| kind == "custom-build")
+    });
+    let first = matches
+        .next()
+        .ok_or_else(|| composition_error("native script has no observed consuming unit"))?;
+    let conflicting = matches.any(|unit| unit.features != first.features);
+    let unreviewed = first
+        .features
+        .iter()
+        .any(|feature| !rule.allowed_features.contains(&feature.as_str()));
+    let missing = rule
+        .required_features
+        .iter()
+        .any(|feature| !first.features.iter().any(|actual| actual == feature));
+    if conflicting || unreviewed || missing {
+        let observed: Vec<String> = first
+            .features
+            .iter()
+            .take(16)
+            .map(|feature| feature.chars().take(96).collect())
+            .collect();
+        return Err(composition_error(format!(
+            "native package {}@{} {:?}: conflicting_units={conflicting}, unreviewed_features={unreviewed}, missing_required_features={missing}; observed={observed:?} ({} total); required={:?}; allowed={:?}",
+            package.name.chars().take(96).collect::<String>(),
+            package.version.chars().take(96).collect::<String>(),
+            script.context,
+            first.features.len(),
+            rule.required_features,
+            rule.allowed_features,
+        )));
+    }
+    Ok(first.features.clone())
+}
+
+fn search_paths(
+    script: &BuildScriptObservation,
+    inputs: &NativeInputs<'_>,
+) -> Result<Vec<(PathBuf, PathBuf)>, Report<ReleaseError>> {
+    let release = match script.context {
+        UnitContext::Host => inputs.execution_output_root.join("release"),
+        UnitContext::Target => inputs
+            .execution_output_root
+            .join(inputs.target.triple())
+            .join("release"),
+    };
+    normal_path(&script.out_dir)?;
+    let relative = script
+        .out_dir
+        .strip_prefix(release.join("build"))
+        .map_err(composition_error)?;
+    let components: Vec<_> = relative.components().collect();
+    if components.len() != 2 || components[1].as_os_str() != "out" {
+        return Err(composition_error(
+            "native OUT_DIR differs from the selected Cargo layout",
+        ));
+    }
+    let mut paths = BTreeMap::new();
+    for linked in &script.linked_paths {
+        let path = PathBuf::from(
+            linked
+                .strip_prefix("native=")
+                .ok_or_else(|| composition_error("unreviewed native search directive"))?,
+        );
+        normal_path(&path)?;
+        if !path.starts_with(&script.out_dir) {
+            return Err(composition_error(
+                "native search path escapes the observed OUT_DIR",
+            ));
+        }
+        let relative = path
+            .strip_prefix(inputs.execution_output_root)
+            .map_err(composition_error)?;
+        let host = inputs.host_output_root.join(relative);
+        real_directory(&host)?;
+        paths.insert(path, host);
+    }
+    if paths.is_empty() {
+        return Err(composition_error(
+            "native script has no observed archive search path",
+        ));
+    }
+    Ok(paths.into_iter().collect())
+}
+
+fn contributor(
+    observations: &CargoObservations,
+    package: &RustPackage,
+    script: &BuildScriptObservation,
+    inputs: &NativeInputs<'_>,
+) -> Result<NativeContributor, Report<ReleaseError>> {
+    let rule = reviewed(&package.name)
+        .ok_or_else(|| composition_error("unreviewed native package origin"))?;
+    if package.version != rule.version {
+        return Err(composition_error(
+            "native package version has not been reviewed",
+        ));
+    }
+    check_environment(&package.name, inputs)?;
+    let features = features_for(observations, package, script, &rule)?;
+    let source = inputs
+        .origins
+        .get(&package.id)
+        .ok_or_else(|| composition_error("native package has no verified exact-ID original"))?;
+    if !lower_hex(&source.original_sha256, 64) {
+        return Err(composition_error("native original has no SHA-256 identity"));
+    }
+    let expected: BTreeSet<_> = rule
+        .libraries
+        .iter()
+        .map(|name| format!("static={name}"))
+        .collect();
+    if script.linked_libs.iter().collect::<BTreeSet<_>>() != expected.iter().collect()
+        || script.linked_libs.len() != expected.len()
+    {
+        return Err(composition_error(
+            "native link directives differ from reviewed static archives",
+        ));
+    }
+    let searches = search_paths(script, inputs)?;
+    let mut archives = Vec::new();
+    for library in rule.libraries {
+        let filename = format!("lib{library}.a");
+        let mut candidates = Vec::new();
+        for (execution, host) in &searches {
+            let host_path = host.join(&filename);
+            match fs::symlink_metadata(&host_path) {
+                Ok(_) => candidates.push((execution.join(&filename), host_path)),
+                Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+                Err(error) => return Err(composition_error(error)),
+            }
+        }
+        let [(path, host_path)] = candidates.as_slice() else {
+            return Err(composition_error(
+                "native archive is missing or ambiguous across search paths",
+            ));
+        };
+        let identity = archive_digest(inputs.host_output_root, host_path, inputs.check)?;
+        archives.push(NativeArchive {
+            path: path.clone(),
+            size: identity.size,
+            sha256: identity.sha256,
+            host_path: host_path.clone(),
+            output_root: inputs.host_output_root.to_owned(),
+        });
+    }
+    let source_tree_sha256 = source_digest(&source.source_root, inputs.check)?;
+    let source_subtrees = rule
+        .source_subtrees
+        .iter()
+        .map(|path| {
+            source_digest(&source.source_root.join(path), inputs.check)
+                .map(|sha256| SourceSubtree { path, sha256 })
+        })
+        .collect::<Result<Vec<_>, _>>()?;
+    Ok(NativeContributor {
+        package_id: package.id.clone(),
+        name: package.name.clone(),
+        version: package.version.clone(),
+        context: script.context,
+        features,
+        classification: match script.context {
+            UnitContext::Host => "build_tool_native_contributor",
+            UnitContext::Target => "conservative_embedded_contributor",
+        },
+        original_sha256: source.original_sha256.clone(),
+        source_tree_sha256,
+        source_subtrees,
+        linked_libs: script.linked_libs.clone(),
+        linked_paths: script.linked_paths.clone(),
+        archives,
+        source_root: source.source_root.clone(),
+    })
+}
+
+/// Captures reviewed native outputs and their verified original sources.
+///
+/// # Errors
+///
+/// Rejects unknown native origins, features, directives or substitutions, unsafe
+/// paths and absent outputs. Toolchain and final platform evidence are separate.
+pub(crate) fn collect(
+    observations: &CargoObservations,
+    inputs: &NativeInputs<'_>,
+) -> Result<NativeInventory, Report<ReleaseError>> {
+    (inputs.check)()?;
+    normal_path(inputs.execution_output_root)?;
+    real_directory(inputs.host_output_root)?;
+    let mut contributors = Vec::new();
+    let mut captured = BTreeSet::new();
+    for script in &observations.build_scripts {
+        (inputs.check)()?;
+        let package = observations
+            .packages
+            .iter()
+            .find(|package| package.id == script.package_id)
+            .ok_or_else(|| composition_error("native script has no observed package"))?;
+        if reviewed(&package.name).is_some()
+            || !script.linked_libs.is_empty()
+            || !script.linked_paths.is_empty()
+        {
+            if !captured.insert((&script.package_id, script.context == UnitContext::Target)) {
+                return Err(composition_error("native script context is duplicated"));
+            }
+            contributors.push(contributor(observations, package, script, inputs)?);
+        }
+    }
+    for unit in &observations.units {
+        let package = observations
+            .packages
+            .iter()
+            .find(|package| package.id == unit.package_id)
+            .ok_or_else(|| composition_error("native unit has no observed package"))?;
+        if reviewed(&package.name).is_some()
+            && !unit.target_kind.iter().any(|kind| kind == "custom-build")
+            && !captured.contains(&(&unit.package_id, unit.context == UnitContext::Target))
+        {
+            return Err(composition_error(
+                "observed native package has no captured build-script execution",
+            ));
+        }
+    }
+    let build_tool_package_ids = observations
+        .units
+        .iter()
+        .filter(|unit| unit.context == UnitContext::Host)
+        .map(|unit| unit.package_id.clone())
+        .collect::<BTreeSet<_>>()
+        .into_iter()
+        .collect();
+    (inputs.check)()?;
+    Ok(NativeInventory {
+        contributors,
+        build_tool_package_ids,
+        material_native_coverage_complete: false,
+    })
+}
+
+impl NativeInventory {
+    /// Rechecks the native source trees and actual output archives before handoff.
+    ///
+    /// # Errors
+    ///
+    /// Rejects changed or aliased files, unsafe paths and an expired attempt.
+    pub(crate) fn rehash(
+        &self,
+        check: &dyn Fn() -> Result<(), Report<ReleaseError>>,
+    ) -> Result<(), Report<ReleaseError>> {
+        check()?;
+        for contributor in &self.contributors {
+            if source_digest(&contributor.source_root, check)? != contributor.source_tree_sha256 {
+                return Err(composition_error(
+                    "native prepared source tree changed after capture",
+                ));
+            }
+            for archive in &contributor.archives {
+                let identity = archive_digest(&archive.output_root, &archive.host_path, check)?;
+                if identity.sha256 != archive.sha256 || identity.size != archive.size {
+                    return Err(composition_error(
+                        "native output archive changed after capture",
+                    ));
+                }
+            }
+        }
+        check()
+    }
+}
+
+#[cfg(test)]
+mod tests;
+
+impl NativeInventory {
+    /// Returns measured native inputs without granting coverage completeness.
+    pub(crate) fn contributors(&self) -> &[NativeContributor] {
+        &self.contributors
+    }
+}
+
+impl NativeContributor {
+    /// Returns the exact observed Cargo package ID for joining only.
+    pub(crate) fn package_id(&self) -> &str {
+        &self.package_id
+    }
+    /// Returns the observed Cargo wrapper package name.
+    pub(crate) fn name(&self) -> &str {
+        &self.name
+    }
+    /// Returns the observed Cargo wrapper package version.
+    pub(crate) fn version(&self) -> &str {
+        &self.version
+    }
+    /// Returns its observed consuming compiler context.
+    pub(crate) fn context(&self) -> UnitContext {
+        self.context
+    }
+    /// Returns effective consuming-unit features.
+    pub(crate) fn features(&self) -> &[String] {
+        &self.features
+    }
+    /// Returns its conservative collector classification.
+    pub(crate) fn classification(&self) -> &str {
+        self.classification
+    }
+    /// Returns the verified original registry archive digest.
+    pub(crate) fn original_sha256(&self) -> &str {
+        &self.original_sha256
+    }
+    /// Returns structured prepared-source tree evidence, not a raw-file checksum.
+    pub(crate) fn source_tree_sha256(&self) -> &str {
+        &self.source_tree_sha256
+    }
+    /// Returns reviewed structured native source subtree observations.
+    pub(crate) fn source_subtrees(&self) -> &[SourceSubtree] {
+        &self.source_subtrees
+    }
+    /// Returns observed reviewed static-link library directives.
+    pub(crate) fn linked_libs(&self) -> &[String] {
+        &self.linked_libs
+    }
+    /// Returns measured static output archives with private paths inaccessible.
+    pub(crate) fn archives(&self) -> &[NativeArchive] {
+        &self.archives
+    }
+    /// Returns whether this wrapper name and version have reviewed native rules.
+    pub(crate) fn reviewed_wrapper(&self) -> bool {
+        reviewed(&self.name).is_some_and(|rule| rule.version == self.version)
+    }
+}
+
+impl SourceSubtree {
+    /// Returns the reviewed source-relative subtree path.
+    pub(crate) fn path(&self) -> &str {
+        self.path
+    }
+    /// Returns structured subtree evidence, not a raw-file checksum.
+    pub(crate) fn sha256(&self) -> &str {
+        &self.sha256
+    }
+}
+
+impl NativeArchive {
+    /// Returns the logical archive filename without exposing output roots.
+    pub(crate) fn filename(&self) -> Option<&str> {
+        self.path.file_name().and_then(|name| name.to_str())
+    }
+    /// Returns measured static archive length.
+    pub(crate) fn size(&self) -> u64 {
+        self.size
+    }
+    /// Returns the raw static-output archive digest, distinct from its source.
+    pub(crate) fn sha256(&self) -> &str {
+        &self.sha256
+    }
+}
+
+#[cfg(test)]
+pub(crate) fn fixture_for_projection(
+    name: &str,
+    context: UnitContext,
+) -> (NativeInventory, CargoObservations) {
+    tests::fixture_for_projection(name, context)
+}
+
+/// Returns the reviewed Cargo wrapper version for a native implementation.
+pub(crate) fn reviewed_wrapper_version(name: &str) -> Option<&'static str> {
+    reviewed(name).map(|rule| rule.version)
+}
diff --git a/crates/trusted-server-release/src/composition/native/tests.rs b/crates/trusted-server-release/src/composition/native/tests.rs
new file mode 100644
index 0000000000..ac12e03e6c
--- /dev/null
+++ b/crates/trusted-server-release/src/composition/native/tests.rs
@@ -0,0 +1,798 @@
+use std::cell::Cell;
+use std::collections::BTreeMap;
+use std::fs;
+use std::os::unix::fs::symlink;
+use std::path::PathBuf;
+
+use serde_json::json;
+use sha2::Sha256;
+use tempfile::TempDir;
+
+use super::*;
+use crate::composition::{
+    BuildScriptObservation, CargoObservations, RustPackage, RustUnit, UnitContext,
+};
+
+#[test]
+fn reviewed_native_wrapper_versions_are_present_in_the_source_lockfile() {
+    let lock: toml::Value = toml::from_str(include_str!("../../../../../Cargo.lock"))
+        .expect("should parse the source lockfile");
+    let packages = lock["package"]
+        .as_array()
+        .expect("should hold locked packages");
+    for name in ["aws-lc-sys", "ring", "libsqlite3-sys"] {
+        let reviewed = reviewed_wrapper_version(name).expect("should review native wrapper");
+        assert!(
+            packages.iter().any(|package| {
+                package["name"].as_str() == Some(name)
+                    && package["version"].as_str() == Some(reviewed)
+            }),
+            "should retain a source-locked version matching reviewed native wrapper {name}"
+        );
+    }
+}
+
+struct Fixture {
+    _temporary: TempDir,
+    root: PathBuf,
+    observations: CargoObservations,
+    origins: BTreeMap<String, NativeSource>,
+    environment: BTreeMap<String, String>,
+}
+
+impl Fixture {
+    fn new(name: &str) -> Self {
+        let temporary = tempfile::tempdir().expect("should create native fixture");
+        let root = fs::canonicalize(temporary.path()).expect("should resolve fixture root");
+        let (version, features, libraries, directories): (&str, &[&str], &[&str], &[&str]) =
+            match name {
+                "aws-lc-sys" => (
+                    "0.42.0",
+                    &["all-bindings", "default"],
+                    &["aws_lc_0_42_0_crypto"],
+                    &["aws-lc"],
+                ),
+                "ring" => (
+                    "0.17.14",
+                    &["alloc", "default", "dev_urandom_fallback"],
+                    &["ring_core_0_17_14_", "ring_core_0_17_14__test"],
+                    &["crypto", "include", "pregenerated"],
+                ),
+                "libsqlite3-sys" => (
+                    "0.38.2",
+                    &[
+                        "bundled",
+                        "bundled_bindings",
+                        "cc",
+                        "default",
+                        "min_sqlite_version_3_34_1",
+                        "pkg-config",
+                        "vcpkg",
+                    ],
+                    &["sqlite3"],
+                    &["sqlite3"],
+                ),
+                _ => panic!("should use a reviewed fixture package"),
+            };
+        let id = format!("registry+https://example.com/index#{name}@{version}");
+        let package_root = root.join("vendor").join(name);
+        fs::create_dir_all(&package_root).expect("should create source root");
+        fs::write(package_root.join("Cargo.toml"), "fictional manifest")
+            .expect("should write manifest");
+        for directory in directories {
+            let path = package_root.join(directory);
+            fs::create_dir(&path).expect("should create native source subtree");
+            fs::write(path.join("source.c"), "fictional source").expect("should write source");
+        }
+        let output = root.join("target/aarch64-apple-darwin/release/build/native/out");
+        fs::create_dir_all(&output).expect("should create OUT_DIR");
+        for library in libraries {
+            fs::write(
+                output.join(format!("lib{library}.a")),
+                b"!<arch>\nfictional archive",
+            )
+            .expect("should write native archive");
+        }
+        let features: Vec<_> = features.iter().map(|value| (*value).to_owned()).collect();
+        let observations = CargoObservations {
+            packages: vec![RustPackage {
+                id: id.clone(),
+                name: name.to_owned(),
+                version: version.to_owned(),
+                source: Some("registry+https://example.com/index".to_owned()),
+                manifest_path: package_root.join("Cargo.toml"),
+                license: None,
+            }],
+            units: vec![RustUnit {
+                package_id: id.clone(),
+                target_name: name.to_owned(),
+                target_kind: vec!["lib".to_owned()],
+                crate_types: vec!["lib".to_owned()],
+                context: UnitContext::Target,
+                features,
+                profile: json!({"test":false}),
+                filenames: vec![],
+                executable: None,
+            }],
+            build_scripts: vec![BuildScriptObservation {
+                package_id: id.clone(),
+                context: UnitContext::Target,
+                out_dir: output.clone(),
+                linked_libs: libraries
+                    .iter()
+                    .map(|library| format!("static={library}"))
+                    .collect(),
+                linked_paths: vec![format!("native={}", output.display())],
+                cfgs: vec![],
+                environment: vec![],
+            }],
+        };
+        let origins = BTreeMap::from([(
+            id,
+            NativeSource {
+                original_sha256: "a".repeat(64),
+                source_root: package_root,
+            },
+        )]);
+        let environment = BTreeMap::from([
+            ("AWS_LC_SYS_USE_SYSTEM".to_owned(), "0".to_owned()),
+            (
+                "AWS_LC_SYS_USE_SYSTEM_aarch64_apple_darwin".to_owned(),
+                "0".to_owned(),
+            ),
+            ("LIBSQLITE3_SYS_USE_PKG_CONFIG".to_owned(), "0".to_owned()),
+        ]);
+        Self {
+            _temporary: temporary,
+            root,
+            observations,
+            origins,
+            environment,
+        }
+    }
+
+    fn collect(&self) -> Result<NativeInventory, Report<ReleaseError>> {
+        collect(
+            &self.observations,
+            &NativeInputs {
+                origins: &self.origins,
+                execution_output_root: &self.root.join("target"),
+                host_output_root: &self.root.join("target"),
+                target: ReleaseTarget::Aarch64AppleDarwin,
+                environment: &self.environment,
+                check: &|| Ok(()),
+            },
+        )
+    }
+
+    fn archive(&self) -> PathBuf {
+        self.observations.build_scripts[0].out_dir.join(
+            match self.observations.packages[0].name.as_str() {
+                "aws-lc-sys" => "libaws_lc_0_42_0_crypto.a",
+                "ring" => "libring_core_0_17_14_.a",
+                _ => "libsqlite3.a",
+            },
+        )
+    }
+}
+
+#[test]
+fn reviewed_aws_lc_bindings_profiles_keep_verified_static_archive_evidence() {
+    for features in [
+        vec![],
+        vec!["prebuilt-nasm"],
+        vec!["all-bindings", "default"],
+    ] {
+        let mut fixture = Fixture::new("aws-lc-sys");
+        fixture.observations.units[0].features = features
+            .iter()
+            .map(|feature| (*feature).to_owned())
+            .collect();
+        let evidence = fixture
+            .collect()
+            .expect("should accept reviewed bindings profiles for supported Unix targets");
+        assert_eq!(
+            evidence.contributors[0].features, fixture.observations.units[0].features,
+            "should preserve actual effective features without enabling extra bindings"
+        );
+        assert_eq!(
+            evidence.contributors[0].linked_libs,
+            ["static=aws_lc_0_42_0_crypto"],
+            "should preserve the verified static crypto archive requirement"
+        );
+        assert_eq!(
+            evidence.contributors[0].archives.len(),
+            1,
+            "should retain the measured native archive"
+        );
+    }
+}
+
+#[test]
+fn native_feature_errors_identify_package_context_and_bounded_observed_features() {
+    let mut fixture = Fixture::new("aws-lc-sys");
+    fixture.observations.units[0]
+        .features
+        .push("fips".to_owned());
+    let error = format!(
+        "{:?}",
+        fixture
+            .collect()
+            .expect_err("should reject unreviewed features")
+    );
+    assert!(
+        error.contains("aws-lc-sys") && error.contains("fips") && error.contains("Target"),
+        "should diagnose the exact package, context and rejected feature: {error}"
+    );
+    fixture.observations.units[0].features = vec!["x".repeat(8192); 128];
+    let error = format!(
+        "{:?}",
+        fixture
+            .collect()
+            .expect_err("should reject excessive unknown feature text")
+    );
+    assert!(
+        error.len() < 4096,
+        "should bound native feature diagnostics"
+    );
+}
+
+#[test]
+fn archive_format_and_digest_cannot_come_from_different_inodes() {
+    let temporary = tempfile::tempdir().expect("should create native archive fixture");
+    let root = fs::canonicalize(temporary.path()).expect("should resolve fixture root");
+    let path = root.join("libexample.a");
+    fs::write(&path, b"!<arch>\nfictional archive").expect("should write valid archive header");
+    let replaced = Cell::new(false);
+    let check = || {
+        if !replaced.replace(true) {
+            let replacement = root.join("replacement");
+            fs::write(&replacement, b"fictional non-archive replacement")
+                .expect("should write replacement bytes");
+            fs::rename(replacement, &path).expect("should replace archive after its format check");
+        }
+        Ok(())
+    };
+    assert!(
+        archive_digest(&root, &path, &check).is_err(),
+        "should reject format and digest observations from different files"
+    );
+    assert!(replaced.get(), "should exercise the replacement window");
+}
+
+#[test]
+fn captures_actual_archives_and_verified_source_materials_for_all_reviewed_origins() {
+    for name in ["aws-lc-sys", "ring", "libsqlite3-sys"] {
+        let fixture = Fixture::new(name);
+        let inventory = fixture
+            .collect()
+            .expect("should capture reviewed native contributors");
+        let value = serde_json::to_value(inventory).expect("should serialize observations");
+        let contributor = &value["contributors"][0];
+        assert_eq!(
+            contributor["original_sha256"],
+            "a".repeat(64),
+            "should bind verified original source"
+        );
+        assert_eq!(
+            contributor["archives"][0]["sha256"],
+            hex::encode(Sha256::digest(b"!<arch>\nfictional archive")),
+            "should hash actual produced archive"
+        );
+        assert_eq!(
+            contributor["classification"], "conservative_embedded_contributor",
+            "should not assert exact linked members"
+        );
+        assert_eq!(
+            value["material_native_coverage_complete"], false,
+            "should remain candidate observations"
+        );
+        assert!(
+            contributor["source_tree_sha256"]
+                .as_str()
+                .is_some_and(|value| value.len() == 64),
+            "should bind the prepared source tree"
+        );
+        assert!(
+            contributor["source_subtrees"]
+                .as_array()
+                .is_some_and(|value| !value.is_empty()),
+            "should identify reviewed native subtrees"
+        );
+        assert_eq!(
+            contributor["archives"]
+                .as_array()
+                .expect("should have archives")
+                .len(),
+            if name == "ring" { 2 } else { 1 },
+            "should include both ring release archives"
+        );
+    }
+}
+
+#[test]
+fn rejects_system_substitution_unknown_origins_features_and_missing_outputs() {
+    let mut fixture = Fixture::new("aws-lc-sys");
+    fixture
+        .environment
+        .insert("AWS_LC_SYS_USE_SYSTEM".to_owned(), "1".to_owned());
+    assert!(
+        fixture.collect().is_err(),
+        "should reject AWS-LC system substitution"
+    );
+    let mut fixture = Fixture::new("libsqlite3-sys");
+    fixture.observations.units[0]
+        .features
+        .push("loadable_extension".to_owned());
+    assert!(
+        fixture.collect().is_err(),
+        "should reject unreviewed SQLite feature"
+    );
+    let mut fixture = Fixture::new("ring");
+    fixture.origins.clear();
+    assert!(
+        fixture.collect().is_err(),
+        "should require a verified origin join"
+    );
+    let fixture = Fixture::new("ring");
+    fs::remove_file(fixture.archive()).expect("should remove output archive");
+    assert!(
+        fixture.collect().is_err(),
+        "should require actual output archives"
+    );
+}
+
+#[test]
+fn rejects_archive_aliases_hardlinks_and_link_search_escapes() {
+    let fixture = Fixture::new("ring");
+    let archive = fixture.archive();
+    let other = fixture.root.join("foreign.a");
+    fs::rename(&archive, &other).expect("should move archive");
+    symlink(&other, &archive).expect("should create alias");
+    assert!(
+        fixture.collect().is_err(),
+        "should reject a leaf archive alias"
+    );
+    fs::remove_file(&archive).expect("should remove alias");
+    fs::hard_link(&other, &archive).expect("should create hardlink");
+    assert!(
+        fixture.collect().is_err(),
+        "should reject externally rewritable archive"
+    );
+    let mut fixture = Fixture::new("libsqlite3-sys");
+    fixture.observations.build_scripts[0].linked_paths = vec!["native=/usr/lib".to_owned()];
+    assert!(
+        fixture.collect().is_err(),
+        "should reject system search substitution"
+    );
+}
+
+#[test]
+fn rejects_unknown_native_scripts_and_missing_native_execution() {
+    let mut fixture = Fixture::new("ring");
+    fixture.observations.packages[0].name = "fictional-native".to_owned();
+    assert!(
+        fixture.collect().is_err(),
+        "should reject an unknown native library origin"
+    );
+    let mut fixture = Fixture::new("ring");
+    fixture.observations.build_scripts.clear();
+    assert!(
+        fixture.collect().is_err(),
+        "should reject an observed native unit without captured output"
+    );
+}
+
+#[test]
+fn host_native_archives_are_build_tools_instead_of_target_contributors() {
+    let mut fixture = Fixture::new("ring");
+    let old = fixture.observations.build_scripts[0].out_dir.clone();
+    let output = fixture.root.join("target/release/build/native/out");
+    fs::create_dir_all(output.parent().expect("should have build directory"))
+        .expect("should create host build directory");
+    fs::rename(old, &output).expect("should move host outputs");
+    fixture.observations.units[0].context = UnitContext::Host;
+    fixture.observations.build_scripts[0].context = UnitContext::Host;
+    fixture.observations.build_scripts[0].out_dir = output.clone();
+    fixture.observations.build_scripts[0].linked_paths =
+        vec![format!("native={}", output.display())];
+    let value = serde_json::to_value(
+        fixture
+            .collect()
+            .expect("should capture host native outputs"),
+    )
+    .expect("should serialize host observations");
+    assert_eq!(
+        value["contributors"][0]["classification"], "build_tool_native_contributor",
+        "should distinguish host build tools from target contributors"
+    );
+    assert_eq!(
+        value["build_tool_package_ids"][0], fixture.observations.packages[0].id,
+        "should list observed host build tools"
+    );
+}
+
+#[test]
+fn rehash_rejects_archive_and_prepared_source_mutation() {
+    let fixture = Fixture::new("ring");
+    let inventory = fixture.collect().expect("should capture native outputs");
+    inventory
+        .rehash(&|| Ok(()))
+        .expect("should rehash unchanged native evidence");
+    fs::write(fixture.archive(), b"!<arch>\nchanged archive").expect("should alter archive");
+    assert!(
+        inventory.rehash(&|| Ok(())).is_err(),
+        "should reject archive changed after capture"
+    );
+
+    let fixture = Fixture::new("libsqlite3-sys");
+    let inventory = fixture.collect().expect("should capture SQLite source");
+    let source = &fixture
+        .origins
+        .values()
+        .next()
+        .expect("should have origin")
+        .source_root;
+    fs::write(source.join("sqlite3/source.c"), "changed fictional source")
+        .expect("should change native source");
+    assert!(
+        inventory.rehash(&|| Ok(())).is_err(),
+        "should reject native source changed after capture"
+    );
+}
+
+#[test]
+fn maps_observed_execution_search_paths_to_host_outputs() {
+    let mut fixture = Fixture::new("ring");
+    let host_root = fixture.root.join("target");
+    let execution_root = PathBuf::from("/boundary/build/target");
+    let script = &mut fixture.observations.build_scripts[0];
+    script.out_dir = execution_root.join(
+        script
+            .out_dir
+            .strip_prefix(&host_root)
+            .expect("should be below host root"),
+    );
+    script.linked_paths = vec![format!("native={}", script.out_dir.display())];
+    let value = serde_json::to_value(
+        collect(
+            &fixture.observations,
+            &NativeInputs {
+                origins: &fixture.origins,
+                execution_output_root: &execution_root,
+                host_output_root: &host_root,
+                target: ReleaseTarget::Aarch64AppleDarwin,
+                environment: &fixture.environment,
+                check: &|| Ok(()),
+            },
+        )
+        .expect("should translate boundary namespace"),
+    )
+    .expect("should serialize boundary observations");
+    assert!(
+        value["contributors"][0]["archives"][0]["path"]
+            .as_str()
+            .expect("should have archive path")
+            .starts_with("/boundary/build/target/"),
+        "should preserve observed namespace rather than invent host observations"
+    );
+}
+
+#[test]
+fn rejects_ancestor_aliases_ambiguous_searches_and_cross_context_outputs() {
+    let fixture = Fixture::new("ring");
+    let output = fixture.observations.build_scripts[0].out_dir.clone();
+    let relocated = fixture.root.join("relocated-out");
+    fs::rename(&output, &relocated).expect("should move OUT_DIR");
+    symlink(&relocated, &output).expect("should alias OUT_DIR");
+    assert!(
+        fixture.collect().is_err(),
+        "should reject an ancestor alias"
+    );
+
+    let mut fixture = Fixture::new("ring");
+    let second = fixture.observations.build_scripts[0]
+        .out_dir
+        .join("duplicate");
+    fs::create_dir(&second).expect("should create duplicate search directory");
+    fs::copy(fixture.archive(), second.join("libring_core_0_17_14_.a"))
+        .expect("should duplicate archive candidate");
+    fixture.observations.build_scripts[0]
+        .linked_paths
+        .push(format!("native={}", second.display()));
+    assert!(
+        fixture.collect().is_err(),
+        "should reject ambiguous archive resolution"
+    );
+
+    let mut fixture = Fixture::new("ring");
+    fixture.observations.build_scripts[0].context = UnitContext::Host;
+    fixture.observations.units[0].context = UnitContext::Host;
+    assert!(
+        fixture.collect().is_err(),
+        "should reject target outputs labeled host context"
+    );
+}
+
+#[test]
+fn rejects_unreviewed_native_controls_directives_versions_and_disabled_bundling() {
+    for feature in ["fips", "bindgen", "ssl", "asan"] {
+        let mut fixture = Fixture::new("aws-lc-sys");
+        fixture.observations.units[0]
+            .features
+            .push(feature.to_owned());
+        assert!(
+            fixture.collect().is_err(),
+            "should reject AWS-LC feature {feature}"
+        );
+    }
+    let mut fixture = Fixture::new("aws-lc-sys");
+    fixture.environment.insert(
+        "AWS_LC_SYS_SYSTEM_DIR".to_owned(),
+        "/example/system".to_owned(),
+    );
+    assert!(
+        fixture.collect().is_err(),
+        "should reject explicit AWS-LC system material"
+    );
+    let mut fixture = Fixture::new("libsqlite3-sys");
+    fixture
+        .environment
+        .insert("LIBSQLITE3_SYS_USE_PKG_CONFIG".to_owned(), "1".to_owned());
+    assert!(
+        fixture.collect().is_err(),
+        "should reject SQLite system discovery"
+    );
+    let mut fixture = Fixture::new("libsqlite3-sys");
+    fixture.observations.units[0]
+        .features
+        .retain(|feature| feature != "bundled");
+    assert!(
+        fixture.collect().is_err(),
+        "should require bundled SQLite source"
+    );
+    let mut fixture = Fixture::new("ring");
+    fixture.observations.build_scripts[0].linked_libs[0] = "dylib=ring_core_0_17_14_".to_owned();
+    assert!(
+        fixture.collect().is_err(),
+        "should reject dynamic native substitution"
+    );
+    let mut fixture = Fixture::new("ring");
+    fixture.observations.packages[0].version = "0.17.15".to_owned();
+    assert!(
+        fixture.collect().is_err(),
+        "should require review for changed native version"
+    );
+}
+
+#[test]
+fn rejects_invalid_material_archive_source_alias_and_missing_native_subtree() {
+    let mut fixture = Fixture::new("ring");
+    fixture
+        .origins
+        .values_mut()
+        .next()
+        .expect("should have origin")
+        .original_sha256 = "unverified".to_owned();
+    assert!(
+        fixture.collect().is_err(),
+        "should require a complete original SHA-256"
+    );
+    let fixture = Fixture::new("ring");
+    fs::write(fixture.archive(), "fictional non-archive").expect("should replace output");
+    assert!(
+        fixture.collect().is_err(),
+        "should reject a file without archive magic"
+    );
+    let mut fixture = Fixture::new("ring");
+    let source = &mut fixture
+        .origins
+        .values_mut()
+        .next()
+        .expect("should have origin")
+        .source_root;
+    let alias = fixture.root.join("source-alias");
+    symlink(&source, &alias).expect("should create source alias");
+    *source = alias;
+    assert!(
+        fixture.collect().is_err(),
+        "should reject an aliased prepared source root"
+    );
+    let fixture = Fixture::new("libsqlite3-sys");
+    let source = &fixture
+        .origins
+        .values()
+        .next()
+        .expect("should have origin")
+        .source_root;
+    fs::remove_dir_all(source.join("sqlite3")).expect("should remove native source subtree");
+    assert!(
+        fixture.collect().is_err(),
+        "should require the reviewed native source subtree"
+    );
+}
+
+#[test]
+fn checks_attempt_deadlines_during_collection_and_rehash() {
+    let fixture = Fixture::new("ring");
+    let inventory = fixture.collect().expect("should capture native outputs");
+    assert!(
+        inventory
+            .rehash(&|| Err(composition_error("fictional expired attempt")))
+            .is_err(),
+        "should reject an expired handoff attempt"
+    );
+    let result = collect(
+        &fixture.observations,
+        &NativeInputs {
+            origins: &fixture.origins,
+            execution_output_root: &fixture.root.join("target"),
+            host_output_root: &fixture.root.join("target"),
+            target: ReleaseTarget::Aarch64AppleDarwin,
+            environment: &fixture.environment,
+            check: &|| Err(composition_error("fictional cancelled attempt")),
+        },
+    );
+    assert!(result.is_err(), "should reject a cancelled capture attempt");
+}
+
+#[test]
+fn native_spdx_join_rejects_changed_source_features_context_and_duplicate_contributors() {
+    for mutation in [
+        "source",
+        "features",
+        "context",
+        "duplicate",
+        "missing",
+        "name",
+        "version",
+        "classification",
+        "unknown",
+    ] {
+        let mut fixture = Fixture::new("ring");
+        let mut inventory = fixture
+            .collect()
+            .expect("should collect checked native input");
+        let origins = crate::composition::origin::VerifiedPackageOrigins::fixture_native_registry(
+            &fixture.observations,
+        );
+        match mutation {
+            "source" => inventory.contributors[0].original_sha256 = "b".repeat(64),
+            "features" => inventory.contributors[0]
+                .features
+                .push("changed".to_owned()),
+            "context" => inventory.contributors[0].context = UnitContext::Host,
+            "duplicate" => inventory
+                .contributors
+                .push(inventory.contributors[0].clone()),
+            "missing" => fixture.observations.packages.clear(),
+            "name" => inventory.contributors[0].name = "other".to_owned(),
+            "version" => inventory.contributors[0].version = "99.0.0".to_owned(),
+            "classification" => inventory.contributors[0].classification = "unknown",
+            "unknown" => inventory.contributors[0].package_id = "unknown opaque ID".to_owned(),
+            _ => unreachable!("should select known mutation"),
+        }
+        assert!(
+            crate::spdx::native::validate_for_tests(&inventory, &fixture.observations, &origins)
+                .is_err(),
+            "should reject native join mutation {mutation}"
+        );
+    }
+}
+
+pub(super) fn fixture_for_projection(
+    name: &str,
+    context: UnitContext,
+) -> (NativeInventory, CargoObservations) {
+    let mut fixture = Fixture::new(name);
+    if context == UnitContext::Host {
+        let output = fixture.root.join("target/release/build/native/out");
+        fs::create_dir_all(&output).expect("should create host output");
+        for entry in fs::read_dir(&fixture.observations.build_scripts[0].out_dir)
+            .expect("should list archives")
+        {
+            let entry = entry.expect("should read archive entry");
+            fs::copy(entry.path(), output.join(entry.file_name()))
+                .expect("should copy host archive");
+        }
+        fixture.observations.units[0].context = context;
+        fixture.observations.build_scripts[0].context = context;
+        fixture.observations.build_scripts[0].out_dir = output.clone();
+        fixture.observations.build_scripts[0].linked_paths =
+            vec![format!("native={}", output.display())];
+    }
+    let inventory = fixture
+        .collect()
+        .expect("should collect owner-checked native fixture");
+    (inventory, fixture.observations)
+}
+
+#[test]
+fn native_spdx_requires_each_reviewed_consuming_context_and_unambiguous_features() {
+    let mut fixture = Fixture::new("ring");
+    let mut inventory = fixture.collect().expect("should collect native inputs");
+    let origins = crate::composition::origin::VerifiedPackageOrigins::fixture_native_registry(
+        &fixture.observations,
+    );
+    inventory.contributors.clear();
+    assert!(
+        crate::spdx::native::validate_for_tests(&inventory, &fixture.observations, &origins)
+            .is_err(),
+        "should reject missing measured receipt for observed native unit"
+    );
+    let inventory = fixture.collect().expect("should collect complete inputs");
+    fixture.observations.units.push(RustUnit {
+        package_id: fixture.observations.packages[0].id.clone(),
+        target_name: "ring".to_owned(),
+        target_kind: vec!["lib".to_owned()],
+        crate_types: vec!["lib".to_owned()],
+        context: UnitContext::Target,
+        features: vec!["alloc".to_owned()],
+        profile: json!({"test":false}),
+        filenames: vec![],
+        executable: None,
+    });
+    assert!(
+        crate::spdx::native::validate_for_tests(&inventory, &fixture.observations, &origins)
+            .is_err(),
+        "should reject ambiguous effective features within one native context"
+    );
+}
+
+#[test]
+fn native_spdx_rejects_aliases_of_the_same_verified_original_context() {
+    let mut fixture = Fixture::new("ring");
+    let mut inventory = fixture.collect().expect("should collect native inputs");
+    let mut alias = inventory.contributors[0].clone();
+    alias.package_id = "relocated opaque alias".to_owned();
+    fixture.observations.packages.push(RustPackage {
+        id: alias.package_id.clone(),
+        name: "ring".to_owned(),
+        version: "0.17.14".to_owned(),
+        source: Some("registry+https://example.com/index".to_owned()),
+        manifest_path: fixture.observations.packages[0].manifest_path.clone(),
+        license: None,
+    });
+    fixture.observations.units.push(RustUnit {
+        package_id: alias.package_id.clone(),
+        target_name: "ring".to_owned(),
+        target_kind: vec!["lib".to_owned()],
+        crate_types: vec!["lib".to_owned()],
+        context: UnitContext::Target,
+        features: alias.features.clone(),
+        profile: json!({"test":false}),
+        filenames: vec![],
+        executable: None,
+    });
+    inventory.contributors.push(alias);
+    let origins = crate::composition::origin::VerifiedPackageOrigins::fixture_native_registry(
+        &fixture.observations,
+    );
+    assert!(
+        crate::spdx::native::validate_for_tests(&inventory, &fixture.observations, &origins)
+            .is_err(),
+        "should reject ambiguous aliases of one stable original/context identity"
+    );
+}
+
+#[test]
+fn native_spdx_rejects_missing_or_conflicting_verified_package_facts() {
+    for mutation in ["missing", "name", "version"] {
+        let mut fixture = Fixture::new("ring");
+        let inventory = fixture.collect().expect("should collect native inputs");
+        match mutation {
+            "missing" => fixture.observations.packages.clear(),
+            "name" => fixture.observations.packages[0].name = "other".to_owned(),
+            "version" => fixture.observations.packages[0].version = "99.0.0".to_owned(),
+            _ => unreachable!("should select known mutation"),
+        }
+        let origins = crate::composition::origin::VerifiedPackageOrigins::fixture_native_registry(
+            &fixture.observations,
+        );
+        let (_, observed) = fixture_for_projection("ring", UnitContext::Target);
+        assert!(
+            crate::spdx::native::validate_for_tests(&inventory, &observed, &origins).is_err(),
+            "should reject verified facts with {mutation}"
+        );
+    }
+}
diff --git a/crates/trusted-server-release/src/composition/origin.rs b/crates/trusted-server-release/src/composition/origin.rs
new file mode 100644
index 0000000000..a3d355d7f3
--- /dev/null
+++ b/crates/trusted-server-release/src/composition/origin.rs
@@ -0,0 +1,403 @@
+//! Exact compiled Cargo identities joined to approved source and verified originals.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::fs;
+use std::path::{Path, PathBuf};
+
+use error_stack::Report;
+use serde::Serialize;
+
+use super::{CargoObservations, composition_error, native::NativeSource};
+use crate::documents::{Role, read_bounded};
+use crate::error::ReleaseError;
+use crate::materials::{CargoOrigin, PreparedCargoMaterials};
+use crate::recipe::ExecutionPaths;
+use crate::source::{ApprovedSource, FreshSource, FreshSourceVerification};
+
+/// Approved tracked manifests bound to one independent source checkout.
+pub(crate) struct WorkspaceOrigins {
+    root: PathBuf,
+    source_commit: String,
+    cargo_lock_sha256: String,
+    manifests: BTreeMap<PathBuf, String>,
+    verification: WorkspaceVerification,
+}
+
+enum WorkspaceVerification {
+    Approved(FreshSourceVerification),
+    #[cfg(test)]
+    Fixture,
+}
+
+impl WorkspaceOrigins {
+    /// Rechecks all approved tracked bytes before and after recipe execution.
+    ///
+    /// # Errors
+    /// Rejects changed source, unexpected files and expired preparation attempts.
+    pub(crate) fn verify_unchanged(&self) -> Result<(), Report<ReleaseError>> {
+        match &self.verification {
+            WorkspaceVerification::Approved(verification) => verification.verify_unchanged(&[]),
+            #[cfg(test)]
+            WorkspaceVerification::Fixture => Ok(()),
+        }
+    }
+    /// Binds approved tracked identities to an unchanged independent checkout.
+    ///
+    /// # Errors
+    /// Rejects a changed checkout, mismatched commit or missing approved lock.
+    pub(crate) fn bind(
+        approved: &ApprovedSource,
+        fresh: &FreshSource,
+    ) -> Result<Self, Report<ReleaseError>> {
+        fresh.verify_unchanged(&[])?;
+        if approved.commit().as_str() != fresh.commit() {
+            return Err(composition_error(
+                "fresh checkout has a different approved commit",
+            ));
+        }
+        real_path(fresh.root())?;
+        Ok(Self {
+            root: fresh.root().to_owned(),
+            source_commit: fresh.commit().to_owned(),
+            cargo_lock_sha256: approved
+                .tracked_sha256("Cargo.lock")
+                .ok_or_else(|| composition_error("approved source has no Cargo.lock"))?
+                .to_owned(),
+            manifests: approved.cargo_manifest_digests(),
+            verification: WorkspaceVerification::Approved(fresh.verification()),
+        })
+    }
+}
+
+/// Origins for compiled packages only; host paths never enter serialized evidence.
+#[derive(Serialize)]
+pub(crate) struct VerifiedPackageOrigins {
+    source_commit: String,
+    materials_sha256: String,
+    packages: BTreeMap<String, PackageOrigin>,
+    #[serde(skip)]
+    native_sources: BTreeMap<String, NativeSource>,
+}
+
+/// One exact observed package joined to an approved original.
+#[derive(Serialize)]
+pub(crate) struct PackageOrigin {
+    name: String,
+    version: String,
+    manifest_path: PathBuf,
+    prepared_manifest_sha256: String,
+    origin: Original,
+}
+
+/// The approved workspace or verified dependency original behind a package.
+#[derive(Serialize)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub(crate) enum Original {
+    /// A tracked package within the approved source commit.
+    Workspace {
+        source_commit: String,
+        path: PathBuf,
+    },
+    /// A registry archive or Git object closure verified by material preparation.
+    Material {
+        source: String,
+        original: CargoOrigin,
+    },
+}
+
+impl VerifiedPackageOrigins {
+    /// Returns the approved source commit bound to these package origins.
+    pub(crate) fn source_commit(&self) -> &str {
+        &self.source_commit
+    }
+
+    /// Returns the measured prepared Cargo materials tree identity.
+    pub(crate) fn materials_sha256(&self) -> &str {
+        &self.materials_sha256
+    }
+
+    /// Looks up a verified origin by its exact observed Cargo package ID.
+    pub(crate) fn package(&self, package_id: &str) -> Option<&PackageOrigin> {
+        self.packages.get(package_id)
+    }
+
+    /// Registry archives and prepared roots authorized by the exact-ID join.
+    pub(crate) fn native_sources(&self) -> &BTreeMap<String, NativeSource> {
+        &self.native_sources
+    }
+}
+
+impl PackageOrigin {
+    /// Returns the package name checked against its verified original.
+    pub(crate) fn name(&self) -> &str {
+        &self.name
+    }
+
+    /// Returns the package version checked against its verified original.
+    pub(crate) fn version(&self) -> &str {
+        &self.version
+    }
+
+    /// Returns the source-relative or prepared vendor-relative manifest path.
+    pub(crate) fn relative_manifest_path(&self) -> &Path {
+        &self.manifest_path
+    }
+
+    /// Returns the measured prepared manifest digest.
+    pub(crate) fn prepared_manifest_sha256(&self) -> &str {
+        &self.prepared_manifest_sha256
+    }
+
+    /// Returns the verified original without reconstructing it from a package name.
+    pub(crate) fn origin(&self) -> &Original {
+        &self.origin
+    }
+}
+
+/// Joins observed package IDs to exact measured source identities.
+///
+/// # Errors
+/// Rejects changed materials, unapproved manifests, aliases and mismatched identities.
+pub(crate) fn join_origins(
+    observed: &CargoObservations,
+    workspace: &WorkspaceOrigins,
+    materials: &PreparedCargoMaterials,
+    paths: &dyn ExecutionPaths,
+) -> Result<VerifiedPackageOrigins, Report<ReleaseError>> {
+    workspace.verify_unchanged()?;
+    if materials.source_commit() != workspace.source_commit
+        || materials.cargo_lock_sha256() != workspace.cargo_lock_sha256
+    {
+        return Err(composition_error(
+            "Cargo materials do not belong to the approved source and lock",
+        ));
+    }
+    materials.rehash()?;
+    real_path(&workspace.root)?;
+    let mut packages = BTreeMap::new();
+    let mut native_sources = BTreeMap::new();
+    let mut used_manifests = BTreeSet::new();
+    for package in &observed.packages {
+        super::normal_path(&package.manifest_path)?;
+        if !used_manifests.insert(package.manifest_path.clone()) {
+            return Err(composition_error(
+                "compiled package manifest has ambiguous Cargo identities",
+            ));
+        }
+        let (relative, hash, origin) = if let Some(source) = &package.source {
+            let mut candidates = Vec::new();
+            for (directory, candidate) in materials.packages() {
+                let host = materials.vendor_dir().join(directory).join("Cargo.toml");
+                if paths.execution_path(&host)? == package.manifest_path {
+                    candidates.push((directory, candidate, host));
+                }
+            }
+            let [(directory, candidate, host)] = candidates.as_slice() else {
+                return Err(composition_error(
+                    "compiled dependency has no unique prepared manifest",
+                ));
+            };
+            if candidate.name() != package.name
+                || candidate.version() != package.version
+                || candidate.source() != source
+            {
+                return Err(composition_error(
+                    "compiled dependency differs from its verified original identity",
+                ));
+            }
+            let manifest = measured_manifest(host, candidate.prepared_manifest_sha256())?;
+            require_identity(&manifest, &package.name, &package.version, None)?;
+            if let CargoOrigin::Registry { archive_sha256 } = candidate.origin() {
+                native_sources.insert(
+                    package.id.clone(),
+                    NativeSource {
+                        original_sha256: archive_sha256.clone(),
+                        source_root: materials.vendor_dir().join(directory),
+                    },
+                );
+            }
+            (
+                PathBuf::from("vendor").join(directory).join("Cargo.toml"),
+                candidate.prepared_manifest_sha256().to_owned(),
+                Original::Material {
+                    source: source.clone(),
+                    original: candidate.origin().clone(),
+                },
+            )
+        } else {
+            let mut candidates = Vec::new();
+            for (relative, hash) in &workspace.manifests {
+                if paths.execution_path(&workspace.root.join(relative))? == package.manifest_path {
+                    candidates.push((relative, hash));
+                }
+            }
+            let [(relative, hash)] = candidates.as_slice() else {
+                return Err(composition_error(
+                    "compiled workspace package has no unique approved tracked manifest",
+                ));
+            };
+            let manifest = measured_manifest(&workspace.root.join(relative), hash)?;
+            require_identity(
+                &manifest,
+                &package.name,
+                &package.version,
+                Some((workspace, relative)),
+            )?;
+            (
+                (*relative).clone(),
+                (*hash).clone(),
+                Original::Workspace {
+                    source_commit: workspace.source_commit.clone(),
+                    path: (*relative).clone(),
+                },
+            )
+        };
+        if packages
+            .insert(
+                package.id.clone(),
+                PackageOrigin {
+                    name: package.name.clone(),
+                    version: package.version.clone(),
+                    manifest_path: relative,
+                    prepared_manifest_sha256: hash,
+                    origin,
+                },
+            )
+            .is_some()
+        {
+            return Err(composition_error("compiled Cargo ID is duplicated"));
+        }
+    }
+    materials.rehash()?;
+    workspace.verify_unchanged()?;
+    Ok(VerifiedPackageOrigins {
+        source_commit: workspace.source_commit.clone(),
+        materials_sha256: materials.digest().to_owned(),
+        packages,
+        native_sources,
+    })
+}
+
+fn real_path(path: &Path) -> Result<(), Report<ReleaseError>> {
+    super::normal_path(path)?;
+    if fs::canonicalize(path).map_err(composition_error)? != path {
+        return Err(composition_error("origin path contains an alias"));
+    }
+    Ok(())
+}
+
+fn measured_manifest(path: &Path, expected: &str) -> Result<toml::Table, Report<ReleaseError>> {
+    real_path(path)?;
+    let raw = read_bounded(path, Role::Source)?;
+    real_path(path)?;
+    if raw.sha256 != expected || raw.bytes.len() > 1024 * 1024 {
+        return Err(composition_error(
+            "origin manifest differs from its approved digest",
+        ));
+    }
+    toml::from_str(std::str::from_utf8(&raw.bytes).map_err(composition_error)?)
+        .map_err(composition_error)
+}
+
+fn require_identity(
+    manifest: &toml::Table,
+    name: &str,
+    version: &str,
+    workspace: Option<(&WorkspaceOrigins, &Path)>,
+) -> Result<(), Report<ReleaseError>> {
+    let package = manifest
+        .get("package")
+        .and_then(toml::Value::as_table)
+        .ok_or_else(|| composition_error("origin manifest has no package"))?;
+    if package.get("name").and_then(toml::Value::as_str) != Some(name)
+        || package.contains_key("workspace")
+    {
+        return Err(composition_error(
+            "origin package name or workspace selection differs",
+        ));
+    }
+    if package.get("version").and_then(toml::Value::as_str) == Some(version) {
+        return Ok(());
+    }
+    if package
+        .get("version")
+        .and_then(toml::Value::as_table)
+        .is_none_or(|value| {
+            value.len() != 1 || value.get("workspace").and_then(toml::Value::as_bool) != Some(true)
+        })
+    {
+        return Err(composition_error("origin package version differs"));
+    }
+    let (workspace, relative) = workspace
+        .ok_or_else(|| composition_error("prepared manifest has unresolved version inheritance"))?;
+    let root_relative = Path::new("Cargo.toml");
+    let mut parent = relative.parent();
+    while let Some(directory) = parent {
+        let ancestor = directory.join("Cargo.toml");
+        if ancestor != relative
+            && ancestor != root_relative
+            && let Some(hash) = workspace.manifests.get(&ancestor)
+        {
+            let ancestor = measured_manifest(&workspace.root.join(&ancestor), hash)?;
+            if ancestor.contains_key("workspace") {
+                return Err(composition_error(
+                    "nested workspace version inheritance is unreviewed",
+                ));
+            }
+        }
+        parent = directory.parent();
+    }
+    let hash = workspace
+        .manifests
+        .get(root_relative)
+        .ok_or_else(|| composition_error("approved root workspace manifest is missing"))?;
+    let root = measured_manifest(&workspace.root.join(root_relative), hash)?;
+    if root
+        .get("workspace")
+        .and_then(|value| value.get("package"))
+        .and_then(|value| value.get("version"))
+        .and_then(toml::Value::as_str)
+        != Some(version)
+    {
+        return Err(composition_error("approved workspace version differs"));
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests;
+
+#[cfg(test)]
+impl VerifiedPackageOrigins {
+    /// Provides fictional registry joins for owner-checked native test fixtures.
+    pub(crate) fn fixture_native_registry(observed: &CargoObservations) -> Self {
+        Self {
+            source_commit: "a".repeat(40),
+            materials_sha256: "b".repeat(64),
+            packages: observed
+                .packages()
+                .iter()
+                .map(|package| {
+                    (
+                        package.id().to_owned(),
+                        PackageOrigin {
+                            name: package.name().to_owned(),
+                            version: package.version().to_owned(),
+                            manifest_path: Path::new("native")
+                                .join(package.name())
+                                .join("Cargo.toml"),
+                            prepared_manifest_sha256: "b".repeat(64),
+                            origin: Original::Material {
+                                source: "registry+https://example.com/index".to_owned(),
+                                original: crate::materials::CargoOrigin::Registry {
+                                    archive_sha256: "a".repeat(64),
+                                },
+                            },
+                        },
+                    )
+                })
+                .collect(),
+            native_sources: BTreeMap::new(),
+        }
+    }
+}
diff --git a/crates/trusted-server-release/src/composition/origin/tests.rs b/crates/trusted-server-release/src/composition/origin/tests.rs
new file mode 100644
index 0000000000..3772ea8d0b
--- /dev/null
+++ b/crates/trusted-server-release/src/composition/origin/tests.rs
@@ -0,0 +1,397 @@
+use std::fs;
+
+use sha2::{Digest as _, Sha256};
+use tempfile::TempDir;
+
+use super::*;
+use crate::composition::RustPackage;
+
+struct Paths;
+impl ExecutionPaths for Paths {
+    fn execution_path(&self, host: &Path) -> Result<PathBuf, Report<ReleaseError>> {
+        Ok(Path::new("/execution").join(host.strip_prefix("/").expect("should be absolute")))
+    }
+    fn host_path(&self, _: &Path) -> Result<PathBuf, Report<ReleaseError>> {
+        panic!("should never reverse-map immutable inputs")
+    }
+}
+
+fn digest(bytes: &[u8]) -> String {
+    hex::encode(Sha256::digest(bytes))
+}
+
+struct Fixture {
+    _source: TempDir,
+    _materials: TempDir,
+    workspace: WorkspaceOrigins,
+    materials: PreparedCargoMaterials,
+    observed: CargoObservations,
+}
+
+impl Fixture {
+    fn workspace() -> Self {
+        let source = tempfile::tempdir().expect("should allocate source");
+        let root = fs::canonicalize(source.path()).expect("should canonicalize source");
+        let manifest = b"[package]\nname='example'\nversion='1.0.0'\n";
+        fs::write(root.join("Cargo.toml"), manifest).expect("should write manifest");
+        let materials = tempfile::tempdir().expect("should allocate materials");
+        let material_root =
+            fs::canonicalize(materials.path()).expect("should canonicalize materials");
+        let token = PreparedCargoMaterials::for_tests(&material_root, &"a".repeat(40), &[])
+            .expect("should prepare token");
+        Self {
+            observed: CargoObservations {
+                packages: vec![RustPackage {
+                    id: "opaque identity".to_owned(),
+                    name: "example".to_owned(),
+                    version: "1.0.0".to_owned(),
+                    source: None,
+                    manifest_path: Paths
+                        .execution_path(&root.join("Cargo.toml"))
+                        .expect("should translate manifest"),
+                    license: None,
+                }],
+                units: vec![],
+                build_scripts: vec![],
+            },
+            workspace: WorkspaceOrigins {
+                verification: WorkspaceVerification::Fixture,
+                root,
+                source_commit: "a".repeat(40),
+                cargo_lock_sha256: "b".repeat(64),
+                manifests: BTreeMap::from([(PathBuf::from("Cargo.toml"), digest(manifest))]),
+            },
+            materials: token,
+            _source: source,
+            _materials: materials,
+        }
+    }
+    fn join(&self) -> Result<VerifiedPackageOrigins, Report<ReleaseError>> {
+        join_origins(&self.observed, &self.workspace, &self.materials, &Paths)
+    }
+}
+
+#[test]
+fn workspace_joins_exact_opaque_id_to_approved_measured_manifest() {
+    let fixture = Fixture::workspace();
+    let result = fixture
+        .join()
+        .expect("should join tracked workspace package");
+    assert!(
+        result.package("opaque identity").is_some(),
+        "should retain exact opaque identity"
+    );
+    assert!(
+        result.package("example").is_none(),
+        "should refuse name-only lookups for an exact observed identity"
+    );
+    let package = result
+        .package("opaque identity")
+        .expect("should retain package origin");
+    assert_eq!(package.name(), "example", "should retain checked name");
+    assert_eq!(package.version(), "1.0.0", "should retain checked version");
+    assert_eq!(
+        package.relative_manifest_path(),
+        Path::new("Cargo.toml"),
+        "should retain relative manifest"
+    );
+    assert_eq!(
+        package.prepared_manifest_sha256(),
+        fixture.workspace.manifests[Path::new("Cargo.toml")],
+        "should retain measured manifest identity"
+    );
+    assert!(
+        matches!(package.origin(), Original::Workspace { source_commit, path } if source_commit == &"a".repeat(40) && path == Path::new("Cargo.toml")),
+        "should retain approved original identity"
+    );
+    assert!(
+        result.native_sources().is_empty(),
+        "should not authorize workspace as registry archive"
+    );
+}
+
+#[test]
+fn workspace_rejects_unapproved_identity_path_and_changed_bytes() {
+    for mutation in [
+        "name",
+        "version",
+        "path",
+        "bytes",
+        "commit",
+        "lock",
+        "alias",
+        "missing",
+        "untracked",
+    ] {
+        let mut fixture = Fixture::workspace();
+        match mutation {
+            "name" => fixture.observed.packages[0].name = "other".to_owned(),
+            "version" => fixture.observed.packages[0].version = "9.0.0".to_owned(),
+            "path" => {
+                fixture.observed.packages[0].manifest_path = PathBuf::from("/unapproved/Cargo.toml")
+            }
+            "bytes" => fs::write(fixture.workspace.root.join("Cargo.toml"), b"changed")
+                .expect("should mutate bytes"),
+            "commit" => fixture.workspace.source_commit = "c".repeat(40),
+            "lock" => fixture.workspace.cargo_lock_sha256 = "c".repeat(64),
+            "alias" => {
+                fs::rename(
+                    fixture.workspace.root.join("Cargo.toml"),
+                    fixture.workspace.root.join("original"),
+                )
+                .expect("should move original");
+                std::os::unix::fs::symlink("original", fixture.workspace.root.join("Cargo.toml"))
+                    .expect("should alias manifest");
+            }
+            "missing" => fs::remove_file(fixture.workspace.root.join("Cargo.toml"))
+                .expect("should remove approved manifest"),
+            "untracked" => {
+                fs::create_dir(fixture.workspace.root.join("untracked"))
+                    .expect("should create untracked dependency");
+                fs::copy(
+                    fixture.workspace.root.join("Cargo.toml"),
+                    fixture.workspace.root.join("untracked/Cargo.toml"),
+                )
+                .expect("should write unapproved matching identity");
+                fixture.observed.packages[0].manifest_path = Paths
+                    .execution_path(&fixture.workspace.root.join("untracked/Cargo.toml"))
+                    .expect("should translate unapproved dependency");
+            }
+            _ => unreachable!(),
+        }
+        assert!(
+            fixture.join().is_err(),
+            "should reject {mutation} substitution"
+        );
+    }
+}
+
+#[test]
+fn registry_requires_exact_source_path_name_version_and_manifest() {
+    for mutation in [
+        "none",
+        "name",
+        "version",
+        "source",
+        "path",
+        "bytes",
+        "ambiguous",
+    ] {
+        let mut fixture = Fixture::workspace();
+        let manifest = b"[package]\nname='example'\nversion='1.0.0'\n";
+        let root = fixture.materials.vendor_dir().join("example-1.0.0");
+        fs::create_dir(&root).expect("should create package root");
+        fs::write(root.join("Cargo.toml"), manifest).expect("should write package manifest");
+        let token =
+            PreparedCargoMaterials::for_tests(fixture.materials.root(), &"a".repeat(40), &[])
+                .expect("should measure vendor");
+        let package = crate::materials::VerifiedCargoPackage::registry_for_tests(
+            "example",
+            "1.0.0",
+            "registry+https://example.com/index",
+            &digest(manifest),
+            &"d".repeat(64),
+        );
+        fixture.materials = token.with_package_for_tests("example-1.0.0", package.clone());
+        fixture.observed.packages[0].source = Some(package.source().to_owned());
+        fixture.observed.packages[0].manifest_path = Paths
+            .execution_path(&root.join("Cargo.toml"))
+            .expect("should translate vendor manifest");
+        match mutation {
+            "name" => fixture.observed.packages[0].name = "other".to_owned(),
+            "version" => fixture.observed.packages[0].version = "9.0.0".to_owned(),
+            "source" => {
+                fixture.observed.packages[0].source =
+                    Some("git+https://example.com/repository#abc".to_owned())
+            }
+            "path" => {
+                fixture.observed.packages[0].manifest_path = fixture.observed.packages[0]
+                    .manifest_path
+                    .with_file_name("Other.toml")
+            }
+            "bytes" => {
+                fs::write(root.join("Cargo.toml"), b"changed").expect("should mutate vendor")
+            }
+            "ambiguous" => fixture.observed.packages.push(RustPackage {
+                id: "different opaque ID".to_owned(),
+                name: "example".to_owned(),
+                version: "1.0.0".to_owned(),
+                source: fixture.observed.packages[0].source.clone(),
+                manifest_path: fixture.observed.packages[0].manifest_path.clone(),
+                license: None,
+            }),
+            _ => {}
+        }
+        let result = fixture.join();
+        if mutation == "none" {
+            let origins = result.expect("should join exact registry package");
+            assert_eq!(
+                origins.native_sources()["opaque identity"].original_sha256,
+                "d".repeat(64),
+                "should authorize verified archive only"
+            );
+            let serialized = serde_json::to_string(&origins).expect("should serialize origins");
+            assert!(
+                !serialized.contains(root.to_str().expect("should have UTF-8 fixture root")),
+                "should exclude host root"
+            );
+        } else {
+            assert!(result.is_err(), "should reject {mutation} substitution");
+        }
+    }
+}
+
+#[test]
+fn root_workspace_version_inheritance_requires_approved_root_bytes() {
+    for mutation in ["none", "root_bytes", "version", "nested", "redirect"] {
+        let mut fixture = Fixture::workspace();
+        let root = b"[workspace]\nmembers=['member']\n[workspace.package]\nversion='1.0.0'\n";
+        let member = if mutation == "redirect" {
+            b"[package]\nname='example'\nversion.workspace=true\nworkspace='../elsewhere'\n"
+                .as_slice()
+        } else {
+            b"[package]\nname='example'\nversion.workspace=true\n".as_slice()
+        };
+        fs::write(fixture.workspace.root.join("Cargo.toml"), root)
+            .expect("should write workspace root");
+        fs::create_dir(fixture.workspace.root.join("member")).expect("should create member");
+        fs::write(fixture.workspace.root.join("member/Cargo.toml"), member)
+            .expect("should write member");
+        fixture.workspace.manifests = BTreeMap::from([
+            (PathBuf::from("Cargo.toml"), digest(root)),
+            (PathBuf::from("member/Cargo.toml"), digest(member)),
+        ]);
+        fixture.observed.packages[0].manifest_path = Paths
+            .execution_path(&fixture.workspace.root.join("member/Cargo.toml"))
+            .expect("should translate member");
+        match mutation {
+            "root_bytes" => fs::write(
+                fixture.workspace.root.join("Cargo.toml"),
+                b"[workspace.package]\nversion='9.0.0'\n",
+            )
+            .expect("should replace root"),
+            "version" => fixture.observed.packages[0].version = "9.0.0".to_owned(),
+            "nested" => {
+                let nested = b"[workspace]\n[workspace.package]\nversion='1.0.0'\n";
+                fs::create_dir(fixture.workspace.root.join("member/nested"))
+                    .expect("should create nested member");
+                fs::write(fixture.workspace.root.join("member/Cargo.toml"), nested)
+                    .expect("should write nested workspace");
+                fixture
+                    .workspace
+                    .manifests
+                    .insert(PathBuf::from("member/Cargo.toml"), digest(nested));
+                fs::write(
+                    fixture.workspace.root.join("member/nested/Cargo.toml"),
+                    member,
+                )
+                .expect("should write nested package");
+                fixture
+                    .workspace
+                    .manifests
+                    .insert(PathBuf::from("member/nested/Cargo.toml"), digest(member));
+                fixture.observed.packages[0].manifest_path = Paths
+                    .execution_path(&fixture.workspace.root.join("member/nested/Cargo.toml"))
+                    .expect("should translate nested member");
+            }
+            _ => {}
+        }
+        assert_eq!(
+            fixture.join().is_ok(),
+            mutation == "none",
+            "should enforce reviewed inheritance for {mutation}"
+        );
+    }
+}
+
+#[test]
+fn git_join_preserves_exact_revision_trees_and_normalization_without_native_archive_authority() {
+    for mutation in ["none", "revision", "manifest", "source_null"] {
+        let mut fixture = Fixture::workspace();
+        let manifest = b"[package]\nname='example'\nversion='1.0.0'\n";
+        let root = fixture.materials.vendor_dir().join("example");
+        fs::create_dir(&root).expect("should create Git package");
+        fs::write(root.join("Cargo.toml"), manifest).expect("should write normalized manifest");
+        let source = format!(
+            "git+https://example.com/repository?rev=reviewed#{}",
+            "e".repeat(40)
+        );
+        let original = CargoOrigin::Git {
+            revision: "e".repeat(40),
+            repository_tree: "f".repeat(40),
+            package_tree: "1".repeat(40),
+            package_path: "member".to_owned(),
+            committed_manifest_blob: "2".repeat(40),
+            committed_manifest_sha256: "3".repeat(64),
+            normalized_manifest_sha256: Some(digest(manifest)),
+        };
+        let package = crate::materials::VerifiedCargoPackage::registry_for_tests(
+            "example",
+            "1.0.0",
+            &source,
+            &digest(manifest),
+            &"d".repeat(64),
+        )
+        .with_origin_for_tests(original);
+        let unused = package.clone();
+        fs::create_dir(fixture.materials.vendor_dir().join("unused"))
+            .expect("should create unused prepared package");
+        fs::write(
+            fixture.materials.vendor_dir().join("unused/Cargo.toml"),
+            manifest,
+        )
+        .expect("should write unused prepared manifest");
+        fixture.materials =
+            PreparedCargoMaterials::for_tests(fixture.materials.root(), &"a".repeat(40), &[])
+                .expect("should measure Git vendor")
+                .with_package_for_tests("example", package)
+                .with_package_for_tests("unused", unused);
+        fixture.observed.packages[0].manifest_path = Paths
+            .execution_path(&root.join("Cargo.toml"))
+            .expect("should translate Git manifest");
+        fixture.observed.packages[0].source = Some(source);
+        match mutation {
+            "revision" => {
+                fixture.observed.packages[0].source = Some(format!(
+                    "git+https://example.com/repository?rev=reviewed#{}",
+                    "9".repeat(40)
+                ))
+            }
+            "manifest" => {
+                fixture.observed.packages[0].manifest_path = Paths
+                    .execution_path(&fixture.workspace.root.join("Cargo.toml"))
+                    .expect("should translate wrong manifest")
+            }
+            "source_null" => fixture.observed.packages[0].source = None,
+            _ => {}
+        }
+        if mutation == "none" {
+            let result = fixture.join().expect("should join exact Git identity");
+            assert_eq!(
+                result.packages.len(),
+                1,
+                "should exclude prepared unused package"
+            );
+            assert!(
+                result.native_sources().is_empty(),
+                "should not treat Git tree as original registry archive"
+            );
+            let serialized = serde_json::to_value(result).expect("should serialize exact origin");
+            assert_eq!(
+                serialized["packages"]["opaque identity"]["origin"]["original"]["revision"],
+                "e".repeat(40),
+                "should retain exact revision"
+            );
+            assert_eq!(
+                serialized["packages"]["opaque identity"]["origin"]["original"]["normalized_manifest_sha256"],
+                digest(manifest),
+                "should retain normalization digest"
+            );
+        } else {
+            assert!(
+                fixture.join().is_err(),
+                "should reject {mutation} substitution"
+            );
+        }
+    }
+}
diff --git a/crates/trusted-server-release/src/composition/platform.rs b/crates/trusted-server-release/src/composition/platform.rs
new file mode 100644
index 0000000000..caddbe5f73
--- /dev/null
+++ b/crates/trusted-server-release/src/composition/platform.rs
@@ -0,0 +1,208 @@
+//! Candidate installed-tool identities and artifact-bound external requirements.
+
+use error_stack::Report;
+use serde::Serialize;
+
+use super::composition_error;
+use super::external::ExternalRequirements;
+use crate::documents::lower_hex;
+use crate::error::ReleaseError;
+use crate::policy::ReleaseTarget;
+use crate::recipe::{AppleDeveloperTools, AppleToolEvidence, RustToolEvidence, SelectedRustTools};
+
+/// Candidate platform observations without original acquisition or qualification.
+#[derive(Debug, Serialize)]
+pub(crate) struct PlatformEvidence {
+    target: &'static str,
+    artifact_sha256: String,
+    rust: RustToolEvidence,
+    apple: Option<AppleToolEvidence>,
+    external_requirements: ExternalRequirements,
+    native_tools: NativeToolCoverage,
+    material_native_coverage_complete: bool,
+}
+
+#[derive(Debug, Serialize)]
+#[serde(tag = "scope", rename_all = "snake_case")]
+enum NativeToolCoverage {
+    ExplicitFastlyHostFiles {
+        evidence: Box<crate::recipe::fastly_tools::FastlyToolEvidence>,
+    },
+    HostPathUnresolved {
+        roles: [&'static str; 5],
+    },
+    ExplicitAppleFiles {
+        full_closure_measured: bool,
+    },
+    ExplicitGnuImage {
+        evidence: Box<crate::recipe::gnu::GnuEvidence>,
+    },
+}
+
+impl PlatformEvidence {
+    /// Returns the selected target triple.
+    pub(crate) fn target(&self) -> &str {
+        self.target
+    }
+    /// Returns the accepted executable's raw-byte digest.
+    pub(crate) fn artifact_sha256(&self) -> &str {
+        &self.artifact_sha256
+    }
+    /// Borrows the measured installed Rust identity.
+    pub(crate) fn rust(&self) -> &RustToolEvidence {
+        &self.rust
+    }
+    /// Borrows exact Apple observations, including their exclusions.
+    pub(crate) fn apple(&self) -> Option<&AppleToolEvidence> {
+        self.apple.as_ref()
+    }
+    /// Borrows the owning GNU measurement, when actually captured.
+    pub(crate) fn gnu(&self) -> Option<&crate::recipe::gnu::GnuEvidence> {
+        match &self.native_tools {
+            NativeToolCoverage::ExplicitGnuImage { evidence } => Some(evidence.as_ref()),
+            _ => None,
+        }
+    }
+    /// Borrows bounded selected Fastly host files when measured by execution.
+    pub(crate) fn fastly_tools(&self) -> Option<&crate::recipe::fastly_tools::FastlyToolEvidence> {
+        match &self.native_tools {
+            NativeToolCoverage::ExplicitFastlyHostFiles { evidence } => Some(evidence),
+            _ => None,
+        }
+    }
+    /// Attaches measured selected Linux host files to the Fastly target.
+    ///
+    /// # Errors
+    ///
+    /// Rejects attachment to another target.
+    pub(crate) fn with_fastly_tools(
+        mut self,
+        evidence: crate::recipe::fastly_tools::FastlyToolEvidence,
+    ) -> Result<Self, Report<ReleaseError>> {
+        if self.target != ReleaseTarget::Wasm32Wasip1.triple() {
+            return Err(composition_error(
+                "Fastly host tools belong to another target",
+            ));
+        }
+        self.native_tools = NativeToolCoverage::ExplicitFastlyHostFiles {
+            evidence: Box::new(evidence),
+        };
+        Ok(self)
+    }
+    /// Borrows the accepted executable's logical runtime requirements.
+    pub(crate) fn external_requirements(&self) -> &ExternalRequirements {
+        &self.external_requirements
+    }
+    /// Returns native tool roles whose host paths were never resolved or measured.
+    pub(crate) fn unresolved_native_tool_roles(&self) -> &[&'static str] {
+        match &self.native_tools {
+            NativeToolCoverage::HostPathUnresolved { roles } => roles,
+            NativeToolCoverage::ExplicitFastlyHostFiles { .. } => &["assembler", "build_tools"],
+            NativeToolCoverage::ExplicitAppleFiles { .. }
+            | NativeToolCoverage::ExplicitGnuImage { .. } => &[],
+        }
+    }
+    /// Returns whether explicit Apple files lack a measured full tool closure.
+    pub(crate) fn apple_tool_closure_unmeasured(&self) -> bool {
+        matches!(
+            self.native_tools,
+            NativeToolCoverage::ExplicitAppleFiles {
+                full_closure_measured: false
+            }
+        )
+    }
+    /// Returns whether material native coverage is recorded as complete.
+    pub(crate) fn material_native_coverage_complete(&self) -> bool {
+        self.material_native_coverage_complete
+    }
+    /// Attaches the owning GNU execution's measured installed-image evidence.
+    ///
+    /// # Errors
+    ///
+    /// Rejects attachment to another target; measurement constructors remain
+    /// private to the actual denied recipe execution.
+    pub(crate) fn with_gnu(
+        mut self,
+        evidence: crate::recipe::gnu::GnuEvidence,
+    ) -> Result<Self, Report<ReleaseError>> {
+        if self.target != ReleaseTarget::X86_64UnknownLinuxGnu.triple() {
+            return Err(composition_error(
+                "GNU image evidence belongs to another target",
+            ));
+        }
+        self.native_tools = NativeToolCoverage::ExplicitGnuImage {
+            evidence: Box::new(evidence),
+        };
+        Ok(self)
+    }
+    /// Binds measured selected tools to requirements from the accepted artifact.
+    ///
+    /// # Errors
+    ///
+    /// Rejects mismatched artifact/target identities or changed bound tools.
+    pub(crate) fn collect(
+        tools: &SelectedRustTools,
+        bound_tools_digest: &str,
+        requirements: ExternalRequirements,
+        target: ReleaseTarget,
+        artifact_sha256: &str,
+    ) -> Result<Self, Report<ReleaseError>> {
+        if !lower_hex(bound_tools_digest, 64)
+            || !lower_hex(artifact_sha256, 64)
+            || tools.target() != target
+            || requirements.target() != target
+            || requirements.artifact_sha256() != artifact_sha256
+            || tools.apple().is_some() != target.is_darwin()
+        {
+            return Err(composition_error(
+                "candidate platform identities differ from selected inputs",
+            ));
+        }
+        if let Some(apple) = tools.apple()
+            && requirements.macho_sdk() != Some(apple.sdk_version().to_string().as_str())
+        {
+            return Err(composition_error(
+                "artifact SDK differs from selected Apple SDK",
+            ));
+        }
+        let rust = tools.candidate_measurement()?;
+        if rust.tree_sha256() != bound_tools_digest {
+            return Err(composition_error(
+                "Rust tools changed before platform measurement",
+            ));
+        }
+        // The Apple evidence is copied from the recorded facts after one
+        // verification inside `candidate_measurement`; nothing is read from
+        // disk afterwards, so a second Apple pass here would rehash the same
+        // SDK and toolchain without changing what the evidence states.
+        let apple = tools
+            .apple()
+            .map(AppleDeveloperTools::candidate_measurement)
+            .transpose()?;
+        if tools.digest()? != bound_tools_digest {
+            return Err(composition_error(
+                "Rust tools changed during platform measurement",
+            ));
+        }
+        Ok(Self {
+            target: target.triple(),
+            artifact_sha256: artifact_sha256.to_owned(),
+            rust,
+            apple,
+            external_requirements: requirements,
+            native_tools: if target.is_darwin() {
+                NativeToolCoverage::ExplicitAppleFiles {
+                    full_closure_measured: false,
+                }
+            } else {
+                NativeToolCoverage::HostPathUnresolved {
+                    roles: ["compiler", "assembler", "archiver", "linker", "build_tools"],
+                }
+            },
+            material_native_coverage_complete: false,
+        })
+    }
+}
+
+#[cfg(test)]
+pub(crate) mod tests;
diff --git a/crates/trusted-server-release/src/composition/platform/tests.rs b/crates/trusted-server-release/src/composition/platform/tests.rs
new file mode 100644
index 0000000000..60e8dfdc23
--- /dev/null
+++ b/crates/trusted-server-release/src/composition/platform/tests.rs
@@ -0,0 +1,397 @@
+use std::fs;
+use std::path::PathBuf;
+
+use sha2::{Digest as _, Sha256};
+use tempfile::TempDir;
+
+use super::*;
+use crate::inspect::tests::builders::{Command, ElfSpec, MachoSpec, elf, macho, wasm_module};
+use crate::inspect::{
+    ElfPolicy, MachoCpu, MachoPolicy, MacosVersion, inspect_elf, inspect_macho, inspect_wasm,
+};
+use crate::recipe::{AppleDeveloperTools, AppleToolFacts};
+
+struct Fixture {
+    _directory: TempDir,
+    root: PathBuf,
+    target: ReleaseTarget,
+}
+
+impl Fixture {
+    fn new(target: ReleaseTarget) -> Self {
+        let directory = tempfile::tempdir().expect("should allocate tool fixture");
+        let root = fs::canonicalize(directory.path()).expect("should canonicalize fixture");
+        let standard = root
+            .join("tools/lib/rustlib")
+            .join(target.triple())
+            .join("lib");
+        fs::create_dir_all(&standard).expect("should create selected target sysroot");
+        fs::create_dir_all(root.join("tools/bin")).expect("should create tool directory");
+        for path in [
+            root.join("tools/bin/cargo"),
+            root.join("tools/bin/rustc"),
+            standard.join("libstd-example.rlib"),
+        ] {
+            fs::write(path, b"fictional measured Rust input").expect("should write Rust fixture");
+        }
+        Self {
+            _directory: directory,
+            root,
+            target,
+        }
+    }
+
+    fn tools(&self) -> SelectedRustTools {
+        SelectedRustTools::for_tests(&self.root.join("tools"), self.target)
+            .expect("should select measured candidate tools")
+    }
+
+    fn apple(&self) -> AppleDeveloperTools {
+        self.apple_with_detached(false)
+    }
+
+    fn apple_with_detached(&self, detached: bool) -> AppleDeveloperTools {
+        let developer_dir = self.root.join("developer");
+        let bin = developer_dir.join("Toolchains/XcodeDefault.xctoolchain/usr/bin");
+        let sdk_root =
+            developer_dir.join("Platforms/MacOSX.platform/Developer/SDKs/MacOSX15.5.sdk");
+        fs::create_dir_all(&bin).expect("should create Apple tools");
+        fs::create_dir_all(&sdk_root).expect("should create SDK settings directory");
+        for path in [
+            bin.join("clang"),
+            bin.join("ar"),
+            bin.join("ld"),
+            sdk_root.join("SDKSettings.json"),
+        ] {
+            fs::write(path, b"fictional measured Apple input").expect("should write Apple fixture");
+        }
+        let digest = hex::encode(Sha256::digest(b"fictional measured Apple input"));
+        let facts = AppleToolFacts {
+            developer_dir,
+            sdk_root,
+            clang: bin.join("clang"),
+            ar: bin.join("ar"),
+            ld: bin.join("ld"),
+            xcode_version: "16.4".to_owned(),
+            sdk_version: MacosVersion::new(15, 5),
+            clang_sha256: digest.clone(),
+            ar_sha256: digest.clone(),
+            ld_sha256: digest.clone(),
+            sdk_settings_sha256: digest,
+        };
+        if detached {
+            AppleDeveloperTools::with_detached_sdk_for_tests(
+                facts,
+                std::time::Instant::now() + std::time::Duration::from_secs(30),
+                &crate::process::Cancellation::default(),
+            )
+            .expect("should stage fictional detached SDK")
+        } else {
+            AppleDeveloperTools::from_facts_for_tests(facts)
+                .expect("should select measured Apple candidate")
+        }
+    }
+}
+
+fn requirements(target: ReleaseTarget) -> ExternalRequirements {
+    match target {
+        ReleaseTarget::Wasm32Wasip1 => ExternalRequirements::from_wasm(
+            &inspect_wasm(&wasm_module(&[("fastly_http_req", "downstream_get")]))
+                .expect("should accept fixture Wasm"),
+        ),
+        ReleaseTarget::X86_64UnknownLinuxGnu => ExternalRequirements::from_elf(
+            &inspect_elf(&elf(&ElfSpec::conforming()), &ElfPolicy::linux_x86_64_gnu())
+                .expect("should accept fixture ELF"),
+        ),
+        ReleaseTarget::Aarch64AppleDarwin | ReleaseTarget::X86_64AppleDarwin => {
+            let cpu = if target == ReleaseTarget::Aarch64AppleDarwin {
+                MachoCpu::Arm64
+            } else {
+                MachoCpu::X86_64
+            };
+            let mut spec = MachoSpec::conforming();
+            if target == ReleaseTarget::X86_64AppleDarwin {
+                spec.cputype = object::macho::CPU_TYPE_X86_64;
+                spec.cpusubtype = object::macho::CPU_SUBTYPE_X86_64_ALL;
+            }
+            ExternalRequirements::from_macho(
+                &inspect_macho(&macho(&spec), &MachoPolicy::macos(cpu))
+                    .expect("should accept fixture Mach-O"),
+            )
+        }
+    }
+}
+
+fn collect(
+    fixture: &Fixture,
+    tools: &SelectedRustTools,
+) -> Result<PlatformEvidence, Report<ReleaseError>> {
+    let external = requirements(fixture.target);
+    let artifact = external.artifact_sha256().to_owned();
+    PlatformEvidence::collect(tools, &tools.digest()?, external, fixture.target, &artifact)
+}
+
+/// Constructs typed platform fixtures only by measuring fictional tool files.
+pub(crate) fn projection_fixture(target: ReleaseTarget) -> PlatformEvidence {
+    let fixture = Fixture::new(target);
+    let tools = if target.is_darwin() {
+        fixture.tools().with_apple_developer_tools(fixture.apple())
+    } else {
+        fixture.tools()
+    };
+    collect(&fixture, &tools).expect("should collect measured platform fixture")
+}
+
+/// Measures an actual detached fictional SDK for the platform adapter tests.
+pub(crate) fn projection_detached_sdk_fixture() -> PlatformEvidence {
+    let fixture = Fixture::new(ReleaseTarget::Aarch64AppleDarwin);
+    let tools = fixture
+        .tools()
+        .with_apple_developer_tools(fixture.apple_with_detached(true));
+    collect(&fixture, &tools).expect("should collect detached SDK fixture")
+}
+
+/// Measures a detached SDK and an in-place fictional toolchain.
+pub(crate) fn projection_measured_toolchain_fixture() -> PlatformEvidence {
+    projection_toolchain_with_libtapi_fixture(false)
+}
+
+/// Measures a fictional toolchain with an explicitly selected optional TAPI file.
+pub(crate) fn projection_toolchain_with_libtapi_fixture(libtapi: bool) -> PlatformEvidence {
+    let fixture = Fixture::new(ReleaseTarget::Aarch64AppleDarwin);
+    let apple = fixture.apple_with_detached(true);
+    let usr = fixture
+        .root
+        .join("developer/Toolchains/XcodeDefault.xctoolchain/usr");
+    fs::create_dir_all(usr.join("lib/clang/17/include"))
+        .expect("should create fictional resource directory");
+    fs::write(usr.join("lib/libLTO.dylib"), b"fictional libLTO")
+        .expect("should write fictional libLTO");
+    if libtapi {
+        fs::write(usr.join("lib/libtapi.dylib"), b"fictional libtapi")
+            .expect("should write fictional libtapi");
+    }
+    fs::write(
+        usr.join("lib/clang/17/include/stddef.h"),
+        b"fictional header",
+    )
+    .expect("should write fictional resource header");
+    let apple = apple
+        .with_measured_toolchain_for_tests(
+            std::time::Instant::now() + std::time::Duration::from_secs(30),
+            &crate::process::Cancellation::default(),
+        )
+        .expect("should measure fictional toolchain");
+    let tools = fixture.tools().with_apple_developer_tools(apple);
+    collect(&fixture, &tools).expect("should collect measured toolchain fixture")
+}
+
+#[test]
+fn candidate_platform_receipt_binds_actual_tools_and_external_artifact_without_completing_coverage()
+{
+    let fixture = Fixture::new(ReleaseTarget::X86_64UnknownLinuxGnu);
+    let tools = fixture.tools();
+    let receipt = collect(&fixture, &tools).expect("should bind candidate platform evidence");
+    let value = serde_json::to_value(receipt).expect("should serialize platform receipt");
+    assert_eq!(
+        value["rust"]["tree_sha256"],
+        tools.digest().expect("should measure tree"),
+        "should bind actual selected tool tree"
+    );
+    assert_eq!(
+        value["target"], "x86_64-unknown-linux-gnu",
+        "should preserve selected target"
+    );
+    assert_eq!(
+        value["artifact_sha256"], value["external_requirements"]["artifact_sha256"],
+        "should bind requirements to inspected executable"
+    );
+    assert_eq!(
+        value["material_native_coverage_complete"], false,
+        "should retain incomplete coverage gate"
+    );
+    assert_eq!(
+        value["native_tools"]["scope"], "host_path_unresolved",
+        "should not invent identities for Linux host PATH tools"
+    );
+    assert_eq!(
+        value["native_tools"]["roles"],
+        serde_json::json!(["compiler", "assembler", "archiver", "linker", "build_tools"]),
+        "should retain every unresolved native tool role"
+    );
+    assert_eq!(
+        value["rust"]["qualification"], "unqualified",
+        "should preserve candidate measurement authority"
+    );
+}
+
+#[test]
+fn platform_binding_rejects_tool_target_requirement_target_artifact_and_digest_mismatches() {
+    for mismatch in [
+        "tool_target",
+        "requirements_target",
+        "artifact",
+        "bound_digest",
+    ] {
+        let fixture = Fixture::new(ReleaseTarget::Wasm32Wasip1);
+        let tools = fixture.tools();
+        let external = requirements(
+            if matches!(mismatch, "tool_target" | "requirements_target") {
+                ReleaseTarget::X86_64UnknownLinuxGnu
+            } else {
+                fixture.target
+            },
+        );
+        let artifact = if mismatch == "artifact" {
+            "a".repeat(64)
+        } else {
+            external.artifact_sha256().to_owned()
+        };
+        let bound = if mismatch == "bound_digest" {
+            "b".repeat(64)
+        } else {
+            tools.digest().expect("should measure bound tools")
+        };
+        let target = if mismatch == "tool_target" {
+            ReleaseTarget::X86_64UnknownLinuxGnu
+        } else {
+            fixture.target
+        };
+        assert!(
+            PlatformEvidence::collect(&tools, &bound, external, target, &artifact).is_err(),
+            "should reject {mismatch}"
+        );
+    }
+}
+
+#[test]
+fn platform_binding_rejects_rust_compiler_and_sysroot_changes_after_binding() {
+    for relative in [
+        "bin/rustc",
+        "lib/rustlib/wasm32-wasip1/lib/libstd-example.rlib",
+    ] {
+        let fixture = Fixture::new(ReleaseTarget::Wasm32Wasip1);
+        let tools = fixture.tools();
+        let bound = tools
+            .digest()
+            .expect("should measure tools before mutation");
+        fs::write(
+            fixture.root.join("tools").join(relative),
+            b"changed selected tool input",
+        )
+        .expect("should change tool input");
+        let external = requirements(fixture.target);
+        let artifact = external.artifact_sha256().to_owned();
+        assert!(
+            PlatformEvidence::collect(&tools, &bound, external, fixture.target, &artifact).is_err(),
+            "should reject changed {relative}"
+        );
+    }
+}
+
+#[test]
+fn darwin_platform_receipt_requires_apple_files_and_retains_sdk_coverage_exclusions() {
+    let fixture = Fixture::new(ReleaseTarget::Aarch64AppleDarwin);
+    assert!(
+        collect(&fixture, &fixture.tools()).is_err(),
+        "should require selected Apple tools for Darwin"
+    );
+    let tools = fixture.tools().with_apple_developer_tools(fixture.apple());
+    let receipt = collect(&fixture, &tools).expect("should retain measured Apple files");
+    let value = serde_json::to_value(receipt).expect("should serialize Apple receipt");
+    assert_eq!(
+        value["apple"]["coverage_exclusions"],
+        serde_json::json!([
+            "sdk_headers",
+            "sdk_stubs",
+            "sdk_frameworks",
+            "tool_helpers",
+            "liblto",
+            "clang_resource_directory",
+            "toolchain_libraries"
+        ]),
+        "should never imply complete SDK coverage"
+    );
+    assert_eq!(
+        value["native_tools"]["full_closure_measured"], false,
+        "should retain incomplete native tool closure"
+    );
+    fs::write(
+        tools.apple().expect("should have Apple selection").clang(),
+        b"changed Apple compiler",
+    )
+    .expect("should change selected Apple tool");
+    assert!(
+        collect(&fixture, &tools).is_err(),
+        "should reject changed Apple files"
+    );
+}
+
+#[test]
+fn non_darwin_platform_receipt_rejects_apple_selection() {
+    let fixture = Fixture::new(ReleaseTarget::Wasm32Wasip1);
+    let tools = fixture.tools().with_apple_developer_tools(fixture.apple());
+    assert!(
+        collect(&fixture, &tools).is_err(),
+        "should reject Apple selection for a non-Darwin target"
+    );
+}
+
+#[test]
+fn platform_binding_rejects_an_artifact_built_for_another_apple_sdk() {
+    let fixture = Fixture::new(ReleaseTarget::Aarch64AppleDarwin);
+    let tools = fixture.tools().with_apple_developer_tools(fixture.apple());
+    let mut spec = MachoSpec::conforming();
+    for command in &mut spec.commands {
+        if let Command::BuildVersion { platform, minos } = *command {
+            *command = Command::BuildVersionSdk {
+                platform,
+                minos,
+                sdk: (15 << 16) | (4 << 8),
+            };
+        }
+    }
+    let facts = inspect_macho(&macho(&spec), &MachoPolicy::macos(MachoCpu::Arm64))
+        .expect("should inspect an otherwise accepted executable with another SDK");
+    let external = ExternalRequirements::from_macho(&facts);
+    assert!(
+        PlatformEvidence::collect(
+            &tools,
+            &tools.digest().expect("should measure bound tools"),
+            external,
+            fixture.target,
+            facts.sha256(),
+        )
+        .is_err(),
+        "should reject a recorded SDK differing from selected Apple tools"
+    );
+}
+
+#[test]
+fn fastly_tool_attachment_preserves_target_and_receipt_incompleteness() {
+    let platform = projection_fixture(ReleaseTarget::Wasm32Wasip1)
+        .with_fastly_tools(crate::recipe::fastly_tools::FastlyToolEvidence::projection_fixture())
+        .expect("should attach selected Fastly host files");
+    assert_eq!(
+        platform.unresolved_native_tool_roles(),
+        ["assembler", "build_tools"],
+        "should retain unmeasured closure roles"
+    );
+    assert!(
+        !platform.material_native_coverage_complete(),
+        "should retain incomplete native material coverage"
+    );
+    let receipt = serde_json::to_value(&platform).expect("should serialize receipt");
+    assert_eq!(
+        receipt["native_tools"]["evidence"]["full_closure_measured"], false,
+        "should preserve bounded measurement scope"
+    );
+    assert!(
+        projection_fixture(ReleaseTarget::X86_64UnknownLinuxGnu)
+            .with_fastly_tools(
+                crate::recipe::fastly_tools::FastlyToolEvidence::projection_fixture()
+            )
+            .is_err(),
+        "should reject another target"
+    );
+}
diff --git a/crates/trusted-server-release/src/composition/tests.rs b/crates/trusted-server-release/src/composition/tests.rs
new file mode 100644
index 0000000000..94ebcf71af
--- /dev/null
+++ b/crates/trusted-server-release/src/composition/tests.rs
@@ -0,0 +1,491 @@
+use std::path::PathBuf;
+
+use serde_json::{Value, json};
+
+use super::*;
+use crate::policy::ReleaseTarget;
+
+const PACKAGE: &str = "registry+https://example.com/index#example@1.0.0";
+const OTHER: &str = "git+https://example.com/source#example@1.0.0";
+
+fn layout() -> CargoLayout {
+    CargoLayout::new(
+        ReleaseTarget::Wasm32Wasip1,
+        PathBuf::from("/build/target"),
+        PathBuf::from("/build/source"),
+    )
+    .expect("should accept the explicit build layout")
+}
+
+fn target(kind: &str) -> Value {
+    json!({
+        "name": "example", "kind": [kind], "crate_types": [kind],
+        "src_path": "/build/vendor/example/src/lib.rs"
+    })
+}
+
+fn metadata() -> Value {
+    let package = |id: &str| {
+        json!({
+            "id": id, "name": "example", "version": "1.0.0",
+        "source": if id == OTHER { "git+https://example.com/source" } else { "registry+https://example.com/index" },
+            "manifest_path": "/build/vendor/example/Cargo.toml",
+            "license": "MIT", "targets": [target("lib"), target("custom-build"), target("proc-macro")]
+        })
+    };
+    json!({
+        "version": 1, "workspace_root": "/build/source", "target_directory": "/build/target",
+        "packages": [package(PACKAGE), package(OTHER)],
+        "resolve": {"nodes": [
+            {"id": PACKAGE, "features": ["host", "target", "unused-union-feature"], "dependencies": []},
+            {"id": OTHER, "features": [], "dependencies": []}
+        ]}
+    })
+}
+
+fn unit(id: &str, kind: &str, host: bool, features: &[&str]) -> Value {
+    let prefix = if host {
+        "/build/target/release"
+    } else {
+        "/build/target/wasm32-wasip1/release"
+    };
+    json!({
+        "reason": "compiler-artifact", "package_id": id,
+        "manifest_path": "/build/vendor/example/Cargo.toml", "target": target(kind),
+        "profile": {"test": false, "opt_level": "3", "debuginfo": 1},
+        "features": features, "filenames": [format!("{prefix}/deps/example.rlib")],
+        "executable": null, "fresh": false
+    })
+}
+
+fn stream(messages: &[Value]) -> Vec<u8> {
+    let mut bytes = Vec::new();
+    for message in messages
+        .iter()
+        .chain([&json!({"reason": "build-finished", "success": true})])
+    {
+        bytes.extend(serde_json::to_vec(message).expect("should encode a message"));
+        bytes.push(b'\n');
+    }
+    bytes
+}
+
+fn observe(meta: &Value, messages: &[Value]) -> CargoObservations {
+    observe_cargo(
+        &serde_json::to_vec(meta).expect("should encode metadata"),
+        &stream(messages),
+        &layout(),
+    )
+    .expect("should join the observed compilation units")
+}
+
+#[test]
+fn host_and_target_units_keep_observed_features_instead_of_metadata_union() {
+    let observed = observe(
+        &metadata(),
+        &[
+            unit(PACKAGE, "lib", true, &["host"]),
+            unit(PACKAGE, "lib", false, &["target"]),
+        ],
+    );
+    assert_eq!(
+        observed.units().len(),
+        2,
+        "should retain both compilation contexts"
+    );
+    let features: Vec<_> = observed
+        .units()
+        .iter()
+        .map(|unit| unit.features().to_vec())
+        .collect();
+    assert!(
+        features.contains(&vec!["host".to_owned()]),
+        "should retain host features"
+    );
+    assert!(
+        features.contains(&vec!["target".to_owned()]),
+        "should retain target features"
+    );
+    assert!(
+        observed
+            .units()
+            .iter()
+            .all(|unit| !unit.features().contains(&"unused-union-feature".to_owned())),
+        "should not substitute package-union features"
+    );
+    assert_eq!(
+        observed.packages().len(),
+        1,
+        "should exclude uncompiled metadata packages"
+    );
+}
+
+#[test]
+fn identical_names_and_versions_from_distinct_sources_remain_separate() {
+    let observed = observe(
+        &metadata(),
+        &[
+            unit(PACKAGE, "lib", false, &[]),
+            unit(OTHER, "lib", false, &[]),
+        ],
+    );
+    assert_eq!(
+        observed.packages.len(),
+        2,
+        "should join by exact opaque package ID"
+    );
+}
+
+#[test]
+fn ambiguous_or_missing_package_and_target_joins_are_rejected() {
+    let cases = [
+        "missing-package",
+        "duplicate-package",
+        "manifest",
+        "target",
+        "workspace",
+        "target-directory",
+    ];
+    for case in cases {
+        let mut meta = metadata();
+        let mut message = unit(PACKAGE, "lib", false, &[]);
+        match case {
+            "missing-package" => message["package_id"] = json!("missing"),
+            "duplicate-package" => {
+                let duplicate = meta["packages"][0].clone();
+                meta["packages"]
+                    .as_array_mut()
+                    .expect("should hold packages")
+                    .push(duplicate);
+            }
+            "manifest" => message["manifest_path"] = json!("/build/other/Cargo.toml"),
+            "target" => message["target"]["src_path"] = json!("/build/other/lib.rs"),
+            "workspace" => meta["workspace_root"] = json!("/another/source"),
+            "target-directory" => meta["target_directory"] = json!("/another/target"),
+            _ => unreachable!("should enumerate each case"),
+        }
+        assert!(
+            observe_cargo(
+                &serde_json::to_vec(&meta).expect("should encode metadata"),
+                &stream(&[message]),
+                &layout()
+            )
+            .is_err(),
+            "should reject {case}"
+        );
+    }
+}
+
+#[test]
+fn invalid_unit_context_freshness_and_features_are_rejected() {
+    for case in [
+        "outside",
+        "mixed",
+        "proc-macro-target",
+        "cached",
+        "test",
+        "duplicate-feature",
+        "duplicate-unit",
+    ] {
+        let mut message = unit(PACKAGE, "lib", false, &[]);
+        match case {
+            "outside" => message["filenames"] = json!(["/elsewhere/example.rlib"]),
+            "mixed" => {
+                message["filenames"] = json!([
+                    "/build/target/release/deps/a.rlib",
+                    "/build/target/wasm32-wasip1/release/deps/a.rlib"
+                ])
+            }
+            "proc-macro-target" => message["target"] = target("proc-macro"),
+            "cached" => message["fresh"] = json!(true),
+            "test" => message["profile"]["test"] = json!(true),
+            "duplicate-feature" => message["features"] = json!(["same", "same"]),
+            "duplicate-unit" => {}
+            _ => unreachable!("should enumerate each case"),
+        }
+        let messages = if case == "duplicate-unit" {
+            vec![message.clone(), message]
+        } else {
+            vec![message]
+        };
+        assert!(
+            observe_cargo(
+                &serde_json::to_vec(&metadata()).expect("should encode metadata"),
+                &stream(&messages),
+                &layout()
+            )
+            .is_err(),
+            "should reject {case}"
+        );
+    }
+}
+
+#[test]
+fn build_script_execution_keeps_link_and_context_observations_separate() {
+    let script = json!({
+        "reason": "build-script-executed", "package_id": PACKAGE,
+        "out_dir": "/build/target/wasm32-wasip1/release/build/example-123/out",
+        "linked_libs": ["static=example"], "linked_paths": ["native=/build/target/wasm32-wasip1/release/build/example-123/out"],
+        "cfgs": ["example"], "env": [["EXAMPLE", "observed"]]
+    });
+    let observed = observe(
+        &metadata(),
+        &[unit(PACKAGE, "custom-build", true, &["host"]), script],
+    );
+    assert_eq!(
+        observed.build_scripts.len(),
+        1,
+        "should retain the execution record"
+    );
+    assert_eq!(observed.build_scripts[0].context, UnitContext::Target);
+    assert_eq!(observed.build_scripts[0].linked_libs, ["static=example"]);
+    assert_eq!(observed.units[0].context, UnitContext::Host);
+}
+
+#[test]
+fn duplicate_json_and_failed_or_unterminated_streams_are_rejected() {
+    let meta = serde_json::to_vec(&metadata()).expect("should encode metadata");
+    for bytes in [
+        b"{\"reason\":\"build-finished\",\"success\":false}\n".as_slice(),
+        b"{\"reason\":\"build-finished\",\"reason\":\"build-finished\",\"success\":true}\n",
+        b"{\"reason\":\"build-finished\",\"success\":true}",
+    ] {
+        assert!(
+            observe_cargo(&meta, bytes, &layout()).is_err(),
+            "should reject invalid stream"
+        );
+    }
+    assert!(
+        observe_cargo(b"{\"version\":1,\"version\":1}", &stream(&[]), &layout()).is_err(),
+        "should reject duplicate metadata keys before insertion"
+    );
+}
+
+#[test]
+fn retained_raw_and_normalized_observations_are_rehashed_before_handoff() {
+    let meta = serde_json::to_vec(&metadata()).expect("should encode metadata");
+    let capture = CargoCapture::new(
+        meta,
+        b"0example v1.0.0\n".to_vec(),
+        &stream(&[unit(PACKAGE, "lib", false, &[])]),
+        &layout(),
+        ["a".repeat(64), "b".repeat(64)],
+    )
+    .expect("should capture checked observations");
+    let retained = tempfile::tempdir().expect("should create export storage");
+    capture
+        .retain(retained.path())
+        .expect("should retain the observations");
+    assert!(
+        capture.export(retained.path()).is_err(),
+        "should not export summary-only observations as actual composition receipts"
+    );
+    assert!(
+        capture.view(retained.path()).is_err(),
+        "should not expose a typed owner view without sealed receipts"
+    );
+    for name in [
+        "cargo-metadata.json",
+        "cargo-tree.txt",
+        "cargo-observations.json",
+    ] {
+        let directory = tempfile::tempdir().expect("should create retained storage");
+        capture
+            .retain(directory.path())
+            .expect("should retain all observations");
+        capture
+            .rehash(directory.path())
+            .expect("should rehash the retained observations");
+        std::fs::write(directory.path().join(name), b"changed")
+            .expect("should alter one observation");
+        assert!(
+            capture.rehash(directory.path()).is_err(),
+            "should reject changed {name}"
+        );
+        let error = match capture.view(directory.path()) {
+            Ok(_) => panic!("should refuse a typed owner view after changing {name}"),
+            Err(error) => error,
+        };
+        assert!(
+            format!("{error:?}").contains(&format!("retained {name} changed")),
+            "should rehash before checking receipt availability: {error:?}"
+        );
+    }
+    assert_eq!(
+        capture.summary()["material_native_coverage_complete"],
+        false
+    );
+    assert!(
+        capture
+            .require_binary(
+                std::path::Path::new("/build/vendor/example/Cargo.toml"),
+                "example",
+                std::path::Path::new("/build/target/wasm32-wasip1/release/example")
+            )
+            .is_err(),
+        "should not substitute a library for the accepted executable"
+    );
+}
+
+#[test]
+fn actual_cargo_195_observations_join_after_only_root_path_relocation() {
+    let metadata = include_bytes!("../../tests/fixtures/composition/cargo-1.95-metadata.json");
+    let messages = include_bytes!("../../tests/fixtures/composition/cargo-1.95-messages.jsonl");
+    let observed = observe_cargo(metadata, messages, &layout())
+        .expect("should parse actual Cargo 1.95 compilation and metadata shapes");
+    assert_eq!(
+        observed.units.len(),
+        2,
+        "should retain the build script and selected binary"
+    );
+    assert_eq!(
+        observed.build_scripts.len(),
+        1,
+        "should retain actual build-script execution"
+    );
+    assert_eq!(
+        observed.packages.len(),
+        1,
+        "should exclude uncompiled workspace members"
+    );
+    let captured = CargoCapture::new(
+        metadata.to_vec(),
+        b"0control v0.1.0\n".to_vec(),
+        messages,
+        &layout(),
+        ["a".repeat(64), "b".repeat(64)],
+    )
+    .expect("should bind actual observed membership");
+    let selected = captured
+        .require_binary(
+            std::path::Path::new("/build/source/crates/control/Cargo.toml"),
+            "control",
+            std::path::Path::new("/build/target/wasm32-wasip1/release/control.wasm"),
+        )
+        .expect("should name the exact selected target binary");
+    assert_eq!(
+        selected, observed.units[0].package_id,
+        "should return the exact observed package identity for graph selection"
+    );
+}
+
+#[test]
+fn duplicate_metadata_targets_and_uncompiled_or_duplicate_scripts_are_rejected() {
+    let mut meta = metadata();
+    let duplicate = meta["packages"][0]["targets"][0].clone();
+    meta["packages"][0]["targets"]
+        .as_array_mut()
+        .expect("should hold targets")
+        .push(duplicate);
+    assert!(
+        observe_cargo(
+            &serde_json::to_vec(&meta).expect("should encode metadata"),
+            &stream(&[unit(PACKAGE, "lib", false, &[])]),
+            &layout()
+        )
+        .is_err(),
+        "should reject ambiguous metadata targets"
+    );
+    let script = json!({"reason": "build-script-executed", "package_id": PACKAGE,
+        "out_dir": "/build/target/wasm32-wasip1/release/build/example-123/out",
+        "linked_libs": [], "linked_paths": [], "cfgs": [], "env": []});
+    let meta = serde_json::to_vec(&metadata()).expect("should encode metadata");
+    assert!(
+        observe_cargo(&meta, &stream(std::slice::from_ref(&script)), &layout()).is_err(),
+        "should reject a script with no compiled host build-script unit"
+    );
+    assert!(
+        observe_cargo(
+            &meta,
+            &stream(&[
+                unit(PACKAGE, "custom-build", true, &[]),
+                script.clone(),
+                script
+            ]),
+            &layout()
+        )
+        .is_err(),
+        "should reject duplicate execution observations"
+    );
+    assert!(
+        observe_cargo(
+            &meta,
+            &stream(&[unit(PACKAGE, "custom-build", false, &[])]),
+            &layout()
+        )
+        .is_err(),
+        "should reject a build-script compiler output in the target context"
+    );
+}
+
+#[test]
+fn actual_cross_build_needs_unfiltered_identities_for_host_only_dependencies() {
+    let metadata =
+        include_bytes!("../../tests/fixtures/composition/cargo-1.95-cross-host-metadata.json");
+    let filtered = include_bytes!(
+        "../../tests/fixtures/composition/cargo-1.95-cross-target-filtered-metadata.json"
+    );
+    let messages =
+        include_bytes!("../../tests/fixtures/composition/cargo-1.95-cross-messages.jsonl");
+    let rejected = observe_cargo(filtered, messages, &layout()).expect_err(
+        "should reproduce target-filtered metadata omitting a compiled host dependency",
+    );
+    assert!(
+        format!("{rejected:?}").contains("example-host-unix"),
+        "should identify the missing compiled dependency"
+    );
+    let observed = observe_cargo(metadata, messages, &layout())
+        .expect("should join actual cross-build units to the complete identity catalog");
+    let host = observed
+        .packages
+        .iter()
+        .find(|package| package.name == "example-host-unix")
+        .expect("should retain observed host-only dependency");
+    assert!(
+        observed
+            .units
+            .iter()
+            .any(|unit| unit.package_id == host.id && unit.context == UnitContext::Host),
+        "should classify host-only dependency from actual compiler output"
+    );
+    assert_eq!(
+        observed.packages.len(),
+        3,
+        "should record the three actually compiled packages"
+    );
+    assert_eq!(
+        observed.units.len(),
+        4,
+        "should retain distinct app host build-script and target binary units"
+    );
+    let tree = include_bytes!("../../tests/fixtures/composition/cargo-1.95-cross-tree.txt");
+    let captured = CargoCapture::new(
+        metadata.to_vec(),
+        tree.to_vec(),
+        messages,
+        &layout(),
+        ["a".repeat(64), "b".repeat(64)],
+    )
+    .expect("should retain the catalog with actual explicit-target tree and build observations");
+    captured
+        .require_binary(
+            Path::new("/build/source/app/Cargo.toml"),
+            "example-app",
+            Path::new("/build/target/wasm32-wasip1/release/example-app.wasm"),
+        )
+        .expect("should bind the exact selected cross-build executable");
+}
+
+#[test]
+fn internal_metadata_and_stream_observation_bounds_are_enforced() {
+    let oversized = vec![b' '; 16 * 1024 * 1024 + 1];
+    let meta = serde_json::to_vec(&metadata()).expect("should encode metadata");
+    assert!(
+        observe_cargo(&oversized, &stream(&[]), &layout()).is_err(),
+        "should bound raw metadata"
+    );
+    assert!(
+        observe_cargo(&meta, &oversized, &layout()).is_err(),
+        "should bound total JSONL before splitting"
+    );
+}
diff --git a/crates/trusted-server-release/src/distribution.rs b/crates/trusted-server-release/src/distribution.rs
new file mode 100644
index 0000000000..b66d248539
--- /dev/null
+++ b/crates/trusted-server-release/src/distribution.rs
@@ -0,0 +1,546 @@
+//! Unqualified candidate release index assembled from completed builds.
+//!
+//! A [`CandidateIndex`] joins exactly one canonical entry per fixed cohort
+//! asset into release-index v1 bytes that pass the retained governing schema
+//! and mirrored consumer semantic checks. It is a candidate only:
+//!
+//! - its tag is the fixed sentinel [`CANDIDATE_TAG`], never a release tag;
+//! - its bytes are only ever named [`CANDIDATE_INDEX_NAME`], never
+//!   `release-index.json`;
+//! - both signature bundle slots are [`BundleSlot::AwaitingSignature`] and
+//!   render the true empty-file record, because [`SignedCompanions`] is
+//!   uninhabited and no file is written for them;
+//! - every unsigned companion carries `"release_qualification": false` and
+//!   its explicit gaps.
+//!
+//! No command, writer, signer or publisher consumes this module. Only the
+//! test-only `transfer` and `ordinary` modules write candidate files, for the
+//! ordinary-CI cross-job join. Nothing here grants signing, publication or
+//! qualification authority.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use error_stack::Report;
+use serde_json::{Value, json};
+use sha2::{Digest as _, Sha256};
+
+use crate::documents::{
+    Role as DocumentRole, canonical_json, is_safe_flat_name, lower_hex, parse_json,
+    validate_release_index, validate_release_index_artifact,
+};
+use crate::error::ReleaseError;
+use crate::policy::{COHORT_ID, FIXED_ARTIFACTS, REPOSITORY};
+use crate::recipe::AssetId;
+
+mod entry;
+mod joins;
+#[cfg(test)]
+mod ordinary;
+#[cfg(test)]
+mod summary;
+#[cfg(test)]
+pub(crate) mod transfer;
+
+#[cfg(test)]
+mod tests;
+
+#[allow(
+    unused_imports,
+    reason = "the completed-build entry path has no production caller yet"
+)]
+pub(crate) use entry::{
+    AcceptanceKind, CandidateAcceptance, candidate_entry_from_completed, check_candidate_owner,
+};
+
+/// Fixed tag of every candidate index; never an official release tag.
+pub(crate) const CANDIDATE_TAG: &str = "v0.0.0-unqualified-candidate";
+/// The only name candidate index bytes are ever given.
+pub(crate) const CANDIDATE_INDEX_NAME: &str = "candidate-release-index.json";
+/// Fixed name of the shared JS inventory asset.
+const INVENTORY_NAME: &str = "tsjs-inventory.json";
+/// SHA-256 of zero bytes: the true digest of an empty bundle file record.
+const EMPTY_SHA256: &str = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
+/// Gaps every candidate index states in addition to its entries' gaps.
+const INDEX_GAPS: [&str; 2] = [
+    "candidate-tag-sentinel",
+    "signature-bundles-awaiting-signature",
+];
+/// Signature bundle companion keys and their asset-name suffixes.
+const BUNDLE_SUFFIXES: [(&str, &str); 2] = [
+    ("provenance", ".provenance.sigstore.json"),
+    ("sbom_attestation", ".sbom.sigstore.json"),
+];
+
+/// Builds a distribution error carrying `message`.
+fn distribution_error(message: impl std::fmt::Display) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Distribution).attach(message.to_string())
+}
+
+/// Lowercase hexadecimal SHA-256 of the exact bytes.
+fn sha256_hex(bytes: &[u8]) -> String {
+    hex::encode(Sha256::digest(bytes))
+}
+
+/// Signed companion bundles; uninhabited until isolated signing exists.
+pub(crate) enum SignedCompanions {}
+
+/// One signature bundle slot of an index artifact entry.
+pub(crate) enum BundleSlot {
+    /// No bundle exists yet; the slot renders the true empty-file record.
+    AwaitingSignature,
+    /// A signed bundle; unreachable because [`SignedCompanions`] is uninhabited.
+    Signed(SignedCompanions),
+}
+
+impl BundleSlot {
+    /// Renders this slot's index file record under `name`.
+    fn record(&self, name: &str) -> Value {
+        match self {
+            Self::AwaitingSignature => json!({"name": name, "size": 0, "sha256": EMPTY_SHA256}),
+            Self::Signed(signed) => match *signed {},
+        }
+    }
+}
+
+/// The four present unsigned companion roles of one artifact entry.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum CompanionRole {
+    Sbom,
+    BuildEvidence,
+    BuildRecipe,
+    RebuildCheck,
+}
+
+impl CompanionRole {
+    const ALL: [Self; 4] = [
+        Self::Sbom,
+        Self::BuildEvidence,
+        Self::BuildRecipe,
+        Self::RebuildCheck,
+    ];
+
+    /// The index companion field name.
+    fn key(self) -> &'static str {
+        match self {
+            Self::Sbom => "sbom",
+            Self::BuildEvidence => "build_evidence",
+            Self::BuildRecipe => "build_recipe",
+            Self::RebuildCheck => "rebuild_check",
+        }
+    }
+
+    /// The required suffix after the asset name.
+    fn suffix(self) -> &'static str {
+        match self {
+            Self::Sbom => ".spdx.json",
+            Self::BuildEvidence => ".build-evidence.json",
+            Self::BuildRecipe => ".build-recipe.json",
+            Self::RebuildCheck => ".rebuild-check.json",
+        }
+    }
+
+    /// The byte bound of this companion role.
+    fn limit(self) -> u64 {
+        match self {
+            Self::Sbom => DocumentRole::Spdx.limit(),
+            Self::BuildEvidence | Self::BuildRecipe | Self::RebuildCheck => {
+                DocumentRole::Companion.limit()
+            }
+        }
+    }
+}
+
+/// One rendered unsigned companion and the identity recorded for it.
+#[derive(Clone, Debug)]
+struct CompanionFile {
+    role: CompanionRole,
+    name: String,
+    size: u64,
+    sha256: String,
+    bytes: Vec<u8>,
+}
+
+impl CompanionFile {
+    /// Records `bytes` under the role-derived name for `asset`.
+    fn new(role: CompanionRole, asset: &str, bytes: Vec<u8>) -> Self {
+        Self {
+            role,
+            name: format!("{asset}{}", role.suffix()),
+            size: bytes.len() as u64,
+            sha256: sha256_hex(&bytes),
+            bytes,
+        }
+    }
+
+    fn record(&self) -> Value {
+        json!({"name": self.name, "size": self.size, "sha256": self.sha256})
+    }
+}
+
+/// One canonical cohort asset's checked index entry and companion bytes.
+///
+/// Only [`candidate_entry_from_completed`] constructs it in production; its
+/// fields are private and production has no byte or JSON constructor. The
+/// single exception is test-only: `distribution::transfer` rebuilds an entry
+/// from an ordinary-CI job's transferred files and reruns every producer join
+/// over those bytes, so the four real entries can be joined across CI jobs.
+#[derive(Clone, Debug)]
+pub(crate) struct CandidateArtifactEntry {
+    asset: AssetId,
+    source_commit: String,
+    policy_version: u64,
+    policy_sha256: String,
+    inventory: Vec<u8>,
+    artifact_size: u64,
+    artifact_sha256: String,
+    companions: Vec<CompanionFile>,
+    gaps: Vec<String>,
+}
+
+impl CandidateArtifactEntry {
+    /// The cohort asset name of this entry.
+    pub(crate) fn name(&self) -> &'static str {
+        self.asset.artifact().name
+    }
+
+    /// Sorted, unique, non-empty gaps stated by this entry's companions.
+    pub(crate) fn gaps(&self) -> &[String] {
+        &self.gaps
+    }
+
+    /// Rehashes every companion and checks its role-derived safe name.
+    fn check_companions(&self, names: &mut BTreeSet<String>) -> Result<(), Report<ReleaseError>> {
+        let roles: Vec<CompanionRole> = self.companions.iter().map(|file| file.role).collect();
+        if roles != CompanionRole::ALL {
+            return Err(distribution_error(format!(
+                "entry `{}` must carry exactly its four unsigned companions",
+                self.name()
+            )));
+        }
+        for file in &self.companions {
+            if file.name != format!("{}{}", self.name(), file.role.suffix()) {
+                return Err(distribution_error(format!(
+                    "companion `{}` is not named for its asset and role",
+                    file.name.escape_debug()
+                )));
+            }
+            insert_name(names, &file.name)?;
+            if file.size == 0
+                || file.size > file.role.limit()
+                || file.size != file.bytes.len() as u64
+                || file.sha256 != sha256_hex(&file.bytes)
+            {
+                return Err(distribution_error(format!(
+                    "companion `{}` bytes differ from its recorded size or digest",
+                    file.name
+                )));
+            }
+        }
+        Ok(())
+    }
+
+    /// Renders this entry's index artifact object.
+    fn index_entry(&self, inventory_sha256: &str) -> Value {
+        let mut value = self.asset.artifact().index_identity();
+        value["size"] = json!(self.artifact_size);
+        value["sha256"] = json!(self.artifact_sha256);
+        value["js_inventory_sha256"] = json!(inventory_sha256);
+        let mut companions = serde_json::Map::new();
+        for file in &self.companions {
+            companions.insert(file.role.key().to_owned(), file.record());
+        }
+        for (key, suffix) in BUNDLE_SUFFIXES {
+            let name = format!("{}{suffix}", self.name());
+            companions.insert(key.to_owned(), BundleSlot::AwaitingSignature.record(&name));
+        }
+        value["companions"] = Value::Object(companions);
+        value
+    }
+}
+
+/// Inserts a safe flat name, rejecting case-insensitive duplicates.
+fn insert_name(names: &mut BTreeSet<String>, name: &str) -> Result<(), Report<ReleaseError>> {
+    if !is_safe_flat_name(name) {
+        return Err(distribution_error(format!(
+            "`{}` is not a safe flat release name",
+            name.escape_debug()
+        )));
+    }
+    if !names.insert(name.to_ascii_lowercase()) {
+        return Err(distribution_error(format!(
+            "`{name}` collides with another release name"
+        )));
+    }
+    Ok(())
+}
+
+/// Validated unsigned candidate index bytes and every file they name.
+///
+/// It carries no signature, publication or qualification capability.
+#[derive(Debug)]
+pub(crate) struct CandidateIndex {
+    bytes: Vec<u8>,
+    sha256: String,
+    inventory: Vec<u8>,
+    companions: BTreeMap<String, Vec<u8>>,
+    gaps: Vec<String>,
+}
+
+impl CandidateIndex {
+    /// The fixed candidate index name; never `release-index.json`.
+    pub(crate) fn name(&self) -> &'static str {
+        CANDIDATE_INDEX_NAME
+    }
+
+    /// The exact canonical index bytes.
+    pub(crate) fn bytes(&self) -> &[u8] {
+        &self.bytes
+    }
+
+    /// SHA-256 of the exact index bytes.
+    pub(crate) fn sha256(&self) -> &str {
+        &self.sha256
+    }
+
+    /// The exact shared JS inventory bytes the index names.
+    pub(crate) fn inventory(&self) -> &[u8] {
+        &self.inventory
+    }
+
+    /// The sixteen present unsigned companion files, by exact name.
+    pub(crate) fn companions(&self) -> &BTreeMap<String, Vec<u8>> {
+        &self.companions
+    }
+
+    /// Sorted, unique gaps of the index and all of its entries.
+    pub(crate) fn gaps(&self) -> &[String] {
+        &self.gaps
+    }
+}
+
+/// Assembles the candidate index from exactly one entry per cohort asset.
+///
+/// Entries may arrive in any order; artifacts are emitted sorted by name, so
+/// equal entries always render identical bytes.
+///
+/// # Errors
+///
+/// Rejects a missing, extra or duplicated asset, entries from different
+/// source commits, producer policies or inventories, unsafe or colliding
+/// names, companion bytes differing from their records, and any rendered
+/// index that fails the retained schema or mirrored consumer checks.
+pub(crate) fn assemble_candidate_index(
+    entries: &[CandidateArtifactEntry],
+) -> Result<CandidateIndex, Report<ReleaseError>> {
+    let ordered = cohort_order(entries)?;
+    let shared = check_shared_identity(&ordered)?;
+    let inventory_sha256 = sha256_hex(shared.inventory);
+    let mut names = BTreeSet::new();
+    insert_name(&mut names, CANDIDATE_INDEX_NAME)?;
+    insert_name(&mut names, INVENTORY_NAME)?;
+    let mut artifacts = Vec::with_capacity(ordered.len());
+    let mut companions = BTreeMap::new();
+    let mut gaps: BTreeSet<String> = INDEX_GAPS.iter().map(|gap| (*gap).to_owned()).collect();
+    for entry in &ordered {
+        insert_name(&mut names, entry.name())?;
+        entry.check_companions(&mut names)?;
+        let artifact = entry.index_entry(&inventory_sha256);
+        validate_release_index_artifact(&artifact)
+            .map_err(|error| error.change_context(ReleaseError::Distribution))?;
+        artifacts.push(artifact);
+        for file in &entry.companions {
+            companions.insert(file.name.clone(), file.bytes.clone());
+        }
+        gaps.extend(entry.gaps.iter().cloned());
+    }
+    let index = json!({
+        "schema_version": 1,
+        "repository": REPOSITORY,
+        "tag": CANDIDATE_TAG,
+        "source_commit": shared.source_commit,
+        "recipe_source_commit": shared.source_commit,
+        "cohort_source_commit": shared.source_commit,
+        "cohort": COHORT_ID,
+        "policy_version": shared.policy_version,
+        "policy_sha256": shared.policy_sha256,
+        "tsjs_inventory": {
+            "name": INVENTORY_NAME,
+            "size": shared.inventory.len(),
+            "sha256": inventory_sha256,
+        },
+        "artifacts": artifacts,
+    });
+    let bytes = canonical_json(&index, DocumentRole::Metadata)
+        .map_err(|error| error.change_context(ReleaseError::Distribution))?;
+    check_rendered_index(&bytes)?;
+    Ok(CandidateIndex {
+        sha256: sha256_hex(&bytes),
+        bytes,
+        inventory: shared.inventory.to_vec(),
+        companions,
+        gaps: gaps.into_iter().collect(),
+    })
+}
+
+/// Orders entries by asset name, requiring each fixed asset exactly once.
+fn cohort_order(
+    entries: &[CandidateArtifactEntry],
+) -> Result<Vec<&CandidateArtifactEntry>, Report<ReleaseError>> {
+    let mut ordered: BTreeMap<&str, &CandidateArtifactEntry> = BTreeMap::new();
+    for entry in entries {
+        if ordered.insert(entry.name(), entry).is_some() {
+            return Err(distribution_error(format!(
+                "asset `{}` appears more than once",
+                entry.name()
+            )));
+        }
+    }
+    if let Some(missing) = FIXED_ARTIFACTS
+        .iter()
+        .find(|fixed| !ordered.contains_key(fixed.name))
+    {
+        return Err(distribution_error(format!(
+            "candidate index is missing asset `{}`",
+            missing.name
+        )));
+    }
+    if ordered.len() != FIXED_ARTIFACTS.len() {
+        return Err(distribution_error(
+            "candidate index must list exactly the fixed cohort assets",
+        ));
+    }
+    Ok(ordered.into_values().collect())
+}
+
+/// The one source, policy and inventory every entry must share.
+struct SharedIdentity<'a> {
+    source_commit: &'a str,
+    policy_version: u64,
+    policy_sha256: &'a str,
+    inventory: &'a [u8],
+}
+
+fn check_shared_identity<'a>(
+    ordered: &[&'a CandidateArtifactEntry],
+) -> Result<SharedIdentity<'a>, Report<ReleaseError>> {
+    let first = ordered
+        .first()
+        .ok_or_else(|| distribution_error("candidate index has no entries"))?;
+    let shared = SharedIdentity {
+        source_commit: &first.source_commit,
+        policy_version: first.policy_version,
+        policy_sha256: &first.policy_sha256,
+        inventory: &first.inventory,
+    };
+    if !lower_hex(shared.source_commit, 40)
+        || !lower_hex(shared.policy_sha256, 64)
+        || shared.policy_version < 1
+        || shared.inventory.is_empty()
+    {
+        return Err(distribution_error(
+            "candidate source or producer policy identity is malformed",
+        ));
+    }
+    for entry in ordered {
+        if entry.source_commit != shared.source_commit {
+            return Err(distribution_error(
+                "candidate entries come from different source commits",
+            ));
+        }
+        if entry.policy_version != shared.policy_version
+            || entry.policy_sha256 != shared.policy_sha256
+        {
+            return Err(distribution_error(
+                "candidate entries name different producer policies",
+            ));
+        }
+        if entry.inventory.as_slice() != shared.inventory {
+            return Err(distribution_error(
+                "candidate entries name different JS inventories",
+            ));
+        }
+    }
+    Ok(shared)
+}
+
+/// Re-parses rendered bytes and repeats the consumer's structural and
+/// semantic checks, including the candidate-only sentinels.
+fn check_rendered_index(bytes: &[u8]) -> Result<(), Report<ReleaseError>> {
+    let parsed = parse_json(bytes, DocumentRole::Metadata)
+        .map_err(|error| error.change_context(ReleaseError::Distribution))?;
+    validate_release_index(&parsed)
+        .map_err(|error| error.change_context(ReleaseError::Distribution))?;
+    let source = parsed["source_commit"].as_str().unwrap_or_default();
+    if parsed["schema_version"] != 1
+        || parsed["repository"] != REPOSITORY
+        || parsed["cohort"] != COHORT_ID
+        || parsed["tag"] != CANDIDATE_TAG
+        || parsed["recipe_source_commit"] != source
+        || parsed["cohort_source_commit"] != source
+        || parsed["tsjs_inventory"]["name"] != INVENTORY_NAME
+    {
+        return Err(distribution_error(
+            "rendered candidate index header differs from the candidate contract",
+        ));
+    }
+    let artifacts = parsed["artifacts"]
+        .as_array()
+        .ok_or_else(|| distribution_error("rendered candidate index has no artifacts"))?;
+    if artifacts.len() != FIXED_ARTIFACTS.len() {
+        return Err(distribution_error(
+            "rendered candidate index must list exactly the cohort artifacts",
+        ));
+    }
+    artifacts
+        .iter()
+        .try_for_each(|artifact| check_rendered_artifact(artifact, &parsed["tsjs_inventory"]))
+}
+
+fn check_rendered_artifact(
+    artifact: &Value,
+    inventory: &Value,
+) -> Result<(), Report<ReleaseError>> {
+    let name = artifact["name"].as_str().unwrap_or_default();
+    let fixed = FIXED_ARTIFACTS
+        .iter()
+        .find(|fixed| fixed.name == name)
+        .ok_or_else(|| distribution_error(format!("unknown rendered asset `{name}`")))?;
+    let identity = fixed.index_identity();
+    let identity_fields = identity
+        .as_object()
+        .ok_or_else(|| distribution_error("fixed identity must be an object"))?;
+    if identity_fields
+        .iter()
+        .any(|(key, value)| &artifact[key] != value)
+    {
+        return Err(distribution_error(format!(
+            "rendered asset `{name}` differs from its fixed identity"
+        )));
+    }
+    if artifact["js_inventory_sha256"] != inventory["sha256"] {
+        return Err(distribution_error(format!(
+            "rendered asset `{name}` names a different JS inventory"
+        )));
+    }
+    let companions = &artifact["companions"];
+    for role in CompanionRole::ALL {
+        let record = &companions[role.key()];
+        if record["name"] != format!("{name}{}", role.suffix())
+            || record["size"].as_u64().is_none_or(|size| size == 0)
+        {
+            return Err(distribution_error(format!(
+                "rendered asset `{name}` has a missing or empty {} companion",
+                role.key()
+            )));
+        }
+    }
+    for (key, suffix) in BUNDLE_SUFFIXES {
+        let expected = BundleSlot::AwaitingSignature.record(&format!("{name}{suffix}"));
+        if companions[key] != expected {
+            return Err(distribution_error(format!(
+                "rendered asset `{name}` {key} bundle is not the awaiting-signature sentinel"
+            )));
+        }
+    }
+    Ok(())
+}
diff --git a/crates/trusted-server-release/src/distribution/entry.rs b/crates/trusted-server-release/src/distribution/entry.rs
new file mode 100644
index 0000000000..28edc006a7
--- /dev/null
+++ b/crates/trusted-server-release/src/distribution/entry.rs
@@ -0,0 +1,534 @@
+//! One canonical candidate entry and its rendered unsigned companions.
+//!
+//! [`candidate_entry_from_completed`] is the only production constructor: it
+//! binds a canonical [`RecipeCompleted`] to its approved source and its actual
+//! runtime or startup acceptance, renders the candidate SPDX itself, and
+//! renders build evidence, recipe and rebuild-check companions whose joins
+//! are rechecked by the producer copy of the consumer rules. [`EntryParts`]
+//! is a private plain struct so the pure renderer can be tested directly;
+//! production has no byte or JSON constructor. The one exception is
+//! test-only: `distribution::transfer` rebuilds an entry from the flat files
+//! an ordinary-CI candidate job uploaded, reruns every join above over those
+//! bytes and derives the policy identity from collector-read policy bytes.
+//! It exists only under `cfg(test)` and grants no release authority.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use error_stack::Report;
+use serde_json::{Value, json};
+
+use super::joins::{
+    EvidenceJoin, ModuleIdentity, check_build_evidence, check_comparison, check_spdx_root,
+    inventory_modules, parse_informational,
+};
+use super::{CandidateArtifactEntry, CompanionFile, CompanionRole, distribution_error, sha256_hex};
+use crate::documents::{Role as DocumentRole, canonical_json, lower_hex, parse_json};
+use crate::error::ReleaseError;
+use crate::policy::{CLI_POLICY_PATH, CLI_POLICY_VERSION, ReleaseTarget};
+use crate::recipe::{
+    AssetId, FastlyEqualityChecked, FastlyRuntimeAccepted, NativeStartupAccepted, RecipeCompleted,
+    Role,
+};
+use crate::source::ApprovedSource;
+use crate::spdx::candidate::candidate_from_completed;
+
+/// Gaps every candidate entry states until signing and workflow binding exist.
+pub(super) const ENTRY_GAPS: [&str; 4] = [
+    "authenticated-bootstrap-not-established",
+    "signature-bundles-awaiting-signature",
+    "trusted-workflow-transfer-not-bound",
+    "workflow-run-identity-unavailable",
+];
+/// Gap stated when no reproduction comparison exists for a native asset.
+pub(super) const NATIVE_REPRODUCTION_GAP: &str = "native-reproduction-unavailable";
+/// Longest accepted gap text.
+pub(super) const MAX_GAP_LENGTH: usize = 256;
+/// Final-byte classification of a JS module retained in the executable.
+const EMBEDDED_CLASSIFICATION: &str = "conservative_embedded_js";
+/// Final-byte classification of a JS module absent from the executable.
+const MATERIAL_CLASSIFICATION: &str = "js_build_material";
+
+/// The actual owning acceptance required for one canonical asset.
+pub(crate) enum CandidateAcceptance<'a> {
+    /// Final-byte Viceroy acceptance plus canonical/reproduction equality.
+    Fastly {
+        runtime: &'a FastlyRuntimeAccepted,
+        equality: &'a FastlyEqualityChecked,
+    },
+    /// Actual startup of the exact copied native CLI.
+    Native(&'a NativeStartupAccepted),
+}
+
+impl CandidateAcceptance<'_> {
+    fn kind(&self) -> AcceptanceKind {
+        match self {
+            Self::Fastly { .. } => AcceptanceKind::FastlyRuntime,
+            Self::Native(_) => AcceptanceKind::NativeStartup,
+        }
+    }
+}
+
+/// Which acceptance family an asset requires.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum AcceptanceKind {
+    /// The Fastly Wasm asset.
+    FastlyRuntime,
+    /// A native CLI asset.
+    NativeStartup,
+}
+
+/// Checks that `completed` may supply a candidate entry under `kind`.
+///
+/// # Errors
+///
+/// Rejects a reproduction build, an approved source at another commit, or an
+/// acceptance family that does not match the completed asset.
+pub(crate) fn check_candidate_owner(
+    completed: &RecipeCompleted,
+    source: &ApprovedSource,
+    kind: AcceptanceKind,
+) -> Result<(), Report<ReleaseError>> {
+    if completed.role() != Role::Canonical {
+        return Err(distribution_error(
+            "candidate index entries come only from the canonical build",
+        ));
+    }
+    if source.commit() != completed.commit() {
+        return Err(distribution_error(
+            "approved source differs from the completed build commit",
+        ));
+    }
+    let expected = if completed.asset().artifact().target == ReleaseTarget::Wasm32Wasip1 {
+        AcceptanceKind::FastlyRuntime
+    } else {
+        AcceptanceKind::NativeStartup
+    };
+    if kind != expected {
+        return Err(distribution_error(format!(
+            "asset `{}` requires {expected:?} acceptance, not {kind:?}",
+            completed.asset().artifact().name
+        )));
+    }
+    Ok(())
+}
+
+/// Renders the candidate entry of one canonical completed build.
+///
+/// The candidate SPDX is rendered here from the same completed owner, and the
+/// owner is rehashed again after rendering.
+///
+/// # Errors
+///
+/// Rejects any [`check_candidate_owner`] failure, an acceptance bound to
+/// another source, role, asset or final bytes, missing composition or JS
+/// evidence, a Fastly executable omitting a prepared module, an untracked
+/// consumer policy, and every rendering or join failure.
+pub(crate) fn candidate_entry_from_completed(
+    completed: &RecipeCompleted,
+    source: &ApprovedSource,
+    acceptance: &CandidateAcceptance<'_>,
+) -> Result<CandidateArtifactEntry, Report<ReleaseError>> {
+    check_candidate_owner(completed, source, acceptance.kind())?;
+    let (comparison, compatibility_tests) = bind_acceptance(completed, acceptance)?;
+    let spdx = candidate_from_completed(completed, source)?;
+    let view = completed.composition_view()?;
+    let javascript = completed.javascript_contributions()?;
+    let artifact = completed.artifact();
+    let membership = view.javascript();
+    if membership.artifact_sha256() != artifact.sha256()
+        || membership.inventory_sha256() != javascript.inventory_sha256()
+    {
+        return Err(distribution_error(
+            "JS membership belongs to another artifact or inventory",
+        ));
+    }
+    let modules = membership
+        .modules()
+        .map(|(module, classification)| {
+            let embedded = match classification {
+                EMBEDDED_CLASSIFICATION => true,
+                MATERIAL_CLASSIFICATION => false,
+                other => {
+                    return Err(distribution_error(format!(
+                        "unknown JS module classification `{other}`"
+                    )));
+                }
+            };
+            Ok(ModuleObservation {
+                id: module.id().to_owned(),
+                filename: module.filename().to_owned(),
+                size: module.size(),
+                sha256: module.sha256().to_owned(),
+                embedded,
+            })
+        })
+        .collect::<Result<Vec<_>, Report<ReleaseError>>>()?;
+    let policy_bytes = source
+        .read_tracked(CLI_POLICY_PATH, DocumentRole::Metadata)
+        .map_err(|error| error.change_context(ReleaseError::Distribution))?;
+    let (policy_version, policy_sha256) = policy_identity(&policy_bytes)?;
+    let definition = completed.recipe_definition()?;
+    let parts = EntryParts {
+        asset: completed.asset(),
+        source_commit: completed.commit().as_str().to_owned(),
+        policy_version,
+        policy_sha256,
+        artifact_sha256: artifact.sha256().to_owned(),
+        artifact_size: artifact.size(),
+        inventory: javascript.raw_inventory().to_vec(),
+        modules,
+        spdx: spdx.bytes().to_vec(),
+        spdx_gaps: spdx.gaps().to_vec(),
+        recipe: RecipeFacts {
+            definition_sha256: definition.sha256().to_owned(),
+            invocation_sha256: completed.plan_digest().to_owned(),
+            cargo_lock_sha256: completed.cargo_lock_sha256().to_owned(),
+            materials_digest: completed.materials_digest().to_owned(),
+            rust_tools_digest: completed.rust_tools_digest().to_owned(),
+        },
+        comparison,
+        compatibility_tests,
+    };
+    let entry = render_entry(parts)?;
+    completed.rehash_for_handoff()?;
+    Ok(entry)
+}
+
+/// Derives the producer policy identity from the exact approved policy bytes.
+///
+/// Mirrors the CLI's `producer_identity`: the version is the integer
+/// `policy_version` (at least 1) of the strictly parsed bytes and the digest is
+/// the SHA-256 of those same bytes. The version must also equal the compiled
+/// [`CLI_POLICY_VERSION`].
+///
+/// # Errors
+///
+/// Rejects malformed JSON, a missing, zero or non-integer version, or a
+/// version other than the compiled one.
+pub(super) fn policy_identity(bytes: &[u8]) -> Result<(u64, String), Report<ReleaseError>> {
+    let policy = parse_json(bytes, DocumentRole::Metadata)
+        .map_err(|error| error.change_context(ReleaseError::Distribution))?;
+    let version = policy["policy_version"]
+        .as_u64()
+        .filter(|version| *version >= 1)
+        .ok_or_else(|| distribution_error("approved consumer policy has no integer version"))?;
+    if version != CLI_POLICY_VERSION {
+        return Err(distribution_error(format!(
+            "approved consumer policy version {version} differs from compiled version {CLI_POLICY_VERSION}"
+        )));
+    }
+    Ok((version, sha256_hex(bytes)))
+}
+
+/// Binds the acceptance to this exact completed build and derives its facts.
+fn bind_acceptance(
+    completed: &RecipeCompleted,
+    acceptance: &CandidateAcceptance<'_>,
+) -> Result<(RebuildComparison, Vec<CompatibilityTest>), Report<ReleaseError>> {
+    let artifact = completed.artifact();
+    match acceptance {
+        CandidateAcceptance::Fastly { runtime, equality } => {
+            let observed = runtime.observed();
+            if equality.asset() != completed.asset()
+                || equality.sha256() != artifact.sha256()
+                || equality.size() != artifact.size()
+                || runtime.source_commit() != completed.commit()
+                || runtime.role() != completed.role()
+                || observed.artifact_sha256() != artifact.sha256()
+                || observed.artifact_size() != artifact.size()
+            {
+                return Err(distribution_error(
+                    "Fastly acceptance belongs to another source, role or final output",
+                ));
+            }
+            let facts = BTreeMap::from([
+                ("viceroy_version", observed.viceroy_version().to_owned()),
+                ("viceroy_sha256", observed.viceroy_sha256().to_owned()),
+                ("fixture_sha256", observed.fixture_sha256().to_owned()),
+                ("health_status", observed.health_status().to_string()),
+            ]);
+            Ok((
+                RebuildComparison::Matched {
+                    reproduction_sha256: equality.sha256().to_owned(),
+                    reproduction_size: equality.size(),
+                },
+                vec![CompatibilityTest {
+                    name: "fastly-final-byte-publisher-request",
+                    facts,
+                }],
+            ))
+        }
+        CandidateAcceptance::Native(accepted) => {
+            let diagnostic = accepted.diagnostic_for(completed)?;
+            let kind = diagnostic["startup"]["kind"]
+                .as_str()
+                .filter(|_| diagnostic["release_qualification"] == false)
+                .ok_or_else(|| distribution_error("native startup diagnostic is incomplete"))?;
+            Ok((
+                RebuildComparison::Unavailable,
+                vec![CompatibilityTest {
+                    name: "native-startup",
+                    facts: BTreeMap::from([("startup_kind", kind.to_owned())]),
+                }],
+            ))
+        }
+    }
+}
+
+/// One prepared JS module and its final-byte membership.
+#[derive(Clone, Debug)]
+pub(super) struct ModuleObservation {
+    pub(super) id: String,
+    pub(super) filename: String,
+    pub(super) size: u64,
+    pub(super) sha256: String,
+    pub(super) embedded: bool,
+}
+
+impl ModuleObservation {
+    fn record(&self) -> Value {
+        json!({"id": self.id, "filename": self.filename, "size": self.size, "sha256": self.sha256})
+    }
+}
+
+/// Recipe identities recorded as authenticated informational data.
+#[derive(Clone, Debug)]
+pub(super) struct RecipeFacts {
+    pub(super) definition_sha256: String,
+    pub(super) invocation_sha256: String,
+    pub(super) cargo_lock_sha256: String,
+    pub(super) materials_digest: String,
+    pub(super) rust_tools_digest: String,
+}
+
+/// The informational rebuild comparison of one entry.
+#[derive(Clone, Debug)]
+pub(super) enum RebuildComparison {
+    /// Canonical and reproduction final bytes were checked identical.
+    Matched {
+        reproduction_sha256: String,
+        reproduction_size: u64,
+    },
+    /// No reproduction comparison exists for this asset.
+    Unavailable,
+}
+
+/// One passed compatibility test and its stable facts (no timings).
+#[derive(Clone, Debug)]
+pub(super) struct CompatibilityTest {
+    pub(super) name: &'static str,
+    pub(super) facts: BTreeMap<&'static str, String>,
+}
+
+/// Plain checked facts of one entry, before rendering.
+#[derive(Clone, Debug)]
+pub(super) struct EntryParts {
+    pub(super) asset: AssetId,
+    pub(super) source_commit: String,
+    pub(super) policy_version: u64,
+    pub(super) policy_sha256: String,
+    pub(super) artifact_sha256: String,
+    pub(super) artifact_size: u64,
+    pub(super) inventory: Vec<u8>,
+    pub(super) modules: Vec<ModuleObservation>,
+    pub(super) spdx: Vec<u8>,
+    pub(super) spdx_gaps: Vec<String>,
+    pub(super) recipe: RecipeFacts,
+    pub(super) comparison: RebuildComparison,
+    pub(super) compatibility_tests: Vec<CompatibilityTest>,
+}
+
+impl EntryParts {
+    fn is_fastly(&self) -> bool {
+        self.asset.artifact().target == ReleaseTarget::Wasm32Wasip1
+    }
+
+    fn check_identity(&self) -> Result<(), Report<ReleaseError>> {
+        if !lower_hex(&self.source_commit, 40)
+            || !lower_hex(&self.policy_sha256, 64)
+            || self.policy_version < 1
+            || !lower_hex(&self.artifact_sha256, 64)
+            || self.artifact_size == 0
+            || self.artifact_size > DocumentRole::Executable.limit()
+        {
+            return Err(distribution_error(
+                "candidate entry source, policy or artifact identity is malformed",
+            ));
+        }
+        if self.compatibility_tests.is_empty() {
+            return Err(distribution_error(
+                "candidate entry needs its passed compatibility test",
+            ));
+        }
+        Ok(())
+    }
+
+    /// Returns the outcome fields after checking the asset's comparison rule.
+    fn comparison_fields(&self) -> Result<(&'static str, Value), Report<ReleaseError>> {
+        match (&self.comparison, self.is_fastly()) {
+            (
+                RebuildComparison::Matched {
+                    reproduction_sha256,
+                    reproduction_size,
+                },
+                true,
+            ) if *reproduction_sha256 == self.artifact_sha256
+                && *reproduction_size == self.artifact_size =>
+            {
+                Ok(("matched", json!(reproduction_sha256)))
+            }
+            (RebuildComparison::Unavailable, false) => Ok(("unavailable", Value::Null)),
+            _ => Err(distribution_error(
+                "rebuild comparison must be the checked Fastly equality or unavailable for a native asset",
+            )),
+        }
+    }
+
+    /// Sorted unique gaps: fixed entry gaps, comparison gaps and SPDX gaps.
+    fn gaps(&self) -> Result<Vec<String>, Report<ReleaseError>> {
+        if self.spdx_gaps.is_empty() {
+            return Err(distribution_error("candidate SPDX must state its gaps"));
+        }
+        let mut gaps: BTreeSet<String> = ENTRY_GAPS.iter().map(|gap| (*gap).to_owned()).collect();
+        if matches!(self.comparison, RebuildComparison::Unavailable) {
+            gaps.insert(NATIVE_REPRODUCTION_GAP.to_owned());
+        }
+        for gap in &self.spdx_gaps {
+            if gap.is_empty()
+                || gap.len() > MAX_GAP_LENGTH
+                || gap
+                    .chars()
+                    .any(|character| character.is_control() || character.is_whitespace())
+            {
+                return Err(distribution_error("candidate gap text is malformed"));
+            }
+            gaps.insert(gap.clone());
+        }
+        Ok(gaps.into_iter().collect())
+    }
+
+    /// Sorted prepared modules and the embedded subset.
+    fn module_records(&self) -> Result<(Vec<Value>, Vec<Value>), Report<ReleaseError>> {
+        let mut modules: Vec<&ModuleObservation> = self.modules.iter().collect();
+        modules.sort_by(|left, right| left.id.cmp(&right.id));
+        if modules.windows(2).any(|pair| pair[0].id == pair[1].id) {
+            return Err(distribution_error("prepared JS module ids must be unique"));
+        }
+        if self.is_fastly() && modules.iter().any(|module| !module.embedded) {
+            return Err(distribution_error(
+                "Fastly executable must embed every prepared JS module",
+            ));
+        }
+        let prepared = modules.iter().map(|module| module.record()).collect();
+        let embedded = modules
+            .iter()
+            .filter(|module| module.embedded)
+            .map(|module| module.record())
+            .collect();
+        Ok((prepared, embedded))
+    }
+}
+
+fn render(value: &Value) -> Result<Vec<u8>, Report<ReleaseError>> {
+    canonical_json(value, DocumentRole::Companion)
+        .map_err(|error| error.change_context(ReleaseError::Distribution))
+}
+
+/// Renders and joins one entry's unsigned companions from plain facts.
+pub(super) fn render_entry(
+    parts: EntryParts,
+) -> Result<CandidateArtifactEntry, Report<ReleaseError>> {
+    parts.check_identity()?;
+    let gaps = parts.gaps()?;
+    let (outcome, reproduction_sha256) = parts.comparison_fields()?;
+    let (prepared, embedded) = parts.module_records()?;
+    let artifact = parts.asset.artifact();
+    let inventory_sha256 = sha256_hex(&parts.inventory);
+    let compatibility: Vec<Value> = parts
+        .compatibility_tests
+        .iter()
+        .map(|test| json!({"name": test.name, "outcome": "passed", "facts": test.facts}))
+        .collect();
+    let build_evidence = render(&json!({
+        "domain": "trusted-server.release.candidate-build-evidence",
+        "schema_version": 1,
+        "release_qualification": false,
+        "gaps": gaps,
+        "source_commit": parts.source_commit,
+        "asset": artifact.name,
+        "target": artifact.target.triple(),
+        "variant": "default",
+        "artifact_sha256": parts.artifact_sha256,
+        "artifact_size": parts.artifact_size,
+        "js_inventory_sha256": inventory_sha256,
+        "prepared_modules": prepared,
+        "embedded_modules": embedded,
+        "compatibility_tests": compatibility,
+        "workflow_run_id": null,
+        "transfer_artifact_id": null,
+    }))?;
+    let recipe = &parts.recipe;
+    let build_recipe = render(&json!({
+        "domain": "trusted-server.release.candidate-build-recipe",
+        "version": 1,
+        "release_qualification": false,
+        "gaps": gaps,
+        "source_commit": parts.source_commit,
+        "asset": artifact.name,
+        "package": artifact.package,
+        "target": artifact.target.triple(),
+        "variant": "default",
+        "recipe_definition_sha256": recipe.definition_sha256,
+        "invocation_sha256": recipe.invocation_sha256,
+        "inputs": {
+            "cargo_lock_sha256": recipe.cargo_lock_sha256,
+            "materials_digest": recipe.materials_digest,
+            "rust_tools_digest": recipe.rust_tools_digest,
+        },
+        "workflow_run_id": null,
+    }))?;
+    let rebuild_check = render(&json!({
+        "domain": "trusted-server.release.candidate-rebuild-check",
+        "version": 1,
+        "release_qualification": false,
+        "gaps": gaps,
+        "source_commit": parts.source_commit,
+        "asset": artifact.name,
+        "outcome": outcome,
+        "canonical_sha256": parts.artifact_sha256,
+        "reproduction_sha256": reproduction_sha256,
+        "workflow_run_id": null,
+        "reproduction_transfer_artifact_id": null,
+    }))?;
+    let modules: Vec<ModuleIdentity> = inventory_modules(&parts.inventory, &parts.source_commit)?;
+    check_build_evidence(
+        &build_evidence,
+        &EvidenceJoin {
+            source_commit: &parts.source_commit,
+            target: artifact.target.triple(),
+            artifact_sha256: &parts.artifact_sha256,
+            inventory_sha256: &inventory_sha256,
+            modules: &modules,
+        },
+    )?;
+    check_spdx_root(&parts.spdx, &parts.artifact_sha256)?;
+    parse_informational(&build_recipe, &parts.source_commit)?;
+    check_comparison(&rebuild_check, &parts.source_commit)?;
+    let companions = vec![
+        CompanionFile::new(CompanionRole::Sbom, artifact.name, parts.spdx),
+        CompanionFile::new(CompanionRole::BuildEvidence, artifact.name, build_evidence),
+        CompanionFile::new(CompanionRole::BuildRecipe, artifact.name, build_recipe),
+        CompanionFile::new(CompanionRole::RebuildCheck, artifact.name, rebuild_check),
+    ];
+    Ok(CandidateArtifactEntry {
+        asset: parts.asset,
+        source_commit: parts.source_commit,
+        policy_version: parts.policy_version,
+        policy_sha256: parts.policy_sha256,
+        inventory: parts.inventory,
+        artifact_size: parts.artifact_size,
+        artifact_sha256: parts.artifact_sha256,
+        companions,
+        gaps,
+    })
+}
diff --git a/crates/trusted-server-release/src/distribution/joins.rs b/crates/trusted-server-release/src/distribution/joins.rs
new file mode 100644
index 0000000000..ad4cde6b2c
--- /dev/null
+++ b/crates/trusted-server-release/src/distribution/joins.rs
@@ -0,0 +1,248 @@
+//! Producer copy of the consumer's document joins over rendered companions.
+//!
+//! These mirror the CLI verifier's inventory, build-evidence, SPDX root and
+//! informational-companion joins so the producer rejects a candidate the
+//! consumer would reject. They parse strictly and read only joined fields.
+//!
+//! Drift guard: the CLI test
+//! `crates/trusted-server-cli/src/release/evidence/candidate_fixture_tests.rs`
+//! runs the consumer's own joins over the golden fixtures this producer
+//! renders, so a divergence between these copies and the CLI fails there.
+
+use error_stack::Report;
+use serde_json::Value;
+
+use super::distribution_error;
+use crate::documents::{Role as DocumentRole, lower_hex, parse_json};
+use crate::error::ReleaseError;
+
+/// Producer role whose byte limit equals the CLI's `Role::Inventory` bound.
+pub(super) const INVENTORY_ROLE: DocumentRole = DocumentRole::Metadata;
+/// The CLI's `bounds::INVENTORY_BYTES` inventory limit (1 MiB).
+#[cfg(test)]
+pub(super) const CLI_INVENTORY_BYTES: u64 = 1_048_576;
+
+/// SPDX document element identifier.
+const DOCUMENT_ID: &str = "SPDXRef-DOCUMENT";
+
+/// The JS module identity joined between inventory and build evidence.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(super) struct ModuleIdentity {
+    pub(super) id: String,
+    pub(super) filename: String,
+    pub(super) size: u64,
+    pub(super) sha256: String,
+}
+
+fn parse(bytes: &[u8], role: DocumentRole) -> Result<Value, Report<ReleaseError>> {
+    parse_json(bytes, role).map_err(|error| error.change_context(ReleaseError::Distribution))
+}
+
+fn module_identity(value: &Value) -> Result<ModuleIdentity, Report<ReleaseError>> {
+    let text = |key: &str| value[key].as_str().unwrap_or_default().to_owned();
+    let module = ModuleIdentity {
+        id: text("id"),
+        filename: text("filename"),
+        size: value["size"].as_u64().unwrap_or(u64::MAX),
+        sha256: text("sha256"),
+    };
+    if module.id.is_empty()
+        || module.filename.is_empty()
+        || module.size == u64::MAX
+        || !lower_hex(&module.sha256, 64)
+    {
+        return Err(distribution_error(
+            "JS module record needs id, filename, integer size and SHA-256",
+        ));
+    }
+    Ok(module)
+}
+
+fn sorted_modules(value: &Value, what: &str) -> Result<Vec<ModuleIdentity>, Report<ReleaseError>> {
+    let modules = value
+        .as_array()
+        .ok_or_else(|| distribution_error(format!("{what} must be an array")))?
+        .iter()
+        .map(module_identity)
+        .collect::<Result<Vec<_>, _>>()?;
+    if modules.windows(2).any(|pair| pair[0].id >= pair[1].id) {
+        return Err(distribution_error(format!(
+            "{what} must be sorted by unique module id"
+        )));
+    }
+    Ok(modules)
+}
+
+fn require_version_and_source(
+    document: &Value,
+    version_field: &str,
+    commit: &str,
+    what: &str,
+) -> Result<(), Report<ReleaseError>> {
+    if !document.is_object() || document[version_field].as_u64() != Some(1) {
+        return Err(distribution_error(format!("{what} version must be 1")));
+    }
+    if document["source_commit"] != commit {
+        return Err(distribution_error(format!(
+            "{what} source commit is not the candidate source"
+        )));
+    }
+    Ok(())
+}
+
+/// Parses the shared JS inventory and returns its module identities.
+pub(super) fn inventory_modules(
+    bytes: &[u8],
+    commit: &str,
+) -> Result<Vec<ModuleIdentity>, Report<ReleaseError>> {
+    let inventory = parse(bytes, INVENTORY_ROLE)?;
+    require_version_and_source(&inventory, "schema_version", commit, "JS inventory")?;
+    let modules = sorted_modules(&inventory["modules"], "JS inventory modules")?;
+    if modules.is_empty() {
+        return Err(distribution_error("JS inventory lists no modules"));
+    }
+    Ok(modules)
+}
+
+/// The index facts one build-evidence companion must join.
+pub(super) struct EvidenceJoin<'a> {
+    pub(super) source_commit: &'a str,
+    pub(super) target: &'a str,
+    pub(super) artifact_sha256: &'a str,
+    pub(super) inventory_sha256: &'a str,
+    pub(super) modules: &'a [ModuleIdentity],
+}
+
+/// Joins rendered build evidence to the index facts and shared inventory.
+pub(super) fn check_build_evidence(
+    bytes: &[u8],
+    join: &EvidenceJoin<'_>,
+) -> Result<(), Report<ReleaseError>> {
+    let evidence = parse(bytes, DocumentRole::Companion)?;
+    require_version_and_source(
+        &evidence,
+        "schema_version",
+        join.source_commit,
+        "build evidence",
+    )?;
+    for (field, wanted) in [
+        ("target", join.target),
+        ("variant", "default"),
+        ("artifact_sha256", join.artifact_sha256),
+        ("js_inventory_sha256", join.inventory_sha256),
+    ] {
+        if evidence[field] != wanted {
+            return Err(distribution_error(format!(
+                "build evidence `{field}` differs from the index entry"
+            )));
+        }
+    }
+    let prepared = sorted_modules(&evidence["prepared_modules"], "prepared modules")?;
+    if prepared != join.modules {
+        return Err(distribution_error(
+            "prepared JS modules differ from the shared inventory",
+        ));
+    }
+    let embedded = sorted_modules(&evidence["embedded_modules"], "embedded modules")?;
+    if let Some(unknown) = embedded
+        .iter()
+        .find(|module| !join.modules.contains(module))
+    {
+        return Err(distribution_error(format!(
+            "embedded JS module `{}` is not exactly an inventory module",
+            unknown.id
+        )));
+    }
+    Ok(())
+}
+
+/// Requires an SPDX 2.3 document describing one root with the executable digest.
+pub(super) fn check_spdx_root(
+    bytes: &[u8],
+    artifact_sha256: &str,
+) -> Result<(), Report<ReleaseError>> {
+    let document = parse(bytes, DocumentRole::Spdx)?;
+    if document["spdxVersion"] != "SPDX-2.3" || document["SPDXID"] != DOCUMENT_ID {
+        return Err(distribution_error("SBOM is not an SPDX 2.3 document"));
+    }
+    let mut described: Vec<&str> = document["documentDescribes"]
+        .as_array()
+        .map(|ids| ids.iter().filter_map(Value::as_str).collect())
+        .unwrap_or_default();
+    described.extend(
+        document["relationships"]
+            .as_array()
+            .map(Vec::as_slice)
+            .unwrap_or_default()
+            .iter()
+            .filter(|relationship| {
+                relationship["spdxElementId"] == DOCUMENT_ID
+                    && relationship["relationshipType"] == "DESCRIBES"
+            })
+            .filter_map(|relationship| relationship["relatedSpdxElement"].as_str()),
+    );
+    described.sort_unstable();
+    described.dedup();
+    let [root] = described.as_slice() else {
+        return Err(distribution_error(
+            "SPDX document must describe exactly one root",
+        ));
+    };
+    let packages: Vec<&Value> = document["packages"]
+        .as_array()
+        .map(|packages| {
+            packages
+                .iter()
+                .filter(|package| package["SPDXID"] == *root)
+                .collect()
+        })
+        .unwrap_or_default();
+    let [package] = packages.as_slice() else {
+        return Err(distribution_error("SPDX root must be exactly one package"));
+    };
+    let checksums: Vec<&str> = package["checksums"]
+        .as_array()
+        .map(|checksums| {
+            checksums
+                .iter()
+                .filter(|checksum| checksum["algorithm"] == "SHA256")
+                .filter_map(|checksum| checksum["checksumValue"].as_str())
+                .collect()
+        })
+        .unwrap_or_default();
+    if checksums.as_slice() != [artifact_sha256] {
+        return Err(distribution_error(
+            "SPDX root package checksum differs from the executable digest",
+        ));
+    }
+    Ok(())
+}
+
+/// Strictly parses a version-1 informational companion for `source_commit`.
+pub(super) fn parse_informational(
+    bytes: &[u8],
+    source_commit: &str,
+) -> Result<Value, Report<ReleaseError>> {
+    let document = parse(bytes, DocumentRole::Companion)?;
+    require_version_and_source(
+        &document,
+        "version",
+        source_commit,
+        "informational companion",
+    )?;
+    Ok(document)
+}
+
+/// Requires a rebuild-check outcome from the closed consumer vocabulary.
+pub(super) fn check_comparison(
+    bytes: &[u8],
+    source_commit: &str,
+) -> Result<(), Report<ReleaseError>> {
+    let document = parse_informational(bytes, source_commit)?;
+    match document["outcome"].as_str() {
+        Some("matched" | "mismatched" | "failed" | "unavailable") => Ok(()),
+        _ => Err(distribution_error(
+            "rebuild check outcome must be matched, mismatched, failed or unavailable",
+        )),
+    }
+}
diff --git a/crates/trusted-server-release/src/distribution/ordinary.rs b/crates/trusted-server-release/src/distribution/ordinary.rs
new file mode 100644
index 0000000000..0699f3d1af
--- /dev/null
+++ b/crates/trusted-server-release/src/distribution/ordinary.rs
@@ -0,0 +1,184 @@
+//! Actual ordinary-CI four-job candidate index join, without release authority.
+//!
+//! The collector downloads the four exact candidate-entry uploads through the
+//! bounded real backend, rebuilds each entry from its transferred bytes,
+//! derives the policy identity from its own authenticated checkout and
+//! assembles the unqualified candidate index. Workflow transfer binding,
+//! signing and qualification stay absent.
+
+use std::ffi::OsString;
+use std::path::PathBuf;
+use std::time::{Duration, Instant};
+
+use serde_json::Value;
+
+use super::transfer::{EntryDescriptor, ReceivedEntry, assemble_received, write_candidate_index};
+use super::{CANDIDATE_INDEX_NAME, EMPTY_SHA256, sha256_hex};
+use crate::collection::transfer::{OrdinaryArtifactSelection, retrieve_ordinary_ci};
+use crate::documents::{Role, lower_hex, parse_json};
+use crate::policy::CLI_POLICY_PATH;
+use crate::preflight::audit_environment;
+use crate::process::Cancellation;
+use crate::recipe::AssetId;
+use crate::source::{CommitId, authenticate};
+
+/// Each producing job's descriptor variable and the asset it must carry.
+const DESCRIPTOR_SLOTS: [(&str, &str); 4] = [
+    (
+        "TS_RELEASE_CANDIDATE_ENTRY_FASTLY",
+        "trusted-server-fastly.wasm",
+    ),
+    (
+        "TS_RELEASE_CANDIDATE_ENTRY_LINUX",
+        "ts-x86_64-unknown-linux-gnu",
+    ),
+    (
+        "TS_RELEASE_CANDIDATE_ENTRY_MACOS_ARM",
+        "ts-aarch64-apple-darwin",
+    ),
+    (
+        "TS_RELEASE_CANDIDATE_ENTRY_MACOS_INTEL",
+        "ts-x86_64-apple-darwin",
+    ),
+];
+
+fn required(name: &str) -> String {
+    let value =
+        std::env::var(name).expect("should provide the explicitly selected ordinary-CI input");
+    assert!(!value.is_empty(), "should provide a non-empty {name}");
+    value
+}
+
+/// Downloads one exact upload and returns its descriptor and checked members.
+fn receive(
+    descriptor: EntryDescriptor,
+    run_id: u64,
+    head: &str,
+    token: &str,
+    deadline: Instant,
+) -> ReceivedEntry {
+    let observed = retrieve_ordinary_ci(
+        OrdinaryArtifactSelection {
+            run_id,
+            run_head_commit: head.to_owned(),
+            artifact_id: descriptor.artifact_id(),
+            artifact_name: descriptor.artifact_name().to_owned(),
+            archive_sha256: descriptor.archive_sha256().to_owned(),
+        },
+        token,
+        deadline,
+        Cancellation::default(),
+    )
+    .expect("should retrieve the exact candidate-entry upload through the bounded real backend");
+    let metadata = parse_json(observed.metadata(), Role::Metadata)
+        .expect("should parse the exact original REST response bytes");
+    assert_eq!(
+        metadata["id"].as_u64(),
+        Some(descriptor.artifact_id()),
+        "should corroborate the exact upload ID in raw REST metadata"
+    );
+    let members = observed
+        .members(descriptor.members())
+        .expect("should accept the upload under the unchanged flat archive contract");
+    ReceivedEntry {
+        descriptor,
+        members,
+    }
+}
+
+#[test]
+#[ignore = "requires the four ordinary-CI candidate-entry uploads, their exact descriptors, a retained clean clone and a read-only Actions token"]
+fn real_four_job_candidate_index() {
+    assert_eq!(
+        std::env::var("GITHUB_ACTIONS").as_deref(),
+        Ok("true"),
+        "should run only in the explicit hosted ordinary-CI collector"
+    );
+    let run_id = required("TS_RELEASE_TRANSFER_RUN_ID")
+        .parse::<u64>()
+        .expect("should select an exact numeric workflow run ID");
+    assert_eq!(
+        required("GITHUB_RUN_ID")
+            .parse::<u64>()
+            .expect("should observe the current workflow run ID"),
+        run_id,
+        "should select the current ordinary-CI workflow run"
+    );
+    // REST identifies the PR head; the checkout and every fixture build the
+    // synthetic merge commit, which is the candidate source.
+    let head = required("TS_RELEASE_TRANSFER_RUN_HEAD_SHA");
+    let source_commit = required("TS_RELEASE_CANDIDATE_SOURCE_COMMIT");
+    assert!(
+        lower_hex(&head, 40) && lower_hex(&source_commit, 40),
+        "should provide exact run-head and candidate source identities"
+    );
+    assert_eq!(
+        required("GITHUB_SHA"),
+        source_commit,
+        "should build the candidate from the checked-out workflow commit"
+    );
+    let source_root =
+        std::fs::canonicalize(PathBuf::from(required("TS_RELEASE_CANDIDATE_SOURCE_ROOT")))
+            .expect("should resolve the retained clean clone");
+    let commit = CommitId::parse(&source_commit).expect("should parse the candidate commit");
+    let audited = audit_environment(&[(OsString::from("PATH"), OsString::from("/usr/bin:/bin"))])
+        .expect("should audit the minimal environment");
+    let source = authenticate(&source_root, &commit, &audited)
+        .expect("should authenticate the retained clean clone at the candidate commit");
+    let policy = source
+        .read_tracked(CLI_POLICY_PATH, Role::Metadata)
+        .expect("should read the tracked consumer policy from the authenticated clone");
+    let index_root = PathBuf::from(required("TS_RELEASE_CANDIDATE_INDEX_ROOT"));
+    let token = required("GH_TOKEN");
+    let descriptors: Vec<EntryDescriptor> = DESCRIPTOR_SLOTS
+        .iter()
+        .map(|(variable, asset)| {
+            let asset = AssetId::parse(asset).expect("should resolve the fixed asset");
+            EntryDescriptor::parse(required(variable).as_bytes(), asset, run_id).unwrap_or_else(
+                |error| panic!("should accept the {variable} descriptor: {error:?}"),
+            )
+        })
+        .collect();
+    super::transfer::check_distinct_uploads(&descriptors.iter().collect::<Vec<_>>())
+        .expect("should select four distinct uploads");
+    let received: Vec<ReceivedEntry> = descriptors
+        .into_iter()
+        .map(|descriptor| {
+            // Each download is its own bounded transport attempt, which the
+            // backend caps at 15 minutes; the largest upload is a ~285 MB CLI.
+            let deadline = Instant::now() + Duration::from_secs(10 * 60);
+            receive(descriptor, run_id, &head, &token, deadline)
+        })
+        .collect();
+    let index = assemble_received(&received, &source_commit, &policy)
+        .unwrap_or_else(|error| panic!("should assemble the four real entries: {error:?}"));
+    drop(received);
+    write_candidate_index(&index, &index_root).expect("should write the candidate index files");
+    let written = std::fs::read(index_root.join(CANDIDATE_INDEX_NAME))
+        .expect("should re-read the written candidate index");
+    assert_eq!(
+        sha256_hex(&written),
+        index.sha256(),
+        "should write exactly the assembled index bytes"
+    );
+    let parsed: Value = serde_json::from_slice(&written).expect("should parse the written index");
+    for artifact in parsed["artifacts"]
+        .as_array()
+        .expect("should list artifacts")
+    {
+        for key in ["provenance", "sbom_attestation"] {
+            let record = &artifact["companions"][key];
+            assert_eq!(
+                (record["size"].as_u64(), record["sha256"].as_str()),
+                (Some(0), Some(EMPTY_SHA256)),
+                "should keep the awaiting-signature sentinel for {key}"
+            );
+        }
+    }
+    println!(
+        "{}",
+        String::from_utf8(written).expect("should render UTF-8 index bytes")
+    );
+    println!("{}  {CANDIDATE_INDEX_NAME}", index.sha256());
+    println!("unqualified candidate gaps: {}", index.gaps().join(", "));
+}
diff --git a/crates/trusted-server-release/src/distribution/summary.rs b/crates/trusted-server-release/src/distribution/summary.rs
new file mode 100644
index 0000000000..aa074194bf
--- /dev/null
+++ b/crates/trusted-server-release/src/distribution/summary.rs
@@ -0,0 +1,208 @@
+//! Test-only re-check and measurement summary of one candidate entry.
+//!
+//! The real CI builds use it to show that an entry built from an actual
+//! completed build re-passes the producer joins and the release-index
+//! `#/$defs/artifact` sub-schema from its retained bytes alone, and to print
+//! what the entry carries. It grants no signing, publication or
+//! qualification authority.
+
+use std::collections::BTreeSet;
+
+use error_stack::Report;
+use serde_json::{Value, json};
+
+use super::joins::{
+    EvidenceJoin, check_build_evidence, check_comparison, check_spdx_root, inventory_modules,
+    parse_informational,
+};
+use super::{CandidateArtifactEntry, CompanionRole, distribution_error, sha256_hex};
+use crate::documents::{
+    Role as DocumentRole, canonical_json, parse_json, validate_release_index_artifact,
+};
+use crate::error::ReleaseError;
+
+/// One companion's identity recomputed from its exact bytes.
+#[derive(Clone, Debug, PartialEq, Eq)]
+struct CompanionSummary {
+    key: &'static str,
+    name: String,
+    size: u64,
+    sha256: String,
+}
+
+/// What one rechecked candidate entry carries, for the printed measurement.
+#[derive(Clone, Debug)]
+pub(crate) struct EntrySummary {
+    name: &'static str,
+    artifact_sha256: String,
+    artifact_size: u64,
+    inventory_sha256: String,
+    entry_sha256: String,
+    entry_size: u64,
+    rebuild_outcome: String,
+    companions: Vec<CompanionSummary>,
+    gaps: Vec<String>,
+}
+
+impl EntrySummary {
+    /// The rechecked rebuild-check outcome.
+    pub(crate) fn rebuild_outcome(&self) -> &str {
+        &self.rebuild_outcome
+    }
+
+    /// SHA-256 of the exact JS inventory bytes the entry names.
+    pub(crate) fn inventory_sha256(&self) -> &str {
+        &self.inventory_sha256
+    }
+
+    /// SHA-256 of the canonical rendered index artifact entry.
+    pub(crate) fn entry_sha256(&self) -> &str {
+        &self.entry_sha256
+    }
+
+    /// The ordinary CI measurement of this entry.
+    pub(crate) fn measurement(&self) -> Value {
+        let companions: serde_json::Map<String, Value> = self
+            .companions
+            .iter()
+            .map(|companion| {
+                (
+                    companion.key.to_owned(),
+                    json!({
+                        "name": companion.name,
+                        "size": companion.size,
+                        "sha256": companion.sha256,
+                    }),
+                )
+            })
+            .collect();
+        json!({
+            "kind": "ordinary-ci-candidate-entry",
+            "asset": self.name,
+            "artifact": {"sha256": self.artifact_sha256, "size": self.artifact_size},
+            "entry": {"sha256": self.entry_sha256, "size": self.entry_size},
+            "js_inventory_sha256": self.inventory_sha256,
+            "rebuild_check_outcome": self.rebuild_outcome,
+            "companions": companions,
+            "gaps": self.gaps,
+            "artifact_schema": "#/$defs/artifact",
+            "release_qualification": false,
+        })
+    }
+}
+
+impl CandidateArtifactEntry {
+    /// Rechecks this entry from its retained bytes and summarizes it.
+    ///
+    /// Rehashes every companion, validates the rendered index artifact
+    /// against the retained `#/$defs/artifact` sub-schema, reruns every
+    /// producer join, and requires each informational companion to state
+    /// exactly the entry's non-empty gaps.
+    ///
+    /// # Errors
+    ///
+    /// Rejects companion bytes that differ from their records, a rendered
+    /// artifact the sub-schema rejects, any failed join, a missing rebuild
+    /// outcome, and empty or inconsistent gaps.
+    pub(crate) fn recheck_for_measurement(&self) -> Result<EntrySummary, Report<ReleaseError>> {
+        self.check_companions(&mut BTreeSet::new())?;
+        if self.gaps.is_empty() {
+            return Err(distribution_error("candidate entry states no gaps"));
+        }
+        let inventory_sha256 = sha256_hex(&self.inventory);
+        let artifact_entry = self.index_entry(&inventory_sha256);
+        validate_release_index_artifact(&artifact_entry)
+            .map_err(|error| error.change_context(ReleaseError::Distribution))?;
+        let companions = self.recomputed_companions(&artifact_entry)?;
+        let modules = inventory_modules(&self.inventory, &self.source_commit)?;
+        check_build_evidence(
+            self.companion_bytes(CompanionRole::BuildEvidence)?,
+            &EvidenceJoin {
+                source_commit: &self.source_commit,
+                target: self.asset.artifact().target.triple(),
+                artifact_sha256: &self.artifact_sha256,
+                inventory_sha256: &inventory_sha256,
+                modules: &modules,
+            },
+        )?;
+        check_spdx_root(
+            self.companion_bytes(CompanionRole::Sbom)?,
+            &self.artifact_sha256,
+        )?;
+        parse_informational(
+            self.companion_bytes(CompanionRole::BuildRecipe)?,
+            &self.source_commit,
+        )?;
+        let rebuild_check = self.companion_bytes(CompanionRole::RebuildCheck)?;
+        check_comparison(rebuild_check, &self.source_commit)?;
+        for role in [
+            CompanionRole::BuildEvidence,
+            CompanionRole::BuildRecipe,
+            CompanionRole::RebuildCheck,
+        ] {
+            let document = parse_json(self.companion_bytes(role)?, DocumentRole::Companion)
+                .map_err(|error| error.change_context(ReleaseError::Distribution))?;
+            if document["release_qualification"] != false || document["gaps"] != json!(self.gaps) {
+                return Err(distribution_error(format!(
+                    "{} companion must be unqualified and state exactly the entry gaps",
+                    role.key()
+                )));
+            }
+        }
+        let rebuild_outcome = parse_informational(rebuild_check, &self.source_commit)?["outcome"]
+            .as_str()
+            .map(str::to_owned)
+            .ok_or_else(|| distribution_error("rebuild check has no outcome"))?;
+        let entry_bytes = canonical_json(&artifact_entry, DocumentRole::Metadata)
+            .map_err(|error| error.change_context(ReleaseError::Distribution))?;
+        Ok(EntrySummary {
+            name: self.name(),
+            artifact_sha256: self.artifact_sha256.clone(),
+            artifact_size: self.artifact_size,
+            inventory_sha256,
+            entry_sha256: sha256_hex(&entry_bytes),
+            entry_size: entry_bytes.len() as u64,
+            rebuild_outcome,
+            companions,
+            gaps: self.gaps.clone(),
+        })
+    }
+
+    /// The exact bytes of the companion with `role`.
+    fn companion_bytes(&self, role: CompanionRole) -> Result<&[u8], Report<ReleaseError>> {
+        self.companions
+            .iter()
+            .find(|file| file.role == role)
+            .map(|file| file.bytes.as_slice())
+            .ok_or_else(|| distribution_error(format!("entry has no {} companion", role.key())))
+    }
+
+    /// Recomputes each companion identity from bytes and requires the
+    /// rendered artifact to record exactly it.
+    fn recomputed_companions(
+        &self,
+        artifact_entry: &Value,
+    ) -> Result<Vec<CompanionSummary>, Report<ReleaseError>> {
+        self.companions
+            .iter()
+            .map(|file| {
+                let summary = CompanionSummary {
+                    key: file.role.key(),
+                    name: file.name.clone(),
+                    size: file.bytes.len() as u64,
+                    sha256: sha256_hex(&file.bytes),
+                };
+                let recorded = &artifact_entry["companions"][summary.key];
+                if recorded
+                    != &json!({"name": summary.name, "size": summary.size, "sha256": summary.sha256})
+                {
+                    return Err(distribution_error(format!(
+                        "rendered {} record differs from its recomputed bytes",
+                        summary.key
+                    )));
+                }
+                Ok(summary)
+            })
+            .collect()
+    }
+}
diff --git a/crates/trusted-server-release/src/distribution/tests.rs b/crates/trusted-server-release/src/distribution/tests.rs
new file mode 100644
index 0000000000..9f927fae62
--- /dev/null
+++ b/crates/trusted-server-release/src/distribution/tests.rs
@@ -0,0 +1,729 @@
+//! Pure candidate index tests over fictional entry facts.
+//!
+//! Entries come from [`EntryParts`] with fictional bytes and identities; a
+//! real completed build cannot be produced without process execution, so the
+//! completed-build wiring rejections live in the recipe tests.
+
+use std::collections::BTreeMap;
+
+use serde_json::{Value, json};
+
+use super::entry::{
+    CompatibilityTest, EntryParts, ModuleObservation, RebuildComparison, RecipeFacts,
+    policy_identity, render_entry,
+};
+use super::*;
+use crate::documents::{validate_release_index_artifact, validate_spdx};
+use crate::policy::{CLI_POLICY_VERSION, FixedArtifact};
+
+mod golden;
+mod summary;
+mod transfer;
+
+/// Fictional approved source commit of every entry.
+const COMMIT: &str = "0123456789abcdef0123456789abcdef01234567";
+/// Another fictional commit.
+const OTHER_COMMIT: &str = "89abcdef0123456789abcdef0123456789abcdef";
+/// The actual tracked consumer policy bytes, so the CLI accepts them as current.
+const POLICY: &[u8] = include_bytes!("../../../trusted-server-cli/release-policy.json");
+/// The CLI's structural positive index fixture.
+const CLI_INDEX_FIXTURE: &[u8] =
+    include_bytes!("../../../trusted-server-cli/tests/fixtures/release/release-index.json");
+const FASTLY: &str = "trusted-server-fastly.wasm";
+const LINUX: &str = "ts-x86_64-unknown-linux-gnu";
+
+fn digest(text: &str) -> String {
+    sha256_hex(text.as_bytes())
+}
+
+fn module(id: &str, embedded: bool) -> ModuleObservation {
+    let body = format!("fictional {id} module body");
+    ModuleObservation {
+        id: id.to_owned(),
+        filename: format!("tsjs-{id}.js"),
+        size: body.len() as u64,
+        sha256: digest(&body),
+        embedded,
+    }
+}
+
+fn inventory() -> Vec<u8> {
+    let modules: Vec<Value> = [module("core", true), module("prebid", true)]
+        .iter()
+        .map(|module| {
+            json!({"id": module.id, "filename": module.filename, "size": module.size,
+                "sha256": module.sha256, "contributions": [{"package": "fictional-js"}]})
+        })
+        .collect();
+    canonical_json(
+        &json!({"schema_version": 1, "source_commit": COMMIT, "modules": modules, "tools": []}),
+        DocumentRole::Metadata,
+    )
+    .expect("should render the fictional inventory")
+}
+
+fn artifact_bytes(asset: &str) -> Vec<u8> {
+    format!("fictional {asset} executable bytes").into_bytes()
+}
+
+fn spdx(asset: &str, artifact_sha256: &str) -> Vec<u8> {
+    let document = json!({
+        "spdxVersion": "SPDX-2.3",
+        "SPDXID": "SPDXRef-DOCUMENT",
+        "name": asset,
+        "dataLicense": "CC0-1.0",
+        "documentNamespace": format!("https://example.com/spdx/candidate/{asset}"),
+        "creationInfo": {
+            "creators": ["Tool: fictional-candidate-fixture"],
+            "created": "2026-01-01T00:00:00Z",
+            "comment": "Unqualified candidate fixture; gaps: fictional-coverage-gap",
+        },
+        "documentDescribes": ["SPDXRef-Artifact"],
+        "packages": [{
+            "SPDXID": "SPDXRef-Artifact",
+            "name": asset,
+            "downloadLocation": "NOASSERTION",
+            "filesAnalyzed": false,
+            "licenseConcluded": "NOASSERTION",
+            "licenseDeclared": "NOASSERTION",
+            "copyrightText": "NOASSERTION",
+            "checksums": [{"algorithm": "SHA256", "checksumValue": artifact_sha256}],
+        }],
+        "relationships": [{
+            "spdxElementId": "SPDXRef-DOCUMENT",
+            "relationshipType": "DESCRIBES",
+            "relatedSpdxElement": "SPDXRef-Artifact",
+        }],
+    });
+    validate_spdx(&document).expect("should keep the fictional SPDX schema-valid");
+    canonical_json(&document, DocumentRole::Spdx).expect("should render the fictional SPDX")
+}
+
+fn parts(asset: &'static str) -> EntryParts {
+    let asset_id = AssetId::parse(asset).expect("should resolve the fixed asset");
+    let bytes = artifact_bytes(asset);
+    let artifact_sha256 = sha256_hex(&bytes);
+    let fastly = asset == FASTLY;
+    let (comparison, test) = if fastly {
+        (
+            RebuildComparison::Matched {
+                reproduction_sha256: artifact_sha256.clone(),
+                reproduction_size: bytes.len() as u64,
+            },
+            CompatibilityTest {
+                name: "fastly-final-byte-publisher-request",
+                facts: BTreeMap::from([
+                    ("viceroy_version", "0.0.0-fictional".to_owned()),
+                    ("health_status", "200".to_owned()),
+                ]),
+            },
+        )
+    } else {
+        (
+            RebuildComparison::Unavailable,
+            CompatibilityTest {
+                name: "native-startup",
+                facts: BTreeMap::from([("startup_kind", "fictional-startup".to_owned())]),
+            },
+        )
+    };
+    EntryParts {
+        asset: asset_id,
+        source_commit: COMMIT.to_owned(),
+        policy_version: CLI_POLICY_VERSION,
+        policy_sha256: sha256_hex(POLICY),
+        spdx: spdx(asset, &artifact_sha256),
+        artifact_sha256,
+        artifact_size: bytes.len() as u64,
+        inventory: inventory(),
+        modules: vec![module("prebid", fastly), module("core", true)],
+        spdx_gaps: vec!["fictional-coverage-gap".to_owned()],
+        recipe: RecipeFacts {
+            definition_sha256: digest("fictional recipe definition"),
+            invocation_sha256: digest("fictional invocation"),
+            cargo_lock_sha256: digest("fictional Cargo.lock"),
+            materials_digest: digest("fictional materials"),
+            rust_tools_digest: digest("fictional Rust tools"),
+        },
+        comparison,
+        compatibility_tests: vec![test],
+    }
+}
+
+fn entry(asset: &'static str) -> CandidateArtifactEntry {
+    render_entry(parts(asset)).expect("should render the fictional entry")
+}
+
+fn entries() -> Vec<CandidateArtifactEntry> {
+    FIXED_ARTIFACTS
+        .iter()
+        .map(|fixed| entry(fixed.name))
+        .collect()
+}
+
+fn assembled() -> CandidateIndex {
+    assemble_candidate_index(&entries()).expect("should assemble the candidate index")
+}
+
+fn rejection<T: core::fmt::Debug>(result: Result<T, Report<ReleaseError>>) -> String {
+    format!("{:?}", result.expect_err("should reject the candidate"))
+}
+
+fn companion(entry: &CandidateArtifactEntry, role: CompanionRole) -> Value {
+    let file = entry
+        .companions
+        .iter()
+        .find(|file| file.role == role)
+        .expect("should carry the companion");
+    serde_json::from_slice(&file.bytes).expect("should parse the companion")
+}
+
+fn rendered_artifacts(index: &CandidateIndex) -> (Value, Vec<Value>) {
+    let value: Value = serde_json::from_slice(index.bytes()).expect("should parse the index");
+    let artifacts = value["artifacts"]
+        .as_array()
+        .expect("should list artifacts")
+        .clone();
+    (value, artifacts)
+}
+
+// ---- Step 1: retained schema validators ----
+
+#[test]
+fn release_index_validator_accepts_the_existing_positive_fixture() {
+    let value = parse_json(CLI_INDEX_FIXTURE, DocumentRole::Metadata)
+        .expect("should parse the CLI index fixture");
+    validate_release_index(&value).expect("should accept the structural positive fixture");
+    validate_release_index_artifact(&value["artifacts"][0])
+        .expect("should accept a valid fixture artifact entry");
+}
+
+#[test]
+fn artifact_validator_rejects_a_fastly_entry_with_the_cli_capability() {
+    let value = parse_json(CLI_INDEX_FIXTURE, DocumentRole::Metadata)
+        .expect("should parse the CLI index fixture");
+    let mut fastly = value["artifacts"]
+        .as_array()
+        .expect("should list artifacts")
+        .iter()
+        .find(|artifact| artifact["name"] == FASTLY)
+        .expect("should contain the Fastly entry")
+        .clone();
+    fastly["capabilities"] = json!(["cli-execute"]);
+    assert!(
+        validate_release_index_artifact(&fastly).is_err(),
+        "should reject cli-execute on the Fastly asset"
+    );
+    fastly["capabilities"] = json!(["fastly-production", "unknown-capability"]);
+    assert!(
+        validate_release_index_artifact(&fastly).is_err(),
+        "should reject an unknown capability"
+    );
+}
+
+// ---- Step 2: fixed identity accessor ----
+
+fn schema_row(name: &str) -> Value {
+    let schema = parse_json(
+        include_bytes!("../../../../docs/superpowers/specs/schemas/release-index-v1.schema.json"),
+        DocumentRole::Metadata,
+    )
+    .expect("should parse the retained schema");
+    schema["$defs"]["artifact"]["oneOf"]
+        .as_array()
+        .expect("should list identity rows")
+        .iter()
+        .find(|row| row["properties"]["name"]["const"] == name)
+        .expect("should have a row per asset")["properties"]
+        .clone()
+}
+
+fn minimum_version(runtime: &str) -> Value {
+    let schema = parse_json(
+        include_bytes!("../../../../docs/superpowers/specs/schemas/release-index-v1.schema.json"),
+        DocumentRole::Metadata,
+    )
+    .expect("should parse the retained schema");
+    schema["$defs"]["compatibility"]["oneOf"]
+        .as_array()
+        .expect("should list compatibility rows")
+        .iter()
+        .find(|row| row["properties"]["runtime"]["const"] == runtime)
+        .expect("should have a compatibility row")["properties"]["minimum_version"]["const"]
+        .clone()
+}
+
+fn check_identity_row(fixed: &FixedArtifact) {
+    let identity = fixed.index_identity();
+    let row = schema_row(fixed.name);
+    for key in [
+        "name",
+        "role",
+        "kind",
+        "package",
+        "target",
+        "variant",
+        "assurance_profile",
+    ] {
+        assert_eq!(
+            identity[key], row[key]["const"],
+            "should render the schema {key} of {}",
+            fixed.name
+        );
+    }
+    let capabilities = &row["capabilities"];
+    let expected = if capabilities["const"].is_array() {
+        capabilities["const"].clone()
+    } else {
+        json!([capabilities["contains"]["const"]])
+    };
+    assert_eq!(
+        identity["capabilities"], expected,
+        "should render only the required capability of {}",
+        fixed.name
+    );
+    let compatibility = &identity["compatibility"];
+    for key in ["runtime", "architecture"] {
+        assert_eq!(
+            compatibility[key], row["compatibility"]["properties"][key]["const"],
+            "should render the schema compatibility {key} of {}",
+            fixed.name
+        );
+    }
+    assert_eq!(
+        compatibility["minimum_version"],
+        minimum_version(compatibility["runtime"].as_str().unwrap_or_default()),
+        "should render the schema minimum version of {}",
+        fixed.name
+    );
+    assert_eq!(
+        identity.as_object().map(serde_json::Map::len),
+        Some(9),
+        "should render exactly the nine identity fields"
+    );
+}
+
+#[test]
+fn fixed_identity_accessor_equals_the_schema_row_for_every_asset() {
+    FIXED_ARTIFACTS.iter().for_each(check_identity_row);
+}
+
+// ---- Step 3: valid four-entry join ----
+
+#[test]
+fn four_valid_entries_assemble_a_schema_valid_candidate_index() {
+    let index = assembled();
+    let (value, artifacts) = rendered_artifacts(&index);
+    validate_release_index(&value).expect("should satisfy the retained schema");
+    assert_eq!(
+        index.name(),
+        CANDIDATE_INDEX_NAME,
+        "should use the fixed name"
+    );
+    assert_ne!(
+        index.name(),
+        "release-index.json",
+        "should never be named as a release"
+    );
+    assert_eq!(value["tag"], CANDIDATE_TAG, "should carry the sentinel tag");
+    assert_eq!(value["source_commit"], COMMIT, "should name the source");
+    assert_eq!(
+        value["recipe_source_commit"], COMMIT,
+        "recipe commit should equal source"
+    );
+    assert_eq!(
+        value["cohort_source_commit"], COMMIT,
+        "cohort commit should equal source"
+    );
+    assert_eq!(
+        value["policy_sha256"],
+        sha256_hex(POLICY),
+        "should name the policy"
+    );
+    assert_eq!(
+        index.sha256(),
+        sha256_hex(index.bytes()),
+        "should hash exact bytes"
+    );
+    let names: Vec<&str> = artifacts
+        .iter()
+        .filter_map(|a| a["name"].as_str())
+        .collect();
+    let mut sorted = names.clone();
+    sorted.sort_unstable();
+    assert_eq!(names, sorted, "should emit artifacts sorted by name");
+    for artifact in &artifacts {
+        let name = artifact["name"].as_str().unwrap_or_default();
+        for (key, suffix) in BUNDLE_SUFFIXES {
+            assert_eq!(
+                artifact["companions"][key],
+                json!({"name": format!("{name}{suffix}"), "size": 0, "sha256": sha256_hex(b"")}),
+                "should render the true empty-file record for {name} {key}"
+            );
+        }
+    }
+    assert_eq!(
+        index.companions().len(),
+        16,
+        "should carry sixteen companions"
+    );
+    assert!(
+        index
+            .gaps()
+            .iter()
+            .any(|gap| gap == "candidate-tag-sentinel"),
+        "should state the sentinel gap"
+    );
+}
+
+// ---- Step 4: join rejections ----
+
+#[test]
+fn join_rejects_missing_extra_and_duplicate_assets() {
+    let mut three = entries();
+    three.pop();
+    assert!(
+        rejection(assemble_candidate_index(&three)).contains("missing asset"),
+        "should reject three entries"
+    );
+    let mut five = entries();
+    five.push(entry(LINUX));
+    assert!(
+        rejection(assemble_candidate_index(&five)).contains("more than once"),
+        "should reject five entries"
+    );
+    let mut duplicate = entries();
+    duplicate[0] = entry(LINUX);
+    assert!(
+        assemble_candidate_index(&duplicate).is_err(),
+        "should reject four entries with one asset twice"
+    );
+}
+
+#[test]
+fn join_rejects_mixed_source_policy_or_inventory() {
+    let mut source = entries();
+    source[2].source_commit = OTHER_COMMIT.to_owned();
+    assert!(
+        rejection(assemble_candidate_index(&source)).contains("different source commits"),
+        "should reject mixed source commits"
+    );
+    let mut policy = entries();
+    policy[1].policy_sha256 = "f".repeat(64);
+    assert!(
+        rejection(assemble_candidate_index(&policy)).contains("different producer policies"),
+        "should reject mixed policy identities"
+    );
+    let mut inventory = entries();
+    inventory[3].inventory.push(b' ');
+    assert!(
+        rejection(assemble_candidate_index(&inventory)).contains("different JS inventories"),
+        "should reject mixed inventory bytes"
+    );
+}
+
+#[test]
+fn rendered_check_rejects_fastly_staging_and_non_sentinel_bundles() {
+    let index = assembled();
+    let (value, artifacts) = rendered_artifacts(&index);
+    let mut fastly = artifacts
+        .iter()
+        .find(|artifact| artifact["name"] == FASTLY)
+        .expect("should render Fastly")
+        .clone();
+    fastly["capabilities"] = json!(["fastly-production", "fastly-staging"]);
+    validate_release_index_artifact(&fastly)
+        .expect("should be structurally compatible with the schema");
+    assert!(
+        rejection(check_rendered_artifact(&fastly, &value["tsjs_inventory"]))
+            .contains("fixed identity"),
+        "should reject the currently forbidden fastly-staging capability"
+    );
+    let mut bundle = artifacts[1].clone();
+    bundle["companions"]["provenance"]["size"] = json!(1);
+    assert!(
+        rejection(check_rendered_artifact(&bundle, &value["tsjs_inventory"]))
+            .contains("awaiting-signature sentinel"),
+        "should reject a non-sentinel bundle record"
+    );
+}
+
+#[test]
+fn join_rejects_unsafe_colliding_or_misnamed_companions() {
+    for name in [
+        "ts-x86_64-unknown-linux-gnu/../evil.spdx.json",
+        "ts-x86_64-unknown-linux-gnu\n.spdx.json",
+        "TS-X86_64-UNKNOWN-LINUX-GNU.spdx.json",
+    ] {
+        let mut altered = entries();
+        let linux = altered
+            .iter_mut()
+            .find(|entry| entry.name() == LINUX)
+            .expect("should hold the Linux entry");
+        linux.companions[0].name = name.to_owned();
+        assert!(
+            assemble_candidate_index(&altered).is_err(),
+            "should reject companion name {name:?}"
+        );
+    }
+    let mut names = BTreeSet::new();
+    insert_name(&mut names, "tsjs-inventory.json").expect("should accept the inventory name");
+    assert!(
+        insert_name(&mut names, "TSJS-Inventory.json").is_err(),
+        "should reject a case-colliding name"
+    );
+    assert!(
+        insert_name(&mut names, "line\nbreak.json").is_err(),
+        "should reject a newline in a name"
+    );
+}
+
+#[test]
+fn join_rejects_companion_size_or_digest_mismatch() {
+    let mut size = entries();
+    size[0].companions[1].size += 1;
+    assert!(
+        rejection(assemble_candidate_index(&size)).contains("recorded size or digest"),
+        "should reject an altered companion length"
+    );
+    let mut sha = entries();
+    sha[0].companions[2].sha256 = "0".repeat(64);
+    assert!(
+        rejection(assemble_candidate_index(&sha)).contains("recorded size or digest"),
+        "should reject an altered companion digest"
+    );
+    let mut bytes = entries();
+    bytes[0].companions[3].bytes.push(b' ');
+    assert!(
+        assemble_candidate_index(&bytes).is_err(),
+        "should reject changed companion bytes"
+    );
+}
+
+// ---- Step 5: signature bundle slots ----
+
+/// Compile-time proof that no signed bundle can be constructed.
+fn signed_bundles_are_uninhabited(signed: &SignedCompanions) -> ! {
+    match *signed {}
+}
+
+#[test]
+fn awaiting_signature_renders_the_true_empty_file_record() {
+    let _proof: fn(&SignedCompanions) -> ! = signed_bundles_are_uninhabited;
+    assert_eq!(
+        BundleSlot::AwaitingSignature.record("example.sbom.sigstore.json"),
+        json!({"name": "example.sbom.sigstore.json", "size": 0, "sha256": EMPTY_SHA256}),
+        "should render the empty-file record"
+    );
+    assert_eq!(
+        EMPTY_SHA256,
+        sha256_hex(b""),
+        "should be the SHA-256 of zero bytes"
+    );
+}
+
+// ---- Step 6: companion rendering rules ----
+
+#[test]
+fn build_evidence_lists_sorted_prepared_modules_and_the_embedded_subset() {
+    let linux = entry(LINUX);
+    let evidence = companion(&linux, CompanionRole::BuildEvidence);
+    let ids = |key: &str| -> Vec<Value> {
+        evidence[key]
+            .as_array()
+            .expect("should list modules")
+            .iter()
+            .map(|module| module["id"].clone())
+            .collect()
+    };
+    assert_eq!(
+        ids("prepared_modules"),
+        [json!("core"), json!("prebid")],
+        "should sort"
+    );
+    assert_eq!(
+        ids("embedded_modules"),
+        [json!("core")],
+        "should list the embedded subset"
+    );
+    let mut extra = parts(LINUX);
+    extra.modules.push(module("unlisted", true));
+    assert!(
+        rejection(render_entry(extra)).contains("differ from the shared inventory"),
+        "should reject prepared modules outside the inventory"
+    );
+}
+
+#[test]
+fn fastly_entry_rejects_a_js_build_material_module() {
+    let mut fastly = parts(FASTLY);
+    fastly.modules[0].embedded = false;
+    assert!(
+        rejection(render_entry(fastly)).contains("embed every prepared JS module"),
+        "should reject a Fastly module classified as build material"
+    );
+}
+
+#[test]
+fn rebuild_check_is_matched_only_with_fastly_equality() {
+    let fastly = companion(&entry(FASTLY), CompanionRole::RebuildCheck);
+    assert_eq!(
+        fastly["outcome"], "matched",
+        "should record Fastly equality"
+    );
+    let linux = companion(&entry(LINUX), CompanionRole::RebuildCheck);
+    assert_eq!(
+        linux["outcome"], "unavailable",
+        "should record native unavailable"
+    );
+    assert_eq!(
+        linux["reproduction_sha256"],
+        Value::Null,
+        "should not invent a digest"
+    );
+    let mut unavailable = parts(FASTLY);
+    unavailable.comparison = RebuildComparison::Unavailable;
+    assert!(
+        render_entry(unavailable).is_err(),
+        "Fastly should require equality"
+    );
+    let mut matched = parts(LINUX);
+    matched.comparison = RebuildComparison::Matched {
+        reproduction_sha256: matched.artifact_sha256.clone(),
+        reproduction_size: matched.artifact_size,
+    };
+    assert!(
+        render_entry(matched).is_err(),
+        "native should never claim matched"
+    );
+    let mut different = parts(FASTLY);
+    different.comparison = RebuildComparison::Matched {
+        reproduction_sha256: "0".repeat(64),
+        reproduction_size: different.artifact_size,
+    };
+    assert!(
+        render_entry(different).is_err(),
+        "should reject other equality bytes"
+    );
+}
+
+#[test]
+fn every_informational_companion_is_unqualified_with_gaps_and_null_transfers() {
+    for entry in entries() {
+        assert!(!entry.gaps().is_empty(), "should state entry gaps");
+        for role in [
+            CompanionRole::BuildEvidence,
+            CompanionRole::BuildRecipe,
+            CompanionRole::RebuildCheck,
+        ] {
+            let document = companion(&entry, role);
+            assert_eq!(
+                document["release_qualification"], false,
+                "should never claim qualification"
+            );
+            let gaps = document["gaps"].as_array().expect("should list gaps");
+            let mut sorted = gaps.clone();
+            sorted.sort_by(|left, right| left.as_str().cmp(&right.as_str()));
+            sorted.dedup();
+            assert!(
+                !gaps.is_empty() && *gaps == sorted,
+                "gaps should be sorted unique"
+            );
+            assert_eq!(
+                document["workflow_run_id"],
+                Value::Null,
+                "run ID is unavailable"
+            );
+        }
+    }
+}
+
+#[test]
+fn entry_rejects_a_wrong_spdx_root_or_missing_gaps() {
+    let mut root = parts(FASTLY);
+    root.spdx = spdx(FASTLY, &"0".repeat(64));
+    assert!(
+        rejection(render_entry(root)).contains("checksum differs"),
+        "should reject an SPDX root bound to other bytes"
+    );
+    let mut gaps = parts(FASTLY);
+    gaps.spdx_gaps.clear();
+    assert!(
+        render_entry(gaps).is_err(),
+        "should require candidate SPDX gaps"
+    );
+    let mut tests = parts(LINUX);
+    tests.compatibility_tests.clear();
+    assert!(
+        render_entry(tests).is_err(),
+        "should require a compatibility test"
+    );
+}
+
+// ---- Step 7: determinism ----
+
+#[test]
+fn assembly_is_deterministic_across_entry_order() {
+    let first = assembled();
+    let second = assembled();
+    assert_eq!(
+        first.bytes(),
+        second.bytes(),
+        "should render identical bytes"
+    );
+    let mut permuted = entries();
+    permuted.reverse();
+    permuted.swap(0, 2);
+    let reordered = assemble_candidate_index(&permuted).expect("should accept any entry order");
+    assert_eq!(
+        first.bytes(),
+        reordered.bytes(),
+        "should ignore entry order"
+    );
+    assert_eq!(
+        first.companions(),
+        reordered.companions(),
+        "should match companions"
+    );
+    assert_eq!(first.gaps(), reordered.gaps(), "should match gaps");
+}
+
+#[test]
+fn inventory_join_uses_the_consumer_inventory_byte_limit() {
+    assert_eq!(
+        super::joins::INVENTORY_ROLE.limit(),
+        super::joins::CLI_INVENTORY_BYTES,
+        "should parse the inventory under the CLI inventory bound"
+    );
+}
+
+// ---- Producer policy identity from approved bytes ----
+
+#[test]
+fn policy_identity_derives_version_and_digest_from_the_same_bytes() {
+    assert_eq!(
+        policy_identity(POLICY).expect("should accept the tracked consumer policy"),
+        (CLI_POLICY_VERSION, sha256_hex(POLICY)),
+        "should read the version and hash the exact approved bytes"
+    );
+}
+
+#[test]
+fn policy_identity_rejects_mismatched_missing_zero_or_non_integer_versions() {
+    for (case, bytes) in [
+        ("mismatched version", br#"{"policy_version":2}"#.as_slice()),
+        ("missing version", br#"{"repository":"example"}"#.as_slice()),
+        ("version zero", br#"{"policy_version":0}"#.as_slice()),
+        (
+            "fractional version",
+            br#"{"policy_version":1.0}"#.as_slice(),
+        ),
+        ("string version", br#"{"policy_version":"1"}"#.as_slice()),
+        ("malformed JSON", b"not JSON".as_slice()),
+    ] {
+        assert!(
+            policy_identity(bytes).is_err(),
+            "should reject the {case} policy"
+        );
+    }
+}
diff --git a/crates/trusted-server-release/src/distribution/tests/golden.rs b/crates/trusted-server-release/src/distribution/tests/golden.rs
new file mode 100644
index 0000000000..6c76654574
--- /dev/null
+++ b/crates/trusted-server-release/src/distribution/tests/golden.rs
@@ -0,0 +1,169 @@
+//! Golden byte equality between the producer's candidate rendering and the
+//! committed fixtures the CLI consumer verifies.
+//!
+//! The committed files under `tests/fixtures/index/candidate/` are fictional
+//! except for `policy_sha256`, which is the digest of the actual tracked
+//! `crates/trusted-server-cli/release-policy.json`, so the consumer accepts
+//! the producer policy as current. A policy change therefore requires
+//! regenerating these fixtures in the same change.
+
+use super::*;
+
+/// Every committed candidate fixture file and its exact bytes.
+const FIXTURES: [(&str, &[u8]); 18] = [
+    (
+        "candidate-release-index.json",
+        include_bytes!("../../../tests/fixtures/index/candidate/candidate-release-index.json"),
+    ),
+    (
+        "tsjs-inventory.json",
+        include_bytes!("../../../tests/fixtures/index/candidate/tsjs-inventory.json"),
+    ),
+    (
+        "trusted-server-fastly.wasm.spdx.json",
+        include_bytes!(
+            "../../../tests/fixtures/index/candidate/trusted-server-fastly.wasm.spdx.json"
+        ),
+    ),
+    (
+        "trusted-server-fastly.wasm.build-evidence.json",
+        include_bytes!(
+            "../../../tests/fixtures/index/candidate/trusted-server-fastly.wasm.build-evidence.json"
+        ),
+    ),
+    (
+        "trusted-server-fastly.wasm.build-recipe.json",
+        include_bytes!(
+            "../../../tests/fixtures/index/candidate/trusted-server-fastly.wasm.build-recipe.json"
+        ),
+    ),
+    (
+        "trusted-server-fastly.wasm.rebuild-check.json",
+        include_bytes!(
+            "../../../tests/fixtures/index/candidate/trusted-server-fastly.wasm.rebuild-check.json"
+        ),
+    ),
+    (
+        "ts-aarch64-apple-darwin.spdx.json",
+        include_bytes!("../../../tests/fixtures/index/candidate/ts-aarch64-apple-darwin.spdx.json"),
+    ),
+    (
+        "ts-aarch64-apple-darwin.build-evidence.json",
+        include_bytes!(
+            "../../../tests/fixtures/index/candidate/ts-aarch64-apple-darwin.build-evidence.json"
+        ),
+    ),
+    (
+        "ts-aarch64-apple-darwin.build-recipe.json",
+        include_bytes!(
+            "../../../tests/fixtures/index/candidate/ts-aarch64-apple-darwin.build-recipe.json"
+        ),
+    ),
+    (
+        "ts-aarch64-apple-darwin.rebuild-check.json",
+        include_bytes!(
+            "../../../tests/fixtures/index/candidate/ts-aarch64-apple-darwin.rebuild-check.json"
+        ),
+    ),
+    (
+        "ts-x86_64-apple-darwin.spdx.json",
+        include_bytes!("../../../tests/fixtures/index/candidate/ts-x86_64-apple-darwin.spdx.json"),
+    ),
+    (
+        "ts-x86_64-apple-darwin.build-evidence.json",
+        include_bytes!(
+            "../../../tests/fixtures/index/candidate/ts-x86_64-apple-darwin.build-evidence.json"
+        ),
+    ),
+    (
+        "ts-x86_64-apple-darwin.build-recipe.json",
+        include_bytes!(
+            "../../../tests/fixtures/index/candidate/ts-x86_64-apple-darwin.build-recipe.json"
+        ),
+    ),
+    (
+        "ts-x86_64-apple-darwin.rebuild-check.json",
+        include_bytes!(
+            "../../../tests/fixtures/index/candidate/ts-x86_64-apple-darwin.rebuild-check.json"
+        ),
+    ),
+    (
+        "ts-x86_64-unknown-linux-gnu.spdx.json",
+        include_bytes!(
+            "../../../tests/fixtures/index/candidate/ts-x86_64-unknown-linux-gnu.spdx.json"
+        ),
+    ),
+    (
+        "ts-x86_64-unknown-linux-gnu.build-evidence.json",
+        include_bytes!(
+            "../../../tests/fixtures/index/candidate/ts-x86_64-unknown-linux-gnu.build-evidence.json"
+        ),
+    ),
+    (
+        "ts-x86_64-unknown-linux-gnu.build-recipe.json",
+        include_bytes!(
+            "../../../tests/fixtures/index/candidate/ts-x86_64-unknown-linux-gnu.build-recipe.json"
+        ),
+    ),
+    (
+        "ts-x86_64-unknown-linux-gnu.rebuild-check.json",
+        include_bytes!(
+            "../../../tests/fixtures/index/candidate/ts-x86_64-unknown-linux-gnu.rebuild-check.json"
+        ),
+    ),
+];
+
+fn fixture(name: &str) -> &'static [u8] {
+    FIXTURES
+        .iter()
+        .find(|(fixture, _)| *fixture == name)
+        .map(|(_, bytes)| *bytes)
+        .expect("should commit the named fixture")
+}
+
+#[test]
+fn producer_rendering_equals_the_committed_candidate_fixtures() {
+    let index = assembled();
+    assert_eq!(
+        index.bytes(),
+        fixture(CANDIDATE_INDEX_NAME),
+        "should render the committed candidate index bytes"
+    );
+    assert_eq!(
+        index.inventory(),
+        fixture(INVENTORY_NAME),
+        "should name the committed inventory bytes"
+    );
+    assert_eq!(
+        index.companions().len() + 2,
+        FIXTURES.len(),
+        "should commit exactly the index, inventory and present companions"
+    );
+    for (name, bytes) in index.companions() {
+        assert_eq!(
+            bytes.as_slice(),
+            fixture(name),
+            "should render the committed companion {name}"
+        );
+    }
+}
+
+#[test]
+fn committed_fixture_names_the_actual_tracked_consumer_policy() {
+    let index: Value = serde_json::from_slice(fixture(CANDIDATE_INDEX_NAME))
+        .expect("should parse the committed index");
+    let policy = parse_json(POLICY, DocumentRole::Metadata).expect("should parse the policy");
+    assert_eq!(
+        index["policy_sha256"],
+        sha256_hex(POLICY),
+        "should bind the exact tracked policy bytes"
+    );
+    assert_eq!(
+        index["policy_version"], policy["policy_version"],
+        "should name the tracked policy version"
+    );
+    assert_eq!(
+        policy["policy_version"], CLI_POLICY_VERSION,
+        "should match the compiled policy version"
+    );
+}
diff --git a/crates/trusted-server-release/src/distribution/tests/summary.rs b/crates/trusted-server-release/src/distribution/tests/summary.rs
new file mode 100644
index 0000000000..86c13a823c
--- /dev/null
+++ b/crates/trusted-server-release/src/distribution/tests/summary.rs
@@ -0,0 +1,160 @@
+//! Pure tests of the test-only entry re-check and its measurement shape.
+
+use super::*;
+
+/// A fictional entry whose companion with `role` carries `bytes`, re-recorded
+/// so only the joins, not the digest records, can reject it.
+fn with_companion(
+    asset: &'static str,
+    role: CompanionRole,
+    bytes: Vec<u8>,
+) -> CandidateArtifactEntry {
+    let mut tampered = entry(asset);
+    let file = tampered
+        .companions
+        .iter_mut()
+        .find(|file| file.role == role)
+        .expect("should carry the companion");
+    *file = CompanionFile::new(role, asset, bytes);
+    tampered
+}
+
+#[test]
+fn fastly_entry_summary_records_matched_outcome_and_recomputed_companions() {
+    let fastly = entry(FASTLY);
+
+    let summary = fastly
+        .recheck_for_measurement()
+        .expect("should recheck the fictional Fastly entry");
+    let measurement = summary.measurement();
+
+    assert_eq!(
+        summary.rebuild_outcome(),
+        "matched",
+        "should record the checked equality"
+    );
+    assert_eq!(
+        summary.inventory_sha256(),
+        sha256_hex(&inventory()),
+        "should name the exact inventory bytes"
+    );
+    let keys: Vec<&String> = measurement
+        .as_object()
+        .expect("should render an object")
+        .keys()
+        .collect();
+    assert_eq!(
+        keys,
+        [
+            "artifact",
+            "artifact_schema",
+            "asset",
+            "companions",
+            "entry",
+            "gaps",
+            "js_inventory_sha256",
+            "kind",
+            "rebuild_check_outcome",
+            "release_qualification",
+        ],
+        "should render exactly the measurement fields"
+    );
+    assert_eq!(measurement["asset"], FASTLY, "should name the asset");
+    assert_eq!(
+        measurement["release_qualification"],
+        json!(false),
+        "should grant no qualification"
+    );
+    assert_eq!(
+        measurement["gaps"],
+        json!(fastly.gaps()),
+        "should record the entry gaps"
+    );
+    for file in &fastly.companions {
+        assert_eq!(
+            measurement["companions"][file.role.key()],
+            json!({"name": file.name, "size": file.bytes.len(), "sha256": sha256_hex(&file.bytes)}),
+            "should record the {} identity recomputed from bytes",
+            file.role.key()
+        );
+    }
+    let rendered = canonical_json(
+        &fastly.index_entry(&sha256_hex(&inventory())),
+        DocumentRole::Metadata,
+    )
+    .expect("should render the artifact entry");
+    assert_eq!(
+        measurement["entry"],
+        json!({"sha256": sha256_hex(&rendered), "size": rendered.len()}),
+        "should record the rendered artifact entry identity"
+    );
+}
+
+#[test]
+fn native_entry_summary_records_unavailable_outcome_and_reproduction_gap() {
+    let summary = entry(LINUX)
+        .recheck_for_measurement()
+        .expect("should recheck the fictional Linux entry");
+
+    assert_eq!(
+        summary.rebuild_outcome(),
+        "unavailable",
+        "should record no native comparison"
+    );
+    assert!(
+        summary.measurement()["gaps"]
+            .as_array()
+            .expect("should list gaps")
+            .contains(&json!("native-reproduction-unavailable")),
+        "should state the native reproduction gap"
+    );
+}
+
+#[test]
+fn recheck_rejects_companion_bytes_differing_from_their_record() {
+    let mut tampered = entry(LINUX);
+    tampered.companions[1].bytes.push(b' ');
+
+    let error = rejection(tampered.recheck_for_measurement());
+
+    assert!(
+        error.contains("differ from its recorded size or digest"),
+        "should reject the stale record: {error}"
+    );
+}
+
+#[test]
+fn recheck_reruns_joins_on_re_recorded_companions() {
+    let evidence = companion(&entry(FASTLY), CompanionRole::BuildEvidence);
+    let mut wrong_inventory = evidence.clone();
+    wrong_inventory["js_inventory_sha256"] = json!(digest("another inventory"));
+    let bytes = canonical_json(&wrong_inventory, DocumentRole::Companion)
+        .expect("should render the tampered evidence");
+
+    let error = rejection(
+        with_companion(FASTLY, CompanionRole::BuildEvidence, bytes).recheck_for_measurement(),
+    );
+
+    assert!(
+        error.contains("`js_inventory_sha256` differs from the index entry"),
+        "should rerun the build evidence join: {error}"
+    );
+}
+
+#[test]
+fn recheck_rejects_a_companion_stating_other_gaps() {
+    let mut recipe = companion(&entry(LINUX), CompanionRole::BuildRecipe);
+    recipe["gaps"] = json!(["fictional-other-gap"]);
+    let bytes = canonical_json(&recipe, DocumentRole::Companion).expect("should render the recipe");
+
+    let error = rejection(
+        with_companion(LINUX, CompanionRole::BuildRecipe, bytes).recheck_for_measurement(),
+    );
+
+    assert!(
+        error.contains(
+            "build_recipe companion must be unqualified and state exactly the entry gaps"
+        ),
+        "should reject inconsistent gaps: {error}"
+    );
+}
diff --git a/crates/trusted-server-release/src/distribution/tests/transfer.rs b/crates/trusted-server-release/src/distribution/tests/transfer.rs
new file mode 100644
index 0000000000..9328b4106b
--- /dev/null
+++ b/crates/trusted-server-release/src/distribution/tests/transfer.rs
@@ -0,0 +1,811 @@
+//! Pure tests of the test-only ordinary-CI entry transfer and its collector.
+//!
+//! Fictional entries are exported to flat files, rebuilt from those bytes and
+//! assembled, which must reproduce the committed golden candidate index.
+
+use std::path::Path;
+
+use crate::distribution::transfer::{
+    ARTIFACT_MEMBER, EntryDescriptor, ReceivedEntry, assemble_received, check_distinct_uploads,
+    member_names, upload_name, write_candidate_index,
+};
+
+use super::*;
+
+/// Fictional producing workflow run of every descriptor.
+const RUN_ID: u64 = 4242;
+/// The committed golden candidate index bytes.
+const GOLDEN_INDEX: &[u8] =
+    include_bytes!("../../../tests/fixtures/index/candidate/candidate-release-index.json");
+const MACOS_ARM: &str = "ts-aarch64-apple-darwin";
+
+fn asset_id(asset: &str) -> AssetId {
+    AssetId::parse(asset).expect("should resolve the fixed asset")
+}
+
+/// The six flat members of the fictional entry for `asset`.
+fn members(asset: &'static str) -> BTreeMap<String, Vec<u8>> {
+    let artifact = artifact_bytes(asset);
+    entry(asset)
+        .transfer_members(&artifact)
+        .into_iter()
+        .map(|(name, bytes)| (name, bytes.to_vec()))
+        .collect()
+}
+
+fn sizes(members: &BTreeMap<String, Vec<u8>>) -> BTreeMap<String, u64> {
+    members
+        .iter()
+        .map(|(name, bytes)| (name.clone(), bytes.len() as u64))
+        .collect()
+}
+
+/// The descriptor JSON the CI describe step would emit for `asset`.
+fn descriptor_json(asset: &'static str, artifact_id: u64) -> Value {
+    let entry_sha256 = entry(asset)
+        .recheck_for_measurement()
+        .expect("should recheck the fictional entry")
+        .entry_sha256()
+        .to_owned();
+    json!({
+        "asset": asset,
+        "entry_sha256": entry_sha256,
+        "members": sizes(&members(asset)),
+        "artifact_id": artifact_id,
+        "artifact_name": format!("candidate-entry-{asset}-{RUN_ID}-1"),
+        "archive_sha256": format!("sha256:{}", digest(&format!("fictional archive {asset}"))),
+        "run_attempt": 1,
+    })
+}
+
+fn render_metadata(value: &Value) -> Vec<u8> {
+    canonical_json(value, DocumentRole::Metadata).expect("should render the fictional JSON")
+}
+
+fn descriptor(asset: &'static str, artifact_id: u64) -> EntryDescriptor {
+    EntryDescriptor::parse(
+        &render_metadata(&descriptor_json(asset, artifact_id)),
+        asset_id(asset),
+        RUN_ID,
+    )
+    .expect("should accept the fictional descriptor")
+}
+
+fn received() -> Vec<ReceivedEntry> {
+    FIXED_ARTIFACTS
+        .iter()
+        .zip(1_u64..)
+        .map(|(fixed, artifact_id)| ReceivedEntry {
+            descriptor: descriptor(fixed.name, artifact_id),
+            members: members(fixed.name),
+        })
+        .collect()
+}
+
+fn rebuild(
+    asset: &'static str,
+    members: &BTreeMap<String, Vec<u8>>,
+) -> Result<CandidateArtifactEntry, Report<ReleaseError>> {
+    CandidateArtifactEntry::from_ordinary_ci_transfer(asset_id(asset), COMMIT, POLICY, members)
+}
+
+/// Rewrites the companion with `suffix` of `asset` through `edit`.
+fn edit_companion(
+    members: &mut BTreeMap<String, Vec<u8>>,
+    asset: &str,
+    suffix: &str,
+    edit: impl FnOnce(&mut Value),
+) {
+    let bytes = members
+        .get_mut(&format!("{asset}{suffix}"))
+        .expect("should carry the companion");
+    let mut value: Value = serde_json::from_slice(bytes).expect("should parse the companion");
+    edit(&mut value);
+    let role = if suffix == ".spdx.json" {
+        DocumentRole::Spdx
+    } else {
+        DocumentRole::Companion
+    };
+    *bytes = canonical_json(&value, role).expect("should render the edited companion");
+}
+
+/// Applies `edit` to all three informational companions of `asset`.
+fn edit_informational(
+    members: &mut BTreeMap<String, Vec<u8>>,
+    asset: &str,
+    edit: impl Fn(&mut Value),
+) {
+    for suffix in [
+        ".build-evidence.json",
+        ".build-recipe.json",
+        ".rebuild-check.json",
+    ] {
+        edit_companion(members, asset, suffix, &edit);
+    }
+}
+
+fn rebuild_rejection(asset: &'static str, members: &BTreeMap<String, Vec<u8>>) -> String {
+    rejection(rebuild(asset, members))
+}
+
+fn read_directory(directory: &Path) -> BTreeMap<String, Vec<u8>> {
+    std::fs::read_dir(directory)
+        .expect("should list the directory")
+        .map(|item| {
+            let item = item.expect("should read the directory entry");
+            let name = item
+                .file_name()
+                .into_string()
+                .expect("should use UTF-8 names");
+            let bytes = std::fs::read(item.path()).expect("should read the member");
+            (name, bytes)
+        })
+        .collect()
+}
+
+// ---- Round trip ----
+
+#[test]
+fn exported_entries_rebuild_into_exactly_the_golden_candidate_index() {
+    let scratch = tempfile::tempdir().expect("should create a scratch directory");
+    let received: Vec<ReceivedEntry> = entries()
+        .iter()
+        .zip(1_u64..)
+        .map(|(entry, artifact_id)| {
+            let asset = entry.name();
+            let upload = scratch.path().join(format!("{asset}-upload"));
+            let transfer = scratch.path().join(format!("{asset}-transfer.json"));
+            entry
+                .export_flat_for_ordinary_ci(&artifact_bytes(asset), &upload, &transfer)
+                .expect("should export the fictional entry");
+            let mut description: Value = serde_json::from_slice(
+                &std::fs::read(&transfer).expect("should read the transfer file"),
+            )
+            .expect("should parse the transfer file");
+            description["artifact_id"] = json!(artifact_id);
+            description["artifact_name"] = json!(format!("candidate-entry-{asset}-{RUN_ID}-1"));
+            description["archive_sha256"] = json!(digest(asset));
+            description["run_attempt"] = json!(1);
+            ReceivedEntry {
+                descriptor: EntryDescriptor::parse(
+                    &render_metadata(&description),
+                    asset_id(asset),
+                    RUN_ID,
+                )
+                .expect("should accept the exported descriptor"),
+                members: read_directory(&upload),
+            }
+        })
+        .collect();
+
+    let index =
+        assemble_received(&received, COMMIT, POLICY).expect("should assemble rebuilt entries");
+
+    assert_eq!(
+        index.bytes(),
+        GOLDEN_INDEX,
+        "should rebuild exactly the committed candidate index"
+    );
+    assert_eq!(
+        index.bytes(),
+        assembled().bytes(),
+        "should equal the directly assembled index"
+    );
+}
+
+#[test]
+fn rebuilt_entry_rechecks_to_the_original_entry_digest() {
+    for fixed in FIXED_ARTIFACTS {
+        let original = entry(fixed.name)
+            .recheck_for_measurement()
+            .expect("should recheck the original entry");
+        let rebuilt = rebuild(fixed.name, &members(fixed.name))
+            .expect("should rebuild the fictional entry")
+            .recheck_for_measurement()
+            .expect("should recheck the rebuilt entry");
+
+        assert_eq!(
+            rebuilt.entry_sha256(),
+            original.entry_sha256(),
+            "should rebuild the identical entry for {}",
+            fixed.name
+        );
+    }
+}
+
+// ---- Rebuild rejections ----
+
+#[test]
+fn rebuild_rejects_missing_extra_or_misnamed_members() {
+    let mut missing = members(FASTLY);
+    missing.remove(ARTIFACT_MEMBER);
+    assert!(
+        rebuild_rejection(FASTLY, &missing).contains("exactly its six flat members"),
+        "should reject a missing executable"
+    );
+
+    let mut extra = members(FASTLY);
+    extra.insert("candidate-build-record.json".to_owned(), b"{}".to_vec());
+    assert!(
+        rebuild_rejection(FASTLY, &extra).contains("exactly its six flat members"),
+        "should reject an extra member"
+    );
+
+    let mut misnamed = members(FASTLY);
+    let spdx = misnamed
+        .remove(&format!("{FASTLY}.spdx.json"))
+        .expect("should carry the SPDX companion");
+    misnamed.insert(format!("{LINUX}.spdx.json"), spdx);
+    assert!(
+        rebuild_rejection(FASTLY, &misnamed).contains("exactly its six flat members"),
+        "should reject a companion named for another asset"
+    );
+}
+
+#[test]
+fn rebuild_rejects_evidence_for_another_asset_target_or_commit() {
+    let mut asset = members(FASTLY);
+    edit_companion(&mut asset, FASTLY, ".build-evidence.json", |evidence| {
+        evidence["asset"] = json!(LINUX);
+    });
+    assert!(
+        rebuild_rejection(FASTLY, &asset).contains("unqualified candidate evidence"),
+        "should reject evidence naming another asset"
+    );
+
+    let mut target = members(LINUX);
+    edit_companion(&mut target, LINUX, ".build-evidence.json", |evidence| {
+        evidence["target"] = json!("x86_64-apple-darwin");
+    });
+    assert!(
+        rebuild_rejection(LINUX, &target).contains("unqualified candidate evidence"),
+        "should reject evidence naming another target"
+    );
+
+    let commit = CandidateArtifactEntry::from_ordinary_ci_transfer(
+        asset_id(LINUX),
+        OTHER_COMMIT,
+        POLICY,
+        &members(LINUX),
+    );
+    assert!(
+        rejection(commit).contains("expected source"),
+        "should reject evidence from another source commit"
+    );
+}
+
+#[test]
+fn rebuild_rejects_qualified_or_workflow_bound_companions() {
+    let mut evidence = members(LINUX);
+    edit_companion(&mut evidence, LINUX, ".build-evidence.json", |document| {
+        document["release_qualification"] = json!(true);
+    });
+    assert!(
+        rebuild_rejection(LINUX, &evidence).contains("unqualified candidate evidence"),
+        "should reject qualified build evidence"
+    );
+
+    let mut recipe = members(LINUX);
+    edit_companion(&mut recipe, LINUX, ".build-recipe.json", |document| {
+        document["release_qualification"] = json!(true);
+    });
+    assert!(
+        rebuild_rejection(LINUX, &recipe).contains("must be unqualified"),
+        "should reject a qualified build recipe"
+    );
+
+    let mut bound = members(LINUX);
+    edit_companion(&mut bound, LINUX, ".build-evidence.json", |document| {
+        document["transfer_artifact_id"] = json!(7);
+    });
+    assert!(
+        rebuild_rejection(LINUX, &bound).contains("unqualified candidate evidence"),
+        "should reject a claimed transfer binding"
+    );
+}
+
+#[test]
+fn rebuild_rejects_differing_or_incomplete_gaps() {
+    let mut differing = members(LINUX);
+    edit_companion(&mut differing, LINUX, ".build-recipe.json", |document| {
+        document["gaps"] = json!(["fictional-other-gap"]);
+    });
+    assert!(
+        rebuild_rejection(LINUX, &differing).contains("exactly the entry gaps"),
+        "should reject gaps differing between companions"
+    );
+
+    let mut incomplete = members(LINUX);
+    edit_informational(&mut incomplete, LINUX, |document| {
+        let gaps: Vec<Value> = document["gaps"]
+            .as_array()
+            .expect("should list gaps")
+            .iter()
+            .filter(|gap| *gap != "trusted-workflow-transfer-not-bound")
+            .cloned()
+            .collect();
+        document["gaps"] = json!(gaps);
+    });
+    assert!(
+        rebuild_rejection(LINUX, &incomplete).contains("omit the fixed gap"),
+        "should reject gaps omitting a fixed entry gap"
+    );
+
+    let mut unsorted = members(LINUX);
+    edit_informational(&mut unsorted, LINUX, |document| {
+        let mut gaps = document["gaps"]
+            .as_array()
+            .expect("should list gaps")
+            .clone();
+        gaps.reverse();
+        document["gaps"] = json!(gaps);
+    });
+    assert!(
+        rebuild_rejection(LINUX, &unsorted).contains("sorted and unique"),
+        "should reject unsorted gaps"
+    );
+
+    let mut fastly_native_gap = members(FASTLY);
+    edit_informational(&mut fastly_native_gap, FASTLY, |document| {
+        let mut gaps: Vec<String> =
+            serde_json::from_value(document["gaps"].clone()).expect("should list gap strings");
+        gaps.push("native-reproduction-unavailable".to_owned());
+        gaps.sort();
+        document["gaps"] = json!(gaps);
+    });
+    assert!(
+        rebuild_rejection(FASTLY, &fastly_native_gap).contains("exactly for native assets"),
+        "should reject the native reproduction gap on the Fastly asset"
+    );
+}
+
+#[test]
+fn rebuild_enforces_the_comparison_rule_per_asset() {
+    let mut fastly_unavailable = members(FASTLY);
+    edit_companion(
+        &mut fastly_unavailable,
+        FASTLY,
+        ".rebuild-check.json",
+        |document| {
+            document["outcome"] = json!("unavailable");
+            document["reproduction_sha256"] = Value::Null;
+        },
+    );
+    assert!(
+        rebuild_rejection(FASTLY, &fastly_unavailable).contains("checked Fastly equality"),
+        "should reject an unavailable Fastly comparison"
+    );
+
+    let mut native_matched = members(LINUX);
+    let artifact_sha256 = sha256_hex(&artifact_bytes(LINUX));
+    edit_companion(
+        &mut native_matched,
+        LINUX,
+        ".rebuild-check.json",
+        |document| {
+            document["outcome"] = json!("matched");
+            document["reproduction_sha256"] = json!(artifact_sha256);
+        },
+    );
+    assert!(
+        rebuild_rejection(LINUX, &native_matched).contains("checked Fastly equality"),
+        "should reject a matched native comparison"
+    );
+
+    let mut fastly_other = members(FASTLY);
+    edit_companion(
+        &mut fastly_other,
+        FASTLY,
+        ".rebuild-check.json",
+        |document| {
+            document["reproduction_sha256"] = json!(digest("fictional other reproduction"));
+        },
+    );
+    assert!(
+        rebuild_rejection(FASTLY, &fastly_other).contains("checked Fastly equality"),
+        "should reject a Fastly reproduction digest other than canonical"
+    );
+}
+
+#[test]
+fn rebuild_rejects_changed_executable_inventory_or_spdx_root() {
+    let mut executable = members(MACOS_ARM);
+    executable.insert(
+        ARTIFACT_MEMBER.to_owned(),
+        b"fictional tampered executable".to_vec(),
+    );
+    assert!(
+        rebuild_rejection(MACOS_ARM, &executable).contains("differs from its build evidence"),
+        "should reject executable bytes other than the recorded artifact"
+    );
+
+    let mut inventory_change = members(MACOS_ARM);
+    let mut value: Value = serde_json::from_slice(&inventory_change[INVENTORY_NAME])
+        .expect("should parse the inventory");
+    value["tools"] = json!([{"name": "fictional-tool"}]);
+    inventory_change.insert(INVENTORY_NAME.to_owned(), render_metadata(&value));
+    assert!(
+        rebuild_rejection(MACOS_ARM, &inventory_change).contains("js_inventory_sha256"),
+        "should reject an inventory other than the evidence digest names"
+    );
+
+    let mut spdx_root = members(MACOS_ARM);
+    edit_companion(&mut spdx_root, MACOS_ARM, ".spdx.json", |document| {
+        document["packages"][0]["checksums"][0]["checksumValue"] =
+            json!(digest("fictional other executable"));
+    });
+    assert!(
+        rebuild_rejection(MACOS_ARM, &spdx_root).contains("SPDX root package checksum"),
+        "should reject an SPDX root naming another executable"
+    );
+
+    let mut embedded = members(FASTLY);
+    edit_companion(&mut embedded, FASTLY, ".build-evidence.json", |document| {
+        let first = document["embedded_modules"][0].clone();
+        document["embedded_modules"] = json!([first]);
+    });
+    assert!(
+        rebuild_rejection(FASTLY, &embedded).contains("embed every prepared JS module"),
+        "should reject a Fastly executable omitting a prepared module"
+    );
+}
+
+#[test]
+fn rebuild_rejects_another_policy_version_or_an_oversized_companion() {
+    let mut policy = parse_json(POLICY, DocumentRole::Metadata).expect("should parse the policy");
+    policy["policy_version"] = json!(CLI_POLICY_VERSION + 1);
+    let other_policy = render_metadata(&policy);
+    let result = CandidateArtifactEntry::from_ordinary_ci_transfer(
+        asset_id(LINUX),
+        COMMIT,
+        &other_policy,
+        &members(LINUX),
+    );
+    assert!(
+        rejection(result).contains("differs from compiled version"),
+        "should reject a policy version other than the compiled one"
+    );
+
+    let mut oversized = members(LINUX);
+    let limit = usize::try_from(DocumentRole::Spdx.limit()).expect("should fit the SPDX limit");
+    oversized.insert(format!("{LINUX}.spdx.json"), vec![b' '; limit + 1]);
+    assert!(
+        rebuild_rejection(LINUX, &oversized).contains("role byte limit"),
+        "should reject a companion over its role limit"
+    );
+}
+
+// ---- Descriptor parser ----
+
+fn descriptor_rejection(value: &Value, asset: &str) -> String {
+    rejection(EntryDescriptor::parse(
+        &render_metadata(value),
+        asset_id(asset),
+        RUN_ID,
+    ))
+}
+
+#[test]
+fn descriptor_accepts_the_exact_upload_outputs() {
+    let parsed = descriptor(FASTLY, 9);
+
+    assert_eq!(parsed.artifact_id(), 9, "should keep the exact upload ID");
+    assert_eq!(
+        parsed.artifact_name(),
+        upload_name(asset_id(FASTLY), RUN_ID, 1),
+        "should keep the exact upload name"
+    );
+    assert_eq!(
+        parsed.archive_sha256(),
+        digest(&format!("fictional archive {FASTLY}")),
+        "should strip the optional sha256 prefix"
+    );
+    assert_eq!(
+        parsed.members().keys().cloned().collect::<BTreeSet<_>>(),
+        member_names(asset_id(FASTLY)),
+        "should declare exactly the six flat members"
+    );
+}
+
+#[test]
+fn descriptor_rejects_unknown_or_missing_keys_and_another_asset() {
+    let mut unknown = descriptor_json(FASTLY, 1);
+    unknown["workflow_run_id"] = json!(1);
+    assert!(
+        descriptor_rejection(&unknown, FASTLY).contains("exactly its transfer and upload keys"),
+        "should reject an unknown key"
+    );
+
+    let mut missing = descriptor_json(FASTLY, 1);
+    missing
+        .as_object_mut()
+        .expect("should be an object")
+        .remove("run_attempt");
+    assert!(
+        descriptor_rejection(&missing, FASTLY).contains("exactly its transfer and upload keys"),
+        "should reject a missing key"
+    );
+
+    assert!(
+        descriptor_rejection(&descriptor_json(FASTLY, 1), LINUX).contains("another asset"),
+        "should reject a descriptor in another asset's slot"
+    );
+}
+
+#[test]
+fn descriptor_rejects_bad_identity_digest_or_name() {
+    let cases: [(&str, Value, &str); 6] = [
+        ("artifact_id", json!(0), "upload ID must be positive"),
+        ("run_attempt", json!(0), "run attempt must be positive"),
+        ("archive_sha256", json!("sha256:ABC"), "archive digest"),
+        (
+            "entry_sha256",
+            json!(digest("x").to_uppercase()),
+            "entry digest",
+        ),
+        (
+            "artifact_name",
+            json!(format!("candidate-entry-{FASTLY}-1-1")),
+            "upload name must be",
+        ),
+        ("run_attempt", json!(2), "upload name must be"),
+    ];
+    for (key, replacement, expected) in cases {
+        let mut value = descriptor_json(FASTLY, 1);
+        value[key] = replacement;
+        let message = descriptor_rejection(&value, FASTLY);
+        assert!(
+            message.contains(expected),
+            "should reject a bad {key}: {message}"
+        );
+    }
+}
+
+#[test]
+fn descriptor_rejects_wrong_member_names_or_sizes() {
+    let mut renamed = descriptor_json(FASTLY, 1);
+    let members = renamed["members"]
+        .as_object_mut()
+        .expect("should list members");
+    let size = members
+        .remove(ARTIFACT_MEMBER)
+        .expect("should declare the executable");
+    members.insert("executable".to_owned(), size);
+    assert!(
+        descriptor_rejection(&renamed, FASTLY).contains("exactly the six flat members"),
+        "should reject a renamed member"
+    );
+
+    let mut empty = descriptor_json(FASTLY, 1);
+    empty["members"][INVENTORY_NAME] = json!(0);
+    assert!(
+        descriptor_rejection(&empty, FASTLY).contains("empty or exceeds its bound"),
+        "should reject an empty member"
+    );
+
+    let mut oversized = descriptor_json(FASTLY, 1);
+    oversized["members"][format!("{FASTLY}.build-recipe.json")] =
+        json!(DocumentRole::Companion.limit() + 1);
+    assert!(
+        descriptor_rejection(&oversized, FASTLY).contains("empty or exceeds its bound"),
+        "should reject a member over its role bound"
+    );
+
+    let mut executable = descriptor_json(FASTLY, 1);
+    executable["members"][ARTIFACT_MEMBER] = json!(DocumentRole::Executable.limit() + 1);
+    assert!(
+        descriptor_rejection(&executable, FASTLY).contains("empty or exceeds its bound"),
+        "should reject an executable over its bound"
+    );
+}
+
+#[test]
+fn collector_rejects_repeated_upload_ids() {
+    let first = descriptor(FASTLY, 5);
+    let second = descriptor(LINUX, 5);
+
+    assert!(
+        rejection(check_distinct_uploads(&[&first, &second])).contains("distinct IDs"),
+        "should reject two slots naming the same upload"
+    );
+}
+
+// ---- Collector assembly ----
+
+#[test]
+fn collector_rejects_members_or_entry_digest_differing_from_the_descriptor() {
+    let mut changed_member = received();
+    changed_member[0]
+        .members
+        .insert(ARTIFACT_MEMBER.to_owned(), b"short".to_vec());
+    assert!(
+        rejection(assemble_received(&changed_member, COMMIT, POLICY))
+            .contains("differ from their descriptor"),
+        "should reject members differing from the declared sizes"
+    );
+
+    let mut other_entry = received();
+    let asset = FIXED_ARTIFACTS[1].name;
+    assert_eq!(
+        other_entry[1].descriptor.asset(),
+        asset_id(asset),
+        "should receive entries in cohort order"
+    );
+    let mut value = descriptor_json(asset, 2);
+    value["entry_sha256"] = json!(digest("fictional other entry"));
+    other_entry[1].descriptor =
+        EntryDescriptor::parse(&render_metadata(&value), asset_id(asset), RUN_ID)
+            .expect("should accept the descriptor shape");
+    assert!(
+        rejection(assemble_received(&other_entry, COMMIT, POLICY))
+            .contains("differs from the producing job's entry"),
+        "should reject an entry other than the producing job checked"
+    );
+
+    let mut three = received();
+    three.pop();
+    assert!(
+        rejection(assemble_received(&three, COMMIT, POLICY)).contains("missing asset"),
+        "should never assemble from fewer than four entries"
+    );
+}
+
+/// Inventory bytes like the fictional one, from `commit` with `tools`.
+fn inventory_from(commit: &str, tools: Value) -> Vec<u8> {
+    let mut value: Value = serde_json::from_slice(&inventory()).expect("should parse inventory");
+    value["source_commit"] = json!(commit);
+    value["tools"] = tools;
+    render_metadata(&value)
+}
+
+/// Rebuilds the fictional entry of `asset` rendered from `parts`.
+fn rebuilt_from(parts: EntryParts, commit: &str) -> CandidateArtifactEntry {
+    let asset = parts.asset;
+    let artifact = artifact_bytes(asset.artifact().name);
+    let entry = render_entry(parts).expect("should render the varied entry");
+    let members: BTreeMap<String, Vec<u8>> = entry
+        .transfer_members(&artifact)
+        .into_iter()
+        .map(|(name, bytes)| (name, bytes.to_vec()))
+        .collect();
+    CandidateArtifactEntry::from_ordinary_ci_transfer(asset, commit, POLICY, &members)
+        .expect("should rebuild the varied entry")
+}
+
+/// Rebuilt entries for every asset except Linux, plus `linux`.
+fn rebuilt_with_linux(linux: CandidateArtifactEntry) -> Vec<CandidateArtifactEntry> {
+    FIXED_ARTIFACTS
+        .iter()
+        .filter(|fixed| fixed.name != LINUX)
+        .map(|fixed| rebuilt_from(parts(fixed.name), COMMIT))
+        .chain([linux])
+        .collect()
+}
+
+#[test]
+fn rebuilt_entries_still_reject_mixed_commits_or_inventories() {
+    let mut other = parts(LINUX);
+    other.source_commit = OTHER_COMMIT.to_owned();
+    other.inventory = inventory_from(OTHER_COMMIT, json!([]));
+    let mixed_commit = rebuilt_with_linux(rebuilt_from(other, OTHER_COMMIT));
+    assert!(
+        rejection(assemble_candidate_index(&mixed_commit)).contains("different source commits"),
+        "should reject rebuilt entries from different commits"
+    );
+
+    let mut varied = parts(LINUX);
+    varied.inventory = inventory_from(COMMIT, json!([{"name": "fictional-tool"}]));
+    let mixed_inventory = rebuilt_with_linux(rebuilt_from(varied, COMMIT));
+    assert!(
+        rejection(assemble_candidate_index(&mixed_inventory)).contains("different JS inventories"),
+        "should reject rebuilt entries naming different inventories"
+    );
+}
+
+// ---- Export and index writers ----
+
+#[test]
+fn export_writes_exactly_the_six_declared_members() {
+    let scratch = tempfile::tempdir().expect("should create a scratch directory");
+    let upload = scratch.path().join("candidate-entry");
+    let transfer = scratch.path().join("candidate-entry-transfer.json");
+
+    entry(MACOS_ARM)
+        .export_flat_for_ordinary_ci(&artifact_bytes(MACOS_ARM), &upload, &transfer)
+        .expect("should export the fictional entry");
+
+    let written = read_directory(&upload);
+    let description: Value =
+        serde_json::from_slice(&std::fs::read(&transfer).expect("should read the transfer file"))
+            .expect("should parse the transfer file");
+    assert_eq!(
+        written.keys().cloned().collect::<BTreeSet<_>>(),
+        member_names(asset_id(MACOS_ARM)),
+        "should write exactly the six flat members"
+    );
+    assert_eq!(
+        description["members"],
+        json!(sizes(&written)),
+        "should declare the written member sizes"
+    );
+    assert_eq!(
+        written,
+        members(MACOS_ARM),
+        "should write the exact member bytes"
+    );
+    assert_eq!(
+        description["asset"], MACOS_ARM,
+        "should name the exported asset"
+    );
+}
+
+#[test]
+fn export_refuses_existing_paths_nested_transfer_or_other_executable_bytes() {
+    let scratch = tempfile::tempdir().expect("should create a scratch directory");
+    let existing = scratch.path().join("existing");
+    std::fs::create_dir(&existing).expect("should create the existing directory");
+    let transfer = scratch.path().join("transfer.json");
+    let linux = entry(LINUX);
+    let artifact = artifact_bytes(LINUX);
+
+    assert!(
+        rejection(linux.export_flat_for_ordinary_ci(&artifact, &existing, &transfer))
+            .contains("cannot create new transfer directory"),
+        "should refuse an existing upload directory"
+    );
+
+    let fresh = scratch.path().join("fresh");
+    assert!(
+        rejection(linux.export_flat_for_ordinary_ci(
+            &artifact,
+            &fresh,
+            &fresh.join("transfer.json")
+        ))
+        .contains("outside the uploaded directory"),
+        "should refuse a transfer file inside the upload"
+    );
+
+    assert!(
+        rejection(linux.export_flat_for_ordinary_ci(b"fictional other bytes", &fresh, &transfer))
+            .contains("differ from the entry's recorded artifact"),
+        "should refuse executable bytes other than the recorded artifact"
+    );
+    assert!(
+        !fresh.exists(),
+        "should write nothing for a rejected export"
+    );
+}
+
+#[test]
+fn index_writer_writes_the_index_inventory_and_sixteen_companions_once() {
+    let scratch = tempfile::tempdir().expect("should create a scratch directory");
+    let root = scratch.path().join("candidate-index");
+    let index = assembled();
+
+    write_candidate_index(&index, &root).expect("should write the candidate index");
+
+    let written = read_directory(&root);
+    assert_eq!(written.len(), 18, "should write exactly eighteen files");
+    assert_eq!(
+        written.get(CANDIDATE_INDEX_NAME).map(Vec::as_slice),
+        Some(index.bytes()),
+        "should write the exact index bytes"
+    );
+    assert_eq!(
+        written.get(INVENTORY_NAME).map(Vec::as_slice),
+        Some(index.inventory()),
+        "should write the exact inventory bytes"
+    );
+    for (name, bytes) in index.companions() {
+        assert_eq!(
+            written.get(name),
+            Some(bytes),
+            "should write the exact companion {name}"
+        );
+    }
+    assert!(
+        rejection(write_candidate_index(&index, &root))
+            .contains("cannot create new transfer directory"),
+        "should refuse an existing index directory"
+    );
+}
diff --git a/crates/trusted-server-release/src/distribution/transfer.rs b/crates/trusted-server-release/src/distribution/transfer.rs
new file mode 100644
index 0000000000..57d34169da
--- /dev/null
+++ b/crates/trusted-server-release/src/distribution/transfer.rs
@@ -0,0 +1,652 @@
+//! Test-only ordinary-CI transfer of candidate entries between CI jobs.
+//!
+//! Each real candidate job exports its rechecked [`CandidateArtifactEntry`]
+//! as six flat files (the final executable, the shared JS inventory and the
+//! four unsigned companions) plus a separate CI-internal descriptor. A
+//! collector job downloads the four exact uploads, rebuilds each entry with
+//! [`CandidateArtifactEntry::from_ordinary_ci_transfer`], which reruns every
+//! producer join over the transferred bytes, and assembles the unqualified
+//! candidate index with the unchanged [`assemble_candidate_index`].
+//!
+//! The descriptor is ordinary-CI plumbing, not a release schema. Nothing here
+//! binds a trusted workflow transfer: companions keep `null` workflow and
+//! transfer identities and the `trusted-workflow-transfer-not-bound` gap, and
+//! nothing grants signing, publication or qualification authority.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::os::unix::fs::DirBuilderExt as _;
+use std::path::Path;
+
+use error_stack::Report;
+use serde_json::{Value, json};
+
+use super::entry::{ENTRY_GAPS, MAX_GAP_LENGTH, NATIVE_REPRODUCTION_GAP, policy_identity};
+use super::joins::{
+    EvidenceJoin, INVENTORY_ROLE, check_build_evidence, check_comparison, check_spdx_root,
+    inventory_modules, parse_informational,
+};
+use super::{
+    CandidateArtifactEntry, CandidateIndex, CompanionFile, CompanionRole, INVENTORY_NAME,
+    assemble_candidate_index, distribution_error, sha256_hex,
+};
+use crate::collection::producer::write_new;
+use crate::documents::{Role as DocumentRole, canonical_json, lower_hex, parse_json};
+use crate::error::ReleaseError;
+use crate::policy::ReleaseTarget;
+use crate::recipe::AssetId;
+
+/// Flat member name of the transferred final executable.
+pub(crate) const ARTIFACT_MEMBER: &str = "artifact";
+/// Prefix of every candidate-entry upload name.
+const UPLOAD_PREFIX: &str = "candidate-entry-";
+/// Keys the producing job's transfer file carries.
+const TRANSFER_KEYS: [&str; 3] = ["asset", "entry_sha256", "members"];
+/// Keys the CI describe step adds from the exact upload-step outputs.
+const UPLOAD_KEYS: [&str; 4] = [
+    "archive_sha256",
+    "artifact_id",
+    "artifact_name",
+    "run_attempt",
+];
+/// Domain of the rendered build-evidence companion.
+const EVIDENCE_DOMAIN: &str = "trusted-server.release.candidate-build-evidence";
+/// Domain of the rendered build-recipe companion.
+const RECIPE_DOMAIN: &str = "trusted-server.release.candidate-build-recipe";
+/// Domain of the rendered rebuild-check companion.
+const REBUILD_DOMAIN: &str = "trusted-server.release.candidate-rebuild-check";
+
+type Result<T> = core::result::Result<T, Report<ReleaseError>>;
+
+fn parse(bytes: &[u8], role: DocumentRole) -> Result<Value> {
+    parse_json(bytes, role).map_err(|error| error.change_context(ReleaseError::Distribution))
+}
+
+fn write_member(path: &Path, bytes: &[u8]) -> Result<()> {
+    write_new(path, bytes).map_err(|error| error.change_context(ReleaseError::Distribution))
+}
+
+/// Creates a new private directory, refusing an existing path.
+fn create_private_directory(directory: &Path) -> Result<()> {
+    std::fs::DirBuilder::new()
+        .mode(0o700)
+        .create(directory)
+        .map_err(|error| {
+            distribution_error(format!(
+                "cannot create new transfer directory {}: {error}",
+                directory.display()
+            ))
+        })
+}
+
+/// The byte bound of one transferred member of `asset`.
+fn member_limit(asset: AssetId, name: &str) -> Option<u64> {
+    if name == ARTIFACT_MEMBER {
+        return Some(DocumentRole::Executable.limit());
+    }
+    if name == INVENTORY_NAME {
+        return Some(INVENTORY_ROLE.limit());
+    }
+    CompanionRole::ALL
+        .into_iter()
+        .find(|role| name == format!("{}{}", asset.artifact().name, role.suffix()))
+        .map(CompanionRole::limit)
+}
+
+/// The exact six flat member names transferred for `asset`.
+pub(crate) fn member_names(asset: AssetId) -> BTreeSet<String> {
+    let mut names: BTreeSet<String> = CompanionRole::ALL
+        .into_iter()
+        .map(|role| format!("{}{}", asset.artifact().name, role.suffix()))
+        .collect();
+    names.insert(ARTIFACT_MEMBER.to_owned());
+    names.insert(INVENTORY_NAME.to_owned());
+    names
+}
+
+/// The exact upload name of `asset` from producing `run_id` and `run_attempt`.
+pub(crate) fn upload_name(asset: AssetId, run_id: u64, run_attempt: u64) -> String {
+    format!(
+        "{UPLOAD_PREFIX}{}-{run_id}-{run_attempt}",
+        asset.artifact().name
+    )
+}
+
+impl CandidateArtifactEntry {
+    /// The exact flat member bytes of this entry plus its final executable.
+    pub(super) fn transfer_members<'a>(&'a self, artifact: &'a [u8]) -> BTreeMap<String, &'a [u8]> {
+        let mut members: BTreeMap<String, &[u8]> = self
+            .companions
+            .iter()
+            .map(|file| (file.name.clone(), file.bytes.as_slice()))
+            .collect();
+        members.insert(ARTIFACT_MEMBER.to_owned(), artifact);
+        members.insert(INVENTORY_NAME.to_owned(), &self.inventory);
+        members
+    }
+
+    /// Exports this rechecked entry for the ordinary-CI index collector.
+    ///
+    /// Writes exactly the six flat members into the new directory
+    /// `upload_directory` and the transfer file (asset, member sizes and
+    /// the rechecked entry digest) to the new file `transfer_file`, which
+    /// must lie outside the upload directory.
+    ///
+    /// # Errors
+    ///
+    /// Rejects executable bytes other than the entry's recorded size and
+    /// digest, a failed recheck, an existing directory or file, a transfer
+    /// file inside the upload directory and any write failure.
+    pub(crate) fn export_flat_for_ordinary_ci(
+        &self,
+        artifact: &[u8],
+        upload_directory: &Path,
+        transfer_file: &Path,
+    ) -> Result<()> {
+        if artifact.len() as u64 != self.artifact_size
+            || sha256_hex(artifact) != self.artifact_sha256
+        {
+            return Err(distribution_error(
+                "exported executable bytes differ from the entry's recorded artifact",
+            ));
+        }
+        if transfer_file.starts_with(upload_directory) {
+            return Err(distribution_error(
+                "transfer file must lie outside the uploaded directory",
+            ));
+        }
+        let summary = self.recheck_for_measurement()?;
+        let members = self.transfer_members(artifact);
+        let sizes: BTreeMap<&str, u64> = members
+            .iter()
+            .map(|(name, bytes)| (name.as_str(), bytes.len() as u64))
+            .collect();
+        let transfer = canonical_json(
+            &json!({
+                "asset": self.name(),
+                "entry_sha256": summary.entry_sha256(),
+                "members": sizes,
+            }),
+            DocumentRole::Metadata,
+        )
+        .map_err(|error| error.change_context(ReleaseError::Distribution))?;
+        create_private_directory(upload_directory)?;
+        for (name, bytes) in &members {
+            write_member(&upload_directory.join(name), bytes)?;
+        }
+        write_member(transfer_file, &transfer)
+    }
+
+    /// Rebuilds one entry from an ordinary-CI job's transferred bytes.
+    ///
+    /// Test-only. `policy` must be the consumer policy bytes the collector
+    /// read from its own authenticated checkout; the policy identity is never
+    /// taken from the producing job. Every producer join reruns over the
+    /// exact bytes: the shared inventory, build evidence (including the
+    /// executable's size and digest, which the transferred executable must
+    /// match), the SPDX root, the informational recipe and the rebuild check.
+    /// Fastly must record the checked `matched` equality and native assets
+    /// `unavailable`; every companion must be unqualified, carry `null`
+    /// workflow and transfer identities and state the same sorted gaps.
+    ///
+    /// # Errors
+    ///
+    /// Rejects a missing, extra or misnamed member, any companion naming
+    /// another asset, target, source or executable, a qualified companion,
+    /// differing or incomplete gaps, a comparison outcome other than the
+    /// asset's rule, a policy version other than the compiled one and any
+    /// failed join or oversized companion.
+    pub(crate) fn from_ordinary_ci_transfer(
+        asset: AssetId,
+        source_commit: &str,
+        policy: &[u8],
+        members: &BTreeMap<String, Vec<u8>>,
+    ) -> Result<Self> {
+        let expected = member_names(asset);
+        if !members.keys().eq(expected.iter()) {
+            return Err(distribution_error(format!(
+                "transfer for `{}` must carry exactly its six flat members",
+                asset.artifact().name
+            )));
+        }
+        if !lower_hex(source_commit, 40) {
+            return Err(distribution_error("expected source commit is malformed"));
+        }
+        let (policy_version, policy_sha256) = policy_identity(policy)?;
+        let member = |name: &str| -> &[u8] { members.get(name).map_or(&[], Vec::as_slice) };
+        let companion = |role: CompanionRole| {
+            member(&format!("{}{}", asset.artifact().name, role.suffix())).to_vec()
+        };
+        let evidence_bytes = companion(CompanionRole::BuildEvidence);
+        let evidence = parse(&evidence_bytes, DocumentRole::Companion)?;
+        let identity = check_evidence_identity(asset, source_commit, &evidence)?;
+        let artifact = member(ARTIFACT_MEMBER);
+        if artifact.len() as u64 != identity.artifact_size
+            || sha256_hex(artifact) != identity.artifact_sha256
+        {
+            return Err(distribution_error(
+                "transferred executable differs from its build evidence",
+            ));
+        }
+        let inventory = member(INVENTORY_NAME).to_vec();
+        let inventory_sha256 = sha256_hex(&inventory);
+        let modules = inventory_modules(&inventory, source_commit)?;
+        check_build_evidence(
+            &evidence_bytes,
+            &EvidenceJoin {
+                source_commit,
+                target: asset.artifact().target.triple(),
+                artifact_sha256: &identity.artifact_sha256,
+                inventory_sha256: &inventory_sha256,
+                modules: &modules,
+            },
+        )?;
+        if is_fastly(asset) && evidence["embedded_modules"] != evidence["prepared_modules"] {
+            return Err(distribution_error(
+                "Fastly executable must embed every prepared JS module",
+            ));
+        }
+        let spdx = companion(CompanionRole::Sbom);
+        check_spdx_root(&spdx, &identity.artifact_sha256)?;
+        let recipe_bytes = companion(CompanionRole::BuildRecipe);
+        let recipe = parse_informational(&recipe_bytes, source_commit)?;
+        check_recipe(asset, &recipe)?;
+        let rebuild_bytes = companion(CompanionRole::RebuildCheck);
+        check_comparison(&rebuild_bytes, source_commit)?;
+        let rebuild = parse_informational(&rebuild_bytes, source_commit)?;
+        check_rebuild(asset, &identity.artifact_sha256, &rebuild)?;
+        let gaps = check_gaps(asset, &evidence)?;
+        for (role, document) in [
+            (CompanionRole::BuildRecipe, &recipe),
+            (CompanionRole::RebuildCheck, &rebuild),
+        ] {
+            if document["release_qualification"] != false || document["gaps"] != json!(gaps) {
+                return Err(distribution_error(format!(
+                    "{} companion must be unqualified and state exactly the entry gaps",
+                    role.key()
+                )));
+            }
+        }
+        let name = asset.artifact().name;
+        let entry = Self {
+            asset,
+            source_commit: source_commit.to_owned(),
+            policy_version,
+            policy_sha256,
+            inventory,
+            artifact_size: identity.artifact_size,
+            artifact_sha256: identity.artifact_sha256,
+            companions: vec![
+                CompanionFile::new(CompanionRole::Sbom, name, spdx),
+                CompanionFile::new(CompanionRole::BuildEvidence, name, evidence_bytes),
+                CompanionFile::new(CompanionRole::BuildRecipe, name, recipe_bytes),
+                CompanionFile::new(CompanionRole::RebuildCheck, name, rebuild_bytes),
+            ],
+            gaps,
+        };
+        entry.check_companions(&mut BTreeSet::new())?;
+        Ok(entry)
+    }
+}
+
+fn is_fastly(asset: AssetId) -> bool {
+    asset.artifact().target == ReleaseTarget::Wasm32Wasip1
+}
+
+/// The executable identity build evidence records.
+struct EvidenceIdentity {
+    artifact_sha256: String,
+    artifact_size: u64,
+}
+
+fn check_evidence_identity(
+    asset: AssetId,
+    source_commit: &str,
+    evidence: &Value,
+) -> Result<EvidenceIdentity> {
+    let artifact = asset.artifact();
+    if evidence["domain"] != EVIDENCE_DOMAIN
+        || evidence["schema_version"] != 1
+        || evidence["release_qualification"] != false
+        || evidence["asset"] != artifact.name
+        || evidence["target"] != artifact.target.triple()
+        || evidence["source_commit"] != source_commit
+        || !evidence["workflow_run_id"].is_null()
+        || !evidence["transfer_artifact_id"].is_null()
+    {
+        return Err(distribution_error(format!(
+            "build evidence is not the unqualified candidate evidence of `{}` at the expected source",
+            artifact.name
+        )));
+    }
+    let artifact_sha256 = evidence["artifact_sha256"]
+        .as_str()
+        .filter(|digest| lower_hex(digest, 64))
+        .map(str::to_owned);
+    let artifact_size = evidence["artifact_size"]
+        .as_u64()
+        .filter(|size| (1..=DocumentRole::Executable.limit()).contains(size));
+    let (Some(artifact_sha256), Some(artifact_size)) = (artifact_sha256, artifact_size) else {
+        return Err(distribution_error(
+            "build evidence executable identity is malformed",
+        ));
+    };
+    Ok(EvidenceIdentity {
+        artifact_sha256,
+        artifact_size,
+    })
+}
+
+fn check_recipe(asset: AssetId, recipe: &Value) -> Result<()> {
+    let artifact = asset.artifact();
+    if recipe["domain"] != RECIPE_DOMAIN
+        || recipe["asset"] != artifact.name
+        || recipe["package"] != artifact.package
+        || recipe["target"] != artifact.target.triple()
+        || !recipe["workflow_run_id"].is_null()
+    {
+        return Err(distribution_error(format!(
+            "build recipe is not the candidate recipe of `{}`",
+            artifact.name
+        )));
+    }
+    Ok(())
+}
+
+fn check_rebuild(asset: AssetId, artifact_sha256: &str, rebuild: &Value) -> Result<()> {
+    let name = asset.artifact().name;
+    if rebuild["domain"] != REBUILD_DOMAIN
+        || rebuild["asset"] != name
+        || rebuild["canonical_sha256"] != artifact_sha256
+        || !rebuild["workflow_run_id"].is_null()
+        || !rebuild["reproduction_transfer_artifact_id"].is_null()
+    {
+        return Err(distribution_error(format!(
+            "rebuild check is not the candidate check of `{name}`"
+        )));
+    }
+    let rule_holds = if is_fastly(asset) {
+        rebuild["outcome"] == "matched" && rebuild["reproduction_sha256"] == artifact_sha256
+    } else {
+        rebuild["outcome"] == "unavailable" && rebuild["reproduction_sha256"].is_null()
+    };
+    if !rule_holds {
+        return Err(distribution_error(format!(
+            "rebuild check of `{name}` must be the checked Fastly equality or unavailable for a native asset"
+        )));
+    }
+    Ok(())
+}
+
+/// Requires sorted, unique, well-formed gaps covering the fixed entry gaps,
+/// the native reproduction gap exactly for native assets and at least one
+/// SPDX gap.
+fn check_gaps(asset: AssetId, evidence: &Value) -> Result<Vec<String>> {
+    let gaps = evidence["gaps"]
+        .as_array()
+        .ok_or_else(|| distribution_error("build evidence states no gap list"))?
+        .iter()
+        .map(|gap| {
+            gap.as_str()
+                .filter(|text| {
+                    !text.is_empty()
+                        && text.len() <= MAX_GAP_LENGTH
+                        && !text
+                            .chars()
+                            .any(|character| character.is_control() || character.is_whitespace())
+                })
+                .map(str::to_owned)
+                .ok_or_else(|| distribution_error("candidate gap text is malformed"))
+        })
+        .collect::<Result<Vec<String>>>()?;
+    if gaps.windows(2).any(|pair| pair[0] >= pair[1]) {
+        return Err(distribution_error(
+            "candidate gaps must be sorted and unique",
+        ));
+    }
+    let has = |wanted: &str| gaps.iter().any(|gap| gap == wanted);
+    if let Some(missing) = ENTRY_GAPS.iter().find(|gap| !has(gap)) {
+        return Err(distribution_error(format!(
+            "candidate gaps omit the fixed gap `{missing}`"
+        )));
+    }
+    if has(NATIVE_REPRODUCTION_GAP) == is_fastly(asset) {
+        return Err(distribution_error(
+            "native reproduction gap must be stated exactly for native assets",
+        ));
+    }
+    let fixed = ENTRY_GAPS.len() + usize::from(!is_fastly(asset));
+    if gaps.len() <= fixed {
+        return Err(distribution_error("candidate SPDX must state its gaps"));
+    }
+    Ok(gaps)
+}
+
+/// One producing job's checked upload descriptor.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct EntryDescriptor {
+    asset: AssetId,
+    entry_sha256: String,
+    artifact_id: u64,
+    artifact_name: String,
+    archive_sha256: String,
+    members: BTreeMap<String, u64>,
+}
+
+impl EntryDescriptor {
+    /// Strictly parses the descriptor the producing job emitted for `asset`.
+    ///
+    /// The descriptor's own `asset` must equal the slot's asset, its upload
+    /// name must be exactly that asset's name for `run_id` and the producing
+    /// job's own `run_attempt`, and its members must be exactly the six flat
+    /// names, each non-empty and within its role bound.
+    ///
+    /// Attempts may differ between descriptors: re-running only a failed job
+    /// gives it a new attempt while the others keep their earlier uploads.
+    /// REST metadata has no attempt field, so the exact recomputed name, with
+    /// the corroborated run, ID, digest, head and repository, carries the
+    /// binding.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed JSON, missing or unknown keys, a zero ID or attempt,
+    /// a malformed digest, another asset or upload name, and wrong member
+    /// names or sizes.
+    pub(crate) fn parse(bytes: &[u8], asset: AssetId, run_id: u64) -> Result<Self> {
+        let value = parse(bytes, DocumentRole::Metadata)?;
+        let keys: BTreeSet<&str> = value
+            .as_object()
+            .ok_or_else(|| distribution_error("candidate entry descriptor must be an object"))?
+            .keys()
+            .map(String::as_str)
+            .collect();
+        let wanted: BTreeSet<&str> = TRANSFER_KEYS.into_iter().chain(UPLOAD_KEYS).collect();
+        if keys != wanted {
+            return Err(distribution_error(
+                "candidate entry descriptor must carry exactly its transfer and upload keys",
+            ));
+        }
+        let name = asset.artifact().name;
+        if value["asset"] != name {
+            return Err(distribution_error(format!(
+                "descriptor names another asset than `{name}`"
+            )));
+        }
+        let entry_sha256 = value["entry_sha256"]
+            .as_str()
+            .filter(|digest| lower_hex(digest, 64))
+            .ok_or_else(|| distribution_error("descriptor entry digest is malformed"))?;
+        let archive = value["archive_sha256"].as_str().unwrap_or_default();
+        let archive_sha256 = archive.strip_prefix("sha256:").unwrap_or(archive);
+        if !lower_hex(archive_sha256, 64) {
+            return Err(distribution_error("descriptor archive digest is malformed"));
+        }
+        let artifact_id = value["artifact_id"]
+            .as_u64()
+            .filter(|id| *id > 0)
+            .ok_or_else(|| distribution_error("descriptor upload ID must be positive"))?;
+        let run_attempt = value["run_attempt"]
+            .as_u64()
+            .filter(|attempt| *attempt > 0)
+            .ok_or_else(|| distribution_error("descriptor run attempt must be positive"))?;
+        let artifact_name = upload_name(asset, run_id, run_attempt);
+        if value["artifact_name"] != artifact_name.as_str() {
+            return Err(distribution_error(format!(
+                "descriptor upload name must be `{artifact_name}`"
+            )));
+        }
+        let members = parse_members(asset, &value["members"])?;
+        Ok(Self {
+            asset,
+            entry_sha256: entry_sha256.to_owned(),
+            artifact_id,
+            artifact_name,
+            archive_sha256: archive_sha256.to_owned(),
+            members,
+        })
+    }
+
+    /// The asset this descriptor's slot names.
+    pub(crate) fn asset(&self) -> AssetId {
+        self.asset
+    }
+
+    /// The exact upload ID returned by the producing upload step.
+    pub(crate) fn artifact_id(&self) -> u64 {
+        self.artifact_id
+    }
+
+    /// The exact upload name the producing job used.
+    pub(crate) fn artifact_name(&self) -> &str {
+        &self.artifact_name
+    }
+
+    /// The original upload ZIP digest, without a `sha256:` prefix.
+    pub(crate) fn archive_sha256(&self) -> &str {
+        &self.archive_sha256
+    }
+
+    /// The exact flat member names and sizes declared by the producing job.
+    pub(crate) fn members(&self) -> &BTreeMap<String, u64> {
+        &self.members
+    }
+}
+
+fn parse_members(asset: AssetId, value: &Value) -> Result<BTreeMap<String, u64>> {
+    let object = value
+        .as_object()
+        .ok_or_else(|| distribution_error("descriptor members must be an object"))?;
+    let names: BTreeSet<String> = object.keys().cloned().collect();
+    if names != member_names(asset) {
+        return Err(distribution_error(format!(
+            "descriptor must declare exactly the six flat members of `{}`",
+            asset.artifact().name
+        )));
+    }
+    object
+        .iter()
+        .map(|(name, size)| {
+            let limit = member_limit(asset, name).unwrap_or_default();
+            size.as_u64()
+                .filter(|size| (1..=limit).contains(size))
+                .map(|size| (name.clone(), size))
+                .ok_or_else(|| {
+                    distribution_error(format!(
+                        "descriptor member `{name}` size is empty or exceeds its bound"
+                    ))
+                })
+        })
+        .collect()
+}
+
+/// Requires four descriptors with distinct upload IDs, one per cohort asset.
+///
+/// # Errors
+///
+/// Rejects a repeated upload ID or asset.
+pub(crate) fn check_distinct_uploads(descriptors: &[&EntryDescriptor]) -> Result<()> {
+    let ids: BTreeSet<u64> = descriptors.iter().map(|item| item.artifact_id).collect();
+    let assets: BTreeSet<&str> = descriptors
+        .iter()
+        .map(|item| item.asset.artifact().name)
+        .collect();
+    if ids.len() != descriptors.len() || assets.len() != descriptors.len() {
+        return Err(distribution_error(
+            "candidate entry uploads must have distinct IDs and assets",
+        ));
+    }
+    Ok(())
+}
+
+/// One downloaded upload: its descriptor and its exact extracted members.
+pub(crate) struct ReceivedEntry {
+    /// The checked descriptor the producing job emitted.
+    pub(crate) descriptor: EntryDescriptor,
+    /// The flat members read through the unchanged ZIP reader.
+    pub(crate) members: BTreeMap<String, Vec<u8>>,
+}
+
+/// Rebuilds each received entry and assembles the unqualified candidate index.
+///
+/// Each rebuilt entry must recheck to exactly the entry digest its producing
+/// job reported, and its members must be exactly the declared names and sizes.
+///
+/// # Errors
+///
+/// Rejects repeated uploads, members differing from their descriptor, any
+/// rebuild failure, an entry digest other than the producing job's, and every
+/// [`assemble_candidate_index`] rejection.
+pub(crate) fn assemble_received(
+    received: &[ReceivedEntry],
+    source_commit: &str,
+    policy: &[u8],
+) -> Result<CandidateIndex> {
+    let descriptors: Vec<&EntryDescriptor> = received.iter().map(|item| &item.descriptor).collect();
+    check_distinct_uploads(&descriptors)?;
+    let entries = received
+        .iter()
+        .map(|item| {
+            let declared = &item.descriptor.members;
+            let matches = item.members.len() == declared.len()
+                && item
+                    .members
+                    .iter()
+                    .all(|(name, bytes)| declared.get(name) == Some(&(bytes.len() as u64)));
+            if !matches {
+                return Err(distribution_error(format!(
+                    "received members of `{}` differ from their descriptor",
+                    item.descriptor.asset.artifact().name
+                )));
+            }
+            let entry = CandidateArtifactEntry::from_ordinary_ci_transfer(
+                item.descriptor.asset,
+                source_commit,
+                policy,
+                &item.members,
+            )?;
+            if entry.recheck_for_measurement()?.entry_sha256() != item.descriptor.entry_sha256 {
+                return Err(distribution_error(format!(
+                    "rebuilt entry of `{}` differs from the producing job's entry",
+                    entry.name()
+                )));
+            }
+            Ok(entry)
+        })
+        .collect::<Result<Vec<_>>>()?;
+    assemble_candidate_index(&entries)
+}
+
+/// Writes the index, shared inventory and sixteen companions into the new
+/// directory `root`.
+///
+/// # Errors
+///
+/// Rejects an existing directory and any write failure.
+pub(crate) fn write_candidate_index(index: &CandidateIndex, root: &Path) -> Result<()> {
+    create_private_directory(root)?;
+    write_member(&root.join(index.name()), index.bytes())?;
+    write_member(&root.join(INVENTORY_NAME), index.inventory())?;
+    for (name, bytes) in index.companions() {
+        write_member(&root.join(name), bytes)?;
+    }
+    Ok(())
+}
diff --git a/crates/trusted-server-release/src/documents.rs b/crates/trusted-server-release/src/documents.rs
new file mode 100644
index 0000000000..433dd3517e
--- /dev/null
+++ b/crates/trusted-server-release/src/documents.rs
@@ -0,0 +1,765 @@
+use std::collections::{BTreeMap, BTreeSet};
+use std::fmt;
+use std::fs::{File, OpenOptions};
+use std::io::{self, Read as _, Write as _};
+use std::os::unix::fs::{MetadataExt as _, OpenOptionsExt as _, PermissionsExt as _};
+use std::path::Path;
+
+use error_stack::Report;
+use jsonschema::Draft;
+use serde::Deserialize;
+use serde::Serialize;
+use serde::de::{DeserializeSeed, MapAccess, SeqAccess, Visitor};
+use serde::ser::{SerializeMap as _, SerializeSeq as _};
+use serde_json::{Map, Number, Value, json};
+use sha2::{Digest as _, Sha256};
+
+use crate::error::ReleaseError;
+
+/// R-INDEX companion role names and their required `<asset>` suffixes.
+const COMPANION_SUFFIXES: [(&str, &str); 6] = [
+    ("sbom", ".spdx.json"),
+    ("provenance", ".provenance.sigstore.json"),
+    ("sbom_attestation", ".sbom.sigstore.json"),
+    ("build_evidence", ".build-evidence.json"),
+    ("build_recipe", ".build-recipe.json"),
+    ("rebuild_check", ".rebuild-check.json"),
+];
+
+/// Byte-limit class selected before a document is read or parsed.
+#[derive(Clone, Copy, Debug)]
+pub(crate) enum Role {
+    Metadata,
+    Source,
+    Companion,
+    Bundle,
+    Spdx,
+    Executable,
+    /// One Cargo `--message-format=json` line.
+    CargoMessage,
+    /// Internal Cargo observations; never a published metadata contract.
+    CargoObservation,
+}
+
+impl Role {
+    /// Maximum bytes permitted for this document role.
+    pub(crate) fn limit(self) -> u64 {
+        match self {
+            Self::Metadata | Self::CargoMessage => 1024 * 1024,
+            Self::Source => 64 * 1024 * 1024,
+            Self::Companion | Self::Bundle => 32 * 1024 * 1024,
+            Self::Spdx | Self::CargoObservation => 16 * 1024 * 1024,
+            Self::Executable => 512 * 1024 * 1024,
+        }
+    }
+}
+
+/// Parses bounded strict JSON with unique keys and finite numeric tokens.
+pub(crate) fn parse_json(bytes: &[u8], role: Role) -> Result<Value, Report<ReleaseError>> {
+    if bytes.len() as u64 > role.limit() {
+        return Err(invalid("document exceeds role byte limit"));
+    }
+    let text = std::str::from_utf8(bytes).map_err(|_| invalid("document must be UTF-8"))?;
+    if text.starts_with('\u{feff}') {
+        return Err(invalid("document must not start with a BOM"));
+    }
+    validate_numbers(text)?;
+    let mut parser = serde_json::Deserializer::from_str(text);
+    let value = StrictSeed { depth: 1 }
+        .deserialize(&mut parser)
+        .map_err(invalid)?;
+    parser.end().map_err(invalid)?;
+    Ok(value)
+}
+
+/// Exact bytes read from one held descriptor and their SHA-256.
+pub(crate) struct RawBytes {
+    pub(crate) bytes: Vec<u8>,
+    pub(crate) sha256: String,
+}
+
+/// Exact bounded file bytes measured without retaining their body in memory.
+pub(crate) struct FileDigest {
+    pub(crate) sha256: String,
+    pub(crate) size: u64,
+    pub(crate) mode: u32,
+}
+
+/// Reads one unlinked regular file without following a leaf symlink.
+pub(crate) fn read_bounded(path: &Path, role: Role) -> Result<RawBytes, Report<ReleaseError>> {
+    read_bounded_with_check(path, role, &|| Ok(()))
+}
+
+/// Reads bounded bytes while checking the owning attempt between 64 KiB chunks.
+///
+/// # Errors
+///
+/// Returns an error for cancellation, expired limits, unsafe files, changed
+/// metadata or paths, or bytes exceeding the role bound before allocation.
+pub(crate) fn read_bounded_with_check(
+    path: &Path,
+    role: Role,
+    check: &dyn Fn() -> Result<(), Report<ReleaseError>>,
+) -> Result<RawBytes, Report<ReleaseError>> {
+    check()?;
+    let file = open_input(path)?;
+    let before = file.metadata().map_err(invalid)?;
+    let raw = read_held_with_check(&file, &before, role, check)?;
+    verify_input_path(path, &before)?;
+    check()?;
+    Ok(raw)
+}
+
+/// Hashes a bounded held file with constant-sized buffers and attempt checks.
+///
+/// # Errors
+///
+/// Returns an error for unsafe files, changed metadata or paths, an exceeded
+/// byte limit, cancellation or an expired owning attempt.
+pub(crate) fn hash_bounded_with_check(
+    path: &Path,
+    limit: u64,
+    check: &dyn Fn() -> Result<(), Report<ReleaseError>>,
+) -> Result<FileDigest, Report<ReleaseError>> {
+    check()?;
+    let file = open_input(path)?;
+    let before = file.metadata().map_err(invalid)?;
+    let digest = consume_held(&file, &before, limit, check, &mut |_| Ok(()))?;
+    verify_input_path(path, &before)?;
+    check()?;
+    Ok(digest)
+}
+
+fn open_input(path: &Path) -> Result<File, Report<ReleaseError>> {
+    OpenOptions::new()
+        .read(true)
+        .custom_flags(libc::O_NOFOLLOW | libc::O_NONBLOCK | libc::O_CLOEXEC)
+        .open(path)
+        .map_err(invalid)
+}
+
+fn verify_input_path(path: &Path, before: &std::fs::Metadata) -> Result<(), Report<ReleaseError>> {
+    let current = std::fs::symlink_metadata(path).map_err(invalid)?;
+    if !current.is_file() || stamp(before) != stamp(&current) {
+        return Err(invalid("input path changes while reading held descriptor"));
+    }
+    Ok(())
+}
+
+fn read_held(
+    file: &File,
+    before: &std::fs::Metadata,
+    role: Role,
+) -> Result<RawBytes, Report<ReleaseError>> {
+    read_held_with_check(file, before, role, &|| Ok(()))
+}
+
+fn read_held_with_check(
+    file: &File,
+    before: &std::fs::Metadata,
+    role: Role,
+    check: &dyn Fn() -> Result<(), Report<ReleaseError>>,
+) -> Result<RawBytes, Report<ReleaseError>> {
+    check()?;
+    validate_held(before, role.limit())?;
+    let capacity = usize::try_from(before.len()).map_err(invalid)?;
+    let mut bytes = Vec::new();
+    bytes.try_reserve_exact(capacity).map_err(invalid)?;
+    let digest = consume_held(file, before, role.limit(), check, &mut |chunk| {
+        bytes.extend_from_slice(chunk);
+        Ok(())
+    })?;
+    Ok(RawBytes {
+        bytes,
+        sha256: digest.sha256,
+    })
+}
+
+fn validate_held(before: &std::fs::Metadata, limit: u64) -> Result<(), Report<ReleaseError>> {
+    if !before.is_file() || before.nlink() != 1 {
+        return Err(invalid("input must be a regular file with one hard link"));
+    }
+    if before.len() > limit {
+        return Err(invalid("input exceeds role byte limit"));
+    }
+    Ok(())
+}
+
+fn consume_held(
+    file: &File,
+    before: &std::fs::Metadata,
+    limit: u64,
+    check: &dyn Fn() -> Result<(), Report<ReleaseError>>,
+    consume: &mut impl FnMut(&[u8]) -> Result<(), Report<ReleaseError>>,
+) -> Result<FileDigest, Report<ReleaseError>> {
+    check()?;
+    validate_held(before, limit)?;
+    let mut input = file;
+    let mut size = 0_u64;
+    let mut buffer = [0_u8; 64 * 1024];
+    let mut digest = Sha256::new();
+    loop {
+        check()?;
+        let count = input.read(&mut buffer).map_err(invalid)?;
+        check()?;
+        if count == 0 {
+            break;
+        }
+        size = size
+            .checked_add(count as u64)
+            .ok_or_else(|| invalid("input length overflows"))?;
+        if size > before.len() || size > limit {
+            return Err(invalid("input grows while reading held descriptor"));
+        }
+        digest.update(&buffer[..count]);
+        consume(&buffer[..count])?;
+    }
+    let after = file.metadata().map_err(invalid)?;
+    if stamp(before) != stamp(&after) || size != before.len() {
+        return Err(invalid("input changes while reading held descriptor"));
+    }
+    check()?;
+    Ok(FileDigest {
+        sha256: hex::encode(digest.finalize()),
+        size,
+        mode: before.permissions().mode(),
+    })
+}
+
+fn stamp(metadata: &std::fs::Metadata) -> (u64, u64, u64, u64, i64, i64, i64, i64, u32) {
+    (
+        metadata.dev(),
+        metadata.ino(),
+        metadata.nlink(),
+        metadata.len(),
+        metadata.mtime(),
+        metadata.mtime_nsec(),
+        metadata.ctime(),
+        metadata.ctime_nsec(),
+        metadata.permissions().mode(),
+    )
+}
+
+struct FlatName<'a>(&'a str);
+
+/// Returns whether `name` is a safe flat release asset name.
+///
+/// Rejects path separators, `..`, empty segments, control characters
+/// (including newlines) and anything outside the governing schema pattern.
+pub(crate) fn is_safe_flat_name(name: &str) -> bool {
+    safe_name(name).is_ok()
+}
+
+fn safe_name(name: &str) -> Result<FlatName<'_>, Report<ReleaseError>> {
+    let mut parts = name.split('.');
+    let first = parts.next().unwrap_or_default();
+    if name.len() > 160
+        || !first
+            .as_bytes()
+            .first()
+            .is_some_and(u8::is_ascii_alphanumeric)
+        || std::iter::once(first).chain(parts).any(|part| {
+            part.is_empty()
+                || !part
+                    .bytes()
+                    .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'_' | b'-'))
+        })
+    {
+        return Err(invalid("unsafe flat filename"));
+    }
+    Ok(FlatName(name))
+}
+
+struct LimitedBytes {
+    bytes: Vec<u8>,
+    limit: u64,
+}
+
+impl io::Write for LimitedBytes {
+    fn write(&mut self, bytes: &[u8]) -> io::Result<usize> {
+        if bytes.len() as u64 > self.limit.saturating_sub(self.bytes.len() as u64) {
+            return Err(io::Error::other("output exceeds role byte limit"));
+        }
+        self.bytes.extend_from_slice(bytes);
+        Ok(bytes.len())
+    }
+    fn flush(&mut self) -> io::Result<()> {
+        Ok(())
+    }
+}
+
+struct Canonical<'a> {
+    value: &'a Value,
+    depth: usize,
+}
+
+impl Serialize for Canonical<'_> {
+    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        if self.depth > 64 && matches!(self.value, Value::Object(_) | Value::Array(_)) {
+            return Err(serde::ser::Error::custom("JSON container depth exceeds 64"));
+        }
+        match self.value {
+            Value::Object(values) => {
+                let ordered: BTreeMap<_, _> = values.iter().collect();
+                let mut map = serializer.serialize_map(Some(ordered.len()))?;
+                for (key, value) in ordered {
+                    map.serialize_entry(
+                        key,
+                        &Canonical {
+                            value,
+                            depth: self.depth + 1,
+                        },
+                    )?;
+                }
+                map.end()
+            }
+            Value::Array(values) => {
+                let mut sequence = serializer.serialize_seq(Some(values.len()))?;
+                for value in values {
+                    sequence.serialize_element(&Canonical {
+                        value,
+                        depth: self.depth + 1,
+                    })?;
+                }
+                sequence.end()
+            }
+            scalar => scalar.serialize(serializer),
+        }
+    }
+}
+
+/// Serializes JSON with sorted keys and a trailing newline.
+pub(crate) fn canonical_json(value: &Value, role: Role) -> Result<Vec<u8>, Report<ReleaseError>> {
+    let mut output = LimitedBytes {
+        bytes: Vec::new(),
+        limit: role.limit(),
+    };
+    serde_json::to_writer(&mut output, &Canonical { value, depth: 1 }).map_err(invalid)?;
+    output.write_all(b"\n").map_err(invalid)?;
+    Ok(output.bytes)
+}
+
+// The caller must select a trusted parent directory; Task 3 owns source/path policy.
+fn atomic_json(path: &Path, value: &Value, role: Role) -> Result<(), Report<ReleaseError>> {
+    let name = path
+        .file_name()
+        .and_then(|name| name.to_str())
+        .ok_or_else(|| invalid("output needs a UTF-8 flat filename"))?;
+    let name = safe_name(name)?;
+    let bytes = canonical_json(value, role)?;
+    let parent = path
+        .parent()
+        .filter(|parent| !parent.as_os_str().is_empty())
+        .unwrap_or(Path::new("."));
+    let directory = OpenOptions::new()
+        .read(true)
+        .custom_flags(libc::O_DIRECTORY | libc::O_NOFOLLOW | libc::O_NONBLOCK | libc::O_CLOEXEC)
+        .open(parent)
+        .map_err(invalid)?;
+    let destination = parent.join(name.0);
+    match std::fs::symlink_metadata(&destination) {
+        Ok(metadata) if !metadata.is_file() || metadata.nlink() != 1 => {
+            return Err(invalid("output must be an unlinked regular file or absent"));
+        }
+        Ok(_) => {}
+        Err(error) if error.kind() == io::ErrorKind::NotFound => {}
+        Err(error) => return Err(invalid(error)),
+    }
+    let mut temporary = tempfile::Builder::new()
+        .prefix(".release-")
+        .tempfile_in(parent)
+        .map_err(invalid)?;
+    temporary
+        .as_file()
+        .set_permissions(std::fs::Permissions::from_mode(0o600))
+        .map_err(invalid)?;
+    temporary.write_all(&bytes).map_err(invalid)?;
+    temporary.as_file().sync_all().map_err(invalid)?;
+    let held = directory.metadata().map_err(invalid)?;
+    let current = std::fs::metadata(parent).map_err(invalid)?;
+    if (held.dev(), held.ino()) != (current.dev(), current.ino()) {
+        return Err(invalid("output parent changes before replacement"));
+    }
+    commit_output(temporary, &destination, &directory)
+}
+
+fn commit_output(
+    temporary: tempfile::NamedTempFile,
+    path: &Path,
+    directory: &File,
+) -> Result<(), Report<ReleaseError>> {
+    temporary
+        .persist(path)
+        .map_err(|error| invalid(error.error))?;
+    directory.sync_all().map_err(invalid)
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct FileRecord {
+    name: String,
+    size: u64,
+    sha256: String,
+}
+
+fn validate_file_records(values: &[Value], role: Role) -> Result<(), Report<ReleaseError>> {
+    let mut names = BTreeSet::new();
+    for value in values {
+        let record = FileRecord::deserialize(value).map_err(invalid)?;
+        record.check(role, &mut names)?;
+    }
+    Ok(())
+}
+
+impl FileRecord {
+    fn check(&self, role: Role, names: &mut BTreeSet<String>) -> Result<(), Report<ReleaseError>> {
+        safe_name(&self.name)?;
+        if self.size > role.limit()
+            || !lower_hex(&self.sha256, 64)
+            || !names.insert(self.name.to_ascii_lowercase())
+        {
+            return Err(invalid(
+                "file record has invalid size, digest or duplicate identity",
+            ));
+        }
+        Ok(())
+    }
+
+    fn fields(value: &Value) -> Result<Self, Report<ReleaseError>> {
+        Ok(Self {
+            name: value["name"]
+                .as_str()
+                .ok_or_else(|| invalid("missing file name"))?
+                .to_owned(),
+            size: value["size"]
+                .as_u64()
+                .ok_or_else(|| invalid("file length must be a nonnegative integer token"))?,
+            sha256: value["sha256"]
+                .as_str()
+                .ok_or_else(|| invalid("missing file digest"))?
+                .to_owned(),
+        })
+    }
+}
+
+/// Returns whether `value` is exactly `length` lowercase hexadecimal digits.
+pub(crate) fn lower_hex(value: &str, length: usize) -> bool {
+    value.len() == length
+        && value
+            .bytes()
+            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+}
+
+#[derive(Clone, Copy)]
+enum KnownSchema {
+    ReleaseIndex,
+    Qualification,
+    Spdx,
+}
+
+impl KnownSchema {
+    fn bytes(&self) -> &'static [u8] {
+        match self {
+            Self::ReleaseIndex => include_bytes!(
+                "../../../docs/superpowers/specs/schemas/release-index-v1.schema.json"
+            ),
+            Self::Qualification => {
+                include_bytes!("../../../scripts/release/qualification/results.schema.json")
+            }
+            Self::Spdx => include_bytes!("../schemas/spdx-2.3.schema.json"),
+        }
+    }
+    fn draft(&self) -> Draft {
+        match self {
+            Self::ReleaseIndex | Self::Qualification => Draft::Draft202012,
+            Self::Spdx => Draft::Draft7,
+        }
+    }
+}
+
+fn schema_accepts(
+    schema: &Value,
+    draft: Draft,
+    value: &Value,
+) -> Result<bool, Report<ReleaseError>> {
+    let validator = jsonschema::options()
+        .with_draft(draft)
+        .offline()
+        .build(schema)
+        .map_err(invalid)?;
+    Ok(validator.is_valid(value))
+}
+
+/// Validates SPDX document structure against the retained, pinned SPDX 2.3 schema.
+///
+/// Schema validity establishes no artifact identity, contributor coverage or
+/// release authority; the producer and consumer check those separately.
+///
+/// # Errors
+///
+/// Rejects a changed retained schema or a structurally invalid document.
+pub(crate) fn validate_spdx(value: &Value) -> Result<(), Report<ReleaseError>> {
+    validate_schema(KnownSchema::Spdx, value)
+}
+
+/// Validates a release index against the retained governing v1 schema.
+///
+/// Also applies the index role checks: safe integer tokens, safe flat and
+/// case-insensitively unique file names, role byte bounds and role-derived
+/// companion names. Schema validity grants no signing or release authority.
+///
+/// # Errors
+///
+/// Rejects a structurally invalid index or a failed role check.
+pub(crate) fn validate_release_index(value: &Value) -> Result<(), Report<ReleaseError>> {
+    validate_schema(KnownSchema::ReleaseIndex, value)
+}
+
+/// Validates one index artifact entry against the retained schema's
+/// `#/$defs/artifact` definition, built from the same retained raw bytes.
+///
+/// # Errors
+///
+/// Rejects an entry outside its fixed per-asset identity row, an unknown
+/// field or capability, or a non-safe integer token.
+pub(crate) fn validate_release_index_artifact(value: &Value) -> Result<(), Report<ReleaseError>> {
+    let retained = parse_json(KnownSchema::ReleaseIndex.bytes(), Role::Metadata)?;
+    let schema = json!({"$defs": retained["$defs"], "$ref": "#/$defs/artifact"});
+    if !schema_accepts(&schema, Draft::Draft202012, value)? {
+        return Err(invalid(
+            "index artifact does not match the retained artifact definition",
+        ));
+    }
+    validate_safe_integers(value)
+}
+
+fn validate_schema(schema: KnownSchema, value: &Value) -> Result<(), Report<ReleaseError>> {
+    let retained = if matches!(schema, KnownSchema::Spdx) {
+        parse_pinned_spdx_schema(schema.bytes())?
+    } else {
+        parse_json(schema.bytes(), Role::Metadata)?
+    };
+    if !schema_accepts(&retained, schema.draft(), value)? {
+        return Err(invalid("document does not match retained schema"));
+    }
+    if matches!(
+        schema,
+        KnownSchema::ReleaseIndex | KnownSchema::Qualification
+    ) {
+        validate_safe_integers(value)?;
+    }
+    if matches!(schema, KnownSchema::ReleaseIndex) {
+        check_index_files(value)?;
+    }
+    Ok(())
+}
+
+/// Checks every index file record and requires role-derived companion names.
+fn check_index_files(value: &Value) -> Result<(), Report<ReleaseError>> {
+    let mut names = BTreeSet::new();
+    FileRecord::fields(&value["tsjs_inventory"])?.check(Role::Metadata, &mut names)?;
+    for artifact in value["artifacts"]
+        .as_array()
+        .ok_or_else(|| invalid("missing artifacts"))?
+    {
+        let asset = FileRecord::fields(artifact)?;
+        asset.check(Role::Executable, &mut names)?;
+        for (kind, companion) in artifact["companions"]
+            .as_object()
+            .ok_or_else(|| invalid("missing companions"))?
+        {
+            let suffix = COMPANION_SUFFIXES
+                .iter()
+                .find(|(role, _)| role == kind)
+                .map(|(_, suffix)| *suffix)
+                .ok_or_else(|| invalid("unknown companion role"))?;
+            let derived = companion["name"]
+                .as_str()
+                .and_then(|name| name.strip_prefix(asset.name.as_str()));
+            if derived != Some(suffix) {
+                return Err(invalid(
+                    "companion name must be the asset name plus its role suffix",
+                ));
+            }
+            let role = if kind == "sbom" {
+                Role::Spdx
+            } else {
+                Role::Companion
+            };
+            FileRecord::fields(companion)?.check(role, &mut names)?;
+        }
+    }
+    Ok(())
+}
+
+fn parse_pinned_spdx_schema(bytes: &[u8]) -> Result<Value, Report<ReleaseError>> {
+    if bytes.len() != 45_312
+        || hex::encode(Sha256::digest(bytes))
+            != "239208b7ac287b3cf5d9a9af23f9d69863971102a5e1587a27a398b43490b89b"
+    {
+        return Err(invalid(
+            "retained SPDX schema raw identity does not match pinned source",
+        ));
+    }
+    let value = parse_json(bytes, Role::Metadata)?;
+    if value["$schema"] != "http://json-schema.org/draft-07/schema#" {
+        return Err(invalid("retained SPDX schema must declare Draft 7"));
+    }
+    Ok(value)
+}
+
+fn validate_safe_integers(value: &Value) -> Result<(), Report<ReleaseError>> {
+    match value {
+        Value::Number(number)
+            if number
+                .as_u64()
+                .is_none_or(|integer| integer > 9_007_199_254_740_991) =>
+        {
+            return Err(invalid(
+                "closed role requires nonnegative safe integer tokens",
+            ));
+        }
+        Value::Object(values) => {
+            for value in values.values() {
+                validate_safe_integers(value)?;
+            }
+        }
+        Value::Array(values) => {
+            for value in values {
+                validate_safe_integers(value)?;
+            }
+        }
+        _ => {}
+    }
+    Ok(())
+}
+
+fn invalid(message: impl fmt::Display) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Document).attach(message.to_string())
+}
+
+// Serde may otherwise convert overflowing integer tokens to finite floats.
+fn validate_numbers(text: &str) -> Result<(), Report<ReleaseError>> {
+    let bytes = text.as_bytes();
+    let mut cursor = 0;
+    while cursor < bytes.len() {
+        if bytes[cursor] == b'"' {
+            cursor += 1;
+            while cursor < bytes.len() {
+                match bytes[cursor] {
+                    b'\\' => cursor += 2,
+                    b'"' => {
+                        cursor += 1;
+                        break;
+                    }
+                    _ => cursor += 1,
+                }
+            }
+        } else if bytes[cursor] == b'-' || bytes[cursor].is_ascii_digit() {
+            let start = cursor;
+            while cursor < bytes.len()
+                && matches!(
+                    bytes[cursor],
+                    b'-' | b'+' | b'.' | b'e' | b'E' | b'0'..=b'9'
+                )
+            {
+                cursor += 1;
+            }
+            let token = &text[start..cursor];
+            let valid = if token.contains(['.', 'e', 'E']) {
+                token.parse::<f64>().is_ok_and(f64::is_finite)
+            } else if token.starts_with('-') {
+                token.parse::<i64>().is_ok()
+            } else {
+                token.parse::<u64>().is_ok()
+            };
+            if !valid {
+                return Err(invalid("JSON number exceeds its finite numeric range"));
+            }
+        } else {
+            cursor += 1;
+        }
+    }
+    Ok(())
+}
+
+struct StrictSeed {
+    depth: usize,
+}
+
+impl<'de> DeserializeSeed<'de> for StrictSeed {
+    type Value = Value;
+
+    fn deserialize<D: serde::Deserializer<'de>>(self, deserializer: D) -> Result<Value, D::Error> {
+        deserializer.deserialize_any(self)
+    }
+}
+
+impl<'de> Visitor<'de> for StrictSeed {
+    type Value = Value;
+
+    fn expecting(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("JSON with unique object keys")
+    }
+
+    fn visit_bool<E: serde::de::Error>(self, value: bool) -> Result<Value, E> {
+        Ok(Value::Bool(value))
+    }
+
+    fn visit_unit<E: serde::de::Error>(self) -> Result<Value, E> {
+        Ok(Value::Null)
+    }
+
+    fn visit_str<E: serde::de::Error>(self, value: &str) -> Result<Value, E> {
+        Ok(Value::String(value.to_owned()))
+    }
+
+    fn visit_i64<E: serde::de::Error>(self, value: i64) -> Result<Value, E> {
+        Ok(Value::Number(Number::from(value)))
+    }
+
+    fn visit_u64<E: serde::de::Error>(self, value: u64) -> Result<Value, E> {
+        Ok(Value::Number(Number::from(value)))
+    }
+
+    fn visit_f64<E: serde::de::Error>(self, value: f64) -> Result<Value, E> {
+        Number::from_f64(value)
+            .map(Value::Number)
+            .ok_or_else(|| E::custom("nonfinite number"))
+    }
+
+    fn visit_seq<A: SeqAccess<'de>>(self, mut access: A) -> Result<Value, A::Error> {
+        if self.depth > 64 {
+            return Err(serde::de::Error::custom("JSON container depth exceeds 64"));
+        }
+        let mut values = Vec::new();
+        while let Some(value) = access.next_element_seed(StrictSeed {
+            depth: self.depth + 1,
+        })? {
+            values.push(value);
+        }
+        Ok(Value::Array(values))
+    }
+
+    fn visit_map<A: MapAccess<'de>>(self, mut access: A) -> Result<Value, A::Error> {
+        if self.depth > 64 {
+            return Err(serde::de::Error::custom("JSON container depth exceeds 64"));
+        }
+        let mut values = Map::new();
+        while let Some(key) = access.next_key::<String>()? {
+            if values.contains_key(&key) {
+                return Err(serde::de::Error::custom("duplicate object key"));
+            }
+            values.insert(
+                key,
+                access.next_value_seed(StrictSeed {
+                    depth: self.depth + 1,
+                })?,
+            );
+        }
+        Ok(Value::Object(values))
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/trusted-server-release/src/documents/tests.rs b/crates/trusted-server-release/src/documents/tests.rs
new file mode 100644
index 0000000000..e3d48ebe85
--- /dev/null
+++ b/crates/trusted-server-release/src/documents/tests.rs
@@ -0,0 +1,883 @@
+use std::cell::Cell;
+use std::ffi::CString;
+use std::fs;
+use std::os::unix::ffi::OsStrExt as _;
+use std::os::unix::fs::symlink;
+
+use serde_json::json;
+use sha2::Sha256;
+use tempfile::tempdir;
+
+use super::*;
+
+#[test]
+fn controlled_reads_cancel_before_and_between_bounded_chunks() {
+    let root = tempdir().expect("should create controlled input");
+    let path = root.path().join("input");
+    fs::write(&path, vec![7_u8; 4 * 64 * 1024]).expect("should write multiple chunks");
+    let calls = Cell::new(0);
+    let check = || {
+        calls.set(calls.get() + 1);
+        if calls.get() >= 6 {
+            return Err(invalid("cancelled fixture"));
+        }
+        Ok(())
+    };
+    assert!(
+        read_bounded_with_check(&path, Role::Executable, &check).is_err(),
+        "should cancel during bounded read"
+    );
+    assert_eq!(
+        calls.get(),
+        6,
+        "should stop between the first and second chunks"
+    );
+    let before = || Err(invalid("already cancelled fixture"));
+    assert!(
+        hash_bounded_with_check(&path, 1024 * 1024, &before).is_err(),
+        "should reject before hashing"
+    );
+}
+
+#[test]
+fn controlled_stream_hash_enforces_limit_and_exact_digest() {
+    let root = tempdir().expect("should create hash input");
+    let path = root.path().join("input");
+    let bytes = vec![9_u8; 3 * 64 * 1024];
+    fs::write(&path, &bytes).expect("should write hash input");
+    let measured = hash_bounded_with_check(&path, bytes.len() as u64, &|| Ok(()))
+        .expect("should stream exact bytes");
+    assert_eq!(
+        measured.sha256,
+        hex::encode(Sha256::digest(&bytes)),
+        "should hash all original bytes"
+    );
+    assert_eq!(
+        measured.size,
+        bytes.len() as u64,
+        "should retain original size"
+    );
+    assert_eq!(
+        measured.mode,
+        fs::metadata(&path)
+            .expect("should inspect measured mode")
+            .mode(),
+        "should retain mode from the same held input"
+    );
+    assert!(
+        hash_bounded_with_check(&path, bytes.len() as u64 - 1, &|| Ok(())).is_err(),
+        "should reject oversized files before reading"
+    );
+}
+
+#[test]
+fn controlled_stream_hash_detects_mutation_and_leaf_replacement() {
+    let root = tempdir().expect("should create changing input");
+    let path = root.path().join("input");
+    let bytes = vec![7_u8; 3 * 64 * 1024];
+    fs::write(&path, &bytes).expect("should write original input");
+    let calls = Cell::new(0);
+    let result = hash_bounded_with_check(&path, bytes.len() as u64, &|| {
+        calls.set(calls.get() + 1);
+        if calls.get() == 4 {
+            fs::write(&path, b"changed").expect("should mutate held input");
+        }
+        Ok(())
+    });
+    assert!(
+        result.is_err(),
+        "should reject mutations between hash chunks"
+    );
+    fs::write(&path, &bytes).expect("should restore input fixture");
+    let calls = Cell::new(0);
+    let result = hash_bounded_with_check(&path, bytes.len() as u64, &|| {
+        calls.set(calls.get() + 1);
+        if calls.get() == 4 {
+            fs::rename(&path, root.path().join("retained")).expect("should replace leaf name");
+            fs::write(&path, &bytes).expect("should write identical replacement bytes");
+        }
+        Ok(())
+    });
+    assert!(
+        result.is_err(),
+        "should reject changed path identity even with matching bytes"
+    );
+}
+
+fn parse(bytes: &[u8]) -> Result<Value, Report<ReleaseError>> {
+    parse_json(bytes, Role::Metadata)
+}
+
+#[test]
+fn rejects_duplicate_keys_at_every_depth() {
+    for depth in 0..64 {
+        let input = format!(
+            "{}{{\"same\":1,\"same\":2}}{}",
+            "[".repeat(depth),
+            "]".repeat(depth)
+        );
+        assert!(
+            parse(input.as_bytes()).is_err(),
+            "should reject duplicate at depth {depth}"
+        );
+    }
+}
+
+#[test]
+fn rejects_duplicate_decoded_keys_in_opaque_objects() {
+    assert!(
+        parse(br#"{"opaque":{"x":0,"\u0078":1}}"#).is_err(),
+        "should reject escaped duplicate key"
+    );
+}
+
+#[test]
+fn rejects_top_level_integer_overflow() {
+    for input in ["18446744073709551616", "-9223372036854775809"] {
+        assert!(
+            parse(input.as_bytes()).is_err(),
+            "should reject integer overflow: {input}"
+        );
+    }
+}
+
+#[test]
+fn rejects_opaque_integer_overflow() {
+    for input in ["18446744073709551616", "-9223372036854775809"] {
+        let bytes = format!("{{\"opaque\":[{{\"value\":{input}}}]}}");
+        assert!(
+            parse(bytes.as_bytes()).is_err(),
+            "should reject opaque integer overflow"
+        );
+    }
+}
+
+#[test]
+fn rejects_nonfinite_and_decimal_exponent_overflow() {
+    for input in [
+        "NaN",
+        "Infinity",
+        "-Infinity",
+        "1e309",
+        "-1e309",
+        "1.8e308",
+        "9".repeat(400).as_str(),
+    ] {
+        assert!(
+            parse(input.as_bytes()).is_err(),
+            "should reject nonfinite or overflowing number"
+        );
+    }
+    for number in [
+        format!("{}.0", "9".repeat(400)),
+        "1e999".to_owned(),
+        "-1.8e308".to_owned(),
+    ] {
+        let opaque = format!("{{\"opaque\":{{\"number\":{number}}}}}");
+        assert!(
+            parse(opaque.as_bytes()).is_err(),
+            "should reject decimal/exponent overflow in opaque values"
+        );
+    }
+}
+
+#[test]
+fn retains_exact_integer_boundaries() {
+    assert_eq!(
+        parse(b"18446744073709551615")
+            .expect("should accept u64 boundary")
+            .as_u64(),
+        Some(u64::MAX),
+        "should retain exact u64"
+    );
+    assert_eq!(
+        parse(b"-9223372036854775808")
+            .expect("should accept i64 boundary")
+            .as_i64(),
+        Some(i64::MIN),
+        "should retain exact i64"
+    );
+}
+
+#[test]
+fn number_like_quoted_text_and_escapes_remain_text() {
+    let value = json!({"text": "18446744073709551616 -9223372036854775809 1e999 \" quoted \\ backslash \\\" 1.8e308", "nested": ["9".repeat(400)]});
+    let bytes = serde_json::to_vec(&value).expect("should serialize text controls");
+    assert_eq!(
+        parse(&bytes).expect("should preserve number-like text"),
+        value,
+        "should skip strings including escaped quotes and backslashes"
+    );
+}
+
+#[test]
+fn rejects_invalid_utf8_before_deserialization() {
+    let error = parse(b"\"\xff\"").expect_err("should reject invalid UTF-8");
+    assert!(
+        format!("{error:?}").contains("UTF-8"),
+        "should diagnose byte encoding before deserialization"
+    );
+}
+
+#[test]
+fn rejects_bom_before_deserialization() {
+    let error = parse(b"\xef\xbb\xbf{}").expect_err("should reject BOM");
+    assert!(
+        format!("{error:?}").contains("BOM"),
+        "should diagnose BOM before deserialization"
+    );
+}
+
+#[test]
+fn rejects_surrogates_and_trailing_controls() {
+    for input in [
+        br#""\ud800""#.as_slice(),
+        br#""\udfff""#,
+        b"{}\0",
+        b"{}\x0b",
+        b"{}\x1f",
+        b"{}{}",
+    ] {
+        assert!(
+            parse(input).is_err(),
+            "should reject surrogate or trailing data"
+        );
+    }
+}
+
+#[test]
+fn rejects_container_depth_65_including_root() {
+    for (open, close) in [("[", "]"), ("{\"nested\":", "}")] {
+        let good = format!("{}0{}", open.repeat(64), close.repeat(64));
+        let bad = format!("{}0{}", open.repeat(65), close.repeat(65));
+        assert!(
+            parse(good.as_bytes()).is_ok(),
+            "should accept 64 containers"
+        );
+        assert!(
+            parse(bad.as_bytes()).is_err(),
+            "should reject 65 containers"
+        );
+    }
+}
+
+#[test]
+fn rejects_oversized_json_before_encoding_or_parsing() {
+    for role in [Role::Metadata, Role::Companion, Role::Bundle, Role::Spdx] {
+        let bytes = vec![0xff; role.limit() as usize + 1];
+        let error = parse_json(&bytes, role).expect_err("should reject role byte overflow");
+        assert!(
+            format!("{error:?}").contains("byte limit"),
+            "should enforce size before encoding"
+        );
+    }
+}
+
+#[test]
+fn rejects_oversized_files_before_reading() {
+    let root = tempdir().expect("should create fixtures");
+    for role in [
+        Role::Metadata,
+        Role::Companion,
+        Role::Bundle,
+        Role::Spdx,
+        Role::Executable,
+    ] {
+        let path = root.path().join("oversized");
+        let file = fs::File::create(&path).expect("should create sparse oversized file");
+        file.set_len(role.limit() + 1).expect("should size fixture");
+        assert!(
+            read_bounded(&path, role).is_err(),
+            "should reject oversized role before read"
+        );
+    }
+}
+
+#[test]
+fn retains_hash_of_exact_original_bytes() {
+    let root = tempdir().expect("should create fixture");
+    let path = root.path().join("source.json");
+    let bytes = b" { \"a\" : 1 } \n";
+    fs::write(&path, bytes).expect("should write original bytes");
+    let raw = read_bounded(&path, Role::Metadata).expect("should read exact bytes");
+    assert_eq!(raw.bytes, bytes, "should retain original bytes");
+    assert_eq!(
+        raw.sha256,
+        hex::encode(Sha256::digest(bytes)),
+        "should hash original bytes before normalization"
+    );
+}
+
+#[test]
+fn rejects_unsafe_flat_names() {
+    for name in [
+        "", ".", "..", ".hidden", "../a", "a/b", "a\\b", "a..b", "a.", "a b", "a\n", "a\0", "é",
+        "-a", "a:b",
+    ] {
+        assert!(
+            safe_name(name).is_err(),
+            "should reject unsafe name {name:?}"
+        );
+    }
+    assert!(
+        safe_name(&"a".repeat(161)).is_err(),
+        "should reject long name"
+    );
+    for name in [
+        "a",
+        "ts-x86_64-unknown-linux-gnu",
+        "file.spdx.json",
+        "A_0-z",
+    ] {
+        assert!(safe_name(name).is_ok(), "should accept safe flat name");
+    }
+}
+
+#[test]
+fn rejects_symlinks_hardlinks_and_directories_at_read() {
+    let root = tempdir().expect("should create fixtures");
+    let real = root.path().join("real");
+    fs::write(&real, b"{}").expect("should write fixture");
+    let link = root.path().join("symlink");
+    symlink(&real, &link).expect("should create symlink");
+    assert!(
+        read_bounded(&link, Role::Metadata).is_err(),
+        "should reject symbolic leaf"
+    );
+    let hard = root.path().join("hardlink");
+    fs::hard_link(&real, &hard).expect("should create hardlink");
+    assert_eq!(
+        fs::metadata(&hard).expect("should inspect links").nlink(),
+        2,
+        "should exercise hardlink fixture"
+    );
+    assert!(
+        read_bounded(&hard, Role::Metadata).is_err(),
+        "should reject hardlink"
+    );
+    assert!(
+        read_bounded(root.path(), Role::Metadata).is_err(),
+        "should reject directory"
+    );
+}
+
+#[test]
+fn canonical_serialization_sorts_recursively_and_adds_one_newline() {
+    let value = json!({"z":[{"z": "é", "a":true}], "a":0});
+    let bytes = canonical_json(&value, Role::Metadata).expect("should serialize canonical bytes");
+    assert_eq!(
+        bytes,
+        "{\"a\":0,\"z\":[{\"a\":true,\"z\":\"é\"}]}\n".as_bytes(),
+        "should sort recursively and retain compact UTF-8"
+    );
+}
+
+#[test]
+fn rejects_oversized_serialization_before_replacement() {
+    let root = tempdir().expect("should create fixture");
+    let path = root.path().join("output.json");
+    fs::write(&path, b"old").expect("should write previous document");
+    let value = json!({"large":"x".repeat(Role::Metadata.limit() as usize)});
+    assert!(
+        atomic_json(&path, &value, Role::Metadata).is_err(),
+        "should reject oversized output"
+    );
+    assert_eq!(
+        fs::read(&path).expect("should retain old file"),
+        b"old",
+        "should preserve old bytes on rejected output"
+    );
+    assert_eq!(
+        fs::read_dir(root.path())
+            .expect("should list fixtures")
+            .count(),
+        1,
+        "should leave no temporary output"
+    );
+}
+
+#[test]
+fn atomic_output_replaces_inode_with_private_mode() {
+    let root = tempdir().expect("should create fixture");
+    let path = root.path().join("output.json");
+    fs::write(&path, b"old").expect("should write previous document");
+    let old = fs::metadata(&path).expect("should inspect old file").ino();
+    atomic_json(&path, &json!({"answer":42}), Role::Metadata)
+        .expect("should replace complete document");
+    let new = fs::metadata(&path).expect("should inspect replaced file");
+    assert_ne!(
+        old,
+        new.ino(),
+        "should replace rather than truncate original inode"
+    );
+    assert_eq!(
+        new.mode() & 0o777,
+        0o600,
+        "should install private 0600 output"
+    );
+    assert_eq!(
+        fs::read(&path).expect("should read complete output"),
+        b"{\"answer\":42}\n",
+        "should install full bytes"
+    );
+}
+
+#[test]
+fn rejects_output_links_and_cleans_failed_replacement() {
+    let root = tempdir().expect("should create fixture");
+    let real = root.path().join("real");
+    fs::write(&real, b"old").expect("should write linked target");
+    let link = root.path().join("link");
+    symlink(&real, &link).expect("should create symbolic output");
+    assert!(
+        atomic_json(&link, &json!({}), Role::Metadata).is_err(),
+        "should reject symbolic output"
+    );
+    let hard = root.path().join("hard");
+    fs::hard_link(&real, &hard).expect("should create hardlinked output");
+    assert!(
+        atomic_json(&hard, &json!({}), Role::Metadata).is_err(),
+        "should reject hardlinked output"
+    );
+    let directory = root.path().join("directory");
+    fs::create_dir(&directory).expect("should create invalid destination");
+    assert!(
+        atomic_json(&directory, &json!({}), Role::Metadata).is_err(),
+        "should reject directory output"
+    );
+    assert_eq!(
+        fs::read(&real).expect("should retain original target"),
+        b"old",
+        "should preserve linked target bytes"
+    );
+    assert_eq!(
+        fs::read_dir(root.path())
+            .expect("should inspect cleanup")
+            .count(),
+        4,
+        "should remove every failed sibling output"
+    );
+}
+
+#[test]
+fn rejects_negative_noninteger_and_out_of_role_lengths() {
+    for size in [
+        json!(-1),
+        json!(1.0),
+        json!(1.5),
+        json!("1"),
+        json!(9007199254740992_u64),
+        json!(Role::Metadata.limit() + 1),
+    ] {
+        let record = json!({"name":"fixture.json", "size":size, "sha256":"a".repeat(64)});
+        assert!(
+            validate_file_records(&[record], Role::Metadata).is_err(),
+            "should reject invalid length representation or bounds"
+        );
+    }
+    for size in [0, 1, Role::Metadata.limit()] {
+        assert!(
+            validate_file_records(
+                &[json!({"name":"fixture.json", "size":size, "sha256":"a".repeat(64)})],
+                Role::Metadata
+            )
+            .is_ok(),
+            "should accept exact valid role boundary"
+        );
+    }
+}
+
+#[test]
+fn rejects_ambiguous_duplicate_file_identities() {
+    for names in [["same.json", "same.json"], ["File.json", "file.json"]] {
+        let records = names.map(|name| json!({"name":name,"size":1,"sha256":"a".repeat(64)}));
+        assert!(
+            validate_file_records(&records, Role::Metadata).is_err(),
+            "should reject duplicate identity including portable case collisions"
+        );
+    }
+}
+
+#[test]
+fn rejects_invalid_file_record_fields() {
+    for record in [
+        json!({"name":"../file", "size":1, "sha256":"a".repeat(64)}),
+        json!({"name":"file", "size":1, "sha256":"A".repeat(64)}),
+        json!({"name":"file", "size":1, "sha256":"a".repeat(64), "extra":true}),
+    ] {
+        assert!(
+            validate_file_records(&[record], Role::Metadata).is_err(),
+            "should reject unsafe, malformed or extra fields"
+        );
+    }
+}
+
+#[test]
+fn draft_202012_prefix_items_and_items_are_enforced() {
+    let schema =
+        json!({"type":"array","prefixItems":[{"const":"first"},{"type":"integer"}],"items":false});
+    assert!(
+        schema_accepts(&schema, Draft::Draft202012, &json!(["first", 2]))
+            .expect("should compile explicit 2020-12 schema"),
+        "should accept prefix items"
+    );
+    for value in [
+        json!(["wrong", 2]),
+        json!(["first", "wrong"]),
+        json!(["first", 2, 3]),
+    ] {
+        assert!(
+            !schema_accepts(&schema, Draft::Draft202012, &value).expect("should compile schema"),
+            "should reject invalid prefix or additional item"
+        );
+    }
+}
+
+#[test]
+fn refuses_unregistered_remote_and_file_references() {
+    for reference in [
+        "https://example.com/unregistered.json",
+        "http://example.com/unregistered.json",
+        "file:///tmp/unregistered-schema.json",
+    ] {
+        assert!(
+            schema_accepts(&json!({"$ref":reference}), Draft::Draft202012, &json!(null)).is_err(),
+            "should refuse unregistered references without retrieval"
+        );
+    }
+}
+
+#[test]
+fn refuses_existing_local_reference_even_with_file_resolution_feature() {
+    let root = tempdir().expect("should create local schema fixture");
+    let path = root.path().join("unregistered.json");
+    fs::write(
+        &path,
+        serde_json::to_vec(&json!({"type":"null"}))
+            .expect("should serialize fictional local schema"),
+    )
+    .expect("should write local schema");
+    let reference = format!("file://{}", path.display());
+    let result = schema_accepts(&json!({"$ref":reference}), Draft::Draft202012, &Value::Null);
+    assert!(
+        result.is_err(),
+        "should refuse existing file without reading an unregistered reference"
+    );
+}
+
+#[test]
+fn retained_spdx_identity_and_draft7_are_exact() {
+    let bytes = KnownSchema::Spdx.bytes();
+    assert_eq!(
+        bytes.len(),
+        45312,
+        "should retain exact original schema length"
+    );
+    assert_eq!(
+        hex::encode(Sha256::digest(bytes)),
+        "239208b7ac287b3cf5d9a9af23f9d69863971102a5e1587a27a398b43490b89b",
+        "should retain pinned original schema hash"
+    );
+    let value = parse(bytes).expect("should parse official retained schema");
+    assert_eq!(
+        value["$schema"], "http://json-schema.org/draft-07/schema#",
+        "should use official Draft 7 dialect"
+    );
+}
+
+#[test]
+fn rejects_altered_spdx_schema_before_evaluation() {
+    let original = KnownSchema::Spdx.bytes();
+    let mut altered = original.to_vec();
+    let title = altered
+        .windows(8)
+        .position(|bytes| bytes == b"SPDX 2.3")
+        .expect("should find official schema title");
+    altered[title] = b'T';
+    assert!(
+        parse_pinned_spdx_schema(&altered).is_err(),
+        "should reject altered but parseable retained schema"
+    );
+    let mut extended = original.to_vec();
+    extended.push(b'\n');
+    assert!(
+        parse_pinned_spdx_schema(&extended).is_err(),
+        "should reject changed raw byte count before use"
+    );
+    assert!(
+        parse_pinned_spdx_schema(original).is_ok(),
+        "should accept exact retained schema identity and dialect"
+    );
+}
+
+#[test]
+fn official_spdx_schema_checks_structure_only() {
+    let valid = json!({"SPDXID":"SPDXRef-DOCUMENT", "spdxVersion":"SPDX-2.3", "creationInfo":{"creators":["Tool: fictional-fixture"],"created":"2026-01-01T00:00:00Z"}, "name":"Fictional fixture", "dataLicense":"CC0-1.0", "documentNamespace":"https://example.com/spdx/fictional-fixture"});
+    assert!(
+        validate_schema(KnownSchema::Spdx, &valid).is_ok(),
+        "should accept a structural toy fixture only"
+    );
+    for value in [json!({}), json!({"SPDXID":42}), {
+        let mut invalid = valid.clone();
+        invalid["packages"] = json!([{"SPDXID":"SPDXRef-Package","name":"fictional"}]);
+        invalid
+    }] {
+        assert!(
+            validate_schema(KnownSchema::Spdx, &value).is_err(),
+            "should reject structurally incomplete SPDX"
+        );
+    }
+}
+
+#[test]
+fn retained_governing_schemas_reject_missing_fields() {
+    for schema in [KnownSchema::ReleaseIndex, KnownSchema::Qualification] {
+        assert!(
+            validate_schema(schema, &json!({})).is_err(),
+            "should apply retained governing required fields"
+        );
+    }
+}
+
+#[test]
+fn retained_qualification_schema_accepts_structural_observation_only() {
+    let mut value = json!({
+        "schema_version":1, "purpose":"disposable-rehearsal-observation", "source_commit":"a".repeat(40),
+        "closure_sha256":"a".repeat(64), "selection_sha256":"a".repeat(64), "raw_tools_sha256":"a".repeat(64), "dependency_sha256":"a".repeat(64),
+        "run":{"repository_id":"1","owner_id":"1","run_id":"1","attempt":1,"job":"fictional-fixture","runner":"github-hosted"},
+        "host":{"environment_id":"macos15-aarch64","kind":"github-hosted-macos","architecture":"aarch64","kernel_architecture":"aarch64",
+            "os_version":"fictional-fixture","translated":false,"runner_image_version":null,"oci_index_sha256":null,"oci_manifest_sha256":null,
+            "glibc_version":null,"identity_log_sha256":"a".repeat(64)},
+        "sdk":{"kind":"apple-sdk","version":"fictional","build_version":"fictional","tree_sha256":"a".repeat(64),"vendor_evidence_sha256":"a".repeat(64)},
+        "tools":[],
+        "recipe":{"id":"tsjs","boundary_sha256":"a".repeat(64),"preparation_log_sha256":"a".repeat(64),"compile_log_sha256":"a".repeat(64),
+            "native_log_sha256":"a".repeat(64),"exit_code":1,"full_recipe":false,"same_boundary":false,"executable_sha256":"a".repeat(64),
+            "native_materials_sha256":"a".repeat(64),"deployment_target":null,"glibc_symbols":[],"unconfined":[],"confined":[],
+            "download_attempts":{"cargo":"unavailable","npm":"unavailable","missing_tool":"unavailable"}},
+        "runtime":[]
+    });
+    assert!(
+        validate_schema(KnownSchema::Qualification, &value).is_ok(),
+        "should accept structural observation fixture without qualifying a release"
+    );
+    value["run"]["attempt"] = json!(1.0);
+    assert!(
+        validate_schema(KnownSchema::Qualification, &value).is_err(),
+        "should reject float representation of integer observation"
+    );
+    value["run"]["attempt"] = json!(1);
+    value["purpose"] = json!("production-qualified");
+    assert!(
+        validate_schema(KnownSchema::Qualification, &value).is_err(),
+        "should enforce retained observation purpose"
+    );
+}
+
+fn index_fixture() -> Value {
+    let identities = [
+        (
+            "trusted-server-fastly.wasm",
+            "wasm32-wasip1",
+            "wasm32",
+            "fastly-compute",
+            "wasip1",
+        ),
+        (
+            "ts-x86_64-unknown-linux-gnu",
+            "x86_64-unknown-linux-gnu",
+            "x86_64",
+            "linux-gnu",
+            "glibc-2.34",
+        ),
+        (
+            "ts-aarch64-apple-darwin",
+            "aarch64-apple-darwin",
+            "aarch64",
+            "macos",
+            "13.0",
+        ),
+        (
+            "ts-x86_64-apple-darwin",
+            "x86_64-apple-darwin",
+            "x86_64",
+            "macos",
+            "13.0",
+        ),
+    ];
+    let artifacts: Vec<_> = identities.iter().map(|(name,target,architecture,runtime,minimum)| {
+        let is_server = *runtime == "fastly-compute";
+        let companions: Map<_,_> = [("sbom", ".spdx.json"), ("provenance", ".provenance.sigstore.json"), ("sbom_attestation", ".sbom.sigstore.json"), ("build_evidence", ".build-evidence.json"), ("build_recipe", ".build-recipe.json"), ("rebuild_check", ".rebuild-check.json")].iter()
+            .map(|(role, suffix)| (role.to_string(), json!({"name":format!("{name}{suffix}"), "size":1, "sha256":"a".repeat(64)}))).collect();
+        json!({"name":name, "size":1, "sha256":"a".repeat(64), "role":if is_server {"server"} else {"operator-cli"},
+            "kind":if is_server {"wasm-core"} else {"native-executable"}, "package":if is_server {"trusted-server-adapter-fastly"} else {"trusted-server-cli"},
+            "target":target, "variant":"default", "assurance_profile":if is_server {"provenance-sbom-repeatable"} else {"provenance-sbom"},
+            "capabilities":if is_server {vec!["fastly-production"]} else {vec!["cli-execute"]},
+            "compatibility":{"runtime":runtime,"minimum_version":minimum,"architecture":architecture},
+            "js_inventory_sha256":"a".repeat(64), "companions":companions})
+    }).collect();
+    let schema =
+        parse(KnownSchema::ReleaseIndex.bytes()).expect("should load retained index schema");
+    json!({"schema_version":1,"repository":schema["properties"]["repository"]["const"],"tag":"v1.0.0",
+        "source_commit":"a".repeat(40),"recipe_source_commit":"a".repeat(40),"cohort_source_commit":"a".repeat(40),
+        "cohort":"phase1-fastly-cli", "policy_version":1,"policy_sha256":"a".repeat(64),
+        "tsjs_inventory":{"name":"tsjs-inventory.json","size":1,"sha256":"a".repeat(64)},"artifacts":artifacts})
+}
+
+#[test]
+fn retained_index_schema_accepts_only_structural_fixed_cohort() {
+    let value = index_fixture();
+    assert!(
+        validate_schema(KnownSchema::ReleaseIndex, &value).is_ok(),
+        "should accept structural fixed-cohort fixture only"
+    );
+    let mut extra = value.clone();
+    extra["artifacts"]
+        .as_array_mut()
+        .expect("should access artifacts")
+        .push(value["artifacts"][0].clone());
+    assert!(
+        validate_schema(KnownSchema::ReleaseIndex, &extra).is_err(),
+        "should reject fifth artifact"
+    );
+    let mut wrong = value;
+    wrong["artifacts"][1]["target"] = json!("aarch64-apple-darwin");
+    assert!(
+        validate_schema(KnownSchema::ReleaseIndex, &wrong).is_err(),
+        "should reject mismatched fixed cohort identity"
+    );
+}
+
+#[test]
+fn index_role_checks_reject_fractional_lengths_and_duplicate_companions() {
+    let good = index_fixture();
+    for size in [
+        json!(-1),
+        json!(1.0),
+        json!(1.5),
+        json!(9007199254740992_u64),
+    ] {
+        let mut value = good.clone();
+        value["artifacts"][0]["companions"]["sbom"]["size"] = size;
+        assert!(
+            validate_schema(KnownSchema::ReleaseIndex, &value).is_err(),
+            "should reject noninteger or unsafe lengths after schema checks"
+        );
+    }
+    let mut duplicate = good;
+    duplicate["artifacts"][1]["companions"]["sbom"]["name"] =
+        duplicate["artifacts"][0]["companions"]["sbom"]["name"].clone();
+    assert!(
+        validate_schema(KnownSchema::ReleaseIndex, &duplicate).is_err(),
+        "should reject duplicate companion identities across artifacts"
+    );
+}
+
+#[test]
+fn index_role_checks_reject_unsafe_policy_integer() {
+    let mut value = index_fixture();
+    value["policy_version"] = json!(9007199254740992_u64);
+    assert!(
+        validate_schema(KnownSchema::ReleaseIndex, &value).is_err(),
+        "should reject integers above interoperable safe limit"
+    );
+    value["policy_version"] = json!(1.0);
+    assert!(
+        validate_schema(KnownSchema::ReleaseIndex, &value).is_err(),
+        "should require integer token representation"
+    );
+}
+
+#[test]
+fn detects_mutation_on_held_input_descriptor() {
+    let root = tempdir().expect("should create fixture");
+    let path = root.path().join("held");
+    fs::write(&path, b"old").expect("should create input");
+    let file = File::open(&path).expect("should hold original descriptor");
+    let before = file.metadata().expect("should capture original metadata");
+    fs::write(&path, b"new").expect("should mutate same-length input");
+    assert!(
+        read_held(&file, &before, Role::Metadata).is_err(),
+        "should detect same-length mutation against captured metadata"
+    );
+}
+
+#[test]
+fn held_read_does_not_reopen_replaced_path() {
+    let root = tempdir().expect("should create fixture");
+    let path = root.path().join("held");
+    fs::write(&path, b"original").expect("should create input");
+    let file = File::open(&path).expect("should hold original descriptor");
+    let before = file.metadata().expect("should capture input metadata");
+    fs::remove_file(&path).expect("should remove input pathname");
+    fs::write(&path, b"replacement").expect("should create different file");
+    assert!(
+        read_held(&file, &before, Role::Metadata).is_err(),
+        "should reject removed held file rather than reopen replacement"
+    );
+}
+
+#[test]
+fn rejects_fifo_without_waiting_for_a_writer() {
+    let root = tempdir().expect("should create fixture");
+    let path = root.path().join("input-fifo");
+    let name = CString::new(path.as_os_str().as_bytes()).expect("should encode fixture pathname");
+    // The CString supplies a valid NUL-terminated pathname for this Unix syscall.
+    assert_eq!(
+        unsafe { libc::mkfifo(name.as_ptr(), 0o600) },
+        0,
+        "should create FIFO fixture"
+    );
+    assert!(
+        read_bounded(&path, Role::Metadata).is_err(),
+        "should reject FIFO without blocking on open or read"
+    );
+}
+
+#[test]
+fn failed_rename_removes_private_sibling() {
+    let root = tempdir().expect("should create fixture");
+    let destination = root.path().join("directory");
+    fs::create_dir(&destination).expect("should create conflicting destination");
+    let directory = File::open(root.path()).expect("should hold parent");
+    let temporary = tempfile::Builder::new()
+        .prefix(".release-")
+        .tempfile_in(root.path())
+        .expect("should create sibling");
+    let temporary_path = temporary.path().to_owned();
+    assert!(
+        commit_output(temporary, &destination, &directory).is_err(),
+        "should fail file-to-directory replacement"
+    );
+    assert!(
+        !temporary_path.exists(),
+        "should clean sibling after actual rename failure"
+    );
+    assert_eq!(
+        fs::read_dir(root.path())
+            .expect("should inspect cleanup")
+            .count(),
+        1,
+        "should leave only existing destination"
+    );
+}
+
+#[test]
+fn index_role_checks_require_role_specific_companion_names() {
+    let good = index_fixture();
+    let mut swapped = good.clone();
+    let sbom = swapped["artifacts"][0]["companions"]["sbom"]["name"].clone();
+    swapped["artifacts"][0]["companions"]["sbom"]["name"] =
+        swapped["artifacts"][0]["companions"]["provenance"]["name"].clone();
+    swapped["artifacts"][0]["companions"]["provenance"]["name"] = sbom;
+    assert!(
+        validate_schema(KnownSchema::ReleaseIndex, &swapped).is_err(),
+        "should reject companion names swapped between roles"
+    );
+    let mut foreign = good;
+    foreign["artifacts"][0]["companions"]["sbom"]["name"] =
+        json!("ts-x86_64-unknown-linux-gnu-other.spdx.json");
+    assert!(
+        validate_schema(KnownSchema::ReleaseIndex, &foreign).is_err(),
+        "should reject companion names not derived from their asset"
+    );
+}
diff --git a/crates/trusted-server-release/src/error.rs b/crates/trusted-server-release/src/error.rs
new file mode 100644
index 0000000000..0fc12a991b
--- /dev/null
+++ b/crates/trusted-server-release/src/error.rs
@@ -0,0 +1,47 @@
+/// Reports a closed release execution gate or invalid release input.
+#[derive(Debug, derive_more::Display)]
+pub(crate) enum ReleaseError {
+    #[display(
+        "Invalid release invocation; Rust release execution remains disabled pending \
+         authenticated bootstrap and preflight"
+    )]
+    Usage,
+    #[display("Invalid release document")]
+    Document,
+    #[display("Release input policy rejects the candidate inputs")]
+    Policy,
+    #[display("Inherited release environment is rejected")]
+    Environment,
+    #[display("Release source is not authenticated")]
+    Source,
+    #[display("Git object verification failed")]
+    GitObject,
+    #[display("Production release selection is not qualified")]
+    Unqualified,
+    #[display("Release inputs are incomplete")]
+    Incomplete,
+    #[display("Final artifact inspection rejected the executable")]
+    Inspect,
+    #[display("Original release material is not verified")]
+    Material,
+    #[display("Bounded release child process failed")]
+    Process,
+    #[display("Release network-denial boundary rejected the execution")]
+    Boundary,
+    #[display("Release recipe inputs or execution plan are rejected")]
+    Recipe,
+    #[display("Final Fastly runtime acceptance rejected the executable")]
+    Runtime,
+    #[display("Artifact composition evidence is rejected")]
+    Composition,
+    #[display("Release transfer collection is rejected")]
+    Collection,
+    #[display("SPDX generation inputs or document are rejected")]
+    Spdx,
+    #[display("Candidate release distribution evidence is rejected")]
+    Distribution,
+    #[display("Immutable release publication is rejected")]
+    Publication,
+}
+
+impl core::error::Error for ReleaseError {}
diff --git a/crates/trusted-server-release/src/git_objects.rs b/crates/trusted-server-release/src/git_objects.rs
new file mode 100644
index 0000000000..7002bdb584
--- /dev/null
+++ b/crates/trusted-server-release/src/git_objects.rs
@@ -0,0 +1,394 @@
+//! Collision-checked Git objects under fixed source and Cargo material budgets.
+
+use std::cell::Cell;
+use std::io::{self, BufRead, Cursor, Read as _};
+
+use error_stack::Report;
+
+use crate::error::ReleaseError;
+
+fn object_error(detail: impl std::fmt::Display) -> Report<ReleaseError> {
+    Report::new(ReleaseError::GitObject).attach(detail.to_string())
+}
+
+/// A shared byte budget across every request in one object collection.
+///
+/// These checks authenticate bytes, not a Git executable or installed checkout.
+pub(crate) struct ObjectReader {
+    object_limit: u64,
+    remaining: Cell<u64>,
+}
+
+impl ObjectReader {
+    /// Creates the source-checkout policy: 64 MiB per object, 2 GiB total.
+    pub(crate) fn source() -> Self {
+        Self {
+            object_limit: 64 * 1024 * 1024,
+            remaining: Cell::new(2 * 1024 * 1024 * 1024),
+        }
+    }
+
+    /// Creates one Cargo collection policy: 32 MiB per object, 512 MiB total.
+    pub(crate) fn cargo_materials() -> Self {
+        Self {
+            object_limit: 32 * 1024 * 1024,
+            remaining: Cell::new(512 * 1024 * 1024),
+        }
+    }
+
+    #[cfg(test)]
+    /// Lowers a test's budget without allocating production-sized bodies.
+    pub(crate) fn set_budget_for_tests(&self, bytes: u64) {
+        self.remaining.set(bytes);
+    }
+
+    /// Preflights sizes, reads bounded batches and delivers only rehashed bytes.
+    ///
+    /// The caller's executor must enforce each supplied output bound and its
+    /// shared deadline/cancellation policy. This reader does not authenticate
+    /// the executable or supervise processes itself.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for failed commands, malformed or inconsistent replies,
+    /// exceeded byte budgets, identity mismatches or detected SHA-1 collisions.
+    pub(crate) fn read_objects(
+        &self,
+        kind: &'static str,
+        oids: &[&str],
+        execute: &mut impl FnMut(&[&str], Vec<u8>, u64) -> Result<Vec<u8>, Report<ReleaseError>>,
+        mut visit: impl FnMut(usize, &[u8]) -> Result<(), Report<ReleaseError>>,
+    ) -> Result<(), Report<ReleaseError>> {
+        let sizes = self.object_sizes(kind, oids, execute)?;
+        let mut start = 0;
+        while start < oids.len() {
+            let mut end = start;
+            let mut limit = 0;
+            while end < oids.len() && limit + sizes[end] + 128 <= self.object_limit + 128 {
+                limit += sizes[end] + 128;
+                end += 1;
+            }
+            let output = execute(&["cat-file", "--batch"], request(&oids[start..end]), limit)?;
+            let mut reader = Cursor::new(output.as_slice());
+            read_batch(
+                &mut reader,
+                &Batch {
+                    kind,
+                    object_limit: self.object_limit,
+                    oids: &oids[start..end],
+                    sizes: &sizes[start..end],
+                    budget: &self.remaining,
+                },
+                &mut |index, bytes| visit(start + index, bytes),
+            )?;
+            if reader.position() != output.len() as u64 {
+                return Err(object_error("unexpected trailing Git batch output"));
+            }
+            start = end;
+        }
+        Ok(())
+    }
+
+    fn object_sizes(
+        &self,
+        kind: &str,
+        oids: &[&str],
+        execute: &mut impl FnMut(&[&str], Vec<u8>, u64) -> Result<Vec<u8>, Report<ReleaseError>>,
+    ) -> Result<Vec<u64>, Report<ReleaseError>> {
+        let limit = (oids.len() as u64)
+            .checked_mul(128)
+            .ok_or_else(|| object_error("object header budget overflow"))?;
+        let output = execute(&["cat-file", "--batch-check"], request(oids), limit)?;
+        let mut reader = Cursor::new(output.as_slice());
+        let mut total = 0_u64;
+        let mut sizes = Vec::with_capacity(oids.len());
+        for oid in oids {
+            let size = read_header(&mut reader, kind, oid)?;
+            total = total
+                .checked_add(size)
+                .ok_or_else(|| object_error("object byte budget overflow"))?;
+            if size > self.object_limit || total > self.remaining.get() {
+                return Err(object_error(
+                    "object exceeds the per-object or aggregate object byte budget",
+                ));
+            }
+            sizes.push(size);
+        }
+        if reader.position() != output.len() as u64 {
+            return Err(object_error("unexpected trailing Git object metadata"));
+        }
+        Ok(sizes)
+    }
+}
+
+fn request(oids: &[&str]) -> Vec<u8> {
+    oids.iter()
+        .flat_map(|oid| oid.bytes().chain(std::iter::once(b'\n')))
+        .collect()
+}
+
+/// Collision-checked Git SHA-1 object id of `bytes` stored as an object of `kind`.
+fn object_id(kind: &str, bytes: &[u8]) -> Result<String, Report<ReleaseError>> {
+    let header = format!("{kind} {}\0", bytes.len());
+    checked_sha1(&[header.as_bytes(), bytes])
+}
+
+/// One `cat-file --batch` request and the shared aggregate byte budget.
+struct Batch<'a> {
+    kind: &'a str,
+    object_limit: u64,
+    oids: &'a [&'a str],
+    sizes: &'a [u64],
+    budget: &'a Cell<u64>,
+}
+
+fn read_batch(
+    reader: &mut impl BufRead,
+    batch: &Batch<'_>,
+    visit: &mut impl FnMut(usize, &[u8]) -> Result<(), Report<ReleaseError>>,
+) -> Result<(), Report<ReleaseError>> {
+    let io_error = |error: io::Error| object_error(format!("cannot read batch output: {error}"));
+    let kind = batch.kind;
+    if batch.sizes.len() != batch.oids.len() {
+        return Err(object_error(
+            "Git preflight size count differs from requested object count",
+        ));
+    }
+    for (index, oid) in batch.oids.iter().enumerate() {
+        let size = read_header(reader, kind, oid)?;
+        if size != batch.sizes[index] {
+            return Err(object_error(
+                "Git object body size differs from preflight metadata",
+            ));
+        }
+        let remaining = batch.budget.get();
+        if size > batch.object_limit || size > remaining {
+            return Err(object_error(format!(
+                "object {oid} exceeds the per-object or aggregate object byte budget"
+            )));
+        }
+        batch.budget.set(remaining - size);
+        let length = usize::try_from(size).map_err(|_| object_error("object size overflows"))?;
+        let mut bytes = vec![0; length];
+        reader.read_exact(&mut bytes).map_err(io_error)?;
+        let mut terminator = [0];
+        reader.read_exact(&mut terminator).map_err(io_error)?;
+        if terminator != *b"\n" {
+            return Err(object_error(format!("batch output for {oid} is malformed")));
+        }
+        if object_id(kind, &bytes)? != *oid {
+            return Err(object_error(format!(
+                "object identity mismatch: {kind} {oid} content does not hash to its id"
+            )));
+        }
+        visit(index, &bytes)?;
+    }
+    Ok(())
+}
+
+/// Reads one `<oid> <kind> <size>` header and returns the object size.
+fn read_header(
+    reader: &mut impl BufRead,
+    kind: &str,
+    oid: &str,
+) -> Result<u64, Report<ReleaseError>> {
+    let mut header = Vec::new();
+    reader
+        .take(128)
+        .read_until(b'\n', &mut header)
+        .map_err(|error| object_error(format!("cannot read batch header: {error}")))?;
+    let header =
+        std::str::from_utf8(&header).map_err(|_| object_error("batch header is not UTF-8"))?;
+    let fields: Vec<&str> = header.trim_end_matches('\n').split(' ').collect();
+    match fields.as_slice() {
+        [returned, returned_kind, size] if *returned == oid && *returned_kind == kind => size
+            .parse::<u64>()
+            .map_err(|_| object_error("batch object size is malformed")),
+        _ => Err(object_error(format!(
+            "object {oid} is not a readable {kind}"
+        ))),
+    }
+}
+
+/// Computes a Git identity with SHA-1 collision detection.
+///
+/// # Errors
+///
+/// Returns an error when the collision detector rejects the supplied bytes.
+pub(crate) fn checked_sha1(parts: &[&[u8]]) -> Result<String, Report<ReleaseError>> {
+    let mut hasher = sha1_checked::Sha1::new();
+    for part in parts {
+        sha1_checked::Digest::update(&mut hasher, part);
+    }
+    let result = hasher.try_finalize();
+    if result.has_collision() {
+        return Err(object_error(
+            "SHA-1 collision detection flags a Git object; its identity is not trusted",
+        ));
+    }
+    Ok(hex::encode(result.hash()))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::cell::Cell;
+
+    #[test]
+    fn shared_reader_preserves_collision_checked_object_delivery() {
+        let bytes = b"fictional object";
+        let mut hash = sha1_checked::Sha1::new();
+        sha1_checked::Digest::update(&mut hash, format!("blob {}\0", bytes.len()).as_bytes());
+        sha1_checked::Digest::update(&mut hash, bytes);
+        let oid = hex::encode(hash.try_finalize().hash());
+        let mut delivered = false;
+        ObjectReader::source()
+            .read_objects(
+                "blob",
+                &[&oid],
+                &mut |arguments, _, _| {
+                    let mut output = format!("{oid} blob {}\n", bytes.len()).into_bytes();
+                    if arguments.contains(&"--batch") {
+                        output.extend_from_slice(bytes);
+                        output.push(b'\n');
+                    }
+                    Ok(output)
+                },
+                |_, body| {
+                    assert_eq!(body, bytes, "should deliver exact verified bytes");
+                    delivered = true;
+                    Ok(())
+                },
+            )
+            .expect("should verify a complete object through shared reader");
+        assert!(delivered, "should deliver verified object");
+    }
+
+    #[test]
+    fn cargo_materials_reject_over_32_mib_before_requesting_body() {
+        let oid = "a".repeat(40);
+        for (reader, expects_body) in [
+            (ObjectReader::cargo_materials(), false),
+            (ObjectReader::source(), true),
+        ] {
+            let body_requested = Cell::new(false);
+            let result = reader.read_objects(
+                "blob",
+                &[&oid],
+                &mut |arguments, _, _| {
+                    if arguments.contains(&"--batch-check") {
+                        Ok(format!("{oid} blob {}\n", 32 * 1024 * 1024 + 1).into_bytes())
+                    } else {
+                        body_requested.set(true);
+                        Err(Report::new(ReleaseError::Source)
+                            .attach("fixture stops before allocating body"))
+                    }
+                },
+                |_, _| panic!("should never deliver fixture object"),
+            );
+            assert!(
+                result.is_err(),
+                "should reject fixture without allocating large body"
+            );
+            assert_eq!(
+                body_requested.get(),
+                expects_body,
+                "should preserve distinct source and Cargo per-object policies"
+            );
+        }
+    }
+
+    #[test]
+    fn cargo_collection_rejects_over_512_mib_before_any_body_request() {
+        let oid = "a".repeat(40);
+        let oids = vec![oid.as_str(); 17];
+        for (reader, expects_body) in [
+            (ObjectReader::cargo_materials(), false),
+            (ObjectReader::source(), true),
+        ] {
+            let mut body_requested = false;
+            let result = reader.read_objects(
+                "blob",
+                &oids,
+                &mut |arguments, _, _| {
+                    if arguments.contains(&"--batch-check") {
+                        Ok(format!("{oid} blob {}\n", 32 * 1024 * 1024)
+                            .repeat(oids.len())
+                            .into_bytes())
+                    } else {
+                        body_requested = true;
+                        Err(object_error("fixture stops before body allocation"))
+                    }
+                },
+                |_, _| panic!("should never deliver large fixture object"),
+            );
+            assert!(
+                result.is_err(),
+                "should reject fixture without materializing bodies"
+            );
+            assert_eq!(
+                body_requested, expects_body,
+                "should preserve distinct aggregate source and Cargo limits"
+            );
+        }
+    }
+
+    #[test]
+    fn body_size_disagreement_rejects_before_budget_or_delivery() {
+        let bytes = b"fictional object";
+        let oid = object_id("blob", bytes).expect("should hash fixture blob");
+        let mut raw = format!("{oid} blob {}\n", bytes.len()).into_bytes();
+        raw.extend_from_slice(bytes);
+        raw.push(b'\n');
+        let budget = Cell::new(1024);
+        let batch = Batch {
+            kind: "blob",
+            object_limit: 64 * 1024 * 1024,
+            oids: &[&oid],
+            sizes: &[1],
+            budget: &budget,
+        };
+        let mut delivered = false;
+        assert!(
+            read_batch(&mut Cursor::new(raw), &batch, &mut |_, _| {
+                delivered = true;
+                Ok(())
+            })
+            .is_err(),
+            "should reject body size inconsistent with preflight"
+        );
+        assert!(!delivered, "should reject before delivering object bytes");
+        assert_eq!(
+            budget.get(),
+            1024,
+            "should preserve budget before metadata joins"
+        );
+    }
+
+    #[test]
+    fn cargo_budget_accumulates_across_separate_object_requests() {
+        let bytes = b"fictional object";
+        let oid = object_id("blob", bytes).expect("should hash fixture object");
+        let reader = ObjectReader::cargo_materials();
+        reader.set_budget_for_tests(bytes.len() as u64);
+        let mut execute = |arguments: &[&str], _: Vec<u8>, _: u64| {
+            let mut output = format!("{oid} blob {}\n", bytes.len()).into_bytes();
+            if arguments.contains(&"--batch") {
+                output.extend_from_slice(bytes);
+                output.push(b'\n');
+            }
+            Ok(output)
+        };
+        reader
+            .read_objects("blob", &[&oid], &mut execute, |_, _| Ok(()))
+            .expect("should consume entire shared budget");
+        assert!(
+            reader
+                .read_objects("blob", &[&oid], &mut execute, |_, _| panic!(
+                    "should not deliver after exhaustion"
+                ))
+                .is_err(),
+            "should preserve aggregate budget across requests"
+        );
+    }
+}
diff --git a/crates/trusted-server-release/src/inspect.rs b/crates/trusted-server-release/src/inspect.rs
new file mode 100644
index 0000000000..aa0cf1ce22
--- /dev/null
+++ b/crates/trusted-server-release/src/inspect.rs
@@ -0,0 +1,708 @@
+//! Pure inspection of final release executables.
+//!
+//! Each inspector reads only the final bytes of one artifact: it never runs
+//! the artifact, rebuilds it or consults the build environment. A successful
+//! inspection returns facts that record what was observed — loader, libraries,
+//! version floors, Wasm import modules and the SHA-256 of the inspected bytes —
+//! for later build evidence. Facts make no claim beyond that observation;
+//! startup and runtime behaviour belong to the recipe and qualification
+//! fixtures.
+//!
+//! Every inspector fails closed: an unsupported container, a truncated or
+//! malformed structure, or any value outside the compiled-in policy rejects
+//! the artifact with [`ReleaseError::Inspect`] and an attached [`Violation`]
+//! naming the rule.
+//!
+//! - [`inspect_elf`]: `x86_64-unknown-linux-gnu` executables against the
+//!   glibc 2.34 loader floor.
+//! - [`inspect_macho`]: thin 64-bit macOS executables against the macOS 13.0
+//!   deployment target.
+//! - [`inspect_wasm`]: Fastly Compute core modules.
+
+mod elf;
+mod macho;
+mod wasm;
+
+use std::fmt;
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256};
+
+use crate::error::ReleaseError;
+
+// Only the tests consume the inspectors until the Task 9 recipes call them.
+#[allow(unused_imports, reason = "consumed by Task 9 recipes")]
+pub(crate) use self::{
+    elf::{ElfPolicy, inspect_elf},
+    macho::{CodeSignature, MachoCpu, MachoPolicy, inspect_macho},
+    wasm::inspect_wasm,
+};
+
+/// Default build-host or runner path prefixes, retained by macOS inspection.
+///
+/// A final executable embedding any of them leaks the build environment
+/// (unremapped source, home, temporary or workspace paths). The scan is
+/// deliberately conservative: it matches anywhere in the file, not only in
+/// loader strings. GNU ELF inspection uses its own reviewed list; this default
+/// retains generic temporary paths for macOS.
+///
+/// Matches are substrings, not path starts: Rust panic locations sit in
+/// unterminated rodata, so the byte before a path is arbitrary. Entries are
+/// therefore specific enough not to match ordinary crate-relative paths; a
+/// bare `/private/` would match serde's `src/private/de.rs`.
+pub(crate) const RUNNER_PATH_PREFIXES: &[&str] = &[
+    "/home/",
+    "/Users/",
+    "/root/",
+    "/private/var/",
+    "/private/tmp/",
+    "/var/folders/",
+    "/tmp/",
+    "/github/workspace/",
+    "/__w/",
+];
+
+/// Maximum number of embedded-path offsets reported in a rejection.
+const REPORTED_PATH_HITS: usize = 16;
+/// Source bytes before each denied-path match in diagnostic context.
+const PATH_CONTEXT_BEFORE: usize = 16;
+/// Source bytes from each denied-path match onward in diagnostic context.
+const PATH_CONTEXT_AFTER: usize = 80;
+/// Maximum section-name bytes included in a diagnostic.
+const SECTION_NAME_BYTES: usize = 32;
+
+/// The inspection rule an artifact violated.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, derive_more::Display)]
+pub(crate) enum Violation {
+    /// The bytes are truncated, malformed or not the expected container.
+    #[display("malformed or unsupported executable container")]
+    Malformed,
+    /// The container is valid but the class, CPU or file type is not the
+    /// selected target's.
+    #[display("executable architecture or file type does not match the target")]
+    Architecture,
+    /// The program interpreter or dynamic linker is missing or unexpected.
+    #[display("program interpreter is missing or unexpected")]
+    Interpreter,
+    /// A linked library is outside the reviewed allowlist.
+    #[display("linked library is outside the reviewed allowlist")]
+    Library,
+    /// A library link uses a kind other than a plain required load.
+    #[display("library link kind is not a plain required load")]
+    LinkKind,
+    /// A symbol version requirement is unparsable, unexpected or above the
+    /// compatibility ceiling.
+    #[display("symbol version requirement is unparsable or exceeds the ceiling")]
+    SymbolVersion,
+    /// The executable carries a runtime library search path or loader
+    /// environment.
+    #[display("executable carries a runtime library search path")]
+    SearchPath,
+    /// The executable embeds a runner-only absolute path.
+    #[display("executable embeds a runner-only absolute path")]
+    EmbeddedPath,
+    /// The deployment target is missing, ambiguous or not the selected floor.
+    #[display("deployment target is missing or does not match the floor")]
+    DeploymentTarget,
+    /// The bytes are a Wasm component or not Wasm at all.
+    #[display("artifact is not a core WebAssembly module")]
+    WasmEncoding,
+    /// The core module fails validation under the pinned feature set.
+    #[display("core WebAssembly module fails validation")]
+    WasmValidation,
+    /// The module imports from an unreviewed module or a non-function item.
+    #[display("WebAssembly import is outside the reviewed host ABI")]
+    WasmImport,
+    /// A required DWARF custom section is missing or empty, so the module
+    /// was stripped.
+    #[display("WebAssembly module lacks a required nonempty debug section")]
+    WasmDebugInfo,
+    /// A required DWARF section of an ELF executable is missing or holds no
+    /// file bytes, so the executable was stripped.
+    #[display("ELF executable lacks a required nonempty debug section")]
+    ElfDebugInfo,
+    /// The module is not a Fastly Compute WASI command: `_start` or `memory`
+    /// is missing or mistyped, or the downstream request ABI is not imported.
+    #[display("WebAssembly module lacks the Fastly Compute entry ABI")]
+    WasmAbi,
+    /// The Mach-O code signature is malformed, not a linker-signed ad-hoc
+    /// signature, carries a CMS signature or team identifier, or is missing
+    /// where the CPU requires it.
+    #[display("Mach-O code signature is not the reviewed linker-signed ad-hoc form")]
+    CodeSignature,
+    /// The Mach-O debug map names an absolute or empty object path, records
+    /// a nonzero object modification time, or is missing where required.
+    #[display("Mach-O debug map is missing, absolute or time-stamped")]
+    MachoDebugMap,
+    /// The Mach-O `LC_UUID` is missing or duplicated.
+    #[display("Mach-O executable identity is missing or duplicated")]
+    MachoIdentity,
+}
+
+/// Builds the inspection rejection carrying `violation` and a detail line.
+fn rejected(violation: Violation, detail: impl fmt::Display) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Inspect)
+        .attach(violation)
+        .attach(detail.to_string())
+}
+
+/// Maps a parser error onto [`Violation::Malformed`].
+fn malformed(context: &str, error: impl fmt::Display) -> Report<ReleaseError> {
+    rejected(Violation::Malformed, format!("{context}: {error}"))
+}
+
+/// Returns the lowercase hex SHA-256 of `bytes`.
+fn sha256_hex(bytes: &[u8]) -> String {
+    hex::encode(Sha256::digest(bytes))
+}
+
+/// Decodes a loader string, rejecting non-UTF-8 bytes.
+fn utf8<'a>(bytes: &'a [u8], context: &str) -> Result<&'a str, Report<ReleaseError>> {
+    std::str::from_utf8(bytes).map_err(|error| malformed(context, error))
+}
+
+/// One occurrence of a denied path prefix in the inspected bytes.
+#[derive(Debug, Clone, PartialEq, Eq)]
+struct PathHit {
+    prefix: &'static str,
+    offset: usize,
+}
+
+/// Finds every occurrence of any `prefixes` entry anywhere in `bytes`.
+///
+/// # Performance
+///
+/// Candidates are found by scanning for `/` only, so the cost is one pass
+/// plus a short comparison per slash rather than one window per prefix.
+fn find_denied_paths<'a>(
+    bytes: &'a [u8],
+    prefixes: &'a [&'static str],
+) -> impl Iterator<Item = PathHit> + 'a {
+    bytes
+        .iter()
+        .enumerate()
+        .filter(|(_, byte)| **byte == b'/')
+        .filter_map(move |(offset, _)| {
+            prefixes
+                .iter()
+                .find(|prefix| bytes[offset..].starts_with(prefix.as_bytes()))
+                .map(|prefix| PathHit { prefix, offset })
+        })
+}
+
+/// Rejects `bytes` if they embed any denied path prefix.
+///
+/// # Errors
+///
+/// Returns [`Violation::EmbeddedPath`] listing the match count and the first
+/// [`REPORTED_PATH_HITS`] prefix/offset pairs with bounded escaped context and
+/// the exact artifact identity.
+fn reject_denied_paths(
+    bytes: &[u8],
+    prefixes: &[&'static str],
+) -> Result<(), Report<ReleaseError>> {
+    reject_denied_paths_with_sections(bytes, prefixes, |_| None)
+}
+
+/// Rejects the same denied paths, adding bounded section and byte diagnostics.
+fn reject_denied_paths_with_sections<'a>(
+    bytes: &[u8],
+    prefixes: &[&'static str],
+    section_at: impl Fn(usize) -> Option<&'a [u8]>,
+) -> Result<(), Report<ReleaseError>> {
+    let mut count = 0_usize;
+    let mut shown = Vec::new();
+    for hit in find_denied_paths(bytes, prefixes) {
+        count += 1;
+        if shown.len() == REPORTED_PATH_HITS {
+            continue;
+        }
+        let start = hit.offset.saturating_sub(PATH_CONTEXT_BEFORE);
+        let end = hit
+            .offset
+            .saturating_add(PATH_CONTEXT_AFTER)
+            .min(bytes.len());
+        let context = bytes[start..end].escape_ascii();
+        let section = section_at(hit.offset).map_or_else(
+            || "unknown".to_owned(),
+            |name| {
+                name[..name.len().min(SECTION_NAME_BYTES)]
+                    .escape_ascii()
+                    .to_string()
+            },
+        );
+        shown.push(format!(
+            "{}@{:#x} section=\"{section}\" context[{start:#x}..{end:#x}]=\"{context}\"",
+            hit.prefix, hit.offset,
+        ));
+    }
+    if count == 0 {
+        return Ok(());
+    }
+    Err(rejected(
+        Violation::EmbeddedPath,
+        format!(
+            "artifact sha256={} size={}; {count} runner-only path occurrence(s): {}",
+            sha256_hex(bytes),
+            bytes.len(),
+            shown.join(", "),
+        ),
+    ))
+}
+
+/// A numeric `GLIBC_x.y[.z]` symbol version.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+pub(crate) struct GlibcVersion {
+    major: u32,
+    minor: u32,
+    patch: u32,
+}
+
+impl GlibcVersion {
+    /// Creates `major.minor`.
+    pub(crate) const fn new(major: u32, minor: u32) -> Self {
+        Self {
+            major,
+            minor,
+            patch: 0,
+        }
+    }
+
+    /// Parses `x.y` or `x.y.z` made of plain decimal components.
+    ///
+    /// Signs, empty components, leading zeros and more than three
+    /// components are rejected, so names such as `GLIBC_PRIVATE` or
+    /// `GLIBC_ABI_DT_RELR` never compare as versions.
+    pub(crate) fn parse(text: &str) -> Option<Self> {
+        let parts = text.split('.').map(decimal).collect::<Option<Vec<_>>>()?;
+        match parts.as_slice() {
+            [major, minor] => Some(Self::new(*major, *minor)),
+            [major, minor, patch] => Some(Self {
+                major: *major,
+                minor: *minor,
+                patch: *patch,
+            }),
+            _ => None,
+        }
+    }
+}
+
+impl fmt::Display for GlibcVersion {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(formatter, "{}.{}", self.major, self.minor)?;
+        if self.patch != 0 {
+            write!(formatter, ".{}", self.patch)?;
+        }
+        Ok(())
+    }
+}
+
+/// Parses one canonical unsigned decimal component.
+fn decimal(text: &str) -> Option<u32> {
+    let canonical = !text.is_empty()
+        && text.bytes().all(|byte| byte.is_ascii_digit())
+        && (text == "0" || !text.starts_with('0'));
+    if canonical { text.parse().ok() } else { None }
+}
+
+/// One `(library, version name)` pair from `.gnu.version_r`.
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, serde::Serialize)]
+pub(crate) struct VersionRequirement {
+    file: String,
+    name: String,
+}
+
+/// One section of an ELF executable named like a required DWARF section.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct ElfDebugSection {
+    name: String,
+    size: usize,
+}
+
+impl ElfDebugSection {
+    /// Section name, one of the required DWARF section names.
+    pub(crate) fn name(&self) -> &str {
+        &self.name
+    }
+
+    /// File bytes the section holds; zero for `SHT_NOBITS`.
+    pub(crate) fn size(&self) -> usize {
+        self.size
+    }
+}
+
+/// Facts observed in an accepted ELF executable.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct ElfFacts {
+    sha256: String,
+    interpreter: String,
+    needed: Vec<String>,
+    version_requirements: Vec<VersionRequirement>,
+    max_glibc: GlibcVersion,
+    debug_sections: Vec<ElfDebugSection>,
+}
+
+impl ElfFacts {
+    /// Sections named like a required DWARF section, in file order.
+    pub(crate) fn debug_sections(&self) -> &[ElfDebugSection] {
+        &self.debug_sections
+    }
+
+    /// Requires nonempty `.debug_info` and `.debug_line` sections.
+    ///
+    /// Release executables keep limited debug info (`debug = 1`) and are
+    /// never stripped, so a missing or empty section means the bytes are not
+    /// the profile's output.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`Violation::ElfDebugInfo`] naming the first required section
+    /// that is absent or holds no file bytes in every occurrence.
+    pub(crate) fn require_debug_sections(&self) -> Result<(), Report<ReleaseError>> {
+        for required in REQUIRED_DEBUG_SECTIONS {
+            let present = self
+                .debug_sections
+                .iter()
+                .any(|section| section.name == required && section.size > 0);
+            if !present {
+                return Err(rejected(
+                    Violation::ElfDebugInfo,
+                    format!("missing or empty section {required}"),
+                ));
+            }
+        }
+        Ok(())
+    }
+
+    /// Lowercase hex SHA-256 of the inspected bytes.
+    pub(crate) fn sha256(&self) -> &str {
+        &self.sha256
+    }
+
+    /// Observed `PT_INTERP` path.
+    pub(crate) fn interpreter(&self) -> &str {
+        &self.interpreter
+    }
+
+    /// Observed `DT_NEEDED` entries in file order.
+    pub(crate) fn needed(&self) -> &[String] {
+        &self.needed
+    }
+
+    /// Observed `.gnu.version_r` requirements, sorted.
+    pub(crate) fn version_requirements(&self) -> &[VersionRequirement] {
+        &self.version_requirements
+    }
+
+    /// Highest observed `GLIBC_` requirement.
+    pub(crate) fn max_glibc(&self) -> GlibcVersion {
+        self.max_glibc
+    }
+}
+
+/// A macOS `X.Y.Z` version as encoded in `LC_BUILD_VERSION`.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, derive_more::Display)]
+#[display("{major}.{minor}.{patch}")]
+pub(crate) struct MacosVersion {
+    major: u16,
+    minor: u8,
+    patch: u8,
+}
+
+impl MacosVersion {
+    /// Creates `major.minor.0`.
+    pub(crate) const fn new(major: u16, minor: u8) -> Self {
+        Self {
+            major,
+            minor,
+            patch: 0,
+        }
+    }
+
+    /// Parses `major.minor` or `major.minor.patch` decimal text, as an SDK
+    /// settings file states its version.
+    ///
+    /// Returns `None` for any other shape, a component with a leading zero or
+    /// sign, or a component out of range.
+    pub(crate) fn parse(text: &str) -> Option<Self> {
+        fn component<T: std::str::FromStr>(part: &str) -> Option<T> {
+            let canonical = !part.is_empty()
+                && part.bytes().all(|byte| byte.is_ascii_digit())
+                && (part == "0" || !part.starts_with('0'));
+            canonical.then(|| part.parse().ok()).flatten()
+        }
+        let mut parts = text.split('.');
+        let major = component(parts.next()?)?;
+        let minor = component(parts.next()?)?;
+        let patch = parts.next().map_or(Some(0), component)?;
+        parts.next().is_none().then_some(Self {
+            major,
+            minor,
+            patch,
+        })
+    }
+
+    /// Decodes the `xxxx.yy.zz` nibble encoding.
+    fn from_encoded(encoded: u32) -> Self {
+        let [high, low, minor, patch] = encoded.to_be_bytes();
+        Self {
+            major: u16::from_be_bytes([high, low]),
+            minor,
+            patch,
+        }
+    }
+}
+
+/// Facts observed in an accepted Mach-O executable.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct MachoFacts {
+    sha256: String,
+    loader: String,
+    cpu: MachoCpu,
+    minos: MacosVersion,
+    sdk: MacosVersion,
+    dylibs: Vec<String>,
+    uuid: [u8; 16],
+    symbols: usize,
+    debug_map_objects: usize,
+    signature: CodeSignature,
+}
+
+impl MachoFacts {
+    /// Observed and validated `LC_LOAD_DYLINKER` install name.
+    pub(crate) fn loader(&self) -> &str {
+        &self.loader
+    }
+
+    /// Observed `LC_UUID`; a linked executable always carries exactly one.
+    pub(crate) fn uuid(&self) -> [u8; 16] {
+        self.uuid
+    }
+
+    /// Number of `LC_SYMTAB` entries, including debug-map stabs.
+    pub(crate) fn symbol_count(&self) -> usize {
+        self.symbols
+    }
+
+    /// Number of `N_OSO` debug-map object entries, all relative with zero
+    /// modification time.
+    pub(crate) fn debug_map_objects(&self) -> usize {
+        self.debug_map_objects
+    }
+
+    /// Observed code signature form.
+    pub(crate) fn signature(&self) -> CodeSignature {
+        self.signature
+    }
+
+    /// Requires the debug map a release build keeps: a non-empty symbol
+    /// table holding at least one `N_OSO` object entry.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`Violation::MachoDebugMap`] when the symbol table is empty
+    /// or holds no object entry, so the executable was stripped.
+    pub(crate) fn require_debug_map(&self) -> Result<(), Report<ReleaseError>> {
+        if self.symbols == 0 || self.debug_map_objects == 0 {
+            return Err(rejected(
+                Violation::MachoDebugMap,
+                format!(
+                    "{} symbols and {} debug-map objects; the executable was stripped",
+                    self.symbols, self.debug_map_objects
+                ),
+            ));
+        }
+        Ok(())
+    }
+    /// Lowercase hex SHA-256 of the inspected bytes.
+    pub(crate) fn sha256(&self) -> &str {
+        &self.sha256
+    }
+
+    /// Observed CPU type.
+    pub(crate) fn cpu(&self) -> MachoCpu {
+        self.cpu
+    }
+
+    /// Observed `LC_BUILD_VERSION` minimum OS version.
+    pub(crate) fn minos(&self) -> MacosVersion {
+        self.minos
+    }
+
+    /// Observed `LC_BUILD_VERSION` SDK version.
+    pub(crate) fn sdk(&self) -> MacosVersion {
+        self.sdk
+    }
+
+    /// Observed `LC_LOAD_DYLIB` install names in load-command order.
+    pub(crate) fn dylibs(&self) -> &[String] {
+        &self.dylibs
+    }
+}
+
+/// One custom section observed in a core Wasm module.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct WasmCustomSection {
+    name: String,
+    size: usize,
+}
+
+impl WasmCustomSection {
+    /// Section name as encoded in the module.
+    pub(crate) fn name(&self) -> &str {
+        &self.name
+    }
+
+    /// Payload length in bytes, excluding the name.
+    pub(crate) fn size(&self) -> usize {
+        self.size
+    }
+}
+
+/// The kind of one core Wasm export, with a function's arity.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum WasmExportKind {
+    /// A function taking `params` values and returning `results` values.
+    Function { params: usize, results: usize },
+    /// A linear memory.
+    Memory,
+    /// A table, global or tag.
+    Other,
+}
+
+/// One export observed in a core Wasm module.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct WasmExport {
+    name: String,
+    kind: WasmExportKind,
+}
+
+impl WasmExport {
+    /// Export name as encoded in the module.
+    pub(crate) fn name(&self) -> &str {
+        &self.name
+    }
+
+    /// Kind of the exported item.
+    pub(crate) fn kind(&self) -> WasmExportKind {
+        self.kind
+    }
+}
+
+/// Facts observed in an accepted core Wasm module.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct WasmFacts {
+    sha256: String,
+    import_modules: Vec<String>,
+    function_imports: usize,
+    custom_sections: Vec<WasmCustomSection>,
+    exports: Vec<WasmExport>,
+}
+
+/// DWARF sections whose nonempty presence proves a Wasm module or ELF
+/// executable was not stripped.
+const REQUIRED_DEBUG_SECTIONS: [&str; 2] = [".debug_info", ".debug_line"];
+
+/// Hostcall modules a Fastly program must import to receive the downstream
+/// request and send its response.
+const REQUIRED_FASTLY_IMPORT_MODULES: [&str; 2] = ["fastly_http_req", "fastly_http_resp"];
+
+impl WasmFacts {
+    /// Exports in module order.
+    pub(crate) fn exports(&self) -> &[WasmExport] {
+        &self.exports
+    }
+
+    /// Requires the Fastly Compute WASI command entry ABI.
+    ///
+    /// The module must export a `_start` function taking and returning
+    /// nothing and a `memory`, and import the downstream request and response
+    /// hostcall modules. Import modules outside the reviewed host ABI were
+    /// already rejected by [`inspect_wasm`].
+    ///
+    /// # Errors
+    ///
+    /// Returns [`Violation::WasmAbi`] naming the first missing or mistyped
+    /// requirement.
+    pub(crate) fn require_fastly_entry_abi(&self) -> Result<(), Report<ReleaseError>> {
+        let kind = |name: &str| {
+            self.exports
+                .iter()
+                .find(|export| export.name == name)
+                .map(|export| export.kind)
+        };
+        match kind("_start") {
+            Some(WasmExportKind::Function {
+                params: 0,
+                results: 0,
+            }) => {}
+            other => {
+                return Err(rejected(
+                    Violation::WasmAbi,
+                    format!("export _start must be a nullary function, found {other:?}"),
+                ));
+            }
+        }
+        if kind("memory") != Some(WasmExportKind::Memory) {
+            return Err(rejected(
+                Violation::WasmAbi,
+                "export memory must be a linear memory",
+            ));
+        }
+        if let Some(missing) = REQUIRED_FASTLY_IMPORT_MODULES
+            .iter()
+            .find(|module| !self.import_modules.iter().any(|seen| seen == *module))
+        {
+            return Err(rejected(
+                Violation::WasmAbi,
+                format!("missing required import module {missing}"),
+            ));
+        }
+        Ok(())
+    }
+
+    /// Custom sections in file order.
+    pub(crate) fn custom_sections(&self) -> &[WasmCustomSection] {
+        &self.custom_sections
+    }
+
+    /// Requires nonempty `.debug_info` and `.debug_line` custom sections.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`Violation::WasmDebugInfo`] naming the first required section
+    /// that is absent or has an empty payload in every occurrence.
+    pub(crate) fn require_debug_sections(&self) -> Result<(), Report<ReleaseError>> {
+        for required in REQUIRED_DEBUG_SECTIONS {
+            let present = self
+                .custom_sections
+                .iter()
+                .any(|section| section.name == required && section.size > 0);
+            if !present {
+                return Err(rejected(
+                    Violation::WasmDebugInfo,
+                    format!("missing or empty custom section {required}"),
+                ));
+            }
+        }
+        Ok(())
+    }
+
+    /// Lowercase hex SHA-256 of the inspected bytes.
+    pub(crate) fn sha256(&self) -> &str {
+        &self.sha256
+    }
+
+    /// Distinct import module names, sorted.
+    pub(crate) fn import_modules(&self) -> &[String] {
+        &self.import_modules
+    }
+
+    /// Total number of imported functions.
+    pub(crate) fn function_imports(&self) -> usize {
+        self.function_imports
+    }
+}
+
+#[cfg(test)]
+pub(crate) mod tests;
diff --git a/crates/trusted-server-release/src/inspect/elf.rs b/crates/trusted-server-release/src/inspect/elf.rs
new file mode 100644
index 0000000000..6c5b455a35
--- /dev/null
+++ b/crates/trusted-server-release/src/inspect/elf.rs
@@ -0,0 +1,487 @@
+//! ELF inspection for `x86_64-unknown-linux-gnu` executables.
+//!
+//! Section observations are accepted only after matching the loader's
+//! dynamic addresses to their actual file-backed `PT_LOAD` ranges.
+
+mod loader;
+
+use std::collections::BTreeSet;
+
+use error_stack::Report;
+use object::Endianness;
+use object::elf::{self as format, FileHeader64};
+use object::read::elf::{Dyn as _, FileHeader as _, ProgramHeader as _, SectionHeader as _};
+use object::read::{SectionIndex, StringTable};
+
+use super::{
+    ElfDebugSection, ElfFacts, GlibcVersion, REQUIRED_DEBUG_SECTIONS, VersionRequirement,
+    Violation, malformed, reject_denied_paths_with_sections, rejected, sha256_hex, utf8,
+};
+use crate::error::ReleaseError;
+
+type Header = FileHeader64<Endianness>;
+type Sections<'data> = object::read::elf::SectionTable<'data, Header, &'data [u8]>;
+
+/// Version-name prefix whose suffix is compared to the glibc ceiling.
+const GLIBC_PREFIX: &str = "GLIBC_";
+
+/// Reviewed `x86_64-unknown-linux-gnu` loader.
+const LINUX_X86_64_INTERPRETER: &str = "/lib64/ld-linux-x86-64.so.2";
+
+/// Reviewed `DT_NEEDED` set for the `ts` CLI.
+///
+/// Rust std on `linux-gnu` links libc, libm, `libgcc_s` (unwinding) and the
+/// loader (`__tls_get_addr`). From glibc 2.34 `libdl`, `libpthread` and
+/// `librt` are merged into libc, so they are deliberately absent: a builder
+/// that still emits them is not the qualified floor.
+const LINUX_X86_64_NEEDED: &[&str] = &[
+    "ld-linux-x86-64.so.2",
+    "libc.so.6",
+    "libgcc_s.so.1",
+    "libm.so.6",
+];
+
+/// GNU-specific runner path prefixes, excluding the generic runtime `/tmp/`.
+///
+/// The Linux CLI includes a dependency's browser lookup under `/tmp/`; that
+/// runtime string is not a build path. Complete GNU recipe acceptance also
+/// requires read-only unbound scratch, IPC without writable shared memory,
+/// no image-declared volumes, and the bound host/execution-root scan in
+/// [`crate::recipe::PreparedRecipe`]. This list alone cannot establish build
+/// path provenance. The default macOS list retains `/tmp/` until its own
+/// filesystem boundary is qualified.
+const LINUX_X86_64_DENIED_PATH_PREFIXES: &[&str] = &[
+    "/home/",
+    "/Users/",
+    "/root/",
+    "/private/var/",
+    "/private/tmp/",
+    "/var/folders/",
+    "/github/workspace/",
+    "/__w/",
+];
+
+/// Version-name prefixes accepted per library, besides `GLIBC_`.
+///
+/// `libgcc_s` versions its unwinder as `GCC_x.y[.z]`; those carry no glibc
+/// floor and are recorded only.
+const OTHER_VERSION_PREFIXES: &[(&str, &str)] = &[("libgcc_s.so.1", "GCC_")];
+
+/// Compiled-in ELF acceptance policy.
+#[derive(Debug, Clone)]
+pub(crate) struct ElfPolicy {
+    pub(crate) interpreter: &'static str,
+    pub(crate) allowed_needed: &'static [&'static str],
+    pub(crate) glibc_maximum: GlibcVersion,
+    pub(crate) denied_path_prefixes: &'static [&'static str],
+}
+
+impl ElfPolicy {
+    /// The reviewed `x86_64-unknown-linux-gnu` policy: glibc 2.34 ceiling.
+    pub(crate) const fn linux_x86_64_gnu() -> Self {
+        Self {
+            interpreter: LINUX_X86_64_INTERPRETER,
+            allowed_needed: LINUX_X86_64_NEEDED,
+            glibc_maximum: GlibcVersion::new(2, 34),
+            denied_path_prefixes: LINUX_X86_64_DENIED_PATH_PREFIXES,
+        }
+    }
+}
+
+/// Inspects a final ELF executable against `policy`.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Inspect`] with a [`Violation`] when the bytes are
+/// not a little-endian 64-bit `x86_64` executable, the interpreter differs,
+/// a `DT_NEEDED` entry is outside the allowlist, `DT_RPATH`/`DT_RUNPATH` (or
+/// a filter) is present, a version requirement is unparsable or above the
+/// glibc ceiling, a section name or debug section is malformed, or a
+/// runner-only path is embedded anywhere in the file. Missing debug info is
+/// recorded, not rejected here; see [`ElfFacts::require_debug_sections`].
+///
+/// Structural inspection records final-file facts, not complete build-path
+/// provenance. The GNU policy permits runtime `/tmp/` constants; its owning
+/// recipe must additionally enforce the filesystem restrictions and scan its
+/// actual bound host and execution roots before accepting the artifact.
+pub(crate) fn inspect_elf(
+    bytes: &[u8],
+    policy: &ElfPolicy,
+) -> Result<ElfFacts, Report<ReleaseError>> {
+    let header = Header::parse(bytes).map_err(|error| malformed("ELF header", error))?;
+    let endian = header
+        .endian()
+        .map_err(|error| malformed("ELF endianness", error))?;
+    check_identity(header, endian)?;
+    let interpreter = interpreter(header, endian, bytes)?;
+    if interpreter != policy.interpreter {
+        return Err(rejected(
+            Violation::Interpreter,
+            format!(
+                "PT_INTERP is {interpreter:?}, expected {:?}",
+                policy.interpreter
+            ),
+        ));
+    }
+    let sections = header
+        .sections(endian, bytes)
+        .map_err(|error| malformed("ELF section table", error))?;
+    loader::validate(header, endian, bytes, &sections)?;
+    let needed = dynamic_needed(header, endian, bytes, &sections)?;
+    if let Some(name) = needed
+        .iter()
+        .find(|name| !policy.allowed_needed.contains(&name.as_str()))
+    {
+        return Err(rejected(Violation::Library, format!("DT_NEEDED {name:?}")));
+    }
+    let version_requirements = version_requirements(endian, bytes, &sections)?;
+    let max_glibc = check_versions(&version_requirements, &needed, policy.glibc_maximum)?;
+    let debug_sections = debug_sections(endian, bytes, &sections)?;
+    reject_denied_paths_with_sections(bytes, policy.denied_path_prefixes, |offset| {
+        section_at(endian, &sections, offset)
+    })?;
+    Ok(ElfFacts {
+        sha256: sha256_hex(bytes),
+        interpreter: interpreter.to_owned(),
+        needed,
+        version_requirements,
+        max_glibc,
+        debug_sections,
+    })
+}
+
+/// Names the file-backed section containing one denied-path offset.
+fn section_at<'a>(endian: Endianness, sections: &Sections<'a>, offset: usize) -> Option<&'a [u8]> {
+    let offset = u64::try_from(offset).ok()?;
+    sections.iter().find_map(|section| {
+        if section.sh_type(endian) == format::SHT_NOBITS {
+            return None;
+        }
+        let start = section.sh_offset(endian);
+        let end = start.checked_add(section.sh_size(endian))?;
+        (start..end)
+            .contains(&offset)
+            .then(|| sections.section_name(endian, section).ok())
+            .flatten()
+    })
+}
+
+/// Returns every section named like a required DWARF section, with the
+/// number of file bytes it holds (zero for `SHT_NOBITS`).
+///
+/// Recording is not acceptance: [`ElfFacts::require_debug_sections`] decides.
+fn debug_sections(
+    endian: Endianness,
+    bytes: &[u8],
+    sections: &Sections<'_>,
+) -> Result<Vec<ElfDebugSection>, Report<ReleaseError>> {
+    let mut found = Vec::new();
+    for section in sections.iter() {
+        let name = sections
+            .section_name(endian, section)
+            .map_err(|error| malformed("ELF section name", error))?;
+        let Some(required) = REQUIRED_DEBUG_SECTIONS
+            .iter()
+            .find(|required| required.as_bytes() == name)
+        else {
+            continue;
+        };
+        let size = if section.sh_type(endian) == format::SHT_NOBITS {
+            0
+        } else {
+            section
+                .data(endian, bytes)
+                .map_err(|error| malformed("ELF debug section", error))?
+                .len()
+        };
+        found.push(ElfDebugSection {
+            name: (*required).to_owned(),
+            size,
+        });
+    }
+    Ok(found)
+}
+
+/// Requires a little-endian `x86_64` `ET_EXEC`/`ET_DYN` file.
+fn check_identity(header: &Header, endian: Endianness) -> Result<(), Report<ReleaseError>> {
+    let ident = header.e_ident();
+    let machine = header.e_machine(endian);
+    let kind = header.e_type(endian);
+    if ident.data != format::ELFDATA2LSB
+        || machine != format::EM_X86_64
+        || !matches!(kind, format::ET_EXEC | format::ET_DYN)
+    {
+        return Err(rejected(
+            Violation::Architecture,
+            format!(
+                "ELF data {} machine {machine} type {kind}; expected little-endian x86_64 \
+                 executable",
+                ident.data
+            ),
+        ));
+    }
+    Ok(())
+}
+
+/// Returns the single `PT_INTERP` path.
+fn interpreter<'data>(
+    header: &Header,
+    endian: Endianness,
+    bytes: &'data [u8],
+) -> Result<&'data str, Report<ReleaseError>> {
+    let headers = header
+        .program_headers(endian, bytes)
+        .map_err(|error| malformed("ELF program headers", error))?;
+    let mut found = Vec::new();
+    for segment in headers {
+        if let Some(path) = segment
+            .interpreter(endian, bytes)
+            .map_err(|error| malformed("ELF PT_INTERP", error))?
+        {
+            found.push(path);
+        }
+    }
+    match found.as_slice() {
+        [path] => utf8(path, "ELF PT_INTERP"),
+        _ => Err(rejected(
+            Violation::Interpreter,
+            format!("expected exactly one PT_INTERP, found {}", found.len()),
+        )),
+    }
+}
+
+/// Returns `DT_NEEDED` names after cross-checking the dynamic section.
+fn dynamic_needed(
+    header: &Header,
+    endian: Endianness,
+    bytes: &[u8],
+    sections: &Sections<'_>,
+) -> Result<Vec<String>, Report<ReleaseError>> {
+    let segment = single_dynamic_segment(header, endian, bytes)?;
+    let mut dynamic_sections = sections
+        .iter()
+        .filter(|section| section.sh_type(endian) == format::SHT_DYNAMIC);
+    let (Some(section), None) = (dynamic_sections.next(), dynamic_sections.next()) else {
+        return Err(malformed(
+            "ELF dynamic section",
+            "expected exactly one SHT_DYNAMIC",
+        ));
+    };
+    if (section.sh_offset(endian), section.sh_size(endian)) != segment {
+        return Err(malformed(
+            "ELF dynamic section",
+            "does not match PT_DYNAMIC",
+        ));
+    }
+    let (entries, link) = section
+        .dynamic(endian, bytes)
+        .map_err(|error| malformed("ELF dynamic entries", error))?
+        .ok_or_else(|| malformed("ELF dynamic entries", "missing"))?;
+    let strings = linked_strings(endian, bytes, sections, link)?;
+    let strtab_address = sections
+        .section(link)
+        .map_err(|error| malformed("ELF dynamic string table", error))?
+        .sh_addr(endian);
+    read_dynamic_entries(entries, endian, strings, strtab_address)
+}
+
+/// Returns `(p_offset, p_filesz)` of the single `PT_DYNAMIC` segment.
+fn single_dynamic_segment(
+    header: &Header,
+    endian: Endianness,
+    bytes: &[u8],
+) -> Result<(u64, u64), Report<ReleaseError>> {
+    let headers = header
+        .program_headers(endian, bytes)
+        .map_err(|error| malformed("ELF program headers", error))?;
+    let mut dynamic = headers
+        .iter()
+        .filter(|segment| segment.p_type(endian) == format::PT_DYNAMIC);
+    match (dynamic.next(), dynamic.next()) {
+        (Some(segment), None) => Ok((segment.p_offset(endian), segment.p_filesz(endian))),
+        _ => Err(rejected(
+            Violation::Interpreter,
+            "expected exactly one PT_DYNAMIC: not a dynamically linked executable",
+        )),
+    }
+}
+
+/// Reads the dynamic entries up to `DT_NULL`.
+fn read_dynamic_entries(
+    entries: &[format::Dyn64<Endianness>],
+    endian: Endianness,
+    strings: StringTable<'_>,
+    strtab_address: u64,
+) -> Result<Vec<String>, Report<ReleaseError>> {
+    let mut needed = Vec::new();
+    let mut strtab = None;
+    let mut terminated = false;
+    for entry in entries {
+        let tag = entry.tag32(endian);
+        match tag {
+            Some(format::DT_NULL) => {
+                terminated = true;
+                break;
+            }
+            Some(format::DT_STRTAB) => strtab = Some(entry.d_val(endian)),
+            Some(format::DT_NEEDED) => needed.push(dynamic_string(entry, endian, strings)?),
+            Some(format::DT_RPATH | format::DT_RUNPATH) => {
+                let path = dynamic_string(entry, endian, strings)?;
+                return Err(rejected(
+                    Violation::SearchPath,
+                    format!("DT_RPATH/DT_RUNPATH {path:?}"),
+                ));
+            }
+            Some(
+                format::DT_AUXILIARY | format::DT_FILTER | format::DT_AUDIT | format::DT_DEPAUDIT,
+            ) => {
+                return Err(rejected(
+                    Violation::Library,
+                    "additional loader library mechanism present",
+                ));
+            }
+            _ => {}
+        }
+    }
+    if !terminated || strtab != Some(strtab_address) {
+        return Err(malformed(
+            "ELF dynamic string table",
+            "DT_STRTAB does not match the linked section",
+        ));
+    }
+    Ok(needed)
+}
+
+/// Decodes a string-valued dynamic entry.
+fn dynamic_string(
+    entry: &format::Dyn64<Endianness>,
+    endian: Endianness,
+    strings: StringTable<'_>,
+) -> Result<String, Report<ReleaseError>> {
+    let raw = entry
+        .string(endian, strings)
+        .map_err(|error| malformed("ELF dynamic string", error))?;
+    utf8(raw, "ELF dynamic string").map(str::to_owned)
+}
+
+/// Returns the string table linked from a section.
+fn linked_strings<'data>(
+    endian: Endianness,
+    bytes: &'data [u8],
+    sections: &Sections<'data>,
+    link: SectionIndex,
+) -> Result<StringTable<'data>, Report<ReleaseError>> {
+    if link == SectionIndex(0) {
+        return Err(malformed("ELF string table", "missing link"));
+    }
+    sections
+        .strings(endian, bytes, link)
+        .map_err(|error| malformed("ELF string table", error))
+}
+
+/// Returns every `.gnu.version_r` requirement, sorted and de-duplicated.
+fn version_requirements(
+    endian: Endianness,
+    bytes: &[u8],
+    sections: &Sections<'_>,
+) -> Result<Vec<VersionRequirement>, Report<ReleaseError>> {
+    let (mut needs, link) = sections
+        .gnu_verneed(endian, bytes)
+        .map_err(|error| malformed("ELF version requirements", error))?
+        .ok_or_else(|| {
+            rejected(
+                Violation::SymbolVersion,
+                "no .gnu.version_r: the glibc ceiling cannot be checked",
+            )
+        })?;
+    let strings = linked_strings(endian, bytes, sections, link)?;
+    let mut found = BTreeSet::new();
+    let parse_error = |error| malformed("ELF version requirement", error);
+    while let Some((need, mut auxiliaries)) = needs.next().map_err(parse_error)? {
+        let file = utf8(
+            need.file(endian, strings).map_err(parse_error)?,
+            "ELF vn_file",
+        )?;
+        while let Some(auxiliary) = auxiliaries.next().map_err(parse_error)? {
+            let name = utf8(
+                auxiliary.name(endian, strings).map_err(parse_error)?,
+                "ELF vna_name",
+            )?;
+            found.insert(VersionRequirement {
+                file: file.to_owned(),
+                name: name.to_owned(),
+            });
+        }
+    }
+    Ok(found.into_iter().collect())
+}
+
+/// Checks every requirement and returns the highest `GLIBC_` version.
+fn check_versions(
+    requirements: &[VersionRequirement],
+    needed: &[String],
+    maximum: GlibcVersion,
+) -> Result<GlibcVersion, Report<ReleaseError>> {
+    let mut highest = None;
+    for requirement in requirements {
+        if !needed.contains(&requirement.file) {
+            return Err(rejected(
+                Violation::SymbolVersion,
+                format!(
+                    "version requirement on {:?}, which is not DT_NEEDED",
+                    requirement.file
+                ),
+            ));
+        }
+        if let Some(version) = glibc_requirement(requirement)? {
+            if version > maximum {
+                return Err(rejected(
+                    Violation::SymbolVersion,
+                    format!(
+                        "{} requires GLIBC_{version} > ceiling {maximum}",
+                        requirement.file
+                    ),
+                ));
+            }
+            highest = highest.max(Some(version));
+        }
+    }
+    highest.ok_or_else(|| {
+        rejected(
+            Violation::SymbolVersion,
+            "no GLIBC_ requirement was observed",
+        )
+    })
+}
+
+/// Classifies one requirement: a parsed `GLIBC_` version, an accepted
+/// non-glibc name (`None`), or a rejection.
+fn glibc_requirement(
+    requirement: &VersionRequirement,
+) -> Result<Option<GlibcVersion>, Report<ReleaseError>> {
+    if let Some(suffix) = requirement.name.strip_prefix(GLIBC_PREFIX) {
+        return GlibcVersion::parse(suffix).map(Some).ok_or_else(|| {
+            rejected(
+                Violation::SymbolVersion,
+                format!(
+                    "unparsable version {:?} from {:?}",
+                    requirement.name, requirement.file
+                ),
+            )
+        });
+    }
+    let accepted = OTHER_VERSION_PREFIXES
+        .iter()
+        .any(|(file, prefix)| requirement.file == *file && requirement.name.starts_with(prefix));
+    if accepted {
+        Ok(None)
+    } else {
+        Err(rejected(
+            Violation::SymbolVersion,
+            format!(
+                "unexpected version {:?} from {:?}",
+                requirement.name, requirement.file
+            ),
+        ))
+    }
+}
diff --git a/crates/trusted-server-release/src/inspect/elf/loader.rs b/crates/trusted-server-release/src/inspect/elf/loader.rs
new file mode 100644
index 0000000000..83d9339682
--- /dev/null
+++ b/crates/trusted-server-release/src/inspect/elf/loader.rs
@@ -0,0 +1,301 @@
+//! Binds section observations to the bytes selected by the ELF loader.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use error_stack::Report;
+use object::Endianness;
+use object::elf as format;
+use object::read::elf::{Dyn as _, FileHeader as _, ProgramHeader as _, SectionHeader as _};
+
+use super::{Header, Sections};
+use crate::error::ReleaseError;
+use crate::inspect::{Violation, malformed, rejected};
+
+type Section = format::SectionHeader64<Endianness>;
+
+fn invalid(detail: impl std::fmt::Display) -> Report<ReleaseError> {
+    malformed("ELF loader metadata", detail)
+}
+
+fn unique_section<'a>(
+    sections: &'a Sections<'_>,
+    endian: Endianness,
+    kind: u32,
+) -> Result<(usize, &'a Section), Report<ReleaseError>> {
+    let mut found = sections
+        .iter()
+        .enumerate()
+        .filter(|(_, section)| section.sh_type(endian) == kind);
+    match (found.next(), found.next()) {
+        (Some(section), None) => Ok(section),
+        _ => Err(invalid(format!("expected one section of type {kind}"))),
+    }
+}
+
+/// Resolves an entire virtual range through exactly one file-backed load.
+fn mapped_offset(
+    header: &Header,
+    endian: Endianness,
+    bytes: &[u8],
+    address: u64,
+    size: u64,
+) -> Result<u64, Report<ReleaseError>> {
+    let end = address
+        .checked_add(size)
+        .ok_or_else(|| invalid("address overflow"))?;
+    let programs = header.program_headers(endian, bytes).map_err(invalid)?;
+    let mut offsets = Vec::new();
+    for program in programs {
+        if program.p_type(endian) != format::PT_LOAD {
+            continue;
+        }
+        let start = program.p_vaddr(endian);
+        let limit = start
+            .checked_add(program.p_filesz(endian))
+            .ok_or_else(|| invalid("segment overflow"))?;
+        let memory_end = start
+            .checked_add(program.p_memsz(endian))
+            .ok_or_else(|| invalid("memory range overflow"))?;
+        // Linux x86_64 mappings include whole 4 KiB pages. A second segment
+        // can replace an earlier segment's bytes even before its nominal
+        // start, or zero-fill them after its file-backed portion.
+        let page_start = start & !4095;
+        let page_end = memory_end
+            .checked_add(4095)
+            .ok_or_else(|| invalid("page range overflow"))?
+            & !4095;
+        if program.p_filesz(endian) > program.p_memsz(endian) {
+            return Err(invalid("load file size exceeds its memory size"));
+        }
+        if page_start < end && page_end > address {
+            if address < start || end > limit {
+                return Err(invalid("load mapping partially overlaps observed metadata"));
+            }
+            let offset = program
+                .p_offset(endian)
+                .checked_add(address - start)
+                .ok_or_else(|| invalid("file offset overflow"))?;
+            let file_end = offset
+                .checked_add(size)
+                .ok_or_else(|| invalid("file range overflow"))?;
+            if file_end > bytes.len() as u64 || program.p_filesz(endian) > program.p_memsz(endian) {
+                return Err(invalid("load range exceeds file or memory"));
+            }
+            offsets.push(offset);
+        }
+    }
+    match offsets.as_slice() {
+        [offset] => Ok(*offset),
+        _ => Err(invalid(
+            "virtual range has no unique file-backed load mapping",
+        )),
+    }
+}
+
+fn required(tags: &BTreeMap<u32, u64>, tag: u32) -> Result<u64, Report<ReleaseError>> {
+    tags.get(&tag)
+        .copied()
+        .ok_or_else(|| invalid(format!("missing dynamic tag {tag}")))
+}
+
+fn dynamic_tags(
+    header: &Header,
+    endian: Endianness,
+    bytes: &[u8],
+    sections: &Sections<'_>,
+) -> Result<BTreeMap<u32, u64>, Report<ReleaseError>> {
+    let (_, section) = unique_section(sections, endian, format::SHT_DYNAMIC)?;
+    let programs = header.program_headers(endian, bytes).map_err(invalid)?;
+    let mut segments = programs
+        .iter()
+        .filter(|program| program.p_type(endian) == format::PT_DYNAMIC);
+    let (Some(segment), None) = (segments.next(), segments.next()) else {
+        return Err(invalid("expected one dynamic segment"));
+    };
+    if mapped_offset(
+        header,
+        endian,
+        bytes,
+        segment.p_vaddr(endian),
+        segment.p_filesz(endian),
+    )? != section.sh_offset(endian)
+        || segment.p_offset(endian) != section.sh_offset(endian)
+        || segment.p_filesz(endian) != section.sh_size(endian)
+    {
+        return Err(invalid("dynamic section differs from loader range"));
+    }
+    let (entries, _) = section
+        .dynamic(endian, bytes)
+        .map_err(invalid)?
+        .ok_or_else(|| invalid("missing dynamic entries"))?;
+    let mut tags = BTreeMap::new();
+    for entry in entries {
+        let tag = entry
+            .tag32(endian)
+            .ok_or_else(|| invalid("unsupported dynamic tag width"))?;
+        if tag == format::DT_NULL {
+            return Ok(tags);
+        }
+        if matches!(
+            tag,
+            format::DT_AUDIT | format::DT_DEPAUDIT | format::DT_AUXILIARY | format::DT_FILTER
+        ) {
+            return Err(rejected(
+                Violation::Library,
+                "additional loader library mechanism",
+            ));
+        }
+        if tag != format::DT_NEEDED && tags.insert(tag, entry.d_val(endian)).is_some() {
+            return Err(invalid(format!("duplicate dynamic singleton {tag}")));
+        }
+    }
+    Err(invalid("dynamic table has no terminator"))
+}
+
+fn check_section(
+    header: &Header,
+    endian: Endianness,
+    bytes: &[u8],
+    section: &Section,
+    address: u64,
+) -> Result<(), Report<ReleaseError>> {
+    if section.sh_addr(endian) != address
+        || mapped_offset(header, endian, bytes, address, section.sh_size(endian))?
+            != section.sh_offset(endian)
+    {
+        return Err(invalid("section differs from loader-selected bytes"));
+    }
+    Ok(())
+}
+
+pub(super) fn validate(
+    header: &Header,
+    endian: Endianness,
+    bytes: &[u8],
+    sections: &Sections<'_>,
+) -> Result<(), Report<ReleaseError>> {
+    let tags = dynamic_tags(header, endian, bytes, sections)?;
+    let (_, dynamic) = unique_section(sections, endian, format::SHT_DYNAMIC)?;
+    let string_index = dynamic.sh_link(endian) as usize;
+    let strings = sections
+        .iter()
+        .nth(string_index)
+        .ok_or_else(|| invalid("missing dynamic strings"))?;
+    if strings.sh_type(endian) != format::SHT_STRTAB
+        || strings.sh_size(endian) != required(&tags, format::DT_STRSZ)?
+    {
+        return Err(invalid("dynamic string table type or length mismatch"));
+    }
+    check_section(
+        header,
+        endian,
+        bytes,
+        strings,
+        required(&tags, format::DT_STRTAB)?,
+    )?;
+    let (_, needs) = unique_section(sections, endian, format::SHT_GNU_VERNEED)?;
+    check_section(
+        header,
+        endian,
+        bytes,
+        needs,
+        required(&tags, format::DT_VERNEED)?,
+    )?;
+    if u64::from(needs.sh_info(endian)) != required(&tags, format::DT_VERNEEDNUM)?
+        || needs.sh_link(endian) as usize != string_index
+    {
+        return Err(invalid("version requirement count or strings mismatch"));
+    }
+    validate_symbols(header, endian, bytes, sections, &tags, string_index)
+}
+
+fn validate_symbols(
+    header: &Header,
+    endian: Endianness,
+    bytes: &[u8],
+    sections: &Sections<'_>,
+    tags: &BTreeMap<u32, u64>,
+    string_index: usize,
+) -> Result<(), Report<ReleaseError>> {
+    let (symbol_index, symbols) = unique_section(sections, endian, format::SHT_DYNSYM)?;
+    let (_, versions) = unique_section(sections, endian, format::SHT_GNU_VERSYM)?;
+    check_section(
+        header,
+        endian,
+        bytes,
+        symbols,
+        required(tags, format::DT_SYMTAB)?,
+    )?;
+    check_section(
+        header,
+        endian,
+        bytes,
+        versions,
+        required(tags, format::DT_VERSYM)?,
+    )?;
+    if required(tags, format::DT_SYMENT)? != 24
+        || symbols.sh_entsize(endian) != 24
+        || !symbols.sh_size(endian).is_multiple_of(24)
+        || symbols.sh_size(endian) < 24
+        || symbols.sh_link(endian) as usize != string_index
+        || versions.sh_link(endian) as usize != symbol_index
+        || versions.sh_size(endian) != symbols.sh_size(endian) / 12
+    {
+        return Err(invalid("dynamic symbol/version table shape mismatch"));
+    }
+    let indices = requirement_indices(
+        endian,
+        bytes,
+        sections,
+        required(tags, format::DT_VERNEEDNUM)?,
+    )?;
+    let symbol_bytes = symbols.data(endian, bytes).map_err(invalid)?;
+    let version_bytes = versions.data(endian, bytes).map_err(invalid)?;
+    for (symbol, version) in symbol_bytes
+        .as_chunks::<24>()
+        .0
+        .iter()
+        .zip(version_bytes.as_chunks::<2>().0)
+    {
+        let index = u16::from_le_bytes([version[0], version[1]]) & 0x7fff;
+        let undefined = u16::from_le_bytes([symbol[6], symbol[7]]) == format::SHN_UNDEF;
+        if undefined && index > 1 && !indices.contains(&index) {
+            return Err(invalid(
+                "undefined symbol references an unaccounted version",
+            ));
+        }
+    }
+    Ok(())
+}
+
+fn requirement_indices(
+    endian: Endianness,
+    bytes: &[u8],
+    sections: &Sections<'_>,
+    expected: u64,
+) -> Result<BTreeSet<u16>, Report<ReleaseError>> {
+    let (mut needs, _) = sections
+        .gnu_verneed(endian, bytes)
+        .map_err(invalid)?
+        .ok_or_else(|| invalid("missing version requirements"))?;
+    let mut count = 0;
+    let mut indices = BTreeSet::new();
+    while let Some((need, mut auxiliary)) = needs.next().map_err(invalid)? {
+        count += 1;
+        let mut auxiliary_count = 0;
+        while let Some(version) = auxiliary.next().map_err(invalid)? {
+            auxiliary_count += 1;
+            let index = version.vna_other.get(endian) & 0x7fff;
+            if index <= 1 || !indices.insert(index) {
+                return Err(invalid("ambiguous version requirement index"));
+            }
+        }
+        if auxiliary_count != need.vn_cnt.get(endian) || auxiliary_count == 0 {
+            return Err(invalid("version auxiliary count mismatch"));
+        }
+    }
+    if count != expected {
+        return Err(invalid("version requirement count mismatch"));
+    }
+    Ok(indices)
+}
diff --git a/crates/trusted-server-release/src/inspect/macho.rs b/crates/trusted-server-release/src/inspect/macho.rs
new file mode 100644
index 0000000000..96dc8a8e57
--- /dev/null
+++ b/crates/trusted-server-release/src/inspect/macho.rs
@@ -0,0 +1,438 @@
+//! Mach-O inspection for thin 64-bit macOS executables.
+//!
+//! Beyond identity, loader and libraries, the inspector records the
+//! `LC_UUID`, the symbol table and its debug map, and the code signature
+//! form. Every `N_OSO` debug-map object path must be relative and carry a
+//! zero modification time (the recipe links with `-oso_prefix` and
+//! `ZERO_AR_DATE=1`). An arm64 executable must carry the linker's ad-hoc
+//! signature, which macOS requires to run it; an `x86_64` executable may be
+//! unsigned or carry the same signature.
+
+mod signature;
+
+use error_stack::Report;
+use object::macho::{self as format, MachHeader64};
+use object::read::macho::{LoadCommandData, LoadCommandVariant, MachHeader as _, Nlist as _};
+use object::{Endianness, FileKind};
+
+use super::{
+    MachoFacts, MacosVersion, RUNNER_PATH_PREFIXES, Violation, malformed, reject_denied_paths,
+    rejected, sha256_hex, utf8,
+};
+use crate::error::ReleaseError;
+
+type Header = MachHeader64<Endianness>;
+
+/// The only dynamic linker a macOS executable may name.
+const MACOS_DYLINKER: &str = "/usr/lib/dyld";
+
+/// Reviewed `LC_LOAD_DYLIB` set for the `ts` CLI.
+///
+/// Observed with `otool -L` on a local `aarch64-apple-darwin` dev build of
+/// `trusted-server-cli`: Security and CoreFoundation (via
+/// `security-framework`), libiconv and libSystem.
+const MACOS_DYLIBS: &[&str] = &[
+    "/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation",
+    "/System/Library/Frameworks/Security.framework/Versions/A/Security",
+    "/usr/lib/libSystem.B.dylib",
+    "/usr/lib/libiconv.2.dylib",
+];
+
+/// Selected macOS CPU type.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, derive_more::Display)]
+pub(crate) enum MachoCpu {
+    /// `aarch64-apple-darwin` (`CPU_SUBTYPE_ARM64_ALL`; arm64e is rejected).
+    #[display("arm64")]
+    Arm64,
+    /// `x86_64-apple-darwin` (`CPU_SUBTYPE_X86_64_ALL`).
+    #[display("x86_64")]
+    X86_64,
+}
+
+impl MachoCpu {
+    /// Returns the expected `(cputype, cpusubtype & !CPU_SUBTYPE_MASK)`.
+    const fn expected(self) -> (u32, u32) {
+        match self {
+            Self::Arm64 => (format::CPU_TYPE_ARM64, format::CPU_SUBTYPE_ARM64_ALL),
+            Self::X86_64 => (format::CPU_TYPE_X86_64, format::CPU_SUBTYPE_X86_64_ALL),
+        }
+    }
+}
+
+/// Compiled-in Mach-O acceptance policy.
+#[derive(Debug, Clone)]
+pub(crate) struct MachoPolicy {
+    pub(crate) cpu: MachoCpu,
+    pub(crate) minimum: MacosVersion,
+    pub(crate) allowed_dylibs: &'static [&'static str],
+    pub(crate) denied_path_prefixes: &'static [&'static str],
+}
+
+impl MachoPolicy {
+    /// The reviewed macOS policy for `cpu`: deployment target exactly 13.0.
+    pub(crate) const fn macos(cpu: MachoCpu) -> Self {
+        Self {
+            cpu,
+            minimum: MacosVersion::new(13, 0),
+            allowed_dylibs: MACOS_DYLIBS,
+            denied_path_prefixes: RUNNER_PATH_PREFIXES,
+        }
+    }
+}
+
+/// The code signature form an accepted executable carries.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, derive_more::Display)]
+pub(crate) enum CodeSignature {
+    /// No `LC_CODE_SIGNATURE`; accepted for `x86_64` only.
+    #[display("unsigned")]
+    Unsigned,
+    /// The linker's ad-hoc signature: one code directory with flags
+    /// `0x20002`, no CMS blob and no team identifier.
+    #[display("linker-signed-ad-hoc")]
+    LinkerSignedAdhoc,
+}
+
+/// Symbol table counts after every debug-map entry was checked.
+#[derive(Default)]
+struct SymbolSummary {
+    symbols: usize,
+    debug_map_objects: usize,
+}
+
+/// Load-command observations accumulated before policy checks.
+#[derive(Default)]
+struct Observed {
+    build_versions: Vec<(u32, MacosVersion, MacosVersion)>,
+    dylinkers: Vec<String>,
+    dylibs: Vec<String>,
+    uuids: Vec<[u8; 16]>,
+    symbol_tables: Vec<SymbolSummary>,
+    signatures: Vec<(u32, u32)>,
+}
+
+/// Inspects a final Mach-O executable against `policy`.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Inspect`] with a [`Violation`] when the bytes are
+/// fat, 32-bit, big-endian or not `MH_EXECUTE`; the CPU differs; there is
+/// not exactly one macOS `LC_BUILD_VERSION` with `minos` equal to the floor
+/// (or an `LC_VERSION_MIN_*` is present); the dynamic linker is not
+/// `/usr/lib/dyld`; a dylib is outside the allowlist or loaded weak,
+/// re-exported, lazy or upward; `LC_RPATH`/`LC_DYLD_ENVIRONMENT` is present;
+/// a runner-only path is embedded anywhere in the file; a debug-map object
+/// path is absolute or time-stamped; there is not exactly one `LC_UUID`
+/// (the linker always writes one); `LC_SYMTAB` or `LC_CODE_SIGNATURE` is
+/// duplicated; the code signature is not the linker's ad-hoc form; or an
+/// arm64 executable is unsigned.
+pub(crate) fn inspect_macho(
+    bytes: &[u8],
+    policy: &MachoPolicy,
+) -> Result<MachoFacts, Report<ReleaseError>> {
+    check_container(bytes)?;
+    let header = Header::parse(bytes, 0).map_err(|error| malformed("Mach-O header", error))?;
+    let endian = header
+        .endian()
+        .map_err(|error| malformed("Mach-O endianness", error))?;
+    check_identity(header, endian, policy.cpu)?;
+    let mut observed = load_commands(header, endian, bytes)?;
+    let (minos, sdk) = deployment_target(&observed, policy.minimum)?;
+    if observed.dylinkers.as_slice() != [MACOS_DYLINKER] {
+        return Err(rejected(
+            Violation::Interpreter,
+            format!(
+                "LC_LOAD_DYLINKER {:?}, expected [{MACOS_DYLINKER:?}]",
+                observed.dylinkers
+            ),
+        ));
+    }
+    if let Some(name) = observed
+        .dylibs
+        .iter()
+        .find(|name| !policy.allowed_dylibs.contains(&name.as_str()))
+    {
+        return Err(rejected(
+            Violation::Library,
+            format!("LC_LOAD_DYLIB {name:?}"),
+        ));
+    }
+    reject_denied_paths(bytes, policy.denied_path_prefixes)?;
+    let signature = code_signature(&observed, bytes, policy.cpu)?;
+    let [uuid] = observed.uuids.as_slice() else {
+        return Err(rejected(
+            Violation::MachoIdentity,
+            format!(
+                "expected exactly one LC_UUID, found {}",
+                observed.uuids.len()
+            ),
+        ));
+    };
+    let uuid = *uuid;
+    let summary = match observed.symbol_tables.as_mut_slice() {
+        [] => SymbolSummary::default(),
+        [summary] => std::mem::take(summary),
+        _ => {
+            return Err(rejected(
+                Violation::MachoDebugMap,
+                "more than one LC_SYMTAB",
+            ));
+        }
+    };
+    Ok(MachoFacts {
+        sha256: sha256_hex(bytes),
+        loader: observed
+            .dylinkers
+            .pop()
+            .expect("should retain the validated dynamic linker"),
+        cpu: policy.cpu,
+        minos,
+        sdk,
+        dylibs: observed.dylibs,
+        uuid,
+        symbols: summary.symbols,
+        debug_map_objects: summary.debug_map_objects,
+        signature,
+    })
+}
+
+/// Classifies the code signature and applies the per-CPU requirement.
+fn code_signature(
+    observed: &Observed,
+    bytes: &[u8],
+    cpu: MachoCpu,
+) -> Result<CodeSignature, Report<ReleaseError>> {
+    let signature = match observed.signatures.as_slice() {
+        [] => CodeSignature::Unsigned,
+        [(offset, size)] => {
+            let start = usize::try_from(*offset).ok();
+            let end = start.and_then(|start| start.checked_add(usize::try_from(*size).ok()?));
+            let blob = start
+                .zip(end)
+                .and_then(|(start, end)| bytes.get(start..end))
+                .ok_or_else(|| {
+                    rejected(
+                        Violation::CodeSignature,
+                        "LC_CODE_SIGNATURE data lies outside the file",
+                    )
+                })?;
+            signature::check_linker_signed(blob)?;
+            CodeSignature::LinkerSignedAdhoc
+        }
+        _ => {
+            return Err(rejected(
+                Violation::CodeSignature,
+                "more than one LC_CODE_SIGNATURE",
+            ));
+        }
+    };
+    if cpu == MachoCpu::Arm64 && signature == CodeSignature::Unsigned {
+        return Err(rejected(
+            Violation::CodeSignature,
+            "an arm64 executable must carry the linker's ad-hoc signature",
+        ));
+    }
+    Ok(signature)
+}
+
+/// Counts the symbol table, requiring every `N_OSO` debug-map entry to name
+/// a non-empty relative UTF-8 path with a zero modification time.
+fn symbol_summary(
+    symtab: &format::SymtabCommand<Endianness>,
+    endian: Endianness,
+    bytes: &[u8],
+) -> Result<SymbolSummary, Report<ReleaseError>> {
+    let parse_error = |error| malformed("Mach-O symbol table", error);
+    // The parser rejects an empty slice it cannot align, so an empty table
+    // is counted without reading it.
+    if symtab.nsyms.get(endian) == 0 {
+        return Ok(SymbolSummary::default());
+    }
+    let table = symtab
+        .symbols::<Header, _>(endian, bytes)
+        .map_err(parse_error)?;
+    let mut summary = SymbolSummary::default();
+    for symbol in table.iter() {
+        summary.symbols += 1;
+        if symbol.n_type() != format::N_OSO {
+            continue;
+        }
+        let name = symbol.name(endian, table.strings()).map_err(parse_error)?;
+        let name = utf8(name, "Mach-O debug-map object")?;
+        if name.is_empty() || name.starts_with('/') {
+            return Err(rejected(
+                Violation::MachoDebugMap,
+                format!("debug-map object {name:?} is not a relative path"),
+            ));
+        }
+        let modified = symbol.n_value(endian);
+        if modified != 0 {
+            return Err(rejected(
+                Violation::MachoDebugMap,
+                format!("debug-map object {name:?} records modification time {modified}"),
+            ));
+        }
+        summary.debug_map_objects += 1;
+    }
+    Ok(summary)
+}
+
+/// Requires a thin 64-bit Mach-O container.
+fn check_container(bytes: &[u8]) -> Result<(), Report<ReleaseError>> {
+    match FileKind::parse(bytes) {
+        Ok(FileKind::MachO64) => Ok(()),
+        Ok(kind @ (FileKind::MachO32 | FileKind::MachOFat32 | FileKind::MachOFat64)) => {
+            Err(rejected(
+                Violation::Architecture,
+                format!("{kind:?}; expected thin 64-bit Mach-O"),
+            ))
+        }
+        Ok(kind) => Err(malformed("Mach-O container", format!("{kind:?}"))),
+        Err(error) => Err(malformed("Mach-O container", error)),
+    }
+}
+
+/// Requires a little-endian `MH_EXECUTE` for the selected CPU.
+fn check_identity(
+    header: &Header,
+    endian: Endianness,
+    cpu: MachoCpu,
+) -> Result<(), Report<ReleaseError>> {
+    let observed = (
+        header.cputype(endian),
+        header.cpusubtype(endian) & !format::CPU_SUBTYPE_MASK,
+    );
+    let file_type = header.filetype(endian);
+    if endian != Endianness::Little || observed != cpu.expected() || file_type != format::MH_EXECUTE
+    {
+        return Err(rejected(
+            Violation::Architecture,
+            format!(
+                "Mach-O {endian:?} cpu {:#x}/{:#x} filetype {file_type}; expected little-endian \
+                 {cpu} MH_EXECUTE",
+                observed.0, observed.1
+            ),
+        ));
+    }
+    Ok(())
+}
+
+/// Walks every load command, rejecting forbidden kinds immediately.
+fn load_commands(
+    header: &Header,
+    endian: Endianness,
+    bytes: &[u8],
+) -> Result<Observed, Report<ReleaseError>> {
+    let parse_error = |error| malformed("Mach-O load command", error);
+    let mut commands = header
+        .load_commands(endian, bytes, 0)
+        .map_err(parse_error)?;
+    let mut observed = Observed::default();
+    while let Some(command) = commands.next().map_err(parse_error)? {
+        record_command(&command, endian, bytes, &mut observed)?;
+    }
+    Ok(observed)
+}
+
+/// Records or rejects one load command.
+fn record_command(
+    command: &LoadCommandData<'_, Endianness>,
+    endian: Endianness,
+    bytes: &[u8],
+    observed: &mut Observed,
+) -> Result<(), Report<ReleaseError>> {
+    let parse_error = |error| malformed("Mach-O load command", error);
+    match command.variant().map_err(parse_error)? {
+        LoadCommandVariant::Uuid(uuid) => observed.uuids.push(uuid.uuid),
+        LoadCommandVariant::Symtab(symtab) => observed
+            .symbol_tables
+            .push(symbol_summary(symtab, endian, bytes)?),
+        LoadCommandVariant::LinkeditData(data) if command.cmd() == format::LC_CODE_SIGNATURE => {
+            observed
+                .signatures
+                .push((data.dataoff.get(endian), data.datasize.get(endian)));
+        }
+        LoadCommandVariant::BuildVersion(build) => observed.build_versions.push((
+            build.platform.get(endian),
+            MacosVersion::from_encoded(build.minos.get(endian)),
+            MacosVersion::from_encoded(build.sdk.get(endian)),
+        )),
+        LoadCommandVariant::LoadDylinker(dylinker) => {
+            let name = command.string(endian, dylinker.name).map_err(parse_error)?;
+            observed
+                .dylinkers
+                .push(utf8(name, "Mach-O dylinker")?.to_owned());
+        }
+        LoadCommandVariant::Dylib(dylib) => {
+            let name = command
+                .string(endian, dylib.dylib.name)
+                .map_err(parse_error)?;
+            observed.dylibs.push(plain_dylib(command.cmd(), name)?);
+        }
+        LoadCommandVariant::Rpath(rpath) => {
+            let path = command.string(endian, rpath.path).map_err(parse_error)?;
+            return Err(rejected(
+                Violation::SearchPath,
+                format!("LC_RPATH {:?}", String::from_utf8_lossy(path)),
+            ));
+        }
+        other => reject_forbidden(&other)?,
+    }
+    Ok(())
+}
+
+/// Rejects load commands that carry no string but are never acceptable in a
+/// release executable.
+fn reject_forbidden(
+    variant: &LoadCommandVariant<'_, Endianness>,
+) -> Result<(), Report<ReleaseError>> {
+    let (violation, detail) = match variant {
+        LoadCommandVariant::VersionMin(_) => {
+            (Violation::DeploymentTarget, "LC_VERSION_MIN_* present")
+        }
+        LoadCommandVariant::IdDylib(_) | LoadCommandVariant::PreboundDylib(_) => {
+            (Violation::LinkKind, "dylib identity in an executable")
+        }
+        LoadCommandVariant::DyldEnvironment(_) => {
+            (Violation::SearchPath, "LC_DYLD_ENVIRONMENT present")
+        }
+        _ => return Ok(()),
+    };
+    Err(rejected(violation, detail))
+}
+
+/// Returns the install name of a plain `LC_LOAD_DYLIB`; weak, re-exported,
+/// lazy and upward loads are rejected.
+fn plain_dylib(cmd: u32, name: &[u8]) -> Result<String, Report<ReleaseError>> {
+    let name = utf8(name, "Mach-O dylib")?;
+    if cmd != format::LC_LOAD_DYLIB {
+        return Err(rejected(
+            Violation::LinkKind,
+            format!("load command {cmd:#x} for {name:?}"),
+        ));
+    }
+    Ok(name.to_owned())
+}
+
+/// Requires exactly one macOS `LC_BUILD_VERSION` whose `minos` equals the
+/// floor; returns `(minos, sdk)`.
+fn deployment_target(
+    observed: &Observed,
+    minimum: MacosVersion,
+) -> Result<(MacosVersion, MacosVersion), Report<ReleaseError>> {
+    let [(platform, minos, sdk)] = observed.build_versions.as_slice() else {
+        return Err(rejected(
+            Violation::DeploymentTarget,
+            format!(
+                "expected exactly one LC_BUILD_VERSION, found {}",
+                observed.build_versions.len()
+            ),
+        ));
+    };
+    if *platform != format::PLATFORM_MACOS || *minos != minimum {
+        return Err(rejected(
+            Violation::DeploymentTarget,
+            format!("platform {platform} minos {minos}; expected macOS minos {minimum}"),
+        ));
+    }
+    Ok((*minos, *sdk))
+}
diff --git a/crates/trusted-server-release/src/inspect/macho/signature.rs b/crates/trusted-server-release/src/inspect/macho/signature.rs
new file mode 100644
index 0000000000..f6b0b7cf6f
--- /dev/null
+++ b/crates/trusted-server-release/src/inspect/macho/signature.rs
@@ -0,0 +1,164 @@
+//! Embedded code signature parsing for linker-signed ad-hoc executables.
+//!
+//! `ld` signs an arm64 executable ad hoc as it links it: a big-endian
+//! `SuperBlob` (`0xfade0cc0`) indexing one `CodeDirectory` (`0xfade0c02`)
+//! whose flags are exactly `CS_ADHOC | CS_LINKER_SIGNED` (`0x20002`), and at
+//! most one requirements blob, which must be the empty set (`0xfade0c01`,
+//! length 12, count 0). A `codesign` identity would add a CMS
+//! blob wrapper and a team identifier; both are rejected, as is any other
+//! slot. The hashes are not recomputed: this records the signature's form,
+//! not its validity, which the actual macOS startup exercises.
+
+use error_stack::Report;
+
+use super::super::{Violation, rejected};
+use crate::error::ReleaseError;
+
+/// Embedded signature `SuperBlob` magic.
+pub(crate) const CSMAGIC_EMBEDDED_SIGNATURE: u32 = 0xfade_0cc0;
+/// `CodeDirectory` blob magic.
+pub(crate) const CSMAGIC_CODEDIRECTORY: u32 = 0xfade_0c02;
+/// Slot of the primary `CodeDirectory`.
+pub(crate) const CSSLOT_CODEDIRECTORY: u32 = 0;
+/// Slot of the internal requirements blob.
+pub(crate) const CSSLOT_REQUIREMENTS: u32 = 2;
+/// Requirements set blob magic.
+pub(crate) const CSMAGIC_REQUIREMENTS: u32 = 0xfade_0c01;
+/// Length of a requirements set with no entries: magic, length and count.
+const EMPTY_REQUIREMENTS_LENGTH: u32 = 12;
+/// Slot of the CMS signature blob wrapper a signing identity adds.
+pub(crate) const CSSLOT_SIGNATURESLOT: u32 = 0x1_0000;
+/// `CS_ADHOC | CS_LINKER_SIGNED`, the only accepted directory flags.
+pub(crate) const LINKER_SIGNED_ADHOC: u32 = 0x2_0002;
+/// First `CodeDirectory` version carrying a team identifier offset.
+const SUPPORTS_TEAM_ID: u32 = 0x2_0200;
+/// Byte offset of the team identifier offset in a `CodeDirectory`.
+const TEAM_OFFSET_FIELD: usize = 48;
+/// Bytes of the `SuperBlob` header: magic, length and count.
+const SUPERBLOB_HEADER: usize = 12;
+/// Bytes of one `SuperBlob` index entry: slot type and offset.
+const INDEX_ENTRY: usize = 8;
+
+/// Reads a big-endian `u32` at `offset`.
+fn be_u32(bytes: &[u8], offset: usize) -> Option<u32> {
+    let end = offset.checked_add(4)?;
+    let word: [u8; 4] = bytes.get(offset..end)?.try_into().ok()?;
+    Some(u32::from_be_bytes(word))
+}
+
+fn signature_rejected(detail: impl std::fmt::Display) -> Report<ReleaseError> {
+    rejected(Violation::CodeSignature, detail)
+}
+
+/// Requires `blob`, the bytes `LC_CODE_SIGNATURE` names, to be exactly one
+/// linker-signed ad-hoc `CodeDirectory` with no CMS blob or team identifier.
+///
+/// # Errors
+///
+/// Returns [`Violation::CodeSignature`] for a malformed or truncated blob,
+/// another magic, a CMS signature slot, any slot other than the directory
+/// and requirements, not exactly one directory, other directory flags, a
+/// team identifier, or more than one or a non-empty requirements blob.
+pub(super) fn check_linker_signed(blob: &[u8]) -> Result<(), Report<ReleaseError>> {
+    let truncated = || signature_rejected("code signature is truncated");
+    if be_u32(blob, 0) != Some(CSMAGIC_EMBEDDED_SIGNATURE) {
+        return Err(signature_rejected(
+            "code signature is not an embedded SuperBlob",
+        ));
+    }
+    let length = be_u32(blob, 4)
+        .and_then(|length| usize::try_from(length).ok())
+        .filter(|length| (SUPERBLOB_HEADER..=blob.len()).contains(length))
+        .ok_or_else(truncated)?;
+    let blob = &blob[..length];
+    let count = be_u32(blob, 8)
+        .and_then(|count| usize::try_from(count).ok())
+        .ok_or_else(truncated)?;
+    let index_end = count
+        .checked_mul(INDEX_ENTRY)
+        .and_then(|bytes| bytes.checked_add(SUPERBLOB_HEADER))
+        .filter(|end| *end <= blob.len())
+        .ok_or_else(truncated)?;
+    let mut directories = 0_usize;
+    let mut requirements = 0_usize;
+    for entry in (SUPERBLOB_HEADER..index_end).step_by(INDEX_ENTRY) {
+        let slot = be_u32(blob, entry).ok_or_else(truncated)?;
+        let offset = be_u32(blob, entry + 4)
+            .and_then(|offset| usize::try_from(offset).ok())
+            .ok_or_else(truncated)?;
+        match slot {
+            CSSLOT_CODEDIRECTORY => {
+                directories += 1;
+                check_directory(blob.get(offset..).ok_or_else(truncated)?)?;
+            }
+            CSSLOT_REQUIREMENTS => {
+                requirements += 1;
+                check_empty_requirements(blob.get(offset..).ok_or_else(truncated)?)?;
+            }
+            CSSLOT_SIGNATURESLOT => {
+                return Err(signature_rejected(
+                    "code signature carries a CMS signature, not a linker ad-hoc signature",
+                ));
+            }
+            other => {
+                return Err(signature_rejected(format!(
+                    "code signature holds unexpected slot {other:#x}"
+                )));
+            }
+        }
+    }
+    if directories != 1 {
+        return Err(signature_rejected(format!(
+            "code signature holds {directories} code directories, expected exactly one"
+        )));
+    }
+    if requirements > 1 {
+        return Err(signature_rejected(
+            "code signature holds more than one requirements blob",
+        ));
+    }
+    Ok(())
+}
+
+/// Requires an empty requirements set: magic `0xfade0c01`, length 12 and
+/// a zero count.
+fn check_empty_requirements(requirements: &[u8]) -> Result<(), Report<ReleaseError>> {
+    let empty = be_u32(requirements, 0) == Some(CSMAGIC_REQUIREMENTS)
+        && be_u32(requirements, 4) == Some(EMPTY_REQUIREMENTS_LENGTH)
+        && be_u32(requirements, 8) == Some(0);
+    if !empty {
+        return Err(signature_rejected(
+            "code signature requirements are not the empty set",
+        ));
+    }
+    Ok(())
+}
+
+/// Requires one `CodeDirectory` with the linker-signed ad-hoc flags and no
+/// team identifier.
+fn check_directory(directory: &[u8]) -> Result<(), Report<ReleaseError>> {
+    let truncated = || signature_rejected("code directory is truncated");
+    if be_u32(directory, 0) != Some(CSMAGIC_CODEDIRECTORY) {
+        return Err(signature_rejected("code directory has another magic"));
+    }
+    let length = be_u32(directory, 4)
+        .and_then(|length| usize::try_from(length).ok())
+        .filter(|length| *length <= directory.len())
+        .ok_or_else(truncated)?;
+    let directory = &directory[..length];
+    let version = be_u32(directory, 8).ok_or_else(truncated)?;
+    let flags = be_u32(directory, 12).ok_or_else(truncated)?;
+    if flags != LINKER_SIGNED_ADHOC {
+        return Err(signature_rejected(format!(
+            "code directory flags {flags:#x}, expected linker-signed ad-hoc \
+             {LINKER_SIGNED_ADHOC:#x}"
+        )));
+    }
+    if version >= SUPPORTS_TEAM_ID {
+        let team = be_u32(directory, TEAM_OFFSET_FIELD).ok_or_else(truncated)?;
+        if team != 0 {
+            return Err(signature_rejected("code directory names a team identifier"));
+        }
+    }
+    Ok(())
+}
diff --git a/crates/trusted-server-release/src/inspect/tests.rs b/crates/trusted-server-release/src/inspect/tests.rs
new file mode 100644
index 0000000000..2ddea479b1
--- /dev/null
+++ b/crates/trusted-server-release/src/inspect/tests.rs
@@ -0,0 +1,144 @@
+//! Final-artifact inspection tests over hand-built images.
+//!
+//! Real-binary observations (dev `ts` builds and the Fastly Wasm) are manual
+//! evidence, not tests, because they depend on host build outputs.
+
+pub(crate) mod builders;
+mod elf;
+mod macho;
+mod wasm;
+
+use error_stack::Report;
+
+use super::*;
+use crate::error::ReleaseError;
+
+/// Returns the [`Violation`] attached to an inspection rejection.
+fn violation<T: fmt::Debug>(result: Result<T, Report<ReleaseError>>) -> Violation {
+    let report = result.expect_err("should reject the artifact");
+    assert!(
+        matches!(report.current_context(), ReleaseError::Inspect),
+        "should report an inspection rejection: {report:?}"
+    );
+    *report
+        .downcast_ref::<Violation>()
+        .expect("should attach the violated rule")
+}
+
+/// Asserts every strict prefix of `bytes` is rejected without panicking.
+fn assert_truncations_rejected<T: fmt::Debug>(
+    bytes: &[u8],
+    inspect: impl Fn(&[u8]) -> Result<T, Report<ReleaseError>>,
+) {
+    for length in 0..bytes.len() {
+        assert!(
+            inspect(&bytes[..length]).is_err(),
+            "should reject the input truncated to {length} of {} bytes",
+            bytes.len()
+        );
+    }
+}
+
+#[test]
+fn glibc_versions_parse_numerically() {
+    assert_eq!(GlibcVersion::parse("2.34"), Some(GlibcVersion::new(2, 34)));
+    assert!(
+        GlibcVersion::parse("2.2.5").expect("should parse three components")
+            < GlibcVersion::new(2, 3),
+        "should compare 2.2.5 below 2.3"
+    );
+    assert!(
+        GlibcVersion::new(2, 9) < GlibcVersion::new(2, 34),
+        "should compare minors numerically, not lexically"
+    );
+    for text in [
+        "",
+        "2",
+        "PRIVATE",
+        "ABI_DT_RELR",
+        "2.34.x",
+        "2.+4",
+        "2.034",
+        "2..34",
+        "1.2.3.4",
+    ] {
+        assert_eq!(GlibcVersion::parse(text), None, "should reject {text:?}");
+    }
+}
+
+#[test]
+fn macos_versions_decode_nibbles() {
+    let version = MacosVersion::from_encoded(0x000d_0100);
+    assert_eq!(version.to_string(), "13.1.0", "should decode xxxx.yy.zz");
+    assert_eq!(
+        MacosVersion::from_encoded(0x000d_0000),
+        MacosVersion::new(13, 0)
+    );
+}
+
+#[test]
+fn denied_path_scan_reports_offsets() {
+    let bytes = b"ok /usr/lib x /home/runner/work y /tmp/abc /tmpfoo";
+    let hits: Vec<_> = find_denied_paths(bytes, RUNNER_PATH_PREFIXES).collect();
+    assert_eq!(
+        hits,
+        vec![
+            PathHit {
+                prefix: "/home/",
+                offset: 14
+            },
+            PathHit {
+                prefix: "/tmp/",
+                offset: 34
+            },
+        ],
+        "should report each runner-only prefix with its offset"
+    );
+    assert!(
+        find_denied_paths(
+            b"serde/src/private/de.rs /rust/deps/x/src/lib.rs",
+            RUNNER_PATH_PREFIXES
+        )
+        .next()
+        .is_none(),
+        "should not match crate-relative or remapped paths"
+    );
+    let report = reject_denied_paths(bytes, RUNNER_PATH_PREFIXES)
+        .expect_err("should reject embedded runner paths");
+    assert!(
+        format!("{report:?}").contains("/home/@0xe"),
+        "should report the hit offset: {report:?}"
+    );
+}
+
+#[test]
+fn denied_path_contexts_are_bounded_and_capped_without_weakening_rejection() {
+    let mut bytes = vec![b'x'; 4096];
+    for offset in (128..4096).step_by(128) {
+        bytes[offset..offset + 6].copy_from_slice(b"/tmp/\n");
+    }
+    let report = reject_denied_paths(&bytes, RUNNER_PATH_PREFIXES)
+        .expect_err("should still reject every denied path");
+    let diagnostic = format!("{report:?}");
+    assert!(
+        diagnostic.contains("31 runner-only path occurrence(s)"),
+        "should count all occurrences: {diagnostic}"
+    );
+    assert_eq!(
+        diagnostic.matches("context[").count(),
+        REPORTED_PATH_HITS,
+        "should report at most sixteen contexts"
+    );
+    assert!(
+        diagnostic.contains("context[0x70..0xd0]"),
+        "should bound each context to sixteen bytes before and eighty after the hit"
+    );
+    assert!(
+        diagnostic.contains("/tmp/\\n"),
+        "should escape raw control bytes"
+    );
+    assert!(
+        diagnostic.len() < 10_000,
+        "should bound output even for many hits"
+    );
+}
diff --git a/crates/trusted-server-release/src/inspect/tests/builders.rs b/crates/trusted-server-release/src/inspect/tests/builders.rs
new file mode 100644
index 0000000000..dfa5c96da3
--- /dev/null
+++ b/crates/trusted-server-release/src/inspect/tests/builders.rs
@@ -0,0 +1,764 @@
+//! Minimal hand-built ELF, Mach-O and Wasm images.
+//!
+//! The images contain only the structures the inspectors read; they are not
+//! runnable. Building them in-process keeps the fixtures host-independent.
+
+mod macho_data;
+
+use object::elf as elf_format;
+use object::macho as macho_format;
+
+pub(crate) use macho_data::{code_signature, debug_map_symbols, linker_signature};
+
+/// One non-loaded ELF section `(name, sh_type, payload)`.
+pub(crate) type ExtraSection = (&'static str, u32, &'static [u8]);
+
+/// Parameters of a synthetic `x86_64` ELF executable.
+pub(crate) struct ElfSpec {
+    pub(crate) machine: u16,
+    pub(crate) interpreter: Option<&'static str>,
+    pub(crate) needed: Vec<&'static str>,
+    pub(crate) runpath: Option<&'static str>,
+    pub(crate) requirements: Vec<(&'static str, Vec<&'static str>)>,
+    pub(crate) payload: &'static [u8],
+    /// Non-loaded sections after `.shstrtab`.
+    pub(crate) debug_sections: Vec<ExtraSection>,
+}
+
+impl ElfSpec {
+    /// A conforming `ts`-like executable at the glibc 2.34 ceiling.
+    pub(crate) fn conforming() -> Self {
+        Self {
+            machine: elf_format::EM_X86_64,
+            interpreter: Some("/lib64/ld-linux-x86-64.so.2"),
+            needed: vec!["libgcc_s.so.1", "libm.so.6", "libc.so.6"],
+            runpath: None,
+            requirements: vec![
+                ("libgcc_s.so.1", vec!["GCC_3.0", "GCC_4.2.0"]),
+                ("libc.so.6", vec!["GLIBC_2.2.5", "GLIBC_2.34", "GLIBC_2.18"]),
+            ],
+            payload: b"fictional rodata /opt/example/src/main.rs",
+            debug_sections: vec![
+                (
+                    ".debug_info",
+                    elf_format::SHT_PROGBITS,
+                    b"fictional dwarf info",
+                ),
+                (
+                    ".debug_line",
+                    elf_format::SHT_PROGBITS,
+                    b"fictional dwarf lines",
+                ),
+            ],
+        }
+    }
+}
+
+/// Little-endian byte writer.
+#[derive(Default)]
+struct Writer(Vec<u8>);
+
+impl Writer {
+    fn u16(&mut self, value: u16) {
+        self.0.extend_from_slice(&value.to_le_bytes());
+    }
+
+    fn u32(&mut self, value: u32) {
+        self.0.extend_from_slice(&value.to_le_bytes());
+    }
+
+    fn u64(&mut self, value: u64) {
+        self.0.extend_from_slice(&value.to_le_bytes());
+    }
+
+    fn align(&mut self, alignment: usize) {
+        while !self.0.len().is_multiple_of(alignment) {
+            self.0.push(0);
+        }
+    }
+
+    fn offset(&self) -> u64 {
+        u64::try_from(self.0.len()).expect("should fit u64")
+    }
+
+    /// Appends `bytes` and returns their range.
+    fn append(&mut self, bytes: &[u8]) -> Range {
+        let offset = self.offset();
+        self.0.extend_from_slice(bytes);
+        (offset, self.offset() - offset)
+    }
+}
+
+/// A NUL-separated string table that returns each string's offset.
+#[derive(Default)]
+struct Strings(Vec<u8>);
+
+impl Strings {
+    fn new() -> Self {
+        Self(vec![0])
+    }
+
+    fn add(&mut self, text: &str) -> u32 {
+        let offset = u32::try_from(self.0.len()).expect("should fit u32");
+        self.0.extend_from_slice(text.as_bytes());
+        self.0.push(0);
+        offset
+    }
+}
+
+/// A `(file offset, size)` range; addresses equal offsets in these images.
+type Range = (u64, u64);
+
+/// One ELF section header record.
+struct Section {
+    name: u32,
+    kind: u32,
+    range: Range,
+    link: u32,
+    info: u32,
+    entry_size: u64,
+}
+
+const ELF_HEADER_SIZE: u64 = 64;
+const PROGRAM_HEADER_SIZE: u64 = 56;
+/// Section index of `.dynstr`, linked from `.dynamic` and `.gnu.version_r`.
+const DYNSTR_INDEX: u32 = 1;
+/// Section index of `.shstrtab`, after the five loader sections.
+const SHSTRTAB_INDEX: u16 = 6;
+
+/// Builds a synthetic ELF64 executable from `spec`.
+pub(crate) fn elf(spec: &ElfSpec) -> Vec<u8> {
+    let mut dynstr = Strings::new();
+    let mut dynamic = spec
+        .needed
+        .iter()
+        .map(|name| (elf_format::DT_NEEDED, u64::from(dynstr.add(name))))
+        .collect::<Vec<_>>();
+    if let Some(path) = spec.runpath {
+        dynamic.push((elf_format::DT_RUNPATH, u64::from(dynstr.add(path))));
+    }
+    let verneed = verneed(&spec.requirements, &mut dynstr);
+    let mut symbols = Writer::default();
+    symbols.0.resize(24, 0);
+    let mut versions = Writer::default();
+    versions.u16(0);
+    for index in 0..spec.requirements.iter().map(|(_, names)| names.len()).sum() {
+        symbols.u32(dynstr.add(&format!("fictional_symbol_{index}")));
+        symbols.0.extend_from_slice(&[0x12, 0]);
+        symbols.u16(0);
+        symbols.u64(0);
+        symbols.u64(0);
+        versions.u16(u16::try_from(index + 2).expect("should fit version index"));
+    }
+    let segments = 3 + u64::from(spec.interpreter.is_some());
+    let mut body = Writer::default();
+    body.0.resize(
+        usize::try_from(ELF_HEADER_SIZE + segments * PROGRAM_HEADER_SIZE).expect("should fit"),
+        0,
+    );
+    let interp = body.append(&spec.interpreter.map(nul_terminated).unwrap_or_default());
+    let dynstr_range = body.append(&dynstr.0);
+    body.align(4);
+    let verneed_range = body.append(&verneed);
+    body.align(8);
+    let symbols_range = body.append(&symbols.0);
+    let versions_range = body.append(&versions.0);
+    body.align(8);
+    dynamic.push((elf_format::DT_STRTAB, dynstr_range.0));
+    dynamic.push((elf_format::DT_STRSZ, dynstr_range.1));
+    dynamic.push((elf_format::DT_VERNEED, verneed_range.0));
+    dynamic.push((elf_format::DT_VERNEEDNUM, spec.requirements.len() as u64));
+    dynamic.push((elf_format::DT_SYMTAB, symbols_range.0));
+    dynamic.push((elf_format::DT_SYMENT, 24));
+    dynamic.push((elf_format::DT_VERSYM, versions_range.0));
+    dynamic.push((elf_format::DT_NULL, 0));
+    dynamic.push((elf_format::DT_NULL, 0));
+    let dynamic_range = body.append(&encode_dynamic(&dynamic));
+    body.0.extend_from_slice(spec.payload);
+    let debug: Vec<(&str, u32, Range)> = spec
+        .debug_sections
+        .iter()
+        .map(|(name, kind, payload)| (*name, *kind, body.append(payload)))
+        .collect();
+    let count = u32::try_from(spec.requirements.len()).expect("should fit");
+    let table = section_table(
+        &mut body,
+        [
+            dynstr_range,
+            dynamic_range,
+            verneed_range,
+            symbols_range,
+            versions_range,
+        ],
+        count,
+        &debug,
+    );
+    let mut header = Writer::default();
+    write_elf_header(&mut header, spec.machine, segments, body.offset(), &table);
+    write_sections(&mut body, &table);
+    if spec.interpreter.is_some() {
+        program_header(&mut header, elf_format::PT_INTERP, interp);
+    }
+    program_header(&mut header, elf_format::PT_DYNAMIC, dynamic_range);
+    program_header(&mut header, elf_format::PT_NOTE, (0, 0));
+    program_header(&mut header, elf_format::PT_LOAD, (0, body.offset()));
+    body.0[..header.0.len()].copy_from_slice(&header.0);
+    body.0
+}
+
+fn nul_terminated(text: &str) -> Vec<u8> {
+    let mut bytes = text.as_bytes().to_vec();
+    bytes.push(0);
+    bytes
+}
+
+fn encode_dynamic(entries: &[(u32, u64)]) -> Vec<u8> {
+    let mut out = Writer::default();
+    for (tag, value) in entries {
+        out.u64(u64::from(*tag));
+        out.u64(*value);
+    }
+    out.0
+}
+
+/// Appends `.shstrtab` to `body` and returns the non-null section headers
+/// for `[.dynstr, .dynamic, .gnu.version_r, .dynsym, .gnu.version]`, then
+/// `.shstrtab` at [`SHSTRTAB_INDEX`], then the `debug` sections.
+fn section_table(
+    body: &mut Writer,
+    ranges: [Range; 5],
+    requirements: u32,
+    debug: &[(&str, u32, Range)],
+) -> Vec<Section> {
+    let mut names = Strings::new();
+    let debug_names: Vec<u32> = debug.iter().map(|(name, _, _)| names.add(name)).collect();
+    let [dynstr, dynamic, verneed, symbols, versions] = ranges;
+    let mut table = vec![
+        Section {
+            name: names.add(".dynstr"),
+            kind: elf_format::SHT_STRTAB,
+            range: dynstr,
+            link: 0,
+            info: 0,
+            entry_size: 0,
+        },
+        Section {
+            name: names.add(".dynamic"),
+            kind: elf_format::SHT_DYNAMIC,
+            range: dynamic,
+            link: DYNSTR_INDEX,
+            info: 0,
+            entry_size: 16,
+        },
+        Section {
+            name: names.add(".gnu.version_r"),
+            kind: elf_format::SHT_GNU_VERNEED,
+            range: verneed,
+            link: DYNSTR_INDEX,
+            info: requirements,
+            entry_size: 0,
+        },
+        Section {
+            name: names.add(".dynsym"),
+            kind: elf_format::SHT_DYNSYM,
+            range: symbols,
+            link: DYNSTR_INDEX,
+            info: 1,
+            entry_size: 24,
+        },
+        Section {
+            name: names.add(".gnu.version"),
+            kind: elf_format::SHT_GNU_VERSYM,
+            range: versions,
+            link: 4,
+            info: 0,
+            entry_size: 2,
+        },
+    ];
+    let name = names.add(".shstrtab");
+    let range = body.append(&names.0);
+    body.align(8);
+    table.push(Section {
+        name,
+        kind: elf_format::SHT_STRTAB,
+        range,
+        link: 0,
+        info: 0,
+        entry_size: 0,
+    });
+    for (name, (_, kind, range)) in debug_names.into_iter().zip(debug) {
+        table.push(Section {
+            name,
+            kind: *kind,
+            range: *range,
+            link: 0,
+            info: 0,
+            entry_size: 0,
+        });
+    }
+    table
+}
+
+/// Encodes `.gnu.version_r` entries against `strings`.
+fn verneed(requirements: &[(&str, Vec<&str>)], strings: &mut Strings) -> Vec<u8> {
+    let mut out = Writer::default();
+    let mut version_index = 2;
+    for (index, (file, names)) in requirements.iter().enumerate() {
+        let last_need = index + 1 == requirements.len();
+        let need_size = 16 + 16 * names.len();
+        out.u16(1);
+        out.u16(u16::try_from(names.len()).expect("should fit"));
+        out.u32(strings.add(file));
+        out.u32(16);
+        out.u32(if last_need {
+            0
+        } else {
+            u32::try_from(need_size).expect("should fit")
+        });
+        for (aux, name) in names.iter().enumerate() {
+            out.u32(0);
+            out.u16(0);
+            out.u16(version_index);
+            version_index += 1;
+            out.u32(strings.add(name));
+            out.u32(if aux + 1 == names.len() { 0 } else { 16 });
+        }
+    }
+    out.0
+}
+
+fn write_elf_header(
+    out: &mut Writer,
+    machine: u16,
+    segments: u64,
+    section_offset: u64,
+    table: &[Section],
+) {
+    out.0.extend_from_slice(&elf_format::ELFMAG);
+    out.0.extend_from_slice(&[
+        elf_format::ELFCLASS64,
+        elf_format::ELFDATA2LSB,
+        elf_format::EV_CURRENT,
+    ]);
+    out.0.resize(16, 0);
+    out.u16(elf_format::ET_DYN);
+    out.u16(machine);
+    out.u32(u32::from(elf_format::EV_CURRENT));
+    out.u64(0);
+    out.u64(ELF_HEADER_SIZE);
+    out.u64(section_offset);
+    out.u32(0);
+    out.u16(64);
+    out.u16(56);
+    out.u16(u16::try_from(segments).expect("should fit"));
+    out.u16(64);
+    out.u16(u16::try_from(table.len() + 1).expect("should fit"));
+    out.u16(SHSTRTAB_INDEX);
+}
+
+fn program_header(out: &mut Writer, kind: u32, (offset, size): Range) {
+    out.u32(kind);
+    out.u32(elf_format::PF_R);
+    out.u64(offset);
+    out.u64(offset);
+    out.u64(offset);
+    out.u64(size);
+    out.u64(size);
+    out.u64(8);
+}
+
+fn write_sections(out: &mut Writer, table: &[Section]) {
+    out.0.extend_from_slice(&[0; 64]);
+    for section in table {
+        out.u32(section.name);
+        out.u32(section.kind);
+        out.u64(0);
+        out.u64(section.range.0);
+        out.u64(section.range.0);
+        out.u64(section.range.1);
+        out.u32(section.link);
+        out.u32(section.info);
+        out.u64(1);
+        out.u64(section.entry_size);
+    }
+}
+
+/// One synthetic Mach-O symbol table entry.
+#[derive(Clone)]
+pub(crate) struct Symbol {
+    pub(crate) n_type: u8,
+    pub(crate) name: &'static str,
+    pub(crate) value: u64,
+}
+
+/// One synthetic Mach-O load command.
+#[derive(Clone)]
+pub(crate) enum Command {
+    BuildVersion {
+        platform: u32,
+        minos: u32,
+    },
+    BuildVersionSdk {
+        platform: u32,
+        minos: u32,
+        sdk: u32,
+    },
+    VersionMin {
+        version: u32,
+    },
+    Dylinker(&'static str),
+    Dylib {
+        cmd: u32,
+        name: &'static str,
+    },
+    Rpath(&'static str),
+    Uuid([u8; 16]),
+    /// `LC_SYMTAB` whose entries and strings follow the payload.
+    Symtab(Vec<Symbol>),
+    /// `LC_CODE_SIGNATURE` whose blob follows the symbol data.
+    CodeSignature(Vec<u8>),
+}
+
+/// Parameters of a synthetic thin 64-bit Mach-O executable.
+pub(crate) struct MachoSpec {
+    pub(crate) cputype: u32,
+    pub(crate) cpusubtype: u32,
+    pub(crate) commands: Vec<Command>,
+    pub(crate) payload: &'static [u8],
+}
+
+/// Encodes `major.minor` in the Mach-O nibble form.
+pub(crate) const fn macos(major: u32, minor: u32) -> u32 {
+    (major << 16) | (minor << 8)
+}
+
+/// The SDK version every synthetic `LC_BUILD_VERSION` records unless a
+/// [`Command::BuildVersionSdk`] states another.
+pub(crate) const SYNTHETIC_SDK: (u32, u32) = (15, 5);
+
+impl MachoSpec {
+    /// A conforming arm64 `ts`-like executable targeting macOS 13.0, linker
+    /// signed, with a UUID and a relative zero-time debug map.
+    pub(crate) fn conforming() -> Self {
+        Self {
+            cputype: macho_format::CPU_TYPE_ARM64,
+            cpusubtype: macho_format::CPU_SUBTYPE_ARM64_ALL,
+            commands: vec![
+                Command::BuildVersion {
+                    platform: macho_format::PLATFORM_MACOS,
+                    minos: macos(13, 0),
+                },
+                Command::Dylinker("/usr/lib/dyld"),
+                Command::Dylib {
+                    cmd: macho_format::LC_LOAD_DYLIB,
+                    name: "/System/Library/Frameworks/Security.framework/Versions/A/Security",
+                },
+                Command::Dylib {
+                    cmd: macho_format::LC_LOAD_DYLIB,
+                    name: "/usr/lib/libSystem.B.dylib",
+                },
+                Command::Uuid([0x5a; 16]),
+                Command::Symtab(debug_map_symbols()),
+                Command::CodeSignature(linker_signature()),
+            ],
+            payload: b"fictional cstring /opt/example/src/main.rs",
+        }
+    }
+
+    /// Returns the index of the first command `matches` selects.
+    pub(crate) fn position(&self, matches: impl Fn(&Command) -> bool) -> usize {
+        self.commands
+            .iter()
+            .position(matches)
+            .expect("should hold the command")
+    }
+}
+
+/// Encoded size of one load command.
+fn command_size(command: &Command) -> usize {
+    match command {
+        Command::BuildVersion { .. } | Command::BuildVersionSdk { .. } | Command::Uuid(_) => 24,
+        Command::VersionMin { .. } | Command::CodeSignature(_) => 16,
+        Command::Symtab(_) => 24,
+        Command::Dylinker(text) | Command::Rpath(text) => (12 + text.len() + 1).div_ceil(8) * 8,
+        Command::Dylib { name, .. } => (24 + name.len() + 1).div_ceil(8) * 8,
+    }
+}
+
+/// Builds a synthetic thin Mach-O executable from `spec`.
+///
+/// Symbol and signature data follow the payload, the signature last, so a
+/// truncated image always cuts referenced data.
+pub(crate) fn macho(spec: &MachoSpec) -> Vec<u8> {
+    let commands_size: usize = spec.commands.iter().map(command_size).sum();
+    // Symbol entries need four-byte alignment, as in a real `__LINKEDIT`.
+    let base = (32 + commands_size + spec.payload.len()).div_ceil(8) * 8;
+    let mut data = Writer::default();
+    let mut tables = Vec::new();
+    for command in &spec.commands {
+        if let Command::Symtab(symbols) = command {
+            tables.push(symbol_data(symbols, &mut data, base));
+        }
+    }
+    let mut layout = Layout {
+        tables: tables.into_iter(),
+        next_signature: base + data.0.len(),
+    };
+    let mut commands = Writer::default();
+    let mut signatures = Writer::default();
+    for command in &spec.commands {
+        encode_command(&mut commands, command, &mut layout);
+        if let Command::CodeSignature(blob) = command {
+            signatures.0.extend_from_slice(blob);
+        }
+    }
+    let mut out = Writer::default();
+    out.u32(macho_format::MH_MAGIC_64);
+    out.u32(spec.cputype);
+    out.u32(spec.cpusubtype);
+    out.u32(macho_format::MH_EXECUTE);
+    out.u32(u32::try_from(spec.commands.len()).expect("should fit"));
+    out.u32(u32::try_from(commands.0.len()).expect("should fit"));
+    out.u32(0);
+    out.u32(0);
+    out.0.extend_from_slice(&commands.0);
+    out.0.extend_from_slice(spec.payload);
+    if !data.0.is_empty() || !signatures.0.is_empty() {
+        out.align(8);
+    }
+    out.0.extend_from_slice(&data.0);
+    out.0.extend_from_slice(&signatures.0);
+    out.0
+}
+
+/// Appends a symbol table's entries and strings to `data`; returns the
+/// `(symoff, nsyms, stroff, strsize)` fields.
+fn symbol_data(symbols: &[Symbol], data: &mut Writer, base: usize) -> [u32; 4] {
+    let mut strings = Strings::new();
+    let mut entries = Writer::default();
+    for symbol in symbols {
+        entries.u32(strings.add(symbol.name));
+        entries.0.push(symbol.n_type);
+        entries.0.push(1);
+        entries.u16(0);
+        entries.u64(symbol.value);
+    }
+    let field = |value: usize| u32::try_from(value).expect("should fit");
+    let symoff = base + data.0.len();
+    data.0.extend_from_slice(&entries.0);
+    let stroff = base + data.0.len();
+    data.0.extend_from_slice(&strings.0);
+    [
+        field(symoff),
+        field(symbols.len()),
+        field(stroff),
+        field(strings.0.len()),
+    ]
+}
+
+/// Precomputed data placement for the commands that reference file data.
+struct Layout {
+    tables: std::vec::IntoIter<[u32; 4]>,
+    next_signature: usize,
+}
+
+fn encode_command(out: &mut Writer, command: &Command, layout: &mut Layout) {
+    match command {
+        Command::BuildVersion { platform, minos } => {
+            let (major, minor) = SYNTHETIC_SDK;
+            encode_command(
+                out,
+                &Command::BuildVersionSdk {
+                    platform: *platform,
+                    minos: *minos,
+                    sdk: macos(major, minor),
+                },
+                layout,
+            );
+        }
+        Command::BuildVersionSdk {
+            platform,
+            minos,
+            sdk,
+        } => {
+            out.u32(macho_format::LC_BUILD_VERSION);
+            out.u32(24);
+            out.u32(*platform);
+            out.u32(*minos);
+            out.u32(*sdk);
+            out.u32(0);
+        }
+        Command::Uuid(uuid) => {
+            out.u32(macho_format::LC_UUID);
+            out.u32(24);
+            out.0.extend_from_slice(uuid);
+        }
+        Command::Symtab(_) => {
+            out.u32(macho_format::LC_SYMTAB);
+            out.u32(24);
+            for field in layout
+                .tables
+                .next()
+                .expect("should hold the table placement")
+            {
+                out.u32(field);
+            }
+        }
+        Command::CodeSignature(blob) => {
+            out.u32(macho_format::LC_CODE_SIGNATURE);
+            out.u32(16);
+            out.u32(u32::try_from(layout.next_signature).expect("should fit"));
+            out.u32(u32::try_from(blob.len()).expect("should fit"));
+            layout.next_signature += blob.len();
+        }
+        Command::VersionMin { version } => {
+            out.u32(macho_format::LC_VERSION_MIN_MACOSX);
+            out.u32(16);
+            out.u32(*version);
+            out.u32(macos(15, 5));
+        }
+        Command::Dylinker(name) => string_command(out, macho_format::LC_LOAD_DYLINKER, &[], name),
+        Command::Dylib { cmd, name } => {
+            string_command(out, *cmd, &[2, 0x0001_0000, 0x0001_0000], name);
+        }
+        Command::Rpath(path) => string_command(out, macho_format::LC_RPATH, &[], path),
+    }
+}
+
+/// Encodes a command whose string follows `fields` after the name offset.
+fn string_command(out: &mut Writer, cmd: u32, fields: &[u32], text: &str) {
+    let fixed = 12 + 4 * fields.len();
+    let size = (fixed + text.len() + 1).div_ceil(8) * 8;
+    out.u32(cmd);
+    out.u32(u32::try_from(size).expect("should fit"));
+    out.u32(u32::try_from(fixed).expect("should fit"));
+    for field in fields {
+        out.u32(*field);
+    }
+    out.0.extend_from_slice(text.as_bytes());
+    out.0.resize(out.0.len() + size - fixed - text.len(), 0);
+}
+
+/// Builds a two-architecture fat header around `thin`.
+pub(super) fn fat(thin: &[u8]) -> Vec<u8> {
+    let mut out = Vec::new();
+    for value in [
+        macho_format::FAT_MAGIC,
+        1,
+        macho_format::CPU_TYPE_ARM64,
+        0,
+        4096,
+    ] {
+        out.extend_from_slice(&value.to_be_bytes());
+    }
+    for value in [u32::try_from(thin.len()).expect("should fit"), 12] {
+        out.extend_from_slice(&value.to_be_bytes());
+    }
+    out.resize(4096, 0);
+    out.extend_from_slice(thin);
+    out
+}
+
+/// Builds a core Wasm module importing `() -> ()` functions.
+pub(crate) fn wasm_module(imports: &[(&str, &str)]) -> Vec<u8> {
+    let mut out = b"\0asm\x01\0\0\0".to_vec();
+    if imports.is_empty() {
+        return out;
+    }
+    section(&mut out, 1, &[1, 0x60, 0, 0]);
+    let mut body = vec![u8::try_from(imports.len()).expect("should fit")];
+    for (module, name) in imports {
+        name_bytes(&mut body, module);
+        name_bytes(&mut body, name);
+        body.extend_from_slice(&[0, 0]);
+    }
+    section(&mut out, 2, &body);
+    out
+}
+
+/// Appends a section with a single-byte LEB128 length.
+pub(super) fn section(out: &mut Vec<u8>, id: u8, body: &[u8]) {
+    out.push(id);
+    out.push(u8::try_from(body.len()).expect("should fit one LEB128 byte"));
+    out.extend_from_slice(body);
+}
+
+fn name_bytes(out: &mut Vec<u8>, text: &str) {
+    out.push(u8::try_from(text.len()).expect("should fit one LEB128 byte"));
+    out.extend_from_slice(text.as_bytes());
+}
+
+/// Builds a core Wasm module importing `() -> ()` functions, then appending
+/// custom sections `(name, payload)` in order.
+pub(super) fn wasm_module_with_customs(
+    imports: &[(&str, &str)],
+    customs: &[(&str, &[u8])],
+) -> Vec<u8> {
+    append_customs(wasm_module(imports), customs)
+}
+
+/// Appends custom sections `(name, payload)` in order to `module`.
+pub(crate) fn append_customs(mut module: Vec<u8>, customs: &[(&str, &[u8])]) -> Vec<u8> {
+    for (name, payload) in customs {
+        let mut body = Vec::new();
+        name_bytes(&mut body, name);
+        body.extend_from_slice(payload);
+        section(&mut module, 0, &body);
+    }
+    module
+}
+
+/// The `_start` export shape of a [`command_module`].
+#[derive(Clone, Copy)]
+pub(crate) enum Entry {
+    /// `_start` takes and returns nothing.
+    Nullary,
+    /// `_start` takes one `i32`.
+    TakesI32,
+    /// The function is exported as `main`, not `_start`.
+    Renamed,
+}
+
+/// Builds a WASI-command-shaped core module importing `() -> ()` functions,
+/// defining one function exported per `entry`, one memory exported as
+/// `memory` when `export_memory` is set, and empty bodies.
+pub(crate) fn command_module(
+    imports: &[(&str, &str)],
+    entry: Entry,
+    export_memory: bool,
+) -> Vec<u8> {
+    let mut out = b"\0asm\x01\0\0\0".to_vec();
+    section(&mut out, 1, &[2, 0x60, 0, 0, 0x60, 1, 0x7f, 0]);
+    if !imports.is_empty() {
+        let mut body = vec![u8::try_from(imports.len()).expect("should fit")];
+        for (module, name) in imports {
+            name_bytes(&mut body, module);
+            name_bytes(&mut body, name);
+            body.extend_from_slice(&[0, 0]);
+        }
+        section(&mut out, 2, &body);
+    }
+    let entry_type = match entry {
+        Entry::Nullary | Entry::Renamed => 0,
+        Entry::TakesI32 => 1,
+    };
+    section(&mut out, 3, &[1, entry_type]);
+    section(&mut out, 5, &[1, 0, 1]);
+    let entry_index = u8::try_from(imports.len()).expect("should fit");
+    let mut exports = vec![if export_memory { 2 } else { 1 }];
+    name_bytes(
+        &mut exports,
+        match entry {
+            Entry::Renamed => "main",
+            Entry::Nullary | Entry::TakesI32 => "_start",
+        },
+    );
+    exports.extend_from_slice(&[0, entry_index]);
+    if export_memory {
+        name_bytes(&mut exports, "memory");
+        exports.extend_from_slice(&[2, 0]);
+    }
+    section(&mut out, 7, &exports);
+    section(&mut out, 10, &[1, 2, 0, 0x0b]);
+    out
+}
diff --git a/crates/trusted-server-release/src/inspect/tests/builders/macho_data.rs b/crates/trusted-server-release/src/inspect/tests/builders/macho_data.rs
new file mode 100644
index 0000000000..6ce4ef24df
--- /dev/null
+++ b/crates/trusted-server-release/src/inspect/tests/builders/macho_data.rs
@@ -0,0 +1,72 @@
+//! Synthetic Mach-O debug-map symbols and code signature blobs.
+
+use object::macho as macho_format;
+
+use super::Symbol;
+
+/// Fictional relative debug-map entries of a linked `ts`.
+pub(crate) fn debug_map_symbols() -> Vec<Symbol> {
+    vec![
+        Symbol {
+            n_type: macho_format::N_OSO,
+            name: "cargo-target/aarch64-apple-darwin/release/deps/ts-0123456789abcdef.o",
+            value: 0,
+        },
+        Symbol {
+            n_type: macho_format::N_OSO,
+            name: "rust-tools/lib/rustlib/aarch64-apple-darwin/lib/libstd-0123.rlib(std.o)",
+            value: 0,
+        },
+        Symbol {
+            n_type: macho_format::N_SECT | macho_format::N_EXT,
+            name: "_main",
+            value: 0x1_0000_0000,
+        },
+    ]
+}
+
+/// A big-endian `SuperBlob` with one `CodeDirectory` carrying `flags`, an
+/// optional team identifier offset and `extra_slots` index entries.
+pub(crate) fn code_signature(flags: u32, team_offset: u32, extra_slots: &[u32]) -> Vec<u8> {
+    let count = 1 + extra_slots.len();
+    let header = 12 + 8 * count;
+    let mut directory = Vec::new();
+    for value in [0xfade_0c02_u32, 88, 0x2_0400, flags, 0, 0, 0, 0, 0] {
+        directory.extend_from_slice(&value.to_be_bytes());
+    }
+    directory.extend_from_slice(&[32, 2, 0, 12]);
+    for value in [0_u32, 0, team_offset] {
+        directory.extend_from_slice(&value.to_be_bytes());
+    }
+    directory.resize(88, 0);
+    let mut extra = Vec::new();
+    let mut entries = vec![(0_u32, header)];
+    for slot in extra_slots {
+        entries.push((*slot, header + directory.len() + extra.len()));
+        for value in [0xfade_0c01_u32, 12, 0] {
+            extra.extend_from_slice(&value.to_be_bytes());
+        }
+    }
+    let length = header + directory.len() + extra.len();
+    let mut out = Vec::new();
+    for value in [
+        0xfade_0cc0_u32,
+        u32::try_from(length).expect("should fit"),
+        u32::try_from(count).expect("should fit"),
+    ] {
+        out.extend_from_slice(&value.to_be_bytes());
+    }
+    for (slot, offset) in entries {
+        out.extend_from_slice(&slot.to_be_bytes());
+        out.extend_from_slice(&u32::try_from(offset).expect("should fit").to_be_bytes());
+    }
+    out.extend_from_slice(&directory);
+    out.extend_from_slice(&extra);
+    out
+}
+
+/// The linker's ad-hoc signature: flags `0x20002`, no team identifier and an
+/// empty requirements slot.
+pub(crate) fn linker_signature() -> Vec<u8> {
+    code_signature(0x2_0002, 0, &[2])
+}
diff --git a/crates/trusted-server-release/src/inspect/tests/elf.rs b/crates/trusted-server-release/src/inspect/tests/elf.rs
new file mode 100644
index 0000000000..81548c77a7
--- /dev/null
+++ b/crates/trusted-server-release/src/inspect/tests/elf.rs
@@ -0,0 +1,429 @@
+//! ELF inspection tests.
+
+use object::elf as elf_format;
+
+use super::builders::{ElfSpec, ExtraSection, MachoSpec, elf, macho};
+use super::*;
+
+fn inspect(spec: &ElfSpec) -> Result<ElfFacts, Report<ReleaseError>> {
+    inspect_elf(&elf(spec), &ElfPolicy::linux_x86_64_gnu())
+}
+
+#[test]
+fn conforming_executable_is_accepted_with_observed_facts() {
+    let bytes = elf(&ElfSpec::conforming());
+
+    let facts = inspect_elf(&bytes, &ElfPolicy::linux_x86_64_gnu())
+        .expect("should accept a conforming executable");
+
+    assert_eq!(facts.interpreter(), "/lib64/ld-linux-x86-64.so.2");
+    assert_eq!(facts.needed(), ["libgcc_s.so.1", "libm.so.6", "libc.so.6"]);
+    assert_eq!(
+        facts.max_glibc(),
+        GlibcVersion::new(2, 34),
+        "should record the highest GLIBC requirement numerically"
+    );
+    assert_eq!(
+        facts.version_requirements().len(),
+        5,
+        "should record every requirement"
+    );
+    assert_eq!(
+        facts.sha256(),
+        sha256_hex(&bytes),
+        "should hash the inspected bytes"
+    );
+}
+
+#[test]
+fn glibc_above_ceiling_is_rejected() {
+    let mut spec = ElfSpec::conforming();
+    spec.requirements[1].1.push("GLIBC_2.35");
+
+    assert_eq!(violation(inspect(&spec)), Violation::SymbolVersion);
+}
+
+#[test]
+fn unparsable_glibc_version_is_rejected() {
+    for name in ["GLIBC_PRIVATE", "GLIBC_ABI_DT_RELR"] {
+        let mut spec = ElfSpec::conforming();
+        spec.requirements[1].1.push(name);
+
+        assert_eq!(
+            violation(inspect(&spec)),
+            Violation::SymbolVersion,
+            "should reject {name}"
+        );
+    }
+}
+
+#[test]
+fn unexpected_version_namespace_is_rejected() {
+    let mut spec = ElfSpec::conforming();
+    spec.requirements[1].1.push("GCC_3.0");
+
+    assert_eq!(
+        violation(inspect(&spec)),
+        Violation::SymbolVersion,
+        "should accept GCC_ names only from libgcc_s"
+    );
+}
+
+#[test]
+fn missing_glibc_requirements_are_rejected() {
+    let mut spec = ElfSpec::conforming();
+    spec.requirements.truncate(1);
+
+    assert_eq!(violation(inspect(&spec)), Violation::SymbolVersion);
+}
+
+#[test]
+fn wrong_architecture_is_rejected() {
+    let mut spec = ElfSpec::conforming();
+    spec.machine = elf_format::EM_AARCH64;
+
+    assert_eq!(violation(inspect(&spec)), Violation::Architecture);
+}
+
+#[test]
+fn missing_interpreter_is_rejected() {
+    let mut spec = ElfSpec::conforming();
+    spec.interpreter = None;
+
+    assert_eq!(violation(inspect(&spec)), Violation::Interpreter);
+}
+
+#[test]
+fn unexpected_interpreter_is_rejected() {
+    let mut spec = ElfSpec::conforming();
+    spec.interpreter = Some("/opt/example/ld.so");
+
+    assert_eq!(violation(inspect(&spec)), Violation::Interpreter);
+}
+
+#[test]
+fn unexpected_needed_library_is_rejected() {
+    for name in ["libssl.so.3", "libpthread.so.0", "/opt/example/libc.so.6"] {
+        let mut spec = ElfSpec::conforming();
+        spec.needed.push(name);
+
+        assert_eq!(
+            violation(inspect(&spec)),
+            Violation::Library,
+            "should reject {name}"
+        );
+    }
+}
+
+#[test]
+fn runpath_is_rejected() {
+    let mut spec = ElfSpec::conforming();
+    spec.runpath = Some("$ORIGIN/../lib");
+
+    assert_eq!(violation(inspect(&spec)), Violation::SearchPath);
+}
+
+fn replace_dynamic_terminator(bytes: &mut [u8], tag: u32, value: u64) {
+    let section_table = u64::from_le_bytes(bytes[40..48].try_into().expect("should read offset"));
+    let section = usize::try_from(section_table).expect("should fit") + 2 * 64;
+    let offset = u64::from_le_bytes(
+        bytes[section + 24..section + 32]
+            .try_into()
+            .expect("should read offset"),
+    );
+    let size = u64::from_le_bytes(
+        bytes[section + 32..section + 40]
+            .try_into()
+            .expect("should read size"),
+    );
+    let start = usize::try_from(offset).expect("should fit");
+    let end = usize::try_from(offset + size).expect("should fit");
+    let entry = (start..end)
+        .step_by(16)
+        .find(|entry| read_u64(bytes, *entry) == 0)
+        .expect("should find terminator");
+    bytes[entry..entry + 8].copy_from_slice(&u64::from(tag).to_le_bytes());
+    bytes[entry + 8..entry + 16].copy_from_slice(&value.to_le_bytes());
+}
+
+#[test]
+fn loader_auditors_are_rejected() {
+    for tag in [elf_format::DT_AUDIT, elf_format::DT_DEPAUDIT] {
+        let mut bytes = elf(&ElfSpec::conforming());
+        replace_dynamic_terminator(&mut bytes, tag, 0);
+        assert_eq!(
+            violation(inspect_elf(&bytes, &ElfPolicy::linux_x86_64_gnu())),
+            Violation::Library,
+            "should reject loader auditor tags"
+        );
+    }
+}
+
+#[test]
+fn unterminated_dynamic_table_is_rejected() {
+    let mut bytes = elf(&ElfSpec::conforming());
+    replace_dynamic_terminator(&mut bytes, elf_format::DT_DEBUG, 0);
+    replace_dynamic_terminator(&mut bytes, elf_format::DT_DEBUG, 0);
+    assert!(
+        inspect_elf(&bytes, &ElfPolicy::linux_x86_64_gnu()).is_err(),
+        "should require a dynamic table terminator"
+    );
+}
+
+fn read_u64(bytes: &[u8], offset: usize) -> u64 {
+    u64::from_le_bytes(
+        bytes[offset..offset + 8]
+            .try_into()
+            .expect("should read field"),
+    )
+}
+
+fn section_offset(bytes: &[u8], index: usize) -> usize {
+    usize::try_from(read_u64(bytes, 40)).expect("should fit section offset") + index * 64
+}
+
+fn change_dynamic_value(bytes: &mut [u8], tag: u32) {
+    let section = section_offset(bytes, 2);
+    let start = usize::try_from(read_u64(bytes, section + 24)).expect("should fit");
+    let end = start + usize::try_from(read_u64(bytes, section + 32)).expect("should fit");
+    let entry = (start..end)
+        .step_by(16)
+        .find(|offset| read_u64(bytes, *offset) == u64::from(tag))
+        .expect("should find dynamic tag");
+    let changed = read_u64(bytes, entry + 8) + 1;
+    bytes[entry + 8..entry + 16].copy_from_slice(&changed.to_le_bytes());
+}
+
+#[test]
+fn loader_metadata_must_match_all_observed_sections() {
+    for tag in [
+        elf_format::DT_STRSZ,
+        elf_format::DT_VERNEED,
+        elf_format::DT_VERNEEDNUM,
+        elf_format::DT_SYMTAB,
+        elf_format::DT_SYMENT,
+        elf_format::DT_VERSYM,
+    ] {
+        let mut bytes = elf(&ElfSpec::conforming());
+        change_dynamic_value(&mut bytes, tag);
+        assert!(
+            inspect_elf(&bytes, &ElfPolicy::linux_x86_64_gnu()).is_err(),
+            "should reject section/dynamic disagreement for tag {tag}"
+        );
+    }
+}
+
+#[test]
+fn shadow_string_table_cannot_hide_loader_libraries() {
+    let mut bytes = elf(&ElfSpec::conforming());
+    let section = section_offset(&bytes, 1);
+    let start = usize::try_from(read_u64(&bytes, section + 24)).expect("should fit");
+    let size = usize::try_from(read_u64(&bytes, section + 32)).expect("should fit");
+    let shadow = bytes[start..start + size].to_vec();
+    let shadow_offset = bytes.len() as u64;
+    bytes.extend_from_slice(&shadow);
+    bytes[section + 24..section + 32].copy_from_slice(&shadow_offset.to_le_bytes());
+    let name = bytes[start..start + size]
+        .windows(9)
+        .position(|name| name == b"libc.so.6")
+        .expect("should find real loader library");
+    bytes[start + name..start + name + 9].copy_from_slice(b"evil.so.6");
+    assert!(
+        inspect_elf(&bytes, &ElfPolicy::linux_x86_64_gnu()).is_err(),
+        "should inspect the loader's actual strings rather than a shadow section"
+    );
+}
+
+#[test]
+fn undefined_symbol_cannot_hide_an_unaccounted_version() {
+    let mut bytes = elf(&ElfSpec::conforming());
+    let section = section_offset(&bytes, 5);
+    let start = usize::try_from(read_u64(&bytes, section + 24)).expect("should fit");
+    bytes[start + 2..start + 4].copy_from_slice(&999_u16.to_le_bytes());
+    assert!(
+        inspect_elf(&bytes, &ElfPolicy::linux_x86_64_gnu()).is_err(),
+        "should bind undefined symbol versions to checked requirements"
+    );
+}
+
+#[test]
+fn partially_overlapping_loads_cannot_replace_observed_bytes() {
+    for file_size in [0_u64, 1] {
+        let mut bytes = elf(&ElfSpec::conforming());
+        let strings = section_offset(&bytes, 1);
+        let address = read_u64(&bytes, strings + 16) + 4;
+        let note = (64..64 + 4 * 56)
+            .step_by(56)
+            .find(|offset| bytes[*offset..*offset + 4] == elf_format::PT_NOTE.to_le_bytes())
+            .expect("should find spare program header");
+        bytes[note..note + 4].copy_from_slice(&elf_format::PT_LOAD.to_le_bytes());
+        for (field, value) in [(8, address), (16, address), (32, file_size), (40, 1)] {
+            bytes[note + field..note + field + 8].copy_from_slice(&value.to_le_bytes());
+        }
+        assert!(
+            inspect_elf(&bytes, &ElfPolicy::linux_x86_64_gnu()).is_err(),
+            "should reject partial file-backed and zero-fill overlaps"
+        );
+    }
+}
+
+#[test]
+fn embedded_runner_path_is_rejected() {
+    let mut spec = ElfSpec::conforming();
+    spec.payload = b"panic at /home/runner/work/example/src/lib.rs";
+
+    assert_eq!(violation(inspect(&spec)), Violation::EmbeddedPath);
+}
+
+#[test]
+fn denied_prefixes_are_configurable() {
+    let policy = ElfPolicy {
+        denied_path_prefixes: &["/opt/example/"],
+        ..ElfPolicy::linux_x86_64_gnu()
+    };
+
+    let result = inspect_elf(&elf(&ElfSpec::conforming()), &policy);
+
+    assert_eq!(violation(result), Violation::EmbeddedPath);
+}
+
+#[test]
+fn non_elf_inputs_are_rejected() {
+    let policy = ElfPolicy::linux_x86_64_gnu();
+    let thin = macho(&MachoSpec::conforming());
+
+    assert_eq!(violation(inspect_elf(&thin, &policy)), Violation::Malformed);
+    assert_eq!(
+        violation(inspect_elf(b"\0asm\x01\0\0\0", &policy)),
+        Violation::Malformed
+    );
+}
+
+#[test]
+fn truncated_executables_are_rejected_without_panic() {
+    let policy = ElfPolicy::linux_x86_64_gnu();
+
+    assert_truncations_rejected(&elf(&ElfSpec::conforming()), |bytes| {
+        inspect_elf(bytes, &policy)
+    });
+}
+
+#[test]
+fn retained_debug_sections_are_recorded_and_required() {
+    let facts = inspect(&ElfSpec::conforming()).expect("should accept a conforming executable");
+
+    let recorded: Vec<(&str, usize)> = facts
+        .debug_sections()
+        .iter()
+        .map(|section| (section.name(), section.size()))
+        .collect();
+    assert_eq!(
+        recorded,
+        [(".debug_info", 20), (".debug_line", 21)],
+        "should record each required DWARF section with its file bytes"
+    );
+    facts
+        .require_debug_sections()
+        .expect("should accept an executable that kept its debug info");
+}
+
+#[test]
+fn stripped_or_empty_debug_sections_are_rejected() {
+    let cases: [(&str, Vec<ExtraSection>); 4] = [
+        ("stripped", Vec::new()),
+        (
+            "missing line table",
+            vec![(".debug_info", elf_format::SHT_PROGBITS, b"fictional dwarf")],
+        ),
+        (
+            "empty info",
+            vec![
+                (".debug_info", elf_format::SHT_PROGBITS, b""),
+                (".debug_line", elf_format::SHT_PROGBITS, b"fictional dwarf"),
+            ],
+        ),
+        (
+            "no file bytes",
+            vec![
+                (".debug_info", elf_format::SHT_PROGBITS, b"fictional dwarf"),
+                (".debug_line", elf_format::SHT_NOBITS, b"fictional dwarf"),
+            ],
+        ),
+    ];
+    for (label, debug_sections) in cases {
+        let spec = ElfSpec {
+            debug_sections,
+            ..ElfSpec::conforming()
+        };
+        let facts = inspect(&spec).expect("should record, not reject, missing debug info");
+
+        assert_eq!(
+            violation(facts.require_debug_sections()),
+            Violation::ElfDebugInfo,
+            "should reject the {label} executable"
+        );
+    }
+}
+
+#[test]
+fn runner_path_rejection_includes_final_elf_diagnostics() {
+    let mut spec = ElfSpec::conforming();
+    spec.debug_sections.push((
+        ".rodata",
+        elf_format::SHT_PROGBITS,
+        b"before /home/runner/example\n\x1bafter",
+    ));
+    let bytes = elf(&spec);
+    let report = inspect_elf(&bytes, &ElfPolicy::linux_x86_64_gnu())
+        .expect_err("should retain rejection of a runner-only path");
+    assert_eq!(
+        report.downcast_ref::<Violation>(),
+        Some(&Violation::EmbeddedPath),
+        "should preserve the rejection rule"
+    );
+    let diagnostic = format!("{report:?}");
+    assert!(
+        diagnostic.contains(&format!(
+            "artifact sha256={} size={}",
+            sha256_hex(&bytes),
+            bytes.len()
+        )),
+        "should bind diagnostic to the final bytes: {diagnostic}"
+    );
+    assert!(
+        diagnostic.contains("section=\".rodata\""),
+        "should identify the containing ELF section: {diagnostic}"
+    );
+    assert!(
+        diagnostic.contains("/home/runner/example\\n\\x1bafter"),
+        "should escape controls in a bounded context: {diagnostic}"
+    );
+}
+
+#[test]
+fn linux_runtime_browser_lookup_path_is_structurally_accepted() {
+    let mut spec = ElfSpec::conforming();
+    spec.debug_sections.push((
+        ".rodata",
+        elf_format::SHT_PROGBITS,
+        b"/opt/google/chrome/tmp/aws/libCHROME",
+    ));
+    inspect(&spec).expect("should permit a Linux runtime temporary-directory lookup constant");
+}
+
+#[test]
+fn linux_keeps_every_other_runner_path_prefix_rejected() {
+    for prefix in RUNNER_PATH_PREFIXES
+        .iter()
+        .copied()
+        .filter(|prefix| *prefix != "/tmp/")
+    {
+        let mut spec = ElfSpec::conforming();
+        spec.payload = prefix.as_bytes();
+        assert_eq!(
+            violation(inspect(&spec)),
+            Violation::EmbeddedPath,
+            "should keep rejecting runner-only prefix {prefix}"
+        );
+    }
+}
diff --git a/crates/trusted-server-release/src/inspect/tests/macho.rs b/crates/trusted-server-release/src/inspect/tests/macho.rs
new file mode 100644
index 0000000000..90487f55a9
--- /dev/null
+++ b/crates/trusted-server-release/src/inspect/tests/macho.rs
@@ -0,0 +1,480 @@
+//! Mach-O inspection tests.
+
+use object::macho as macho_format;
+
+use super::builders::{
+    Command, ElfSpec, MachoSpec, Symbol, code_signature, debug_map_symbols, elf, fat,
+    linker_signature, macho, macos,
+};
+use super::*;
+
+fn inspect(spec: &MachoSpec) -> Result<MachoFacts, Report<ReleaseError>> {
+    inspect_macho(&macho(spec), &MachoPolicy::macos(MachoCpu::Arm64))
+}
+
+fn with_command(command: Command) -> MachoSpec {
+    let mut spec = MachoSpec::conforming();
+    spec.commands.push(command);
+    spec
+}
+
+#[test]
+fn conforming_executable_is_accepted_with_observed_facts() {
+    let bytes = macho(&MachoSpec::conforming());
+
+    let facts = inspect_macho(&bytes, &MachoPolicy::macos(MachoCpu::Arm64))
+        .expect("should accept a conforming executable");
+
+    assert_eq!(facts.cpu(), MachoCpu::Arm64);
+    assert_eq!(
+        facts.loader(),
+        "/usr/lib/dyld",
+        "should retain the observed and validated dynamic linker"
+    );
+    assert_eq!(
+        facts.minos(),
+        MacosVersion::new(13, 0),
+        "should record minos 13.0"
+    );
+    assert_eq!(
+        facts.sdk(),
+        MacosVersion::new(15, 5),
+        "should record the SDK version"
+    );
+    assert_eq!(
+        facts.dylibs(),
+        [
+            "/System/Library/Frameworks/Security.framework/Versions/A/Security",
+            "/usr/lib/libSystem.B.dylib",
+        ]
+    );
+    assert_eq!(
+        facts.sha256(),
+        sha256_hex(&bytes),
+        "should hash the inspected bytes"
+    );
+}
+
+#[test]
+fn x86_64_policy_accepts_x86_64_executable() {
+    let mut spec = MachoSpec::conforming();
+    spec.cputype = macho_format::CPU_TYPE_X86_64;
+    spec.cpusubtype = macho_format::CPU_SUBTYPE_X86_64_ALL | macho_format::CPU_SUBTYPE_LIB64;
+
+    let facts = inspect_macho(&macho(&spec), &MachoPolicy::macos(MachoCpu::X86_64))
+        .expect("should accept x86_64 with capability bits masked");
+
+    assert_eq!(facts.cpu(), MachoCpu::X86_64);
+}
+
+#[test]
+fn deployment_target_other_than_floor_is_rejected() {
+    for (major, minor) in [(11, 0), (14, 0), (12, 7)] {
+        let mut spec = MachoSpec::conforming();
+        spec.commands[0] = Command::BuildVersion {
+            platform: macho_format::PLATFORM_MACOS,
+            minos: macos(major, minor),
+        };
+
+        assert_eq!(
+            violation(inspect(&spec)),
+            Violation::DeploymentTarget,
+            "should reject minos {major}.{minor}"
+        );
+    }
+}
+
+#[test]
+fn missing_or_legacy_deployment_target_is_rejected() {
+    let mut missing = MachoSpec::conforming();
+    missing.commands.remove(0);
+    let mut legacy = MachoSpec::conforming();
+    legacy.commands[0] = Command::VersionMin {
+        version: macos(13, 0),
+    };
+    let duplicate = with_command(Command::BuildVersion {
+        platform: macho_format::PLATFORM_MACOS,
+        minos: macos(13, 0),
+    });
+
+    for spec in [missing, legacy, duplicate] {
+        assert_eq!(violation(inspect(&spec)), Violation::DeploymentTarget);
+    }
+}
+
+#[test]
+fn non_macos_platform_is_rejected() {
+    let mut spec = MachoSpec::conforming();
+    spec.commands[0] = Command::BuildVersion {
+        platform: macho_format::PLATFORM_IOS,
+        minos: macos(13, 0),
+    };
+
+    assert_eq!(violation(inspect(&spec)), Violation::DeploymentTarget);
+}
+
+#[test]
+fn wrong_cpu_is_rejected() {
+    let mut x86 = MachoSpec::conforming();
+    x86.cputype = macho_format::CPU_TYPE_X86_64;
+    x86.cpusubtype = macho_format::CPU_SUBTYPE_X86_64_ALL;
+    let mut arm64e = MachoSpec::conforming();
+    arm64e.cpusubtype = macho_format::CPU_SUBTYPE_ARM64E;
+
+    for spec in [x86, arm64e] {
+        assert_eq!(violation(inspect(&spec)), Violation::Architecture);
+    }
+}
+
+#[test]
+fn fat_binary_is_rejected() {
+    let thin = macho(&MachoSpec::conforming());
+
+    let result = inspect_macho(&fat(&thin), &MachoPolicy::macos(MachoCpu::Arm64));
+
+    assert_eq!(violation(result), Violation::Architecture);
+}
+
+#[test]
+fn unexpected_dylib_is_rejected() {
+    let spec = with_command(Command::Dylib {
+        cmd: macho_format::LC_LOAD_DYLIB,
+        name: "/usr/local/lib/libexample.dylib",
+    });
+
+    assert_eq!(violation(inspect(&spec)), Violation::Library);
+}
+
+#[test]
+fn non_plain_dylib_loads_are_rejected() {
+    for cmd in [
+        macho_format::LC_LOAD_WEAK_DYLIB,
+        macho_format::LC_REEXPORT_DYLIB,
+        macho_format::LC_LAZY_LOAD_DYLIB,
+        macho_format::LC_LOAD_UPWARD_DYLIB,
+    ] {
+        let spec = with_command(Command::Dylib {
+            cmd,
+            name: "/usr/lib/libSystem.B.dylib",
+        });
+
+        assert_eq!(
+            violation(inspect(&spec)),
+            Violation::LinkKind,
+            "should reject {cmd:#x}"
+        );
+    }
+}
+
+#[test]
+fn rpath_is_rejected() {
+    let spec = with_command(Command::Rpath("@executable_path/../lib"));
+
+    assert_eq!(violation(inspect(&spec)), Violation::SearchPath);
+}
+
+#[test]
+fn unexpected_dylinker_is_rejected() {
+    let mut spec = MachoSpec::conforming();
+    spec.commands[1] = Command::Dylinker("/opt/example/dyld");
+
+    assert_eq!(violation(inspect(&spec)), Violation::Interpreter);
+}
+
+#[test]
+fn embedded_runner_path_is_rejected() {
+    let mut spec = MachoSpec::conforming();
+    spec.payload = b"panic at /Users/runner/work/example/src/lib.rs";
+
+    assert_eq!(violation(inspect(&spec)), Violation::EmbeddedPath);
+}
+
+#[test]
+fn non_macho_inputs_are_rejected() {
+    let policy = MachoPolicy::macos(MachoCpu::Arm64);
+    let linux = elf(&ElfSpec::conforming());
+
+    assert_eq!(
+        violation(inspect_macho(&linux, &policy)),
+        Violation::Malformed
+    );
+    assert_eq!(
+        violation(inspect_macho(b"not an executable", &policy)),
+        Violation::Malformed
+    );
+}
+
+#[test]
+fn truncated_executables_are_rejected_without_panic() {
+    let policy = MachoPolicy::macos(MachoCpu::Arm64);
+    let mut spec = MachoSpec::conforming();
+    spec.payload = b"";
+
+    assert_truncations_rejected(&macho(&spec), |bytes| inspect_macho(bytes, &policy));
+}
+
+#[test]
+fn macos_temporary_directory_paths_remain_rejected() {
+    let mut spec = MachoSpec::conforming();
+    spec.payload = b"/tmp/example/generated.rs";
+    assert_eq!(
+        violation(inspect(&spec)),
+        Violation::EmbeddedPath,
+        "should retain the macOS policy until its filesystem boundary is qualified"
+    );
+}
+
+fn signature_index(spec: &MachoSpec) -> usize {
+    spec.position(|command| matches!(command, Command::CodeSignature(_)))
+}
+
+fn symtab_index(spec: &MachoSpec) -> usize {
+    spec.position(|command| matches!(command, Command::Symtab(_)))
+}
+
+fn with_signature(blob: Vec<u8>) -> MachoSpec {
+    let mut spec = MachoSpec::conforming();
+    let index = signature_index(&spec);
+    spec.commands[index] = Command::CodeSignature(blob);
+    spec
+}
+
+fn with_symbols(symbols: Vec<Symbol>) -> MachoSpec {
+    let mut spec = MachoSpec::conforming();
+    let index = symtab_index(&spec);
+    spec.commands[index] = Command::Symtab(symbols);
+    spec
+}
+
+fn object(name: &'static str, value: u64) -> Symbol {
+    Symbol {
+        n_type: macho_format::N_OSO,
+        name,
+        value,
+    }
+}
+
+#[test]
+fn conforming_executable_records_uuid_debug_map_and_signature() {
+    let facts = inspect(&MachoSpec::conforming()).expect("should accept a conforming executable");
+
+    assert_eq!(facts.uuid(), [0x5a; 16], "should record LC_UUID");
+    assert_eq!(facts.symbol_count(), 3, "should count every symbol");
+    assert_eq!(
+        facts.debug_map_objects(),
+        2,
+        "should count the relative debug-map objects"
+    );
+    assert_eq!(
+        facts.signature(),
+        CodeSignature::LinkerSignedAdhoc,
+        "should record the linker's ad-hoc signature"
+    );
+    facts
+        .require_debug_map()
+        .expect("should keep the debug map a release build needs");
+}
+
+#[test]
+fn arm64_must_be_linker_signed_while_x86_64_may_be_unsigned() {
+    let mut unsigned_arm64 = MachoSpec::conforming();
+    unsigned_arm64
+        .commands
+        .remove(signature_index(&unsigned_arm64));
+    assert_eq!(
+        violation(inspect(&unsigned_arm64)),
+        Violation::CodeSignature,
+        "should require a signature on arm64"
+    );
+
+    let mut unsigned_x86_64 = MachoSpec::conforming();
+    unsigned_x86_64
+        .commands
+        .remove(signature_index(&unsigned_x86_64));
+    unsigned_x86_64.cputype = macho_format::CPU_TYPE_X86_64;
+    unsigned_x86_64.cpusubtype = macho_format::CPU_SUBTYPE_X86_64_ALL;
+    let facts = inspect_macho(
+        &macho(&unsigned_x86_64),
+        &MachoPolicy::macos(MachoCpu::X86_64),
+    )
+    .expect("should accept an unsigned x86_64 executable");
+    assert_eq!(facts.signature(), CodeSignature::Unsigned);
+}
+
+#[test]
+fn signatures_other_than_linker_signed_ad_hoc_are_rejected() {
+    let mut bad_magic = linker_signature();
+    bad_magic[0] = 0;
+    let mut short_length = linker_signature();
+    short_length[4..8].copy_from_slice(&4_u32.to_be_bytes());
+    let mut long_length = linker_signature();
+    long_length[4..8].copy_from_slice(&u32::MAX.to_be_bytes());
+    let cases: [(&str, Vec<u8>); 9] = [
+        (
+            "ad hoc without linker signing",
+            code_signature(0x2, 0, &[2]),
+        ),
+        (
+            "linker signing without ad hoc",
+            code_signature(0x2_0000, 0, &[2]),
+        ),
+        ("no flags", code_signature(0, 0, &[2])),
+        ("a team identifier", code_signature(0x2_0002, 52, &[2])),
+        (
+            "a CMS signature blob",
+            code_signature(0x2_0002, 0, &[0x1_0000]),
+        ),
+        ("an entitlements slot", code_signature(0x2_0002, 0, &[5])),
+        ("another magic", bad_magic),
+        ("a length below the header", short_length),
+        ("a length past the blob", long_length),
+    ];
+    for (label, blob) in cases {
+        assert_eq!(
+            violation(inspect(&with_signature(blob))),
+            Violation::CodeSignature,
+            "should reject a signature with {label}"
+        );
+    }
+}
+
+#[test]
+fn duplicate_code_directories_or_signatures_are_rejected() {
+    let two_directories = with_signature(code_signature(0x2_0002, 0, &[0]));
+    assert_eq!(
+        violation(inspect(&two_directories)),
+        Violation::CodeSignature
+    );
+
+    let doubled = with_command(Command::CodeSignature(linker_signature()));
+    assert_eq!(violation(inspect(&doubled)), Violation::CodeSignature);
+}
+
+#[test]
+fn debug_map_objects_must_be_relative_and_zero_time() {
+    let cases: [(&str, Symbol); 4] = [
+        (
+            "an absolute object",
+            object("/opt/example/target/release/deps/ts.o", 0),
+        ),
+        ("an empty object path", object("", 0)),
+        (
+            "a modification time",
+            object("cargo-target/release/deps/ts.o", 1_700_000_000),
+        ),
+        (
+            "an absolute archive member",
+            object("/opt/example/rust-tools/libstd.rlib(std.o)", 0),
+        ),
+    ];
+    for (label, symbol) in cases {
+        let mut symbols = debug_map_symbols();
+        symbols.push(symbol);
+        assert_eq!(
+            violation(inspect(&with_symbols(symbols))),
+            Violation::MachoDebugMap,
+            "should reject {label}"
+        );
+    }
+}
+
+#[test]
+fn stripped_executables_fail_the_debug_map_requirement() {
+    let mut no_symbols = MachoSpec::conforming();
+    no_symbols.commands.remove(symtab_index(&no_symbols));
+    let no_objects = with_symbols(vec![Symbol {
+        n_type: macho_format::N_SECT | macho_format::N_EXT,
+        name: "_main",
+        value: 0x1_0000_0000,
+    }]);
+    let empty = with_symbols(Vec::new());
+    for (label, spec) in [
+        ("without a symbol table", no_symbols),
+        ("without debug-map objects", no_objects),
+        ("with an empty symbol table", empty),
+    ] {
+        let facts = inspect(&spec).expect("should inspect the stripped executable");
+        assert_eq!(
+            violation(facts.require_debug_map()),
+            Violation::MachoDebugMap,
+            "should reject an executable {label}"
+        );
+    }
+    let doubled = with_command(Command::Symtab(debug_map_symbols()));
+    assert_eq!(violation(inspect(&doubled)), Violation::MachoDebugMap);
+}
+
+#[test]
+fn uuid_is_required_exactly_once() {
+    let mut missing = MachoSpec::conforming();
+    missing
+        .commands
+        .remove(missing.position(|command| matches!(command, Command::Uuid(_))));
+    assert_eq!(
+        violation(inspect(&missing)),
+        Violation::MachoIdentity,
+        "should reject a linked executable without LC_UUID"
+    );
+
+    let doubled = with_command(Command::Uuid([0x6b; 16]));
+    assert_eq!(violation(inspect(&doubled)), Violation::MachoIdentity);
+}
+
+#[test]
+fn requirements_must_be_one_empty_set() {
+    let mut populated = linker_signature();
+    let count_at = populated.len() - 4;
+    populated[count_at..].copy_from_slice(&1_u32.to_be_bytes());
+    let mut wrong_magic = linker_signature();
+    let magic_at = wrong_magic.len() - 12;
+    wrong_magic[magic_at..magic_at + 4].copy_from_slice(&0xfade_0c05_u32.to_be_bytes());
+    let cases: [(&str, Vec<u8>); 3] = [
+        ("a populated requirements set", populated),
+        ("another requirements magic", wrong_magic),
+        (
+            "two requirements blobs",
+            code_signature(0x2_0002, 0, &[2, 2]),
+        ),
+    ];
+    for (label, blob) in cases {
+        assert_eq!(
+            violation(inspect(&with_signature(blob))),
+            Violation::CodeSignature,
+            "should reject {label}"
+        );
+    }
+    inspect(&with_signature(code_signature(0x2_0002, 0, &[])))
+        .expect("should accept a signature without a requirements blob");
+}
+
+#[test]
+fn build_version_records_the_linked_sdk() {
+    let mut spec = MachoSpec::conforming();
+    spec.commands[0] = Command::BuildVersionSdk {
+        platform: macho_format::PLATFORM_MACOS,
+        minos: macos(13, 0),
+        sdk: macos(26, 1),
+    };
+
+    let facts = inspect(&spec).expect("should accept another SDK version");
+
+    assert_eq!(
+        facts.sdk(),
+        MacosVersion::new(26, 1),
+        "should record the SDK"
+    );
+}
+
+#[test]
+fn sdk_versions_parse_only_dotted_decimal_text() {
+    assert_eq!(MacosVersion::parse("15.5"), Some(MacosVersion::new(15, 5)));
+    assert_eq!(
+        MacosVersion::parse("26.0.1").map(|version| version.to_string()),
+        Some("26.0.1".to_owned())
+    );
+    for text in [
+        "", "15", "15.", "15.5.1.2", "015.5", "15.05", "+15.5", "15.256", "a.b",
+    ] {
+        assert_eq!(MacosVersion::parse(text), None, "should reject {text:?}");
+    }
+}
diff --git a/crates/trusted-server-release/src/inspect/tests/wasm.rs b/crates/trusted-server-release/src/inspect/tests/wasm.rs
new file mode 100644
index 0000000000..f1f843250a
--- /dev/null
+++ b/crates/trusted-server-release/src/inspect/tests/wasm.rs
@@ -0,0 +1,332 @@
+//! Core Wasm inspection tests.
+
+use super::builders::{Entry, command_module, section, wasm_module, wasm_module_with_customs};
+use super::*;
+
+#[test]
+fn valid_core_module_is_accepted_with_observed_imports() {
+    let bytes = wasm_module(&[
+        ("wasi_snapshot_preview1", "fd_write"),
+        ("fastly_http_req", "send"),
+        ("fastly_http_req", "body_downstream_get"),
+    ]);
+
+    let facts = inspect_wasm(&bytes).expect("should accept a Fastly core module");
+
+    assert_eq!(
+        facts.import_modules(),
+        ["fastly_http_req", "wasi_snapshot_preview1"],
+        "should record distinct sorted import modules"
+    );
+    assert_eq!(
+        facts.function_imports(),
+        3,
+        "should count every function import"
+    );
+    assert_eq!(
+        facts.sha256(),
+        sha256_hex(&bytes),
+        "should hash the inspected bytes"
+    );
+}
+
+#[test]
+fn reviewed_fastly_async_io_imports_are_recorded() {
+    let bytes = wasm_module(&[
+        ("fastly_async_io", "is_ready"),
+        ("fastly_async_io", "select"),
+    ]);
+    let facts = inspect_wasm(&bytes).expect("should accept the reviewed asynchronous host module");
+    assert_eq!(
+        facts.import_modules(),
+        ["fastly_async_io"],
+        "should retain the exact observed import module"
+    );
+    assert_eq!(
+        facts.function_imports(),
+        2,
+        "should record both asynchronous host calls"
+    );
+    assert_eq!(
+        facts.sha256(),
+        sha256_hex(&bytes),
+        "should bind the exact inspected bytes"
+    );
+}
+
+#[test]
+fn import_free_module_is_accepted() {
+    let facts = inspect_wasm(&wasm_module(&[])).expect("should accept an empty module");
+
+    assert!(
+        facts.import_modules().is_empty(),
+        "should record no imports"
+    );
+}
+
+#[test]
+fn unknown_import_module_is_rejected() {
+    for module in [
+        "wasi:http/types@0.3.0",
+        "spin:example/key-value",
+        "env",
+        "fastly_example",
+        "fastly_async_io_extra",
+        "FASTLY_ASYNC_IO",
+        "fastly_async_io/v1",
+        "fastly_backend",
+        "fastly_abi",
+    ] {
+        let bytes = wasm_module(&[("wasi_snapshot_preview1", "fd_write"), (module, "call")]);
+
+        assert_eq!(
+            violation(inspect_wasm(&bytes)),
+            Violation::WasmImport,
+            "should reject {module}"
+        );
+    }
+}
+
+#[test]
+fn non_function_import_is_rejected() {
+    for module in ["fastly_log", "fastly_async_io"] {
+        let mut bytes = b"\0asm\x01\0\0\0".to_vec();
+        let mut body = vec![1];
+        for name in [module, "memory"] {
+            body.push(u8::try_from(name.len()).expect("should fit"));
+            body.extend_from_slice(name.as_bytes());
+        }
+        body.extend_from_slice(&[2, 0, 1]);
+        section(&mut bytes, 2, &body);
+
+        assert_eq!(
+            violation(inspect_wasm(&bytes)),
+            Violation::WasmImport,
+            "should reject non-function imports from {module}"
+        );
+    }
+}
+
+#[test]
+fn component_is_rejected() {
+    assert_eq!(
+        violation(inspect_wasm(b"\0asm\x0d\0\x01\0")),
+        Violation::WasmEncoding,
+        "should reject a component before validation"
+    );
+}
+
+#[test]
+fn non_wasm_is_rejected() {
+    for bytes in [
+        &b""[..],
+        b"\0asm",
+        b"\0asm\x02\0\0\0",
+        b"\x7fELF\x02\x01\x01\0",
+    ] {
+        assert_eq!(violation(inspect_wasm(bytes)), Violation::WasmEncoding);
+    }
+}
+
+#[test]
+fn invalid_core_module_is_rejected() {
+    let mut import_without_type = b"\0asm\x01\0\0\0".to_vec();
+    section(&mut import_without_type, 2, &[1, 1, b'a', 1, b'b', 0, 0]);
+    let mut unknown_section = b"\0asm\x01\0\0\0".to_vec();
+    section(&mut unknown_section, 99, &[0]);
+
+    for bytes in [import_without_type, unknown_section] {
+        assert_eq!(violation(inspect_wasm(&bytes)), Violation::WasmValidation);
+    }
+}
+
+/// Prefix lengths that end on a section boundary and so form a valid module:
+/// the bare header and the header plus the type section.
+const SECTION_BOUNDARIES: [usize; 2] = [8, 14];
+
+#[test]
+fn truncated_modules_are_handled_without_panic() {
+    let bytes = wasm_module(&[
+        ("fastly_log", "write"),
+        ("wasi_snapshot_preview1", "fd_write"),
+    ]);
+
+    for length in 0..bytes.len() {
+        let truncated = &bytes[..length];
+        let result = inspect_wasm(truncated);
+        assert!(
+            result.is_err() || SECTION_BOUNDARIES.contains(&length),
+            "should reject the module truncated to {length} bytes"
+        );
+    }
+}
+
+#[test]
+fn custom_sections_are_recorded_in_file_order_with_sizes() {
+    let bytes = wasm_module_with_customs(
+        &[("fastly_log", "write")],
+        &[
+            (".debug_info", b"info"),
+            ("name", b"xy"),
+            (".debug_info", b""),
+        ],
+    );
+
+    let facts = inspect_wasm(&bytes).expect("should accept a module with custom sections");
+
+    let observed: Vec<(&str, usize)> = facts
+        .custom_sections()
+        .iter()
+        .map(|section| (section.name(), section.size()))
+        .collect();
+    assert_eq!(
+        observed,
+        [(".debug_info", 4), ("name", 2), (".debug_info", 0)],
+        "should record every custom section name and payload size in order"
+    );
+    assert!(
+        inspect_wasm(&wasm_module(&[]))
+            .expect("should accept an empty module")
+            .custom_sections()
+            .is_empty(),
+        "should record no custom sections for a bare module"
+    );
+}
+
+#[test]
+fn debug_sections_are_required_and_nonempty() {
+    let complete = wasm_module_with_customs(
+        &[],
+        &[(".debug_info", b"i"), (".debug_line", b"l"), ("name", b"n")],
+    );
+    inspect_wasm(&complete)
+        .expect("should accept a module with debug sections")
+        .require_debug_sections()
+        .expect("should accept both debug sections");
+
+    let cases: [(&str, Vec<u8>); 4] = [
+        ("stripped", wasm_module_with_customs(&[], &[("name", b"n")])),
+        (
+            "missing line",
+            wasm_module_with_customs(&[], &[(".debug_info", b"i")]),
+        ),
+        (
+            "missing info",
+            wasm_module_with_customs(&[], &[(".debug_line", b"l")]),
+        ),
+        (
+            "empty info",
+            wasm_module_with_customs(&[], &[(".debug_info", b""), (".debug_line", b"l")]),
+        ),
+    ];
+    for (label, bytes) in cases {
+        let facts = inspect_wasm(&bytes).expect("should accept the module itself");
+        assert_eq!(
+            violation(facts.require_debug_sections()),
+            Violation::WasmDebugInfo,
+            "should reject a {label} module for the no-strip check"
+        );
+    }
+}
+
+/// Imports of a minimal Fastly command: WASI plus both downstream hostcalls.
+const FASTLY_COMMAND_IMPORTS: [(&str, &str); 3] = [
+    ("wasi_snapshot_preview1", "fd_write"),
+    ("fastly_http_req", "body_downstream_get"),
+    ("fastly_http_resp", "send_downstream"),
+];
+
+#[test]
+fn fastly_command_entry_abi_is_accepted_and_exports_are_recorded() {
+    let facts = inspect_wasm(&command_module(
+        &FASTLY_COMMAND_IMPORTS,
+        Entry::Nullary,
+        true,
+    ))
+    .expect("should accept a Fastly command module");
+
+    facts
+        .require_fastly_entry_abi()
+        .expect("should accept the Fastly entry ABI");
+    let observed: Vec<(&str, WasmExportKind)> = facts
+        .exports()
+        .iter()
+        .map(|export| (export.name(), export.kind()))
+        .collect();
+    assert_eq!(
+        observed,
+        [
+            (
+                "_start",
+                WasmExportKind::Function {
+                    params: 0,
+                    results: 0
+                }
+            ),
+            ("memory", WasmExportKind::Memory),
+        ],
+        "should record every export with its kind in module order"
+    );
+}
+
+#[test]
+fn wrong_fastly_entry_abi_is_rejected() {
+    let only_wasi = [("wasi_snapshot_preview1", "fd_write")];
+    let without_response = [
+        ("wasi_snapshot_preview1", "fd_write"),
+        ("fastly_http_req", "body_downstream_get"),
+    ];
+    let cases: [(&str, Vec<u8>); 6] = [
+        (
+            "missing _start",
+            command_module(&FASTLY_COMMAND_IMPORTS, Entry::Renamed, true),
+        ),
+        (
+            "_start taking an argument",
+            command_module(&FASTLY_COMMAND_IMPORTS, Entry::TakesI32, true),
+        ),
+        (
+            "unexported memory",
+            command_module(&FASTLY_COMMAND_IMPORTS, Entry::Nullary, false),
+        ),
+        (
+            "plain WASI command",
+            command_module(&only_wasi, Entry::Nullary, true),
+        ),
+        (
+            "missing response hostcalls",
+            command_module(&without_response, Entry::Nullary, true),
+        ),
+        (
+            "library without exports",
+            wasm_module(&FASTLY_COMMAND_IMPORTS),
+        ),
+    ];
+    for (label, bytes) in cases {
+        let facts = inspect_wasm(&bytes).expect("should accept the module itself");
+        assert_eq!(
+            violation(facts.require_fastly_entry_abi()),
+            Violation::WasmAbi,
+            "should reject a {label} as the Fastly entry ABI"
+        );
+    }
+}
+
+#[test]
+fn foreign_host_abi_command_is_rejected_before_the_entry_check() {
+    let bytes = command_module(
+        &[
+            ("fastly_http_req", "body_downstream_get"),
+            ("fastly_http_resp", "send_downstream"),
+            ("wasi:http/types@0.3.0", "handle"),
+        ],
+        Entry::Nullary,
+        true,
+    );
+
+    assert_eq!(
+        violation(inspect_wasm(&bytes)),
+        Violation::WasmImport,
+        "should reject a command importing a foreign host ABI"
+    );
+}
diff --git a/crates/trusted-server-release/src/inspect/wasm.rs b/crates/trusted-server-release/src/inspect/wasm.rs
new file mode 100644
index 0000000000..23b77e478a
--- /dev/null
+++ b/crates/trusted-server-release/src/inspect/wasm.rs
@@ -0,0 +1,159 @@
+//! Core WebAssembly inspection for the Fastly Compute artifact.
+
+use std::collections::BTreeSet;
+
+use error_stack::Report;
+use wasmparser::types::{EntityType, Types};
+use wasmparser::{CompositeInnerType, Parser, Payload, TypeRef, Validator, WasmFeatures};
+
+use super::{
+    Violation, WasmCustomSection, WasmExport, WasmExportKind, WasmFacts, rejected, sha256_hex,
+};
+use crate::error::ReleaseError;
+
+/// Reviewed import modules of the Fastly Compute host ABI.
+///
+/// Observed in release builds of `trusted-server-adapter-fastly`: WASI
+/// preview 1 plus these `fastly_*` hostcall modules. The locked SDK 0.13.1
+/// also uses the reviewed asynchronous I/O module supported by Viceroy 0.21.0.
+/// Adding a module changes the host ABI policy and requires review.
+pub(crate) const FASTLY_IMPORT_MODULES: &[&str] = &[
+    "fastly_async_io",
+    "fastly_cache",
+    "fastly_compute_runtime",
+    "fastly_config_store",
+    "fastly_erl",
+    "fastly_geo",
+    "fastly_http_body",
+    "fastly_http_cache",
+    "fastly_http_downstream",
+    "fastly_http_req",
+    "fastly_http_resp",
+    "fastly_image_optimizer",
+    "fastly_kv_store",
+    "fastly_log",
+    "fastly_purge",
+    "fastly_secret_store",
+    "wasi_snapshot_preview1",
+];
+
+/// Pinned validation feature set: the WebAssembly 2.0 specification.
+const FEATURES: WasmFeatures = WasmFeatures::WASM2;
+
+/// Inspects a final Fastly Compute Wasm artifact.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Inspect`] with a [`Violation`] when the bytes are
+/// a component or not a core module ([`Violation::WasmEncoding`]), fail
+/// validation under [`WasmFeatures::WASM2`] ([`Violation::WasmValidation`]),
+/// or import a non-function item or from a module outside
+/// [`FASTLY_IMPORT_MODULES`] ([`Violation::WasmImport`]).
+pub(crate) fn inspect_wasm(bytes: &[u8]) -> Result<WasmFacts, Report<ReleaseError>> {
+    if Parser::is_component(bytes) {
+        return Err(rejected(
+            Violation::WasmEncoding,
+            "component, not a core module",
+        ));
+    }
+    if !Parser::is_core_wasm(bytes) {
+        return Err(rejected(
+            Violation::WasmEncoding,
+            "missing core module header",
+        ));
+    }
+    let types = Validator::new_with_features(FEATURES)
+        .validate_all(bytes)
+        .map_err(|error| rejected(Violation::WasmValidation, error))?;
+    let exports = exports(&types)?;
+    let (import_modules, function_imports) = imports(bytes)?;
+    if let Some(module) = import_modules
+        .iter()
+        .find(|module| !FASTLY_IMPORT_MODULES.contains(&module.as_str()))
+    {
+        return Err(rejected(
+            Violation::WasmImport,
+            format!("import module {module:?}"),
+        ));
+    }
+    Ok(WasmFacts {
+        sha256: sha256_hex(bytes),
+        import_modules: import_modules.into_iter().collect(),
+        function_imports,
+        custom_sections: custom_sections(bytes)?,
+        exports,
+    })
+}
+
+/// Returns every export of the validated module in module order.
+fn exports(types: &Types) -> Result<Vec<WasmExport>, Report<ReleaseError>> {
+    let types = types.as_ref();
+    let Some(exports) = types.core_exports() else {
+        return Err(rejected(
+            Violation::WasmEncoding,
+            "validated types describe a component",
+        ));
+    };
+    Ok(exports
+        .map(|(name, entity)| {
+            let kind = match entity {
+                EntityType::Func(id) | EntityType::FuncExact(id) => {
+                    match &types[id].composite_type.inner {
+                        CompositeInnerType::Func(function) => WasmExportKind::Function {
+                            params: function.params().len(),
+                            results: function.results().len(),
+                        },
+                        _ => WasmExportKind::Other,
+                    }
+                }
+                EntityType::Memory(_) => WasmExportKind::Memory,
+                EntityType::Table(_) | EntityType::Global(_) | EntityType::Tag(_) => {
+                    WasmExportKind::Other
+                }
+            };
+            WasmExport {
+                name: name.to_owned(),
+                kind,
+            }
+        })
+        .collect())
+}
+
+/// Returns every custom section in file order.
+fn custom_sections(bytes: &[u8]) -> Result<Vec<WasmCustomSection>, Report<ReleaseError>> {
+    let mut sections = Vec::new();
+    for payload in Parser::new(0).parse_all(bytes) {
+        let payload = payload.map_err(|error| rejected(Violation::WasmValidation, error))?;
+        if let Payload::CustomSection(reader) = payload {
+            sections.push(WasmCustomSection {
+                name: reader.name().to_owned(),
+                size: reader.data().len(),
+            });
+        }
+    }
+    Ok(sections)
+}
+
+/// Returns the distinct import modules and the function import count.
+fn imports(bytes: &[u8]) -> Result<(BTreeSet<String>, usize), Report<ReleaseError>> {
+    let parse_error = |error| rejected(Violation::WasmValidation, error);
+    let mut modules = BTreeSet::new();
+    let mut functions = 0;
+    for payload in Parser::new(0).parse_all(bytes) {
+        let Payload::ImportSection(reader) = payload.map_err(parse_error)? else {
+            continue;
+        };
+        for import in reader.into_imports() {
+            let import = import.map_err(parse_error)?;
+            if !matches!(import.ty, TypeRef::Func(_)) {
+                return Err(rejected(
+                    Violation::WasmImport,
+                    format!("non-function import {}::{}", import.module, import.name),
+                ));
+            }
+            modules.insert(import.module.to_owned());
+            functions += 1;
+        }
+    }
+    Ok((modules, functions))
+}
diff --git a/crates/trusted-server-release/src/javascript.rs b/crates/trusted-server-release/src/javascript.rs
new file mode 100644
index 0000000000..5c8b90d821
--- /dev/null
+++ b/crates/trusted-server-release/src/javascript.rs
@@ -0,0 +1,861 @@
+//! Full observed two-installation JS builds and private retained completion.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::ffi::OsString;
+use std::fs;
+use std::path::{Path, PathBuf};
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256};
+
+use crate::boundary::{Boundary, DenialProof};
+use crate::documents::{RawBytes, Role, parse_json, read_bounded_with_check};
+use crate::error::ReleaseError;
+use crate::preparation::{JsAttempt, PreparedJsBuild, preparation_error};
+use crate::process::ProcessOutcome;
+use crate::source::join_inventory;
+
+pub(crate) mod contributions;
+pub(crate) use contributions::RetainedContributions;
+
+/// Exact retained module facts produced by the actual two-side comparison.
+struct Module {
+    filename: String,
+    size: u64,
+    sha256: String,
+}
+
+/// Complete module identity exported only from a rehashed owned JS handoff.
+#[derive(Clone, Debug, serde::Serialize)]
+pub(crate) struct RetainedJsModule {
+    id: String,
+    filename: String,
+    size: u64,
+    sha256: String,
+}
+
+impl RetainedJsModule {
+    /// The approved discovered module identity.
+    pub(crate) fn id(&self) -> &str {
+        &self.id
+    }
+    /// The checked flat bundle filename.
+    pub(crate) fn filename(&self) -> &str {
+        &self.filename
+    }
+    /// Complete final bundle length.
+    pub(crate) fn size(&self) -> u64 {
+        self.size
+    }
+    /// SHA-256 of complete final bundle bytes.
+    pub(crate) fn sha256(&self) -> &str {
+        &self.sha256
+    }
+}
+
+/// Captured immediately after the collector exits, before later writable stages.
+struct CapturedInventory {
+    raw: RawBytes,
+    modules: BTreeMap<String, Module>,
+}
+
+fn verify_captured_output(
+    output: &Path,
+    captured: &CapturedInventory,
+    check: &dyn Fn() -> Result<(), Report<ReleaseError>>,
+) -> Result<(), Report<ReleaseError>> {
+    check()?;
+    let current =
+        read_bounded_with_check(&output.join("tsjs-inventory.json"), Role::Metadata, check)?;
+    if current.bytes != captured.raw.bytes || current.sha256 != captured.raw.sha256 {
+        return Err(preparation_error(
+            "original collector inventory changed after measurement",
+        ));
+    }
+    let bundles = output.join("bundles");
+    let expected: BTreeSet<_> = captured
+        .modules
+        .values()
+        .map(|module| module.filename.clone())
+        .collect();
+    if filenames(&bundles, expected.len())? != expected {
+        return Err(preparation_error("original collector module set changed"));
+    }
+    for module in captured.modules.values() {
+        let current =
+            read_bounded_with_check(&bundles.join(&module.filename), Role::Bundle, check)?;
+        if current.sha256 != module.sha256 || current.bytes.len() as u64 != module.size {
+            return Err(preparation_error("original collector module bytes changed"));
+        }
+    }
+    check()
+}
+
+fn settings_digest(fingerprints: &[[u8; 32]; 2]) -> String {
+    let mut digest = Sha256::new();
+    digest.update(b"source-owned-js-two-install-v2\nnode24.20.0\nnpm11.19.0\nLinux-owned-PID-cleanup\noffline-include-dev\ninstall-umask022\nLANG=C.UTF-8\nLC_ALL=C.UTF-8\nTZ=UTC\nrelease-tests-1\nfull-registered-typecheck\nfull-final-module-bytes\n");
+    for fingerprint in fingerprints {
+        digest.update(fingerprint);
+    }
+    hex::encode(digest.finalize())
+}
+
+fn finalize_execution(
+    execution: Result<JsBuildCompleted, Report<ReleaseError>>,
+    cleanup: Result<(), Report<ReleaseError>>,
+) -> Result<JsBuildCompleted, Report<ReleaseError>> {
+    match (execution, cleanup) {
+        (Ok(completed), Ok(())) => {
+            completed.rehash_for_handoff()?;
+            Ok(completed)
+        }
+        (Ok(_), Err(error)) => Err(error),
+        (Err(error), Ok(())) => Err(error),
+        (Err(error), Err(cleanup)) => {
+            Err(error.attach(format!("private JS cleanup also failed: {cleanup:?}")))
+        }
+    }
+}
+
+/// A completed private execution, unavailable from JSON assertions or paths.
+///
+/// Only the actual successful preparation/install/build/test/negative/control/
+/// equality path below constructs this value. Production tool selection remains
+/// unavailable until authenticated bootstrap and qualification are complete.
+pub(crate) struct JsBuildCompleted {
+    directory: tempfile::TempDir,
+    source_commit: String,
+    tools_sha256: String,
+    settings_sha256: String,
+    inventory_sha256: String,
+    observation_sha256: String,
+    modules: BTreeMap<String, Module>,
+    tests: [u64; 2],
+    attempt: JsAttempt,
+}
+
+impl JsBuildCompleted {
+    /// Exports conservative rendered origins from the checked original inventory.
+    ///
+    /// # Errors
+    ///
+    /// Rejects changed handoffs, expired attempts and inconsistent origin joins.
+    pub(crate) fn retained_contributions(
+        &self,
+    ) -> Result<RetainedContributions, Report<ReleaseError>> {
+        contributions::export(self)
+    }
+    /// Exports module facts after checking the complete retained handoff.
+    ///
+    /// # Errors
+    ///
+    /// Rejects changed files, aliases or expired preparation attempts.
+    pub(crate) fn retained_modules(&self) -> Result<Vec<RetainedJsModule>, Report<ReleaseError>> {
+        self.rehash_for_handoff()?;
+        Ok(self
+            .modules
+            .iter()
+            .map(|(id, module)| RetainedJsModule {
+                id: id.clone(),
+                filename: module.filename.clone(),
+                size: module.size,
+                sha256: module.sha256.clone(),
+            })
+            .collect())
+    }
+
+    /// Returns the approved source bound to the executed build.
+    pub(crate) fn source_commit(&self) -> &str {
+        &self.source_commit
+    }
+    /// Returns the exact selected native tool-input digest.
+    pub(crate) fn tools_sha256(&self) -> &str {
+        &self.tools_sha256
+    }
+    /// Returns the fixed recipe and both actual execution-boundary settings digest.
+    pub(crate) fn settings_sha256(&self) -> &str {
+        &self.settings_sha256
+    }
+    /// Returns the raw original A inventory digest.
+    pub(crate) fn inventory_sha256(&self) -> &str {
+        &self.inventory_sha256
+    }
+    /// Returns the successful registered test counts of both independent JS builds.
+    pub(crate) fn test_counts(&self) -> [u64; 2] {
+        self.tests
+    }
+
+    /// Rejoins the retained A inventory and all exact module bytes before handoff.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if an owned retained file changed, vanished or appeared.
+    pub(crate) fn rehash_for_handoff(&self) -> Result<&Path, Report<ReleaseError>> {
+        self.attempt.check()?;
+        let expected = BTreeSet::from([
+            "bundles".to_owned(),
+            "tsjs-inventory.json".to_owned(),
+            "npm-observation.json".to_owned(),
+        ]);
+        if filenames(self.directory.path(), expected.len())? != expected {
+            return Err(preparation_error(
+                "retained JS root contains an unrecorded entry",
+            ));
+        }
+        let inventory = read_bounded_with_check(
+            &self.directory.path().join("tsjs-inventory.json"),
+            Role::Metadata,
+            &|| self.attempt.check(),
+        )?;
+        if inventory.sha256 != self.inventory_sha256 {
+            return Err(preparation_error("retained original JS inventory changed"));
+        }
+        let observation = read_bounded_with_check(
+            &self.directory.path().join("npm-observation.json"),
+            Role::Metadata,
+            &|| self.attempt.check(),
+        )?;
+        if observation.sha256 != self.observation_sha256 {
+            return Err(preparation_error("retained actual npm observation changed"));
+        }
+        let bundles = self.directory.path().join("bundles");
+        let expected: BTreeSet<_> = self
+            .modules
+            .values()
+            .map(|module| module.filename.clone())
+            .collect();
+        let actual = filenames(&bundles, expected.len())?;
+        if actual != expected {
+            return Err(preparation_error("retained JS module set changed"));
+        }
+        for module in self.modules.values() {
+            let raw =
+                read_bounded_with_check(&bundles.join(&module.filename), Role::Bundle, &|| {
+                    self.attempt.check()
+                })?;
+            if raw.sha256 != module.sha256 || raw.bytes.len() as u64 != module.size {
+                return Err(preparation_error("retained JS module changed"));
+            }
+        }
+        Ok(self.directory.path())
+    }
+}
+
+#[cfg(test)]
+impl JsBuildCompleted {
+    /// Builds a retained fixture bound to `source_commit` without executing a build.
+    ///
+    /// Only tests construct this; production completion stays on the real path.
+    pub(crate) fn fixture_for_tests(source_commit: &str) -> Self {
+        let directory = tempfile::tempdir().expect("should create retained fixture");
+        fs::create_dir(directory.path().join("bundles")).expect("should create bundle root");
+        let inventory = b"fictional original inventory";
+        let observation = b"fictional private observation";
+        let module = b"fictional module";
+        fs::write(directory.path().join("tsjs-inventory.json"), inventory)
+            .expect("should write exact fixture inventory");
+        fs::write(directory.path().join("npm-observation.json"), observation)
+            .expect("should write exact fixture observation");
+        fs::write(directory.path().join("bundles/tsjs-core.js"), module)
+            .expect("should write fixture module");
+        JsBuildCompleted {
+            directory,
+            source_commit: source_commit.to_owned(),
+            tools_sha256: "b".repeat(64),
+            settings_sha256: "c".repeat(64),
+            inventory_sha256: hex::encode(Sha256::digest(inventory)),
+            observation_sha256: hex::encode(Sha256::digest(observation)),
+            modules: BTreeMap::from([(
+                "core".to_owned(),
+                Module {
+                    filename: "tsjs-core.js".to_owned(),
+                    size: module.len() as u64,
+                    sha256: hex::encode(Sha256::digest(module)),
+                },
+            )]),
+            tests: [1, 1],
+            // Real-fixture denial cases bind after a full Apple developer-tool
+            // verify, which exceeded a 30-second lifetime on a hosted
+            // macos-15 runner (run 39552419463), so allow ten minutes.
+            attempt: JsAttempt::new(
+                std::time::Instant::now() + std::time::Duration::from_secs(10 * 60),
+                crate::process::Cancellation::default(),
+            ),
+        }
+    }
+}
+
+fn filenames(root: &Path, limit: usize) -> Result<BTreeSet<String>, Report<ReleaseError>> {
+    if !fs::symlink_metadata(root)
+        .map_err(preparation_error)?
+        .is_dir()
+    {
+        return Err(preparation_error(
+            "retained JS directory changed type or became an alias",
+        ));
+    }
+    let mut names = BTreeSet::new();
+    for entry in fs::read_dir(root).map_err(preparation_error)? {
+        let name = entry
+            .map_err(preparation_error)?
+            .file_name()
+            .into_string()
+            .map_err(|_| preparation_error("bundle name is not UTF-8"))?;
+        if !names.insert(name) || names.len() > limit {
+            return Err(preparation_error("unexpected retained module entries"));
+        }
+    }
+    Ok(names)
+}
+
+fn inventory_modules(
+    bytes: &[u8],
+    expected: &[String],
+) -> Result<BTreeMap<String, Module>, Report<ReleaseError>> {
+    let inventory = parse_json(bytes, Role::Metadata)?;
+    let array = inventory["modules"]
+        .as_array()
+        .ok_or_else(|| preparation_error("JS inventory has no module table"))?;
+    let mut modules = BTreeMap::new();
+    let mut previous = None::<String>;
+    for entry in array {
+        let id = entry["id"]
+            .as_str()
+            .ok_or_else(|| preparation_error("JS module has no id"))?;
+        if !expected.iter().any(|expected| expected == id)
+            || previous.as_deref().is_some_and(|previous| previous >= id)
+        {
+            return Err(preparation_error(
+                "JS module set is untracked, duplicate or unordered",
+            ));
+        }
+        let filename = entry["filename"]
+            .as_str()
+            .ok_or_else(|| preparation_error("JS module has no filename"))?;
+        if filename != format!("tsjs-{id}.js") {
+            return Err(preparation_error(
+                "JS module filename differs from tracked identity",
+            ));
+        }
+        let size = entry["size"]
+            .as_u64()
+            .filter(|size| *size > 0 && *size <= 32 * 1024 * 1024)
+            .ok_or_else(|| preparation_error("JS module size is invalid"))?;
+        let sha256 = entry["sha256"]
+            .as_str()
+            .filter(|digest| {
+                digest.len() == 64
+                    && digest
+                        .bytes()
+                        .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+            })
+            .ok_or_else(|| preparation_error("JS module digest is invalid"))?;
+        modules.insert(
+            id.to_owned(),
+            Module {
+                filename: filename.to_owned(),
+                size,
+                sha256: sha256.to_owned(),
+            },
+        );
+        previous = Some(id.to_owned());
+    }
+    if modules.keys().ne(expected.iter()) {
+        return Err(preparation_error(
+            "JS inventory does not cover every tracked module",
+        ));
+    }
+    Ok(modules)
+}
+
+fn compare_modules(
+    first: &Path,
+    second: &Path,
+    modules: &BTreeMap<String, Module>,
+    check: &dyn Fn() -> Result<(), Report<ReleaseError>>,
+) -> Result<(), Report<ReleaseError>> {
+    let expected: BTreeSet<_> = modules
+        .values()
+        .map(|module| module.filename.clone())
+        .collect();
+    if filenames(first, expected.len())? != expected
+        || filenames(second, expected.len())? != expected
+    {
+        return Err(preparation_error(
+            "independent JS build bundle sets differ from approved source",
+        ));
+    }
+    for module in modules.values() {
+        check()?;
+        let first = read_bounded_with_check(&first.join(&module.filename), Role::Bundle, check)?;
+        let second = read_bounded_with_check(&second.join(&module.filename), Role::Bundle, check)?;
+        if first.bytes != second.bytes
+            || first.sha256 != module.sha256
+            || first.bytes.len() as u64 != module.size
+        {
+            return Err(preparation_error(
+                "final JS module bytes differ between the independent builds",
+            ));
+        }
+    }
+    Ok(())
+}
+
+fn test_report(
+    bytes: &[u8],
+    expected: &BTreeSet<String>,
+    execution_library: &Path,
+) -> Result<u64, Report<ReleaseError>> {
+    let report = parse_json(bytes, Role::Companion)?;
+    let total = report["numTotalTests"]
+        .as_u64()
+        .filter(|total| *total > 0)
+        .ok_or_else(|| preparation_error("registered JS test suite selected zero tests"))?;
+    if report["success"] != true
+        || report["numFailedTests"] != 0
+        || report["numPassedTests"] != total
+        || report["numPendingTests"] != 0
+    {
+        return Err(preparation_error(
+            "full registered JS tests did not all pass",
+        ));
+    }
+    let results = report["testResults"]
+        .as_array()
+        .ok_or_else(|| preparation_error("JS tests omitted per-file results"))?;
+    let mut actual = BTreeSet::new();
+    for result in results {
+        let name = result["name"]
+            .as_str()
+            .ok_or_else(|| preparation_error("JS test result lacks its file"))?;
+        let relative = Path::new(name)
+            .strip_prefix(execution_library)
+            .map_err(preparation_error)?
+            .to_str()
+            .ok_or_else(|| preparation_error("JS test result is not UTF-8"))?;
+        if result["status"] != "passed" || !expected.contains(relative) {
+            return Err(preparation_error(
+                "JS test file failed or is not registered",
+            ));
+        }
+        actual.insert(relative.to_owned());
+    }
+    if actual != *expected {
+        return Err(preparation_error(
+            "JS test/type-check report omits registered files",
+        ));
+    }
+    Ok(total)
+}
+
+// Failure diagnostics deliberately exclude assertions, stacks and child output.
+fn vitest_failure_diagnostic(
+    bytes: &[u8],
+    expected: &BTreeSet<String>,
+    execution_library: &Path,
+) -> Result<String, Report<ReleaseError>> {
+    let report = parse_json(bytes, Role::Companion)?;
+    let results = report["testResults"]
+        .as_array()
+        .ok_or_else(|| preparation_error("Vitest report lacks suite results"))?;
+    let sanitize = |name: &str| -> String {
+        name.chars()
+            .take(256)
+            .map(|character| {
+                if character.is_ascii() && !character.is_ascii_control() {
+                    character
+                } else {
+                    '?'
+                }
+            })
+            .collect()
+    };
+    let mut names = Vec::new();
+    for result in results {
+        if names.len() >= 16 {
+            break;
+        }
+        let Some(relative) = result["name"].as_str().and_then(|name| {
+            Path::new(name)
+                .strip_prefix(execution_library)
+                .ok()?
+                .to_str()
+        }) else {
+            continue;
+        };
+        if !expected.contains(relative) {
+            continue;
+        }
+        if result["status"] == "failed" {
+            names.push(format!("suite failed: {}", sanitize(relative)));
+        }
+        if let Some(assertions) = result["assertionResults"].as_array() {
+            for assertion in assertions {
+                if names.len() >= 16 {
+                    break;
+                }
+                if assertion["status"] == "failed"
+                    && let Some(name) = assertion["fullName"].as_str()
+                {
+                    names.push(format!("test failed: {}", sanitize(name)));
+                }
+            }
+        }
+    }
+    Ok(if names.is_empty() {
+        "Vitest failed without registered failed names".to_owned()
+    } else {
+        format!("Vitest failed names (at most 16): {}", names.join("; "))
+    })
+}
+
+struct MissingFiles {
+    paths: Vec<(PathBuf, PathBuf)>,
+    _directory: tempfile::TempDir,
+}
+impl MissingFiles {
+    fn remove(paths: &[PathBuf]) -> Result<Self, Report<ReleaseError>> {
+        let directory = tempfile::tempdir().map_err(preparation_error)?;
+        let mut missing = Self {
+            paths: Vec::new(),
+            _directory: directory,
+        };
+        for (index, path) in paths.iter().enumerate() {
+            let destination = missing._directory.path().join(index.to_string());
+            fs::rename(path, &destination).map_err(preparation_error)?;
+            missing.paths.push((path.clone(), destination));
+        }
+        Ok(missing)
+    }
+    fn restore(&mut self) -> Result<(), Report<ReleaseError>> {
+        while let Some((original, temporary)) = self.paths.last() {
+            fs::rename(temporary, original).map_err(preparation_error)?;
+            self.paths.pop();
+        }
+        Ok(())
+    }
+}
+impl Drop for MissingFiles {
+    fn drop(&mut self) {
+        let _ = self.restore();
+    }
+}
+
+impl PreparedJsBuild<'_> {
+    fn prohibited_install_download_probe(
+        &self,
+        index: usize,
+        boundary: &Boundary,
+        proof: &DenialProof,
+        captured: &CapturedInventory,
+    ) -> Result<(), Report<ReleaseError>> {
+        let side = &self.sides[index];
+        let probe = side
+            .state
+            .path()
+            .join("install-download/node_modules/esbuild");
+        fs::create_dir_all(probe.join("lib")).map_err(preparation_error)?;
+        let mut originals = BTreeMap::new();
+        for relative in ["install.js", "package.json", "lib/main.js"] {
+            let raw = read_bounded_with_check(
+                &side.library().join("node_modules/esbuild").join(relative),
+                Role::Bundle,
+                &|| self.attempt.check(),
+            )?;
+            fs::write(probe.join(relative), &raw.bytes).map_err(preparation_error)?;
+            originals.insert(relative, raw.sha256);
+        }
+        // This separate tree contains neither a native package nor an optimized
+        // binary. Omitting npm from PATH exercises esbuild's actual direct
+        // download fallback without waiting through npm's network retries.
+        let command = self
+            .command_with_npm_path(index, boundary, false)?
+            .arguments([boundary
+                .execution_path(&probe.join("install.js"))?
+                .into_os_string()]);
+        let result = boundary.run_confined(&command, proof)?;
+        verify_captured_output(&side.output(), captured, &|| self.attempt.check())?;
+        let stderr = std::str::from_utf8(result.stderr()).map_err(preparation_error)?;
+        if result.outcome() != (ProcessOutcome::Exited { code: 1 })
+            || !stderr.contains("[esbuild] Trying to download ")
+            || !stderr.contains("Failed to install package")
+        {
+            return Err(preparation_error(
+                "actual missing-native install download did not fail under denial",
+            ));
+        }
+        let mut pending = vec![probe.clone()];
+        let mut remaining = originals;
+        while let Some(directory) = pending.pop() {
+            self.attempt.check()?;
+            for entry in fs::read_dir(directory).map_err(preparation_error)? {
+                let entry = entry.map_err(preparation_error)?;
+                let path = entry.path();
+                let metadata = fs::symlink_metadata(&path).map_err(preparation_error)?;
+                if metadata.is_dir() {
+                    pending.push(path);
+                } else {
+                    let relative = path
+                        .strip_prefix(&probe)
+                        .map_err(preparation_error)?
+                        .to_str()
+                        .ok_or_else(|| preparation_error("probe member is not UTF-8"))?;
+                    let expected = remaining.remove(relative).ok_or_else(|| {
+                        preparation_error("denied install produced a replacement native tool")
+                    })?;
+                    if read_bounded_with_check(&path, Role::Bundle, &|| self.attempt.check())?
+                        .sha256
+                        != expected
+                    {
+                        return Err(preparation_error("denied install changed probe inputs"));
+                    }
+                }
+            }
+        }
+        if !remaining.is_empty() {
+            return Err(preparation_error("denied install removed probe inputs"));
+        }
+        side.verify_source()?;
+        self.check()
+    }
+
+    fn missing_tool_probes(
+        &self,
+        index: usize,
+        boundary: &Boundary,
+        proof: &DenialProof,
+        captured: &CapturedInventory,
+    ) -> Result<(), Report<ReleaseError>> {
+        let side = &self.sides[index];
+        let architecture = match std::env::consts::ARCH {
+            "x86_64" => "x64",
+            "aarch64" => "arm64",
+            _ => {
+                return Err(preparation_error(
+                    "unsupported native JS probe architecture",
+                ));
+            }
+        };
+        let cases = [
+            (vec![side.library().join(format!("node_modules/@esbuild/linux-{architecture}/bin/esbuild")), side.library().join("node_modules/esbuild/bin/esbuild"), side.library().join("node_modules/.bin/esbuild")], "const e=require('esbuild'); e.transformSync('const x=1',{minify:true})"),
+            (vec![side.library().join(format!("node_modules/@rollup/rollup-linux-{architecture}-gnu/rollup.linux-{architecture}-gnu.node"))], "require('rollup')"),
+        ];
+        for (paths, operation) in cases {
+            let mut missing = MissingFiles::remove(&paths)?;
+            let script = format!(
+                "try{{{operation};process.exitCode=0}}catch{{process.stdout.write('TS_RELEASE_MISSING_TOOL_DENIED\\n');process.exitCode=73}}"
+            );
+            let command = self
+                .command(index, boundary)?
+                .arguments([OsString::from("--eval"), OsString::from(script)]);
+            let result = boundary.run_confined(&command, proof);
+            missing.restore()?;
+            let result = result?;
+            verify_captured_output(&side.output(), captured, &|| self.attempt.check())?;
+            if result.outcome() != (ProcessOutcome::Exited { code: 73 })
+                || result.stdout() != b"TS_RELEASE_MISSING_TOOL_DENIED\n"
+            {
+                return Err(preparation_error(
+                    "missing native tool fetched a substitute or lacked an actual denied failure",
+                ));
+            }
+            side.verify_source()?;
+            self.check()?;
+        }
+        Ok(())
+    }
+
+    /// Executes both independent full builds under their exact proven boundaries.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for any input mutation, installation/hook/control failure,
+    /// failed or incomplete test/type-check suite, or any final module difference.
+    pub(crate) fn run(
+        self,
+        boundaries: [&Boundary; 2],
+        proofs: [&DenialProof; 2],
+    ) -> Result<JsBuildCompleted, Report<ReleaseError>> {
+        let execution = self.execute(boundaries, proofs);
+        let cleanup = self.cleanup();
+        finalize_execution(execution, cleanup)
+    }
+
+    fn execute(
+        &self,
+        boundaries: [&Boundary; 2],
+        proofs: [&DenialProof; 2],
+    ) -> Result<JsBuildCompleted, Report<ReleaseError>> {
+        for (index, boundary) in boundaries.iter().enumerate() {
+            if !boundary.matches_roots(&self.boundary_roots(index)?)
+                || !boundary.has_owned_descendant_cleanup()
+            {
+                return Err(preparation_error(
+                    "JS execution requires independent exact Linux boundary roots",
+                ));
+            }
+        }
+        let mut counts = [0_u64; 2];
+        let mut observations = Vec::new();
+        let mut captured_inventories = Vec::new();
+        for index in 0..2 {
+            observations.push(self.install(index, boundaries[index], proofs[index])?);
+            self.run_command(
+                index,
+                boundaries[index],
+                proofs[index],
+                self.collector_arguments(index, boundaries[index])?,
+            )?;
+            let side = &self.sides[index];
+            let raw = read_bounded_with_check(
+                &side.output().join("tsjs-inventory.json"),
+                Role::Metadata,
+                &|| self.attempt.check(),
+            )?;
+            join_inventory(self.source, &raw.bytes)?;
+            let modules = inventory_modules(&raw.bytes, &self.module_ids)?;
+            let captured = CapturedInventory { raw, modules };
+            verify_captured_output(&side.output(), &captured, &|| self.attempt.check())?;
+            self.missing_tool_probes(index, boundaries[index], proofs[index], &captured)?;
+            self.prohibited_install_download_probe(
+                index,
+                boundaries[index],
+                proofs[index],
+                &captured,
+            )?;
+            let arguments = vec![
+                boundaries[index]
+                    .execution_path(&side.library().join("node_modules/vitest/vitest.mjs"))?
+                    .into_os_string(),
+                OsString::from("run"),
+                OsString::from("--reporter=json"),
+                OsString::from("--outputFile"),
+                boundaries[index]
+                    .execution_path(&side.output().join("vitest.json"))?
+                    .into_os_string(),
+            ];
+            if let Err(mut error) =
+                self.run_command(index, boundaries[index], proofs[index], arguments)
+            {
+                let diagnostic = read_bounded_with_check(
+                    &side.output().join("vitest.json"),
+                    Role::Companion,
+                    &|| self.attempt.check(),
+                )
+                .and_then(|report| {
+                    vitest_failure_diagnostic(
+                        &report.bytes,
+                        &side.expected_tests,
+                        &boundaries[index].execution_path(&side.library())?,
+                    )
+                });
+                error = error.attach(
+                    diagnostic
+                        .unwrap_or_else(|_| "Bounded Vitest failure names unavailable".to_owned()),
+                );
+                if let Err(changed) =
+                    verify_captured_output(&side.output(), &captured, &|| self.attempt.check())
+                {
+                    error = error.attach(format!(
+                        "post-failure collector recheck failed: {changed:?}"
+                    ));
+                }
+                if let Err(changed) = side.verify_source() {
+                    error =
+                        error.attach(format!("post-failure source recheck failed: {changed:?}"));
+                }
+                return Err(error);
+            }
+            verify_captured_output(&side.output(), &captured, &|| self.attempt.check())?;
+            let report = read_bounded_with_check(
+                &side.output().join("vitest.json"),
+                Role::Companion,
+                &|| self.attempt.check(),
+            )?;
+            counts[index] = test_report(
+                &report.bytes,
+                &side.expected_tests,
+                &boundaries[index].execution_path(&side.library())?,
+            )?;
+            side.verify_source()?;
+            captured_inventories.push(captured);
+        }
+        self.check()?;
+        for (index, captured) in captured_inventories.iter().enumerate() {
+            verify_captured_output(&self.sides[index].output(), captured, &|| {
+                self.attempt.check()
+            })?;
+        }
+        let [first, second]: [CapturedInventory; 2] = captured_inventories
+            .try_into()
+            .map_err(|_| preparation_error("both original collector inventories are required"))?;
+        let modules = first.modules;
+        for (id, first) in &modules {
+            let last = second
+                .modules
+                .get(id)
+                .ok_or_else(|| preparation_error("B omitted a tracked module"))?;
+            if first.sha256 != last.sha256 || first.size != last.size {
+                return Err(preparation_error(
+                    "independent JS build inventory module measurements differ",
+                ));
+            }
+        }
+        compare_modules(
+            &self.sides[0].output().join("bundles"),
+            &self.sides[1].output().join("bundles"),
+            &modules,
+            &|| self.attempt.check(),
+        )?;
+        let directory = tempfile::tempdir().map_err(preparation_error)?;
+        fs::create_dir(directory.path().join("bundles")).map_err(preparation_error)?;
+        fs::write(
+            directory.path().join("tsjs-inventory.json"),
+            &first.raw.bytes,
+        )
+        .map_err(preparation_error)?;
+        let observation = &observations
+            .first()
+            .ok_or_else(|| preparation_error("actual A installation observation is absent"))?
+            .raw;
+        fs::write(directory.path().join("npm-observation.json"), observation)
+            .map_err(preparation_error)?;
+        for module in modules.values() {
+            let raw = read_bounded_with_check(
+                &self.sides[0]
+                    .output()
+                    .join("bundles")
+                    .join(&module.filename),
+                Role::Bundle,
+                &|| self.attempt.check(),
+            )?;
+            if raw.sha256 != module.sha256 || raw.bytes.len() as u64 != module.size {
+                return Err(preparation_error("A output changed before retention"));
+            }
+            fs::write(
+                directory.path().join("bundles").join(&module.filename),
+                raw.bytes,
+            )
+            .map_err(preparation_error)?;
+        }
+        let completed = JsBuildCompleted {
+            directory,
+            source_commit: self.source.commit().as_str().to_owned(),
+            tools_sha256: self.tools_digest.clone(),
+            settings_sha256: settings_digest(&[
+                boundaries[0].execution_fingerprint(),
+                boundaries[1].execution_fingerprint(),
+            ]),
+            inventory_sha256: first.raw.sha256,
+            observation_sha256: hex::encode(Sha256::digest(observation)),
+            modules,
+            tests: counts,
+            attempt: self.attempt.clone(),
+        };
+        completed.rehash_for_handoff()?;
+        Ok(completed)
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/trusted-server-release/src/javascript/contributions.rs b/crates/trusted-server-release/src/javascript/contributions.rs
new file mode 100644
index 0000000000..25fb2f957a
--- /dev/null
+++ b/crates/trusted-server-release/src/javascript/contributions.rs
@@ -0,0 +1,770 @@
+//! Checked informational exports; rendered membership is conservative, not final-function attribution.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use error_stack::Report;
+use serde_json::Value;
+#[cfg(test)]
+use sha2::Digest as _;
+
+use super::{JsBuildCompleted, inventory_modules};
+use crate::documents::{Role, parse_json, read_bounded_with_check};
+use crate::error::ReleaseError;
+use crate::preparation::preparation_error;
+
+type Result<T> = core::result::Result<T, Report<ReleaseError>>;
+
+/// Original collector facts exported only after the owning handoff is rehashed.
+///
+/// These observations grant no execution, qualification or complete-coverage authority.
+#[derive(Debug, serde::Serialize)]
+pub(crate) struct RetainedContributions {
+    #[serde(skip)]
+    raw_inventory: Vec<u8>,
+    inventory_sha256: String,
+    inventory: Inventory,
+}
+
+#[derive(Debug, serde::Serialize)]
+struct Inventory {
+    schema_version: u64,
+    source_commit: String,
+    modules: Vec<ModuleContributions>,
+    materials: Vec<Material>,
+    tools: Vec<Tool>,
+}
+
+/// Conservative post-Rollup origins for a complete final bundle.
+#[derive(Debug, serde::Serialize)]
+pub(crate) struct ModuleContributions {
+    id: String,
+    filename: String,
+    size: u64,
+    sha256: String,
+    contributions: Vec<Contribution>,
+}
+
+/// A positively rendered origin; later minification can remove its code.
+#[derive(Debug, serde::Serialize)]
+pub(crate) struct Contribution {
+    #[serde(flatten)]
+    origin: Origin,
+    stage: String,
+    rendered_length: u64,
+}
+
+/// Checked original-source identity or a reviewed generated producer observation.
+#[derive(Clone, Debug, serde::Serialize)]
+#[serde(tag = "kind", rename_all = "kebab-case")]
+pub(crate) enum Origin {
+    Source {
+        path: String,
+        transform: String,
+        sha256: String,
+    },
+    Npm {
+        lock_path: String,
+        package_name: String,
+        package_version: String,
+        integrity: String,
+        path: String,
+        transform: String,
+        sha256: String,
+    },
+    Generated {
+        id: String,
+        plugin: String,
+        owner_lock_path: String,
+        generated_sha256: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        input: Option<Box<Origin>>,
+    },
+}
+
+/// Retained material observations, with structured trees distinct from raw files.
+#[derive(Clone, Debug, serde::Serialize)]
+#[serde(tag = "kind", rename_all = "kebab-case")]
+pub(crate) enum Material {
+    Source {
+        id: String,
+        path: String,
+        sha256: String,
+    },
+    NpmPackage {
+        id: String,
+        lock_path: String,
+        name: String,
+        version: String,
+        integrity: String,
+        installed_tree_sha256: String,
+    },
+    ToolDistribution {
+        id: String,
+        name: String,
+        version: String,
+        sha256: String,
+    },
+    LifecycleEvent {
+        id: String,
+        package_material_id: String,
+        event: String,
+        script_sha256: String,
+    },
+    LifecycleOutput {
+        id: String,
+        package_material_id: String,
+        event: String,
+        script_sha256: String,
+        path: String,
+        size: u64,
+        sha256: String,
+    },
+}
+
+/// A collector tool role joined to its measured distribution material.
+#[derive(Debug, serde::Serialize)]
+pub(crate) struct Tool {
+    name: String,
+    version: String,
+    role: String,
+    material_id: String,
+}
+
+impl RetainedContributions {
+    /// Returns the exact original collector inventory bytes.
+    pub(crate) fn raw_inventory(&self) -> &[u8] {
+        &self.raw_inventory
+    }
+    /// Returns the approved collector source identity.
+    pub(crate) fn source_commit(&self) -> &str {
+        &self.inventory.source_commit
+    }
+    /// Returns the raw original inventory digest, not a reserialization digest.
+    pub(crate) fn inventory_sha256(&self) -> &str {
+        &self.inventory_sha256
+    }
+    /// Returns the checked conservative bundle observations.
+    pub(crate) fn modules(&self) -> &[ModuleContributions] {
+        &self.inventory.modules
+    }
+    /// Returns observed materials without implying they contribute runtime bytes.
+    pub(crate) fn materials(&self) -> &[Material] {
+        &self.inventory.materials
+    }
+    /// Returns checked tool-to-distribution joins from the original collector.
+    pub(crate) fn tools(&self) -> &[Tool] {
+        &self.inventory.tools
+    }
+}
+
+impl ModuleContributions {
+    /// Returns the checked complete bundle filename.
+    pub(crate) fn filename(&self) -> &str {
+        &self.filename
+    }
+    /// Returns complete final bundle length.
+    pub(crate) fn size(&self) -> u64 {
+        self.size
+    }
+    /// Returns the discovered module identity.
+    pub(crate) fn id(&self) -> &str {
+        &self.id
+    }
+    /// Returns the complete final bundle digest.
+    pub(crate) fn sha256(&self) -> &str {
+        &self.sha256
+    }
+    /// Returns conservative rendered origins, before final minification.
+    pub(crate) fn contributions(&self) -> &[Contribution] {
+        &self.contributions
+    }
+}
+
+impl Contribution {
+    /// Returns the observed contribution stage before later minification.
+    pub(crate) fn stage(&self) -> &str {
+        &self.stage
+    }
+    /// Returns checked ownership without implying final-function reachability.
+    pub(crate) fn origin(&self) -> &Origin {
+        &self.origin
+    }
+    /// Returns positive length at the recorded Rollup observation stage.
+    pub(crate) fn rendered_length(&self) -> u64 {
+        self.rendered_length
+    }
+}
+
+impl Tool {
+    /// Returns the observed tool identity.
+    pub(crate) fn name(&self) -> &str {
+        &self.name
+    }
+    /// Returns the observed tool version.
+    pub(crate) fn version(&self) -> &str {
+        &self.version
+    }
+    /// Returns its recorded build role.
+    pub(crate) fn role(&self) -> &str {
+        &self.role
+    }
+    /// Returns its checked distribution material identity.
+    pub(crate) fn material_id(&self) -> &str {
+        &self.material_id
+    }
+}
+
+pub(super) fn export(completed: &JsBuildCompleted) -> Result<RetainedContributions> {
+    let root = completed.rehash_for_handoff()?;
+    let raw = read_bounded_with_check(&root.join("tsjs-inventory.json"), Role::Metadata, &|| {
+        completed.attempt.check()
+    })?;
+    if raw.sha256 != completed.inventory_sha256 {
+        return Err(preparation_error(
+            "original JS inventory changed during export",
+        ));
+    }
+    let value = parse_json(&raw.bytes, Role::Metadata)?;
+    fields(
+        &value,
+        &[
+            "schema_version",
+            "source_commit",
+            "modules",
+            "materials",
+            "tools",
+        ],
+    )?;
+    if value["schema_version"] != 1 || value["source_commit"] != completed.source_commit {
+        return Err(preparation_error(
+            "JS contribution source or schema differs",
+        ));
+    }
+    let expected: Vec<_> = completed.modules.keys().cloned().collect();
+    let modules = inventory_modules(&raw.bytes, &expected)?;
+    for (id, parsed) in &modules {
+        let owned = &completed.modules[id];
+        if parsed.filename != owned.filename
+            || parsed.size != owned.size
+            || parsed.sha256 != owned.sha256
+        {
+            return Err(preparation_error(
+                "contribution module differs from owned module",
+            ));
+        }
+    }
+    let material_values = array(&value["materials"])?;
+    let mut material_ids = BTreeMap::new();
+    let mut materials = Vec::new();
+    for entry in material_values {
+        let id = text(entry, "id")?;
+        if material_ids.insert(id.clone(), entry).is_some() {
+            return Err(preparation_error("duplicate JS material identity"));
+        }
+        materials.push(material(entry)?);
+    }
+    for material in &materials {
+        validate_material_join(material, &material_ids)?;
+    }
+    let mut exported_modules = Vec::new();
+    let mut original_files = BTreeMap::new();
+    for entry in array(&value["modules"])? {
+        fields(
+            entry,
+            &["id", "filename", "size", "sha256", "contributions"],
+        )?;
+        let mut contributions = Vec::new();
+        let mut origins = BTreeSet::new();
+        for observed in array(&entry["contributions"])? {
+            if observed["stage"] != "rollup-rendered" {
+                return Err(preparation_error("unknown JS contribution stage"));
+            }
+            let rendered_length = observed["rendered_length"]
+                .as_u64()
+                .filter(|n| *n > 0 && *n <= 32 * 1024 * 1024)
+                .ok_or_else(|| preparation_error("invalid rendered contribution length"))?;
+            let origin = origin(observed, &material_ids, true)?;
+            consistent_originals(&origin, &mut original_files)?;
+            let identity = origin_key(&origin);
+            if !origins.insert(identity) {
+                return Err(preparation_error("duplicate JS rendered origin"));
+            }
+            contributions.push(Contribution {
+                origin,
+                stage: "rollup-rendered".to_owned(),
+                rendered_length,
+            });
+        }
+        let module = &modules[&text(entry, "id")?];
+        exported_modules.push(ModuleContributions {
+            id: text(entry, "id")?,
+            filename: module.filename.clone(),
+            size: module.size,
+            sha256: module.sha256.clone(),
+            contributions,
+        });
+    }
+    let mut names = BTreeSet::new();
+    let mut tools = Vec::new();
+    for entry in array(&value["tools"])? {
+        fields(entry, &["name", "version", "role", "material_id"])?;
+        let tool = Tool {
+            name: text(entry, "name")?,
+            version: text(entry, "version")?,
+            role: text(entry, "role")?,
+            material_id: text(entry, "material_id")?,
+        };
+        let material = material_ids
+            .get(&tool.material_id)
+            .ok_or_else(|| preparation_error("missing JS tool material"))?;
+        if material["kind"] != "tool-distribution"
+            || material["name"] != tool.name
+            || material["version"] != tool.version
+            || ![
+                "runtime",
+                "package-manager",
+                "bundler",
+                "minifier",
+                "test-runner",
+            ]
+            .contains(&tool.role.as_str())
+            || !names.insert(tool.name.clone())
+        {
+            return Err(preparation_error("invalid JS tool ownership"));
+        }
+        tools.push(tool);
+    }
+    completed.rehash_for_handoff()?;
+    Ok(RetainedContributions {
+        raw_inventory: raw.bytes,
+        inventory_sha256: raw.sha256,
+        inventory: Inventory {
+            schema_version: 1,
+            source_commit: completed.source_commit.clone(),
+            modules: exported_modules,
+            materials,
+            tools,
+        },
+    })
+}
+
+fn origin(value: &Value, materials: &BTreeMap<String, &Value>, rendered: bool) -> Result<Origin> {
+    let mut keys = match value["kind"].as_str() {
+        Some("source") => vec!["kind", "path", "transform", "sha256"],
+        Some("npm") => vec![
+            "kind",
+            "lock_path",
+            "package_name",
+            "package_version",
+            "integrity",
+            "path",
+            "transform",
+            "sha256",
+        ],
+        Some("generated") if rendered => {
+            let mut keys = vec![
+                "kind",
+                "id",
+                "plugin",
+                "owner_lock_path",
+                "generated_sha256",
+            ];
+            if value.get("input").is_some() {
+                keys.push("input");
+            }
+            keys
+        }
+        _ => return Err(preparation_error("unknown JS origin kind")),
+    };
+    if rendered {
+        keys.extend(["stage", "rendered_length"]);
+    }
+    fields(value, &keys)?;
+    if value["kind"] == "generated" {
+        let id = value["id"]
+            .as_str()
+            .filter(|v| v.len() <= 4096)
+            .ok_or_else(|| preparation_error("invalid virtual origin identity"))?
+            .to_owned();
+        let plugin = text(value, "plugin")?;
+        let owner_lock_path = text(value, "owner_lock_path")?;
+        let owner = materials
+            .get(&format!("npm:{owner_lock_path}"))
+            .ok_or_else(|| preparation_error("missing generated producer material"))?;
+        if owner_lock_path != "node_modules/vite"
+            || owner["kind"] != "npm-package"
+            || owner["name"] != "vite"
+        {
+            return Err(preparation_error("unreviewed generated owner"));
+        }
+        let input = value
+            .get("input")
+            .map(|input| origin(input, materials, false).map(Box::new))
+            .transpose()?;
+        let valid = match (&*plugin, input.as_deref()) {
+            ("commonjs", None) => id == "\0commonjsHelpers.js",
+            ("vite:build-import-analysis", None) => id == "\0vite/preload-helper.js",
+            ("commonjs", Some(Origin::Source { path, .. })) => {
+                id == format!("\0{path}?commonjs-es-import")
+            }
+            (
+                "commonjs",
+                Some(Origin::Npm {
+                    lock_path, path, ..
+                }),
+            ) => id == format!("\0{lock_path}/{path}?commonjs-es-import"),
+            _ => false,
+        };
+        if !valid {
+            return Err(preparation_error(
+                "unknown or inconsistent generated producer",
+            ));
+        }
+        return Ok(Origin::Generated {
+            id,
+            plugin,
+            owner_lock_path,
+            generated_sha256: digest(value, "generated_sha256")?,
+            input,
+        });
+    }
+    let path = checked_path(value, "path")?;
+    let transform = text(value, "transform")?;
+    if !["identity", "raw", "inline"].contains(&transform.as_str()) {
+        return Err(preparation_error("unknown JS source transformation"));
+    }
+    let sha256 = digest(value, "sha256")?;
+    if value["kind"] == "source" {
+        if path.split('/').any(|part| part == "node_modules") {
+            return Err(preparation_error("unmapped npm source ownership"));
+        }
+        return Ok(Origin::Source {
+            path,
+            transform,
+            sha256,
+        });
+    }
+    let lock_path = checked_path(value, "lock_path")?;
+    let package_name = text(value, "package_name")?;
+    let package_version = text(value, "package_version")?;
+    let integrity = integrity(value)?;
+    let owner = materials
+        .get(&format!("npm:{lock_path}"))
+        .ok_or_else(|| preparation_error("missing npm contribution material"))?;
+    if owner["kind"] != "npm-package"
+        || owner["lock_path"] != lock_path
+        || owner["name"] != package_name
+        || owner["version"] != package_version
+        || owner["integrity"] != integrity
+    {
+        return Err(preparation_error(
+            "npm contribution differs from installed ownership",
+        ));
+    }
+    if path.split('/').any(|part| part == "node_modules") {
+        return Err(preparation_error("nested npm input needs its own owner"));
+    }
+    Ok(Origin::Npm {
+        lock_path,
+        package_name,
+        package_version,
+        integrity,
+        path,
+        transform,
+        sha256,
+    })
+}
+
+fn origin_key(origin: &Origin) -> String {
+    match origin {
+        Origin::Source {
+            path, transform, ..
+        } => format!("source:{path}:{transform}"),
+        Origin::Npm {
+            lock_path,
+            path,
+            transform,
+            ..
+        } => format!("npm:{lock_path}:{path}:{transform}"),
+        Origin::Generated { id, .. } => format!("generated:{id}"),
+    }
+}
+
+fn consistent_originals(origin: &Origin, originals: &mut BTreeMap<String, String>) -> Result<()> {
+    let (key, sha256) = match origin {
+        Origin::Source { path, sha256, .. } => (format!("source:{path}"), sha256),
+        Origin::Npm {
+            lock_path,
+            path,
+            sha256,
+            ..
+        } => (format!("npm:{lock_path}:{path}"), sha256),
+        Origin::Generated {
+            id,
+            generated_sha256,
+            input,
+            ..
+        } => {
+            if let Some(input) = input {
+                consistent_originals(input, originals)?;
+            }
+            (format!("generated:{id}"), generated_sha256)
+        }
+    };
+    if originals
+        .insert(key, sha256.clone())
+        .is_some_and(|previous| previous != *sha256)
+    {
+        return Err(preparation_error(
+            "conflicting original JS contribution bytes",
+        ));
+    }
+    Ok(())
+}
+
+fn material(value: &Value) -> Result<Material> {
+    let id = text(value, "id")?;
+    Ok(match value["kind"].as_str() {
+        Some("source") => {
+            fields(value, &["kind", "id", "path", "sha256"])?;
+            let path = checked_path(value, "path")?;
+            if id != format!("source:{path}") {
+                return Err(preparation_error("invalid source material identity"));
+            }
+            Material::Source {
+                id,
+                path,
+                sha256: digest(value, "sha256")?,
+            }
+        }
+        Some("npm-package") => {
+            fields(
+                value,
+                &[
+                    "kind",
+                    "id",
+                    "lock_path",
+                    "name",
+                    "version",
+                    "integrity",
+                    "installed_tree_sha256",
+                ],
+            )?;
+            let lock_path = checked_path(value, "lock_path")?;
+            let name = text(value, "name")?;
+            if id != format!("npm:{lock_path}")
+                || lock_path.rsplit("node_modules/").next() != Some(name.as_str())
+                || !lock_path.starts_with("node_modules/")
+            {
+                return Err(preparation_error("invalid npm material identity"));
+            }
+            Material::NpmPackage {
+                id,
+                lock_path,
+                name,
+                version: text(value, "version")?,
+                integrity: integrity(value)?,
+                installed_tree_sha256: digest(value, "installed_tree_sha256")?,
+            }
+        }
+        Some("tool-distribution") => {
+            fields(value, &["kind", "id", "name", "version", "sha256"])?;
+            Material::ToolDistribution {
+                id,
+                name: text(value, "name")?,
+                version: text(value, "version")?,
+                sha256: digest(value, "sha256")?,
+            }
+        }
+        Some("lifecycle-event") => {
+            fields(
+                value,
+                &[
+                    "kind",
+                    "id",
+                    "package_material_id",
+                    "event",
+                    "script_sha256",
+                ],
+            )?;
+            Material::LifecycleEvent {
+                id,
+                package_material_id: text(value, "package_material_id")?,
+                event: event(value)?,
+                script_sha256: digest(value, "script_sha256")?,
+            }
+        }
+        Some("lifecycle-output") => {
+            fields(
+                value,
+                &[
+                    "kind",
+                    "id",
+                    "package_material_id",
+                    "event",
+                    "script_sha256",
+                    "path",
+                    "size",
+                    "sha256",
+                ],
+            )?;
+            Material::LifecycleOutput {
+                id,
+                package_material_id: text(value, "package_material_id")?,
+                event: event(value)?,
+                script_sha256: digest(value, "script_sha256")?,
+                path: checked_path(value, "path")?,
+                size: value["size"]
+                    .as_u64()
+                    .filter(|n| *n <= 32 * 1024 * 1024)
+                    .ok_or_else(|| preparation_error("invalid lifecycle output size"))?,
+                sha256: digest(value, "sha256")?,
+            }
+        }
+        _ => return Err(preparation_error("unknown JS material kind")),
+    })
+}
+
+fn validate_material_join(material: &Material, materials: &BTreeMap<String, &Value>) -> Result<()> {
+    match material {
+        Material::LifecycleEvent {
+            package_material_id,
+            ..
+        }
+        | Material::LifecycleOutput {
+            package_material_id,
+            ..
+        } => {
+            let owner = materials
+                .get(package_material_id)
+                .ok_or_else(|| preparation_error("missing lifecycle package owner"))?;
+            if owner["kind"] != "npm-package" {
+                return Err(preparation_error("invalid lifecycle package owner"));
+            }
+            if let Material::LifecycleOutput {
+                event,
+                script_sha256,
+                path,
+                ..
+            } = material
+            {
+                let lock = owner["lock_path"]
+                    .as_str()
+                    .ok_or_else(|| preparation_error("missing lifecycle lock path"))?;
+                if !path.starts_with(&format!("{lock}/")) {
+                    return Err(preparation_error("lifecycle output escapes owner"));
+                }
+                let joined = materials.values().any(|entry| {
+                    entry["kind"] == "lifecycle-event"
+                        && entry["package_material_id"] == *package_material_id
+                        && entry["event"] == *event
+                        && entry["script_sha256"] == *script_sha256
+                });
+                if !joined {
+                    return Err(preparation_error("lifecycle output lacks observed event"));
+                }
+                if materials.values().any(|entry| {
+                    entry["kind"] == "npm-package"
+                        && entry["id"] != *package_material_id
+                        && entry["lock_path"].as_str().is_some_and(|nested| {
+                            nested.starts_with(&format!("{lock}/"))
+                                && path.starts_with(&format!("{nested}/"))
+                        })
+                }) {
+                    return Err(preparation_error(
+                        "lifecycle output belongs to nested package",
+                    ));
+                }
+            }
+        }
+        _ => {}
+    }
+    Ok(())
+}
+
+fn fields(value: &Value, expected: &[&str]) -> Result<()> {
+    let object = value
+        .as_object()
+        .ok_or_else(|| preparation_error("JS record is not an object"))?;
+    if object.len() != expected.len() || expected.iter().any(|key| !object.contains_key(*key)) {
+        return Err(preparation_error("unknown or missing JS record fields"));
+    }
+    Ok(())
+}
+fn text(value: &Value, key: &str) -> Result<String> {
+    value[key]
+        .as_str()
+        .filter(|v| !v.is_empty() && v.len() <= 4096 && !v.chars().any(char::is_control))
+        .map(str::to_owned)
+        .ok_or_else(|| preparation_error("invalid JS identity text"))
+}
+fn checked_path(value: &Value, key: &str) -> Result<String> {
+    let path = text(value, key)?;
+    if path.starts_with('/')
+        || path.contains('\\')
+        || path
+            .split('/')
+            .any(|part| part.is_empty() || part == "." || part == "..")
+    {
+        return Err(preparation_error("unsafe JS origin path"));
+    }
+    Ok(path)
+}
+fn digest(value: &Value, key: &str) -> Result<String> {
+    let digest = text(value, key)?;
+    if digest.len() != 64
+        || !digest
+            .bytes()
+            .all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b))
+    {
+        return Err(preparation_error("invalid JS SHA-256"));
+    }
+    Ok(digest)
+}
+fn integrity(value: &Value) -> Result<String> {
+    let integrity = text(value, "integrity")?;
+    if integrity.len() != 95
+        || !integrity.starts_with("sha512-")
+        || !integrity.ends_with("==")
+        || !integrity.as_bytes()[7..93]
+            .iter()
+            .all(|b| b.is_ascii_alphanumeric() || *b == b'+' || *b == b'/')
+    {
+        return Err(preparation_error("invalid npm archive integrity"));
+    }
+    Ok(integrity)
+}
+fn event(value: &Value) -> Result<String> {
+    let event = text(value, "event")?;
+    if !["preinstall", "install", "postinstall", "prepare"].contains(&event.as_str()) {
+        return Err(preparation_error("unknown lifecycle event"));
+    }
+    Ok(event)
+}
+fn array(value: &Value) -> Result<&Vec<Value>> {
+    value
+        .as_array()
+        .ok_or_else(|| preparation_error("missing JS observation array"))
+}
+
+#[cfg(test)]
+mod tests;
+
+#[cfg(test)]
+impl JsBuildCompleted {
+    /// Creates a rehashed fictional owner with checked collector variants.
+    pub(crate) fn fixture_for_projection(commit: &str) -> Self {
+        let mut completed = tests::fixture();
+        completed.source_commit = commit.to_owned();
+        let mut inventory = tests::rich_inventory(&completed);
+        inventory["source_commit"] = serde_json::json!(commit);
+        let bytes = serde_json::to_vec(&inventory).expect("should encode fictional inventory");
+        std::fs::write(
+            completed.directory.path().join("tsjs-inventory.json"),
+            &bytes,
+        )
+        .expect("should write fictional original inventory");
+        completed.inventory_sha256 = hex::encode(sha2::Sha256::digest(&bytes));
+        completed
+    }
+}
diff --git a/crates/trusted-server-release/src/javascript/contributions/tests.rs b/crates/trusted-server-release/src/javascript/contributions/tests.rs
new file mode 100644
index 0000000000..afb55e7849
--- /dev/null
+++ b/crates/trusted-server-release/src/javascript/contributions/tests.rs
@@ -0,0 +1,201 @@
+use serde_json::{Value, json};
+use sha2::{Digest as _, Sha256};
+
+use super::super::JsBuildCompleted;
+
+pub(super) fn fixture() -> JsBuildCompleted {
+    let mut completed = JsBuildCompleted::fixture_for_tests(&"a".repeat(40));
+    let module = &completed.modules["core"];
+    let inventory = json!({
+        "schema_version":1,"source_commit":completed.source_commit,
+        "modules":[{"id":"core","filename":module.filename,"size":module.size,"sha256":module.sha256,
+        "contributions":[{"kind":"source","path":"src/example.ts","transform":"identity","sha256":"c".repeat(64),"stage":"rollup-rendered","rendered_length":12}]}],
+        "tools":[],"materials":[]
+    });
+    replace(&mut completed, &inventory);
+    completed
+}
+
+fn replace(completed: &mut JsBuildCompleted, inventory: &Value) {
+    let bytes = serde_json::to_vec(inventory).expect("should encode inventory");
+    std::fs::write(
+        completed.directory.path().join("tsjs-inventory.json"),
+        &bytes,
+    )
+    .expect("should write retained inventory");
+    completed.inventory_sha256 = hex::encode(Sha256::digest(&bytes));
+}
+
+#[test]
+fn checked_export_preserves_original_digest_and_conservative_source_origin() {
+    let completed = fixture();
+    let exported = completed
+        .retained_contributions()
+        .expect("should export checked origins");
+    let value = serde_json::to_value(exported).expect("should serialize informational export");
+    assert_eq!(
+        value["inventory_sha256"], completed.inventory_sha256,
+        "should bind raw original inventory"
+    );
+    assert_eq!(
+        value["inventory"]["modules"][0]["contributions"][0]["path"], "src/example.ts",
+        "should preserve rendered source origin"
+    );
+}
+
+#[test]
+fn checked_export_rejects_changed_bundle_before_reading_origins() {
+    let completed = fixture();
+    std::fs::write(
+        completed.directory.path().join("bundles/tsjs-core.js"),
+        b"tampered",
+    )
+    .expect("should mutate fixture bundle");
+    assert!(
+        completed.retained_contributions().is_err(),
+        "should reject changed final module"
+    );
+}
+
+#[test]
+fn checked_export_rejects_unknown_origin_source_mismatch_and_path_aliases() {
+    for (pointer, replacement) in [
+        ("/source_commit", json!("b".repeat(40))),
+        ("/modules/0/contributions/0/kind", json!("unknown")),
+        ("/modules/0/contributions/0/path", json!("src//example.ts")),
+        ("/modules/0/contributions/0/stage", json!("final-function")),
+        ("/modules/0/contributions/0/rendered_length", json!(0)),
+    ] {
+        let mut completed = fixture();
+        let bytes = std::fs::read(completed.directory.path().join("tsjs-inventory.json"))
+            .expect("should read fixture");
+        let mut inventory: Value = serde_json::from_slice(&bytes).expect("should parse fixture");
+        *inventory
+            .pointer_mut(pointer)
+            .expect("should select fixture field") = replacement;
+        replace(&mut completed, &inventory);
+        assert!(
+            completed.retained_contributions().is_err(),
+            "should reject invalid origin at {pointer}"
+        );
+    }
+}
+
+pub(super) fn rich_inventory(completed: &JsBuildCompleted) -> Value {
+    let bytes = std::fs::read(completed.directory.path().join("tsjs-inventory.json"))
+        .expect("should read fixture");
+    let mut inventory: Value = serde_json::from_slice(&bytes).expect("should parse fixture");
+    let integrity = format!("sha512-{}==", "A".repeat(86));
+    inventory["materials"] = json!([
+        {"kind":"npm-package","id":"npm:node_modules/vite","lock_path":"node_modules/vite","name":"vite","version":"1.0.0","integrity":integrity,"installed_tree_sha256":"d".repeat(64)},
+        {"kind":"tool-distribution","id":"tool:vite","name":"vite","version":"1.0.0","sha256":"e".repeat(64)},
+        {"kind":"source","id":"source:scripts/example.mjs","path":"scripts/example.mjs","sha256":"f".repeat(64)},
+        {"kind":"lifecycle-event","id":"lifecycle:node_modules/vite:postinstall","package_material_id":"npm:node_modules/vite","event":"postinstall","script_sha256":"1".repeat(64)},
+        {"kind":"lifecycle-output","id":"output:node_modules/vite/generated.js","package_material_id":"npm:node_modules/vite","event":"postinstall","script_sha256":"1".repeat(64),"path":"node_modules/vite/generated.js","size":10,"sha256":"2".repeat(64)}
+    ]);
+    inventory["tools"] =
+        json!([{"name":"vite","version":"1.0.0","role":"bundler","material_id":"tool:vite"}]);
+    inventory["modules"][0]["contributions"] = json!([
+        {"kind":"source","path":"src/example.ts","transform":"raw","sha256":"c".repeat(64),"stage":"rollup-rendered","rendered_length":12},
+        {"kind":"npm","lock_path":"node_modules/vite","package_name":"vite","package_version":"1.0.0","integrity":integrity,"path":"dist/example.js","transform":"identity","sha256":"3".repeat(64),"stage":"rollup-rendered","rendered_length":15},
+        {"kind":"generated","id":"\u{0}commonjsHelpers.js","plugin":"commonjs","owner_lock_path":"node_modules/vite","generated_sha256":"4".repeat(64),"stage":"rollup-rendered","rendered_length":20},
+        {"kind":"generated","id":"\u{0}node_modules/vite/dist/example.js?commonjs-es-import","plugin":"commonjs","owner_lock_path":"node_modules/vite","generated_sha256":"5".repeat(64),"input":{"kind":"npm","lock_path":"node_modules/vite","package_name":"vite","package_version":"1.0.0","integrity":integrity,"path":"dist/example.js","transform":"identity","sha256":"3".repeat(64)},"stage":"rollup-rendered","rendered_length":20}
+    ]);
+    inventory
+}
+
+#[test]
+fn original_collector_variants_preserve_generated_nul_ids_and_distinct_tree_evidence() {
+    let mut completed = fixture();
+    let inventory = rich_inventory(&completed);
+    replace(&mut completed, &inventory);
+    let exported = completed
+        .retained_contributions()
+        .expect("should accept actual collector variants");
+    assert_eq!(
+        exported.modules().len(),
+        1,
+        "should export typed bundle observations"
+    );
+    assert_eq!(
+        exported.materials().len(),
+        5,
+        "should retain every distinct material role"
+    );
+    assert_eq!(
+        exported.inventory_sha256(),
+        completed.inventory_sha256,
+        "should preserve raw digest"
+    );
+    let value = serde_json::to_value(exported).expect("should encode checked origins");
+    assert_eq!(
+        value["inventory"], inventory,
+        "should preserve all original typed facts"
+    );
+}
+
+#[test]
+fn mismatched_npm_generated_tool_and_lifecycle_ownership_fail_closed() {
+    for (pointer, replacement) in [
+        ("/modules/0/contributions/1/package_version", json!("2.0.0")),
+        (
+            "/modules/0/contributions/1/path",
+            json!("node_modules/other/example.js"),
+        ),
+        ("/modules/0/contributions/2/id", json!("\u{0}unknown.js")),
+        ("/modules/0/contributions/2/plugin", json!("unreviewed")),
+        (
+            "/modules/0/contributions/3/input/sha256",
+            json!("6".repeat(64)),
+        ),
+        ("/tools/0/material_id", json!("npm:node_modules/vite")),
+        ("/materials/4/script_sha256", json!("6".repeat(64))),
+        ("/materials/4/path", json!("node_modules/other/output.js")),
+    ] {
+        let mut completed = fixture();
+        let mut inventory = rich_inventory(&completed);
+        *inventory
+            .pointer_mut(pointer)
+            .expect("should select ownership field") = replacement;
+        replace(&mut completed, &inventory);
+        assert!(
+            completed.retained_contributions().is_err(),
+            "should reject inconsistent ownership at {pointer}"
+        );
+    }
+}
+
+#[test]
+fn duplicate_contribution_and_material_ownership_fail_closed() {
+    for duplicate_material in [false, true] {
+        let mut completed = fixture();
+        let mut inventory = rich_inventory(&completed);
+        let entries = if duplicate_material {
+            inventory["materials"].as_array_mut()
+        } else {
+            inventory["modules"][0]["contributions"].as_array_mut()
+        }
+        .expect("should select records");
+        entries.push(entries[0].clone());
+        replace(&mut completed, &inventory);
+        assert!(
+            completed.retained_contributions().is_err(),
+            "should reject duplicate ownership"
+        );
+    }
+}
+
+#[test]
+fn checked_export_retains_exact_original_raw_bytes() {
+    let completed = fixture();
+    let expected = std::fs::read(completed.directory.path().join("tsjs-inventory.json"))
+        .expect("should read original bytes");
+    let exported = completed
+        .retained_contributions()
+        .expect("should export originals");
+    assert_eq!(
+        exported.raw_inventory(),
+        expected,
+        "should preserve exact raw bytes"
+    );
+}
diff --git a/crates/trusted-server-release/src/javascript/tests.rs b/crates/trusted-server-release/src/javascript/tests.rs
new file mode 100644
index 0000000000..a046181849
--- /dev/null
+++ b/crates/trusted-server-release/src/javascript/tests.rs
@@ -0,0 +1,296 @@
+use super::*;
+use serde_json::{Value, json};
+use std::os::unix::fs::symlink;
+
+mod adopt;
+
+#[test]
+fn one_byte_final_module_difference_rejects_the_complete_comparison() {
+    let first = tempfile::tempdir().expect("should create A outputs");
+    let second = tempfile::tempdir().expect("should create B outputs");
+    fs::write(first.path().join("tsjs-core.js"), b"one").expect("should write A module");
+    fs::write(second.path().join("tsjs-core.js"), b"one").expect("should write B module");
+    let modules = BTreeMap::from([(
+        "core".to_owned(),
+        Module {
+            filename: "tsjs-core.js".to_owned(),
+            size: 3,
+            sha256: hex::encode(Sha256::digest(b"one")),
+        },
+    )]);
+    compare_modules(first.path(), second.path(), &modules, &|| Ok(()))
+        .expect("should compare complete equal bytes");
+    fs::write(second.path().join("tsjs-core.js"), b"onE").expect("should change one final byte");
+    assert!(
+        compare_modules(first.path(), second.path(), &modules, &|| Ok(())).is_err(),
+        "should reject one differing final byte"
+    );
+}
+#[test]
+fn full_suite_report_rejects_zero_selection_or_missing_typecheck_file() {
+    let expected = BTreeSet::from([
+        "test/example.test.ts".to_owned(),
+        "test/types.test.ts".to_owned(),
+    ]);
+    let mut report = json!({"success":true,"numTotalTests":2,"numPassedTests":2,"numFailedTests":0,"numPendingTests":0,"testResults":[{"name":"/example/lib/test/example.test.ts","status":"passed"},{"name":"/example/lib/test/types.test.ts","status":"passed"}]});
+    let encode = |value: &Value| serde_json::to_vec(value).expect("should encode test report");
+    assert_eq!(
+        test_report(&encode(&report), &expected, Path::new("/example/lib"))
+            .expect("should join all registered results"),
+        2,
+        "should retain nonzero passed count"
+    );
+    report["numTotalTests"] = json!(0);
+    assert!(
+        test_report(&encode(&report), &expected, Path::new("/example/lib")).is_err(),
+        "should reject zero selected tests"
+    );
+    report["numTotalTests"] = json!(2);
+    report["testResults"]
+        .as_array_mut()
+        .expect("should retain array")
+        .pop();
+    assert!(
+        test_report(&encode(&report), &expected, Path::new("/example/lib")).is_err(),
+        "should reject an omitted registered type-check suite"
+    );
+}
+#[test]
+fn full_suite_report_rejects_failed_pending_or_unregistered_results() {
+    let expected = BTreeSet::from(["test/example.test.ts".to_owned()]);
+    let passing = json!({"success":true,"numTotalTests":1,"numPassedTests":1,"numFailedTests":0,"numPendingTests":0,"testResults":[{"name":"/example/lib/test/example.test.ts","status":"passed"}]});
+    let encode = |value: &Value| serde_json::to_vec(value).expect("should encode test report");
+    test_report(&encode(&passing), &expected, Path::new("/example/lib"))
+        .expect("should accept the passing control report");
+    let changes: [(&str, Value); 6] = [
+        ("/success", json!(false)),
+        ("/numFailedTests", json!(1)),
+        ("/numPassedTests", json!(0)),
+        ("/numPendingTests", json!(1)),
+        ("/testResults/0/status", json!("failed")),
+        (
+            "/testResults/0/name",
+            json!("/example/lib/test/other.test.ts"),
+        ),
+    ];
+    for (pointer, value) in changes {
+        let mut report = passing.clone();
+        *report
+            .pointer_mut(pointer)
+            .expect("should select an existing report field") = value;
+        assert!(
+            test_report(&encode(&report), &expected, Path::new("/example/lib")).is_err(),
+            "should reject a report with changed {pointer}"
+        );
+    }
+}
+#[test]
+fn parsed_inventory_cannot_choose_an_untracked_module_or_filename() {
+    let mut inventory = json!({"modules":[{"id":"core","filename":"tsjs-core.js","size":1,"sha256":"a".repeat(64)}]});
+    let expected = vec!["core".to_owned()];
+    let encode =
+        |value: &Value| serde_json::to_vec(value).expect("should encode inventory fixture");
+    inventory_modules(&encode(&inventory), &expected).expect("should parse tracked module facts");
+    inventory["modules"][0]["filename"] = json!("../outside");
+    assert!(
+        inventory_modules(&encode(&inventory), &expected).is_err(),
+        "should reject path-selected bundle output"
+    );
+}
+
+fn retained_fixture() -> JsBuildCompleted {
+    JsBuildCompleted::fixture_for_tests(&"a".repeat(40))
+}
+
+#[test]
+fn retained_module_facts_are_derived_from_the_rehashed_owned_handoff() {
+    let completed = retained_fixture();
+    let modules = completed
+        .retained_modules()
+        .expect("should derive checked module facts");
+    assert_eq!(modules.len(), 1, "should retain the exact module set");
+    assert_eq!(
+        modules[0].id(),
+        "core",
+        "should preserve checked module identity"
+    );
+    assert_eq!(
+        modules[0].filename(),
+        "tsjs-core.js",
+        "should preserve checked filename"
+    );
+    assert_eq!(
+        modules[0].size(),
+        b"fictional module".len() as u64,
+        "should preserve complete module length"
+    );
+    assert_eq!(
+        modules[0].sha256(),
+        hex::encode(Sha256::digest(b"fictional module")),
+        "should preserve complete module digest"
+    );
+    fs::write(
+        completed.directory.path().join("bundles/tsjs-core.js"),
+        b"changed",
+    )
+    .expect("should change retained module");
+    assert!(
+        completed.retained_modules().is_err(),
+        "should reject changed bytes before exporting facts"
+    );
+}
+
+#[test]
+fn retained_handoff_rejects_extra_root_files() {
+    let completed = retained_fixture();
+    completed
+        .rehash_for_handoff()
+        .expect("should rejoin exact fixture bytes");
+    fs::write(completed.directory.path().join("unrecorded"), b"extra")
+        .expect("should inject an extra retained file");
+    assert!(
+        completed.rehash_for_handoff().is_err(),
+        "should reject unrecorded retained root entries"
+    );
+}
+
+#[test]
+fn retained_handoff_rejects_identical_directory_aliases() {
+    for alias_bundles in [false, true] {
+        let completed = retained_fixture();
+        let external = tempfile::tempdir().expect("should create replacement directory");
+        let original = if alias_bundles {
+            completed.directory.path().join("bundles")
+        } else {
+            completed.directory.path().to_owned()
+        };
+        let destination = external.path().join("retained");
+        fs::rename(&original, &destination).expect("should relocate identical retained bytes");
+        symlink(&destination, &original).expect("should alias identical retained directory");
+        assert!(
+            completed.rehash_for_handoff().is_err(),
+            "should reject directory aliases despite identical bytes"
+        );
+    }
+}
+
+#[test]
+fn original_collector_bytes_cannot_be_replaced_by_later_child_output() {
+    let completed = retained_fixture();
+    let output = completed.directory.path();
+    let raw = read_bounded_with_check(&output.join("tsjs-inventory.json"), Role::Metadata, &|| {
+        Ok(())
+    })
+    .expect("should capture original collector bytes");
+    let captured = CapturedInventory {
+        raw,
+        modules: completed.modules,
+    };
+    verify_captured_output(output, &captured, &|| Ok(()))
+        .expect("should rejoin original collector outputs");
+    fs::write(output.join("tsjs-inventory.json"), b"replacement inventory")
+        .expect("should simulate later child inventory replacement");
+    assert!(
+        verify_captured_output(output, &captured, &|| Ok(())).is_err(),
+        "should reject later inventory replacement before retaining it as original"
+    );
+}
+
+#[test]
+fn completion_settings_bind_both_actual_boundary_instances() {
+    let first = settings_digest(&[[1_u8; 32], [2_u8; 32]]);
+    assert_ne!(
+        first,
+        settings_digest(&[[3_u8; 32], [2_u8; 32]]),
+        "should bind A controls"
+    );
+    assert_ne!(
+        first,
+        settings_digest(&[[1_u8; 32], [3_u8; 32]]),
+        "should bind B controls"
+    );
+    assert_ne!(
+        first,
+        settings_digest(&[[2_u8; 32], [1_u8; 32]]),
+        "should bind comparison-side ordering"
+    );
+}
+
+#[test]
+fn failed_cleanup_cannot_return_or_retain_a_completed_build() {
+    let completed = retained_fixture();
+    let retained = completed.directory.path().to_owned();
+    assert!(
+        finalize_execution(
+            Ok(completed),
+            Err(preparation_error("fictional cleanup failure"))
+        )
+        .is_err(),
+        "should deny completion when private resource cleanup fails"
+    );
+    assert!(
+        !retained.exists(),
+        "should discard private retained output when cleanup fails"
+    );
+    let error = finalize_execution(
+        Err(preparation_error("fictional execution failure")),
+        Err(preparation_error("fictional cleanup failure")),
+    )
+    .err()
+    .expect("should reject both failures");
+    let message = format!("{error:?}");
+    assert!(
+        message.contains("fictional execution failure")
+            && message.contains("fictional cleanup failure"),
+        "should retain both failure contexts"
+    );
+}
+
+#[test]
+fn vitest_failure_diagnostics_include_only_bounded_registered_names() {
+    let report = json!({"testResults":[
+        {"name":"/work/lib/test/fictional.test.ts","status":"failed","message":"PRIVATE ASSERTION","assertionResults":[
+            {"fullName":"fictional suite should reject invalid input","status":"failed","failureMessages":["PRIVATE STACK"]},
+            {"fullName":"successful case","status":"passed"}
+        ]},
+        {"name":"/outside/private-file","status":"failed","assertionResults":[]}
+    ]});
+    let expected = BTreeSet::from(["test/fictional.test.ts".to_owned()]);
+    let bytes = serde_json::to_vec(&report).expect("should encode fictional report");
+    let diagnostic = vitest_failure_diagnostic(&bytes, &expected, Path::new("/work/lib"))
+        .expect("should parse report");
+    assert!(
+        diagnostic.contains("test/fictional.test.ts")
+            && diagnostic.contains("fictional suite should reject invalid input"),
+        "should preserve failed suite and test identities"
+    );
+    for omitted in [
+        "PRIVATE ASSERTION",
+        "PRIVATE STACK",
+        "successful case",
+        "private-file",
+    ] {
+        assert!(
+            !diagnostic.contains(omitted),
+            "should omit arbitrary failure context and unregistered paths"
+        );
+    }
+    assert!(
+        vitest_failure_diagnostic(b"{", &expected, Path::new("/work/lib")).is_err(),
+        "should reject malformed reports"
+    );
+    let tests: Vec<_> = (0..100)
+        .map(|_| json!({"fullName":format!("{}\n\u{1b}","x".repeat(1000)),"status":"failed"}))
+        .collect();
+    let large = json!({"testResults":[{"name":"/work/lib/test/fictional.test.ts","status":"failed","assertionResults":tests}]});
+    let diagnostic = vitest_failure_diagnostic(
+        &serde_json::to_vec(&large).expect("should encode bounded fixture"),
+        &expected,
+        Path::new("/work/lib"),
+    )
+    .expect("should summarize names");
+    assert!(
+        diagnostic.len() < 5000 && !diagnostic.contains(['\n', '\u{1b}']),
+        "should bound count and length and remove controls"
+    );
+}
diff --git a/crates/trusted-server-release/src/javascript/tests/adopt.rs b/crates/trusted-server-release/src/javascript/tests/adopt.rs
new file mode 100644
index 0000000000..1ae0198f2a
--- /dev/null
+++ b/crates/trusted-server-release/src/javascript/tests/adopt.rs
@@ -0,0 +1,500 @@
+//! Test-only adoption of the JS handoff an ordinary Linux CI job uploaded.
+//!
+//! The macOS candidate jobs cannot run the Linux-only two-installation JS
+//! build, so they adopt the Linux job's retained handoff as an artifact.
+//! Adoption copies exactly `bundles/`, `tsjs-inventory.json` and
+//! `npm-observation.json` into a private directory, rejoins the inventory
+//! against the authenticated source with the same helpers the real build
+//! uses, and requires every module digest and the measurement's inventory
+//! digest to match. The artifact itself is not authenticated, and the
+//! returned measurement says so.
+//!
+//! The Linux job exports the artifact as a root holding exactly the
+//! retained handoff directory and its measurement beside it.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::time::{Duration, Instant};
+
+use error_stack::Report;
+use serde_json::{Value, json};
+use sha2::{Digest as _, Sha256};
+
+use super::super::{JsBuildCompleted, Module, filenames, inventory_modules};
+use crate::documents::{Role, parse_json, read_bounded};
+use crate::error::ReleaseError;
+use crate::preparation::{JsAttempt, preparation_error};
+use crate::process::Cancellation;
+use crate::source::{ApprovedSource, join_inventory};
+
+/// Kind of the Linux job's JS measurement.
+const MEASUREMENT_KIND: &str = "ordinary-ci-two-fresh-js-builds";
+/// Origin label of an adopted handoff.
+pub(crate) const ADOPTED_ORIGIN: &str = "linux-ordinary-ci-artifact";
+/// How long an adopted handoff stays usable by the candidate run.
+const ADOPTED_LIFETIME: Duration = Duration::from_secs(4 * 60 * 60);
+/// The exact entries of a retained handoff.
+const HANDOFF_ENTRIES: [&str; 3] = ["bundles", "npm-observation.json", "tsjs-inventory.json"];
+/// Directory of an exported root holding the three retained entries.
+const EXPORTED_HANDOFF: &str = "handoff";
+/// The Linux job's JS measurement beside the exported handoff.
+const EXPORTED_MEASUREMENT: &str = "js-execution-measurement.json";
+
+fn lower_hex_64(value: &Value) -> Option<&str> {
+    value.as_str().filter(|text| {
+        text.len() == 64
+            && text
+                .bytes()
+                .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+    })
+}
+
+/// The measured facts an adopted handoff must match.
+struct MeasuredHandoff<'a> {
+    inventory_sha256: &'a str,
+    tools_sha256: &'a str,
+    settings_sha256: &'a str,
+    tests: [u64; 2],
+}
+
+/// Requires the Linux job's measurement for `source`.
+fn check_measurement<'a>(
+    source: &ApprovedSource,
+    measurement: &'a Value,
+) -> Result<MeasuredHandoff<'a>, Report<ReleaseError>> {
+    let shape = measurement["schema_version"] == 1
+        && measurement["kind"] == MEASUREMENT_KIND
+        && measurement["release_qualification"] == false;
+    if !shape {
+        return Err(preparation_error(
+            "JS measurement is not an ordinary CI two-build measurement",
+        ));
+    }
+    if measurement["source_commit"].as_str() != Some(source.commit().as_str()) {
+        return Err(preparation_error(
+            "JS measurement names another source commit",
+        ));
+    }
+    let digest = |name: &str| {
+        lower_hex_64(&measurement[name])
+            .ok_or_else(|| preparation_error(format!("JS measurement {name} is not a digest")))
+    };
+    let count = |index: usize| {
+        measurement["test_counts"][index]
+            .as_u64()
+            .filter(|count| *count > 0)
+            .ok_or_else(|| preparation_error("JS measurement test counts are not positive"))
+    };
+    Ok(MeasuredHandoff {
+        inventory_sha256: digest("inventory_sha256")?,
+        tools_sha256: digest("tools_sha256")?,
+        settings_sha256: digest("settings_sha256")?,
+        tests: [count(0)?, count(1)?],
+    })
+}
+
+/// Reads the exact module set of `bundles` and requires each digest.
+fn read_modules(
+    bundles: &Path,
+    modules: &BTreeMap<String, Module>,
+) -> Result<Vec<(String, Vec<u8>)>, Report<ReleaseError>> {
+    let expected: BTreeSet<_> = modules
+        .values()
+        .map(|module| module.filename.clone())
+        .collect();
+    if filenames(bundles, expected.len()).ok() != Some(expected) {
+        return Err(preparation_error(
+            "adopted JS bundle set differs from the inventory",
+        ));
+    }
+    modules
+        .values()
+        .map(|module| {
+            let raw = read_bounded(&bundles.join(&module.filename), Role::Bundle)?;
+            if raw.sha256 != module.sha256 || raw.bytes.len() as u64 != module.size {
+                return Err(preparation_error(
+                    "adopted JS module differs from the inventory",
+                ));
+            }
+            Ok((module.filename.clone(), raw.bytes))
+        })
+        .collect()
+}
+
+impl JsBuildCompleted {
+    /// Exports the retained handoff and its ordinary CI `measurement` into
+    /// the fresh `destination` for the macOS candidate jobs.
+    ///
+    /// The source handoff is rehashed before and after the copy. The caller
+    /// must read and adopt the export to verify its copied bytes against the
+    /// measurement before transferring or using it.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when the retained root no longer rehashes,
+    /// `destination` exists or its parent does not, or a copy or the
+    /// measurement cannot be written.
+    pub(crate) fn export_ordinary_ci_handoff_for_tests(
+        &self,
+        measurement: &Value,
+        destination: &Path,
+    ) -> Result<(), Report<ReleaseError>> {
+        let retained = self.rehash_for_handoff()?;
+        fs::create_dir(destination).map_err(preparation_error)?;
+        let handoff = destination.join(EXPORTED_HANDOFF);
+        fs::create_dir_all(handoff.join("bundles")).map_err(preparation_error)?;
+        for name in ["tsjs-inventory.json", "npm-observation.json"] {
+            fs::copy(retained.join(name), handoff.join(name)).map_err(preparation_error)?;
+        }
+        for module in self.modules.values() {
+            fs::copy(
+                retained.join("bundles").join(&module.filename),
+                handoff.join("bundles").join(&module.filename),
+            )
+            .map_err(preparation_error)?;
+        }
+        let encoded = serde_json::to_vec_pretty(measurement).map_err(preparation_error)?;
+        fs::write(destination.join(EXPORTED_MEASUREMENT), encoded).map_err(preparation_error)?;
+        self.rehash_for_handoff()?;
+        Ok(())
+    }
+
+    /// Reads a root the Linux job exported: exactly the handoff directory and
+    /// the measurement file, nothing else.
+    ///
+    /// Returns the handoff directory and the parsed measurement; neither is
+    /// authenticated, and [`Self::adopt_ordinary_ci_handoff_for_tests`]
+    /// checks both.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when the root holds any other entry, or the
+    /// measurement cannot be read or parsed as JSON.
+    pub(crate) fn read_exported_ordinary_ci_handoff_for_tests(
+        root: &Path,
+    ) -> Result<(PathBuf, Value), Report<ReleaseError>> {
+        let expected: BTreeSet<String> = [EXPORTED_HANDOFF, EXPORTED_MEASUREMENT]
+            .map(str::to_owned)
+            .into();
+        if filenames(root, expected.len()).ok() != Some(expected) {
+            return Err(preparation_error(
+                "exported JS root holds entries beyond the handoff and its measurement",
+            ));
+        }
+        let raw = read_bounded(&root.join(EXPORTED_MEASUREMENT), Role::Metadata)?;
+        let measurement = parse_json(&raw.bytes, Role::Metadata)?;
+        Ok((root.join(EXPORTED_HANDOFF), measurement))
+    }
+
+    /// Adopts a Linux ordinary CI JS handoff for a macOS candidate run.
+    ///
+    /// Returns the private copy and a measurement labelling its origin as
+    /// `linux-ordinary-ci-artifact` with `authenticated: false`.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when the measurement is not the Linux job's for this
+    /// source, the handoff holds any entry beyond the three retained ones,
+    /// the inventory digest differs from the measurement, the inventory does
+    /// not rejoin the source or name exactly its modules, a module differs
+    /// from its inventory digest, or the private copy cannot be written.
+    pub(crate) fn adopt_ordinary_ci_handoff_for_tests(
+        source: &ApprovedSource,
+        handoff: &Path,
+        measurement: &Value,
+    ) -> Result<(Self, Value), Report<ReleaseError>> {
+        let measured = check_measurement(source, measurement)?;
+        let expected: BTreeSet<String> = HANDOFF_ENTRIES.map(str::to_owned).into();
+        if filenames(handoff, expected.len()).ok() != Some(expected) {
+            return Err(preparation_error(
+                "adopted JS handoff holds entries beyond the retained three",
+            ));
+        }
+        let inventory = read_bounded(&handoff.join("tsjs-inventory.json"), Role::Metadata)?;
+        if inventory.sha256 != measured.inventory_sha256 {
+            return Err(preparation_error(
+                "adopted JS inventory differs from the measured inventory",
+            ));
+        }
+        join_inventory(source, &inventory.bytes)?;
+        let modules = inventory_modules(&inventory.bytes, &source.module_ids())?;
+        let bundles = read_modules(&handoff.join("bundles"), &modules)?;
+        let observation = read_bounded(&handoff.join("npm-observation.json"), Role::Metadata)?;
+
+        let directory = tempfile::tempdir().map_err(preparation_error)?;
+        fs::create_dir(directory.path().join("bundles")).map_err(preparation_error)?;
+        fs::write(
+            directory.path().join("tsjs-inventory.json"),
+            &inventory.bytes,
+        )
+        .map_err(preparation_error)?;
+        fs::write(
+            directory.path().join("npm-observation.json"),
+            &observation.bytes,
+        )
+        .map_err(preparation_error)?;
+        for (filename, bytes) in &bundles {
+            fs::write(directory.path().join("bundles").join(filename), bytes)
+                .map_err(preparation_error)?;
+        }
+        let adopted = Self {
+            directory,
+            source_commit: source.commit().as_str().to_owned(),
+            tools_sha256: measured.tools_sha256.to_owned(),
+            settings_sha256: measured.settings_sha256.to_owned(),
+            inventory_sha256: inventory.sha256.clone(),
+            observation_sha256: hex::encode(Sha256::digest(&observation.bytes)),
+            modules,
+            tests: measured.tests,
+            attempt: JsAttempt::new(Instant::now() + ADOPTED_LIFETIME, Cancellation::default()),
+        };
+        adopted.rehash_for_handoff()?;
+        let label = json!({
+            "js_handoff": {
+                "origin": ADOPTED_ORIGIN,
+                "authenticated": false,
+                "source_commit": adopted.source_commit,
+                "inventory_sha256": adopted.inventory_sha256,
+                "tools_sha256": adopted.tools_sha256,
+                "settings_sha256": adopted.settings_sha256,
+                "module_count": adopted.modules.len(),
+            }
+        });
+        Ok((adopted, label))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::source::CommitId;
+
+    const COMMIT: &str = "0123456789abcdef0123456789abcdef01234567";
+    const OTHER_COMMIT: &str = "fedcba9876543210fedcba9876543210fedcba98";
+    const MODULE: &[u8] = b"fictional core module";
+
+    fn source(commit: &str) -> ApprovedSource {
+        ApprovedSource::in_memory_for_tests(
+            &CommitId::parse(commit).expect("should parse the commit"),
+            &["crates/trusted-server-js/lib/src/core/index.ts"],
+        )
+    }
+
+    fn inventory(commit: &str) -> Vec<u8> {
+        serde_json::to_vec(&json!({
+            "schema_version": 1,
+            "source_commit": commit,
+            "materials": [],
+            "tools": [],
+            "modules": [{
+                "id": "core",
+                "filename": "tsjs-core.js",
+                "size": MODULE.len(),
+                "sha256": hex::encode(Sha256::digest(MODULE)),
+            }],
+        }))
+        .expect("should encode the inventory")
+    }
+
+    /// A retained Linux handoff and its measurement.
+    fn handoff(commit: &str) -> (tempfile::TempDir, Value) {
+        let directory = tempfile::tempdir().expect("should create the handoff");
+        let root = directory.path();
+        fs::create_dir(root.join("bundles")).expect("should create bundles");
+        fs::write(root.join("bundles/tsjs-core.js"), MODULE).expect("should write the module");
+        let inventory = inventory(commit);
+        fs::write(root.join("tsjs-inventory.json"), &inventory).expect("should write inventory");
+        fs::write(root.join("npm-observation.json"), b"fictional observation")
+            .expect("should write the observation");
+        let measurement = json!({
+            "schema_version": 1,
+            "kind": MEASUREMENT_KIND,
+            "source_commit": commit,
+            "test_counts": [3, 3],
+            "module_count": 1,
+            "tools_sha256": "b".repeat(64),
+            "settings_sha256": "c".repeat(64),
+            "inventory_sha256": hex::encode(Sha256::digest(&inventory)),
+            "private_roots_removed": 2,
+            "release_qualification": false,
+        });
+        (directory, measurement)
+    }
+
+    fn rejection(source: &ApprovedSource, root: &Path, measurement: &Value) -> String {
+        match JsBuildCompleted::adopt_ordinary_ci_handoff_for_tests(source, root, measurement) {
+            Ok(_) => panic!("should reject the handoff"),
+            Err(error) => format!("{error:?}"),
+        }
+    }
+
+    #[test]
+    fn adopted_handoff_is_a_private_rejoined_copy_labelled_unauthenticated() {
+        let (directory, measurement) = handoff(COMMIT);
+
+        let (adopted, label) = JsBuildCompleted::adopt_ordinary_ci_handoff_for_tests(
+            &source(COMMIT),
+            directory.path(),
+            &measurement,
+        )
+        .expect("should adopt the handoff");
+
+        let retained = adopted
+            .rehash_for_handoff()
+            .expect("should rehash the copy");
+        assert_ne!(
+            retained,
+            directory.path(),
+            "should copy into its own directory"
+        );
+        assert_eq!(adopted.source_commit(), COMMIT, "should bind the source");
+        assert_eq!(adopted.inventory_sha256(), measurement["inventory_sha256"]);
+        assert_eq!(adopted.tools_sha256(), "b".repeat(64));
+        assert_eq!(adopted.test_counts(), [3, 3]);
+        assert_eq!(label["js_handoff"]["origin"], "linux-ordinary-ci-artifact");
+        assert_eq!(label["js_handoff"]["authenticated"], false);
+        assert_eq!(label["js_handoff"]["module_count"], 1);
+        fs::remove_dir_all(directory.path()).expect("should remove the original");
+        adopted
+            .rehash_for_handoff()
+            .expect("should not depend on the original artifact");
+    }
+
+    #[test]
+    fn exported_handoff_reads_back_and_adopts_unchanged() {
+        let (directory, measurement) = handoff(COMMIT);
+        let (adopted, _) = JsBuildCompleted::adopt_ordinary_ci_handoff_for_tests(
+            &source(COMMIT),
+            directory.path(),
+            &measurement,
+        )
+        .expect("should adopt the original handoff");
+        let scratch = tempfile::tempdir().expect("should create the export parent");
+        let exported = scratch.path().join("js-handoff");
+
+        adopted
+            .export_ordinary_ci_handoff_for_tests(&measurement, &exported)
+            .expect("should export the retained handoff");
+        let (handoff_root, read_measurement) =
+            JsBuildCompleted::read_exported_ordinary_ci_handoff_for_tests(&exported)
+                .expect("should read the exported root");
+
+        assert_eq!(handoff_root, exported.join("handoff"));
+        assert_eq!(
+            read_measurement, measurement,
+            "should carry the measurement unchanged"
+        );
+        let (readopted, label) = JsBuildCompleted::adopt_ordinary_ci_handoff_for_tests(
+            &source(COMMIT),
+            &handoff_root,
+            &read_measurement,
+        )
+        .expect("should adopt the exported handoff");
+        assert_eq!(readopted.inventory_sha256(), adopted.inventory_sha256());
+        assert_eq!(label["js_handoff"]["authenticated"], false);
+        assert!(
+            adopted
+                .export_ordinary_ci_handoff_for_tests(&measurement, &exported)
+                .is_err(),
+            "should refuse an existing destination"
+        );
+    }
+
+    #[test]
+    fn exported_roots_with_extra_or_missing_entries_are_rejected() {
+        let scratch = tempfile::tempdir().expect("should create the export root");
+        let root = scratch.path();
+        fs::create_dir(root.join("handoff")).expect("should create the handoff");
+        assert!(
+            JsBuildCompleted::read_exported_ordinary_ci_handoff_for_tests(root).is_err(),
+            "should reject a root without its measurement"
+        );
+        fs::write(root.join("js-execution-measurement.json"), b"{}")
+            .expect("should write the measurement");
+        JsBuildCompleted::read_exported_ordinary_ci_handoff_for_tests(root)
+            .expect("should read an exact root");
+        fs::write(root.join("extra.json"), b"{}").expect("should add an entry");
+        let error = JsBuildCompleted::read_exported_ordinary_ci_handoff_for_tests(root)
+            .expect_err("should reject an extra entry");
+        assert!(
+            format!("{error:?}").contains("beyond the handoff and its measurement"),
+            "should name the unexpected entry: {error:?}"
+        );
+        fs::remove_file(root.join("extra.json")).expect("should remove the extra entry");
+        fs::write(root.join("js-execution-measurement.json"), b"not json")
+            .expect("should corrupt the measurement");
+        assert!(
+            JsBuildCompleted::read_exported_ordinary_ci_handoff_for_tests(root).is_err(),
+            "should reject a measurement that is not JSON"
+        );
+    }
+
+    #[test]
+    fn handoffs_with_extra_or_changed_entries_are_rejected() {
+        let (directory, measurement) = handoff(COMMIT);
+        fs::write(directory.path().join("extra.json"), b"{}").expect("should add an entry");
+        assert!(
+            rejection(&source(COMMIT), directory.path(), &measurement)
+                .contains("beyond the retained three"),
+            "should reject an extra root entry"
+        );
+
+        let (directory, measurement) = handoff(COMMIT);
+        fs::write(directory.path().join("bundles/tsjs-extra.js"), b"x").expect("should add");
+        assert!(
+            rejection(&source(COMMIT), directory.path(), &measurement)
+                .contains("bundle set differs"),
+            "should reject an extra bundle"
+        );
+
+        let (directory, measurement) = handoff(COMMIT);
+        fs::write(
+            directory.path().join("bundles/tsjs-core.js"),
+            b"fictional core modulE",
+        )
+        .expect("should change the module");
+        assert!(
+            rejection(&source(COMMIT), directory.path(), &measurement)
+                .contains("module differs from the inventory"),
+            "should reject a module digest mismatch"
+        );
+    }
+
+    #[test]
+    fn handoffs_from_another_commit_or_measurement_are_rejected() {
+        let (directory, measurement) = handoff(OTHER_COMMIT);
+        assert!(
+            rejection(&source(COMMIT), directory.path(), &measurement)
+                .contains("another source commit"),
+            "should reject a measurement of a foreign commit"
+        );
+
+        let (directory, mut measurement) = handoff(OTHER_COMMIT);
+        measurement["source_commit"] = json!(COMMIT);
+        let inventory = fs::read(directory.path().join("tsjs-inventory.json"))
+            .expect("should read the inventory");
+        measurement["inventory_sha256"] = json!(hex::encode(Sha256::digest(&inventory)));
+        assert!(
+            rejection(&source(COMMIT), directory.path(), &measurement)
+                .contains("does not match the approved commit"),
+            "should reject an inventory of a foreign commit"
+        );
+
+        let (directory, mut measurement) = handoff(COMMIT);
+        measurement["inventory_sha256"] = json!("d".repeat(64));
+        assert!(
+            rejection(&source(COMMIT), directory.path(), &measurement)
+                .contains("differs from the measured inventory"),
+            "should reject an inventory the measurement did not record"
+        );
+
+        let (directory, mut measurement) = handoff(COMMIT);
+        measurement["release_qualification"] = json!(true);
+        assert!(
+            rejection(&source(COMMIT), directory.path(), &measurement)
+                .contains("not an ordinary CI two-build measurement"),
+            "should reject a measurement claiming qualification"
+        );
+    }
+}
diff --git a/crates/trusted-server-release/src/lifecycle_guard.rs b/crates/trusted-server-release/src/lifecycle_guard.rs
new file mode 100644
index 0000000000..2262a4176b
--- /dev/null
+++ b/crates/trusted-server-release/src/lifecycle_guard.rs
@@ -0,0 +1,86 @@
+//! Linux-only N-API guard for the trusted npm lifecycle observer.
+//!
+//! Compile this approved source with the selected native Rust toolchain using
+//! `--crate-type cdylib --edition 2024`. The resulting `.node` file is a measured
+//! tool input, loaded before the observer receives its private authentication
+//! key. It is not a standalone executable or a qualification receipt.
+
+#![deny(unsafe_op_in_unsafe_fn)]
+
+#[cfg(not(target_os = "linux"))]
+compile_error!("the npm lifecycle guard requires Linux");
+
+use core::ffi::{c_char, c_int, c_ulong, c_void};
+use core::ptr;
+
+const PR_SET_DUMPABLE: c_int = 4;
+const PR_GET_DUMPABLE: c_int = 3;
+
+unsafe extern "C" {
+    fn prctl(option: c_int, ...) -> c_int;
+    fn umask(mask: u32) -> u32;
+    fn napi_throw_error(env: *mut c_void, code: *const c_char, message: *const c_char) -> c_int;
+    fn napi_get_boolean(env: *mut c_void, value: bool, result: *mut *mut c_void) -> c_int;
+    fn napi_set_named_property(
+        env: *mut c_void,
+        object: *mut c_void,
+        name: *const c_char,
+        value: *mut c_void,
+    ) -> c_int;
+}
+
+/// Protects the observer from same-user process-memory and `/proc` descriptor
+/// access before it accepts sensitive input.
+///
+/// # Safety
+///
+/// Node must call this N-API registration entry with a live environment and
+/// exports object. The library must come from the selected read-only tool root.
+#[unsafe(no_mangle)]
+pub unsafe extern "C" fn napi_register_module_v1(
+    env: *mut c_void,
+    exports: *mut c_void,
+) -> *mut c_void {
+    // SAFETY: umask accepts any mode mask. This dedicated observer process
+    // selects npm's fixed extraction mode before spawning any install hooks.
+    unsafe {
+        umask(0o022);
+    }
+    // SAFETY: Linux prctl accepts these fixed options and zero arguments.
+    let protected = unsafe {
+        prctl(
+            PR_SET_DUMPABLE,
+            0 as c_ulong,
+            0 as c_ulong,
+            0 as c_ulong,
+            0 as c_ulong,
+        ) == 0
+            && prctl(
+                PR_GET_DUMPABLE,
+                0 as c_ulong,
+                0 as c_ulong,
+                0 as c_ulong,
+                0 as c_ulong,
+            ) == 0
+    };
+    let mut value = ptr::null_mut();
+    // SAFETY: Node supplies valid N-API handles; all strings are static C strings.
+    let exported = protected
+        && unsafe {
+            napi_get_boolean(env, true, &mut value) == 0
+                && napi_set_named_property(env, exports, c"protected".as_ptr(), value) == 0
+        };
+    if !exported {
+        // SAFETY: The live Node environment and static NUL-terminated message
+        // meet N-API's preconditions. A pending exception rejects require().
+        unsafe {
+            napi_throw_error(
+                env,
+                ptr::null(),
+                c"Cannot protect lifecycle observer".as_ptr(),
+            );
+        }
+        return ptr::null_mut();
+    }
+    exports
+}
diff --git a/crates/trusted-server-release/src/main.rs b/crates/trusted-server-release/src/main.rs
new file mode 100644
index 0000000000..35a880d862
--- /dev/null
+++ b/crates/trusted-server-release/src/main.rs
@@ -0,0 +1,246 @@
+// consumed by Task 7 preparation and Task 9 recipes
+#[allow(dead_code)]
+mod boundary;
+#[allow(dead_code, reason = "qualified collection remains closed")]
+mod collection;
+#[allow(dead_code, reason = "Task 10 composition capture is being integrated")]
+mod composition;
+#[allow(
+    dead_code,
+    reason = "the candidate release index has no command, writer or signer yet"
+)]
+mod distribution;
+// Atomic output and schema helpers are consumed by later producer stages.
+#[allow(dead_code)]
+mod documents;
+mod error;
+mod git_objects;
+#[allow(dead_code, reason = "consumed by Task 9 recipes")]
+mod inspect;
+#[allow(dead_code, reason = "production JS tool qualification remains closed")]
+mod javascript;
+#[allow(dead_code, reason = "consumed by Task 7 material preparation")]
+mod materials;
+mod package;
+mod policy;
+mod preflight;
+#[allow(dead_code, reason = "production JS tool qualification remains closed")]
+mod preparation;
+#[allow(
+    dead_code,
+    reason = "immutable release publication remains closed: no API adapter, workflow or command"
+)]
+mod publication;
+#[allow(
+    dead_code,
+    reason = "Task 9 slice 1 recipe layer has no production caller yet"
+)]
+mod recipe;
+// `expect` would be unfulfilled in the test build, where the tests use it.
+#[allow(dead_code, reason = "consumed by Task 7 boundary and preparation")]
+mod process;
+#[allow(dead_code)]
+mod source;
+#[allow(
+    dead_code,
+    reason = "complete SPDX composition inputs remain unavailable"
+)]
+mod spdx;
+mod tool_tree;
+mod workflow_contract;
+
+use std::ffi::OsString;
+use std::io::Write as _;
+use std::path::PathBuf;
+use std::process::ExitCode;
+
+use clap::{Parser, Subcommand};
+use error::ReleaseError;
+use error_stack::Report;
+use error_stack::fmt::ColorMode;
+use source::CommitId;
+
+/// Exit status of `audit-inputs` when any input is incomplete.
+const INCOMPLETE_STATUS: u8 = 3;
+
+#[derive(Parser)]
+#[command(
+    name = "trusted-server-release",
+    disable_help_flag = true,
+    disable_help_subcommand = true,
+    disable_version_flag = true
+)]
+struct Cli {
+    #[command(subcommand)]
+    command: Command,
+}
+
+#[derive(Subcommand)]
+enum Command {
+    /// Fail-closed release preflight over the current-directory source root.
+    Preflight {
+        #[arg(long)]
+        cohort: PathBuf,
+        #[arg(long = "source-commit")]
+        source_commit: String,
+        #[arg(long = "require-qualified")]
+        require_qualified: bool,
+    },
+    /// Diagnostic report of pending inputs; constructs no authorization.
+    AuditInputs,
+    /// Check explicitly supplied validation workflow files without executing them.
+    CheckWorkflowContract {
+        #[arg(long = "workflow", required = true, num_args = 1..)]
+        workflows: Vec<PathBuf>,
+    },
+    /// Inspect a retained manual Fastly package against independently approved digests.
+    InspectFastlyPackage {
+        #[arg(long)]
+        package_dir: PathBuf,
+        #[arg(long)]
+        manifest: PathBuf,
+        #[arg(long)]
+        expected_manifest_sha256: String,
+        #[arg(long)]
+        expected_wasm_sha256: String,
+    },
+    /// Private fixed in-image GNU tool measurement; supplies no authority.
+    #[command(hide = true)]
+    GnuImageMeasurement,
+    /// Network-denial socket probe used by the boundary controls.
+    BoundaryProbe {
+        #[command(subcommand)]
+        probe: ProbeCommand,
+    },
+}
+
+#[derive(Subcommand)]
+enum ProbeCommand {
+    /// Attempts one TCP connect to a literal loopback `IP:PORT`, prints
+    /// `connected` (exit 0) or `denied errno=<n>` (exit 3), and does nothing
+    /// else.
+    Connect { address: String },
+}
+
+/// Writes one human-readable diagnostic line to stderr.
+///
+/// The `log` facade is deliberately not used: no logger is installed before
+/// the environment audit runs, and configuring one from inherited variables
+/// such as `RUST_LOG` would itself be an unaudited input channel. Write
+/// failures are ignored because diagnostics never change the outcome.
+pub(crate) fn notice(message: std::fmt::Arguments<'_>) {
+    let _ = writeln!(std::io::stderr(), "{message}");
+}
+
+fn main() -> ExitCode {
+    let inherited: Vec<(OsString, OsString)> = std::env::vars_os().collect();
+    Report::set_color_mode(ColorMode::None);
+    let arguments: Vec<OsString> = std::env::args_os().collect();
+    match run(&inherited, &arguments) {
+        Ok(status) => status,
+        Err(report) => {
+            notice(format_args!("{report:?}"));
+            ExitCode::FAILURE
+        }
+    }
+}
+
+fn run(
+    inherited: &[(OsString, OsString)],
+    arguments: &[OsString],
+) -> Result<ExitCode, Report<ReleaseError>> {
+    let cli = Cli::try_parse_from(arguments).map_err(|error| {
+        Report::new(ReleaseError::Usage).attach(format!("invalid invocation: {}", error.kind()))
+    })?;
+    match cli.command {
+        Command::Preflight {
+            cohort,
+            source_commit,
+            require_qualified,
+        } => {
+            let commit = CommitId::parse(&source_commit)?;
+            preflight::run_preflight(inherited, &cohort, &commit, require_qualified)?;
+            Ok(ExitCode::SUCCESS)
+        }
+        Command::AuditInputs => audit_inputs(),
+        Command::CheckWorkflowContract { workflows } => {
+            workflow_contract::check_files(&workflows)?;
+            let report = serde_json::json!({
+                "report": "workflow-contract-check",
+                "release_qualification": false,
+                "source_eligibility": false,
+            });
+            let bytes = documents::canonical_json(&report, documents::Role::Metadata)?;
+            std::io::stdout().write_all(&bytes).map_err(|error| {
+                Report::new(ReleaseError::Document).attach(format!(
+                    "cannot write workflow contract diagnostic: {error}"
+                ))
+            })?;
+            Ok(ExitCode::SUCCESS)
+        }
+        Command::InspectFastlyPackage {
+            package_dir,
+            manifest,
+            expected_manifest_sha256,
+            expected_wasm_sha256,
+        } => {
+            let report = package::inspect_package(
+                &package_dir,
+                &manifest,
+                &expected_manifest_sha256,
+                &expected_wasm_sha256,
+            )?;
+            let bytes = documents::canonical_json(&report, documents::Role::Metadata)?;
+            std::io::stdout().write_all(&bytes).map_err(|error| {
+                Report::new(ReleaseError::Inspect)
+                    .attach(format!("cannot write package inspection: {error}"))
+            })?;
+            Ok(ExitCode::SUCCESS)
+        }
+        Command::GnuImageMeasurement => {
+            let bytes = recipe::gnu::helper_measurement()?;
+            std::io::stdout().write_all(&bytes).map_err(|error| {
+                Report::new(ReleaseError::Recipe)
+                    .attach(format!("cannot write GNU measurement: {error}"))
+            })?;
+            Ok(ExitCode::SUCCESS)
+        }
+        Command::BoundaryProbe {
+            probe: ProbeCommand::Connect { address },
+        } => boundary_probe(&address),
+    }
+}
+
+/// Runs the single-connect probe and reports its real outcome.
+fn boundary_probe(address: &str) -> Result<ExitCode, Report<ReleaseError>> {
+    let address = boundary::parse_loopback(address)?;
+    let report = boundary::connect_probe(address)?;
+    std::io::stdout()
+        .write_all(format!("{report}\n").as_bytes())
+        .map_err(|error| {
+            Report::new(ReleaseError::Boundary)
+                .attach(format!("cannot write probe report: {error}"))
+        })?;
+    Ok(match report {
+        boundary::ProbeReport::Connected => ExitCode::SUCCESS,
+        boundary::ProbeReport::Denied { .. } => ExitCode::from(boundary::DENIED_STATUS),
+    })
+}
+
+fn audit_inputs() -> Result<ExitCode, Report<ReleaseError>> {
+    let root = preflight::source_root()?;
+    let inputs = policy::load_inputs(&root)?;
+    let audit = policy::audit_inputs(&inputs);
+    let bytes = documents::canonical_json(&audit.to_json(), documents::Role::Metadata)?;
+    std::io::stdout().write_all(&bytes).map_err(|error| {
+        Report::new(ReleaseError::Incomplete).attach(format!("cannot write audit report: {error}"))
+    })?;
+    if audit.is_complete() {
+        return Ok(ExitCode::SUCCESS);
+    }
+    notice(format_args!(
+        "{}: release inputs are incomplete; this diagnostic authorizes nothing",
+        ReleaseError::Incomplete
+    ));
+    Ok(ExitCode::from(INCOMPLETE_STATUS))
+}
diff --git a/crates/trusted-server-release/src/materials.rs b/crates/trusted-server-release/src/materials.rs
new file mode 100644
index 0000000000..5ae8d14ef8
--- /dev/null
+++ b/crates/trusted-server-release/src/materials.rs
@@ -0,0 +1,277 @@
+//! Original dependency identities derived from the independently approved source.
+//!
+//! Lockfile checksums authenticate original archive bytes. They do not prove
+//! extraction, installation, lifecycle execution, tool qualification or JS
+//! build completion.
+
+mod archive;
+mod cargo_vendor;
+mod extract;
+mod git;
+mod locked;
+mod manifest;
+mod npm_bundle;
+
+use std::collections::BTreeMap;
+use std::path::Path;
+use std::time::Instant;
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256};
+
+use crate::documents::Role;
+use crate::error::ReleaseError;
+use crate::process::Cancellation;
+use crate::source::ApprovedSource;
+pub(crate) use archive::VerifiedOriginal;
+#[cfg(all(test, target_os = "linux"))]
+pub(crate) use cargo_vendor::resolution_differences;
+#[allow(unused_imports, reason = "consumed by the Task 9 recipe")]
+pub(crate) use cargo_vendor::{
+    CargoOrigin, GitSourceConfig, GitVendorInput, PreparedCargoMaterials, VendorInputs,
+    VerifiedCargoPackage,
+};
+pub(crate) use extract::ExtractedOriginal;
+use locked::{CargoMaterials, NpmMaterial, parse_cargo, parse_npm};
+pub(crate) use manifest::{ReviewedNpmManifest, RootManifestReview};
+pub(crate) use npm_bundle::PreparedNpmOriginals;
+
+const NPM_LOCK: &str = "crates/trusted-server-js/lib/package-lock.json";
+
+fn material_error(detail: impl std::fmt::Display) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Material).attach(detail.to_string())
+}
+
+/// Expected original dependency identities, bound to approved lockfile bytes.
+///
+/// This is not a completed installation or a qualified tool selection.
+pub(crate) struct LockedMaterials {
+    source_commit: String,
+    cargo_lock_sha256: String,
+    npm_lock_sha256: String,
+    cargo: CargoMaterials,
+    npm: BTreeMap<String, NpmMaterial>,
+}
+
+impl LockedMaterials {
+    /// Starts one bounded collection of locked Git object snapshots.
+    ///
+    /// This selects a local executable; it does not qualify a release tool.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for an unsafe executable or expired collection.
+    pub(crate) fn git_collection(
+        &self,
+        program: &Path,
+        deadline: Instant,
+        cancellation: &Cancellation,
+    ) -> Result<git::GitCollection<'_>, Report<ReleaseError>> {
+        git::GitCollection::new(self, program, deadline, cancellation)
+    }
+    /// Reviews approved root declarations without executing npm lifecycle hooks.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for changed source, lifecycle hooks or an implicit install.
+    pub(crate) fn review_root(
+        &self,
+        source: &ApprovedSource,
+    ) -> Result<RootManifestReview, Report<ReleaseError>> {
+        if source.commit().as_str() != self.source_commit {
+            return Err(material_error(
+                "root manifest is bound to a different approved source",
+            ));
+        }
+        manifest::review_root(source)
+    }
+
+    /// Reviews a verified npm manifest against locked identity and hook policy.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for a mismatched original, changed manifest or unreviewed hook.
+    pub(crate) fn review_npm(
+        &self,
+        location: &str,
+        extracted: ExtractedOriginal,
+    ) -> Result<ReviewedNpmManifest, Report<ReleaseError>> {
+        let locked = self
+            .npm
+            .get(location)
+            .ok_or_else(|| material_error("unknown npm location"))?;
+        if extracted.source_commit() != self.source_commit
+            || extracted.identity() != format!("npm:{location}")
+        {
+            return Err(material_error(
+                "extracted manifest is not bound to this locked acquisition",
+            ));
+        }
+        manifest::review_npm(extracted, &locked.name, &locked.version)
+    }
+    /// Extracts a verified npm original into new private state.
+    ///
+    /// # Errors
+    ///
+    /// Returns a material error if the original is not bound to this source
+    /// and locked location, or its archive violates the extraction policy.
+    pub(crate) fn extract_npm(
+        &self,
+        location: &str,
+        original: VerifiedOriginal,
+    ) -> Result<ExtractedOriginal, Report<ReleaseError>> {
+        let locked = self
+            .npm
+            .get(location)
+            .ok_or_else(|| material_error("unknown npm location"))?;
+        self.join_original(&original, &format!("npm:{location}"))?;
+        let index_alias = matches!(
+            (locked.name.as_str(), locked.version.as_str()),
+            ("agent-base", "7.1.4")
+                | ("http-proxy-agent", "7.0.2")
+                | ("https-proxy-agent", "7.0.6")
+        );
+        let (root, node_tar_timestamps) = match (locked.name.as_str(), locked.version.as_str()) {
+            ("@types/chai", "5.2.3") => ("chai", true),
+            ("@types/deep-eql", "4.0.2") => ("deep-eql", true),
+            ("@types/estree", "1.0.8") => ("estree", true),
+            ("@types/jsdom", "27.0.0") => ("jsdom", true),
+            ("@types/json-schema", "7.0.15") => ("json-schema", true),
+            ("@types/json5", "0.0.29") => ("json5", false),
+            ("@types/node", "24.10.13") => ("node v24.10", true),
+            ("@types/tough-cookie", "4.0.5") => ("tough-cookie", true),
+            _ => ("package", false),
+        };
+        extract::extract(
+            original,
+            extract::Selection {
+                root,
+                index_alias,
+                node_tar_timestamps,
+                local_pax: locked.name == "gulp-wrap" && locked.version == "0.15.0",
+                cargo_package: false,
+            },
+        )
+    }
+
+    /// Extracts a verified registry crate under its exact locked root.
+    ///
+    /// # Errors
+    ///
+    /// Returns a material error for a mismatched identity or unsafe archive.
+    pub(crate) fn extract_registry(
+        &self,
+        name: &str,
+        version: &str,
+        original: VerifiedOriginal,
+    ) -> Result<ExtractedOriginal, Report<ReleaseError>> {
+        if !self
+            .cargo
+            .registry
+            .contains_key(&(name.to_owned(), version.to_owned()))
+        {
+            return Err(material_error("unknown registry identity"));
+        }
+        self.join_original(&original, &format!("crate:{name}@{version}"))?;
+        extract::extract(
+            original,
+            extract::Selection {
+                root: &format!("{name}-{version}"),
+                index_alias: false,
+                node_tar_timestamps: false,
+                local_pax: false,
+                cargo_package: true,
+            },
+        )
+    }
+
+    fn join_original(
+        &self,
+        original: &VerifiedOriginal,
+        identity: &str,
+    ) -> Result<(), Report<ReleaseError>> {
+        if original.source_commit() != self.source_commit || original.identity() != identity {
+            return Err(material_error(
+                "original is not bound to this approved locked identity",
+            ));
+        }
+        Ok(())
+    }
+
+    /// Loads only the approved tracked lockfiles and derives their identities.
+    ///
+    /// # Errors
+    ///
+    /// Returns a material/source/document error if either lockfile changed,
+    /// has an unsupported format or cannot identify an original acquisition.
+    pub(crate) fn from_source(source: &ApprovedSource) -> Result<Self, Report<ReleaseError>> {
+        let cargo = source.read_tracked("Cargo.lock", Role::Metadata)?;
+        let npm = source.read_tracked(NPM_LOCK, Role::Metadata)?;
+        Ok(Self {
+            source_commit: source.commit().as_str().to_owned(),
+            cargo_lock_sha256: hex::encode(Sha256::digest(&cargo)),
+            npm_lock_sha256: hex::encode(Sha256::digest(&npm)),
+            cargo: parse_cargo(&cargo)?,
+            npm: parse_npm(&npm)?,
+        })
+    }
+
+    /// Verifies an original npm archive selected by its locked installation path.
+    ///
+    /// Optional packages receive the same checksum checks as every other package.
+    ///
+    /// # Errors
+    ///
+    /// Returns a material error for an unknown location or changed archive.
+    pub(crate) fn verify_npm(
+        &self,
+        location: &str,
+        path: &Path,
+        deadline: Instant,
+        cancellation: &Cancellation,
+    ) -> Result<VerifiedOriginal, Report<ReleaseError>> {
+        let locked = self
+            .npm
+            .get(location)
+            .ok_or_else(|| material_error("npm archive is not in the approved lockfile"))?;
+        archive::verify(
+            path,
+            archive::Expected::Sha512(&locked.sha512),
+            &self.source_commit,
+            &format!("npm:{location}"),
+            deadline,
+            cancellation,
+        )
+    }
+
+    /// Verifies an original registry crate selected by its exact locked identity.
+    ///
+    /// # Errors
+    ///
+    /// Returns a material error for an unknown identity or changed archive.
+    pub(crate) fn verify_registry(
+        &self,
+        name: &str,
+        version: &str,
+        path: &Path,
+        deadline: Instant,
+        cancellation: &Cancellation,
+    ) -> Result<VerifiedOriginal, Report<ReleaseError>> {
+        let locked = self
+            .cargo
+            .registry
+            .get(&(name.to_owned(), version.to_owned()))
+            .ok_or_else(|| material_error("crate archive is not in the approved lockfile"))?;
+        archive::verify(
+            path,
+            archive::Expected::Sha256(&locked.sha256),
+            &self.source_commit,
+            &format!("crate:{name}@{version}"),
+            deadline,
+            cancellation,
+        )
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/trusted-server-release/src/materials/archive.rs b/crates/trusted-server-release/src/materials/archive.rs
new file mode 100644
index 0000000000..fde4a02a5a
--- /dev/null
+++ b/crates/trusted-server-release/src/materials/archive.rs
@@ -0,0 +1,202 @@
+//! Checks original bytes and retains a private copy, without extracting them.
+
+use std::fs::{File, Metadata, OpenOptions};
+use std::io::{Read as _, Seek as _, Write};
+use std::os::unix::fs::{MetadataExt as _, OpenOptionsExt as _};
+use std::path::Path;
+use std::time::Instant;
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256, Sha512};
+
+use super::material_error;
+use crate::error::ReleaseError;
+use crate::process::Cancellation;
+
+/// Original dependency archives are distinct from toolchain distributions.
+/// The current npm/crate material stage accepts at most 64 MiB per original.
+const ARCHIVE_LIMIT: u64 = 64 * 1024 * 1024;
+
+#[derive(Clone, Copy)]
+pub(super) enum Expected<'a> {
+    Sha256(&'a str),
+    Sha512(&'a [u8; 64]),
+}
+
+fn stamp(metadata: &Metadata) -> (u64, u64, u64, u64, i64, i64, i64, i64) {
+    (
+        metadata.dev(),
+        metadata.ino(),
+        metadata.nlink(),
+        metadata.len(),
+        metadata.mtime(),
+        metadata.mtime_nsec(),
+        metadata.ctime(),
+        metadata.ctime_nsec(),
+    )
+}
+
+/// Exact verified original bytes, retained independently of their input path.
+///
+/// No deserialization or caller-supplied digest constructor is available.
+pub(crate) struct VerifiedOriginal {
+    file: File,
+    source_commit: String,
+    identity: String,
+    sha256: String,
+    length: u64,
+    deadline: Instant,
+    cancellation: Cancellation,
+}
+
+fn check_limits(
+    deadline: Instant,
+    cancellation: &Cancellation,
+) -> Result<(), Report<ReleaseError>> {
+    if cancellation.is_cancelled() || Instant::now() >= deadline {
+        return Err(material_error(
+            "original material verification cancelled or timed out",
+        ));
+    }
+    Ok(())
+}
+
+impl VerifiedOriginal {
+    pub(super) fn check(&self) -> Result<(), Report<ReleaseError>> {
+        check_limits(self.deadline, &self.cancellation)
+    }
+
+    /// Copies the retained original after checking its exact bytes again.
+    ///
+    /// # Errors
+    ///
+    /// Returns a material error if retained bytes changed or copying fails.
+    pub(crate) fn copy_verified(
+        &mut self,
+        destination: &mut impl Write,
+    ) -> Result<(), Report<ReleaseError>> {
+        check_limits(self.deadline, &self.cancellation)?;
+        self.file.rewind().map_err(material_error)?;
+        let mut hasher = Sha256::new();
+        let mut length = 0_u64;
+        let mut buffer = [0_u8; 64 * 1024];
+        loop {
+            check_limits(self.deadline, &self.cancellation)?;
+            let count = self.file.read(&mut buffer).map_err(material_error)?;
+            if count == 0 {
+                break;
+            }
+            length += count as u64;
+            if length > self.length {
+                return Err(material_error("retained original grew"));
+            }
+            hasher.update(&buffer[..count]);
+        }
+        if length != self.length || hex::encode(hasher.finalize()) != self.sha256 {
+            return Err(material_error("retained original changed"));
+        }
+        self.file.rewind().map_err(material_error)?;
+        let mut copied = 0_u64;
+        loop {
+            check_limits(self.deadline, &self.cancellation)?;
+            let count = self.file.read(&mut buffer).map_err(material_error)?;
+            if count == 0 {
+                break;
+            }
+            copied += count as u64;
+            if copied > self.length {
+                return Err(material_error("retained original grew while copying"));
+            }
+            destination
+                .write_all(&buffer[..count])
+                .map_err(material_error)?;
+        }
+        if copied != self.length {
+            return Err(material_error("retained original changed while copying"));
+        }
+        check_limits(self.deadline, &self.cancellation)?;
+        Ok(())
+    }
+
+    /// Returns the approved source that supplies this archive's expected identity.
+    pub(crate) fn source_commit(&self) -> &str {
+        &self.source_commit
+    }
+
+    /// Returns the original's source-bound package or installation identity.
+    pub(crate) fn identity(&self) -> &str {
+        &self.identity
+    }
+
+    /// Returns the SHA-256 of the exact retained distribution bytes.
+    pub(crate) fn sha256(&self) -> &str {
+        &self.sha256
+    }
+}
+
+pub(super) fn verify(
+    path: &Path,
+    expected: Expected<'_>,
+    source_commit: &str,
+    identity: &str,
+    deadline: Instant,
+    cancellation: &Cancellation,
+) -> Result<VerifiedOriginal, Report<ReleaseError>> {
+    check_limits(deadline, cancellation)?;
+    let mut input = OpenOptions::new()
+        .read(true)
+        .custom_flags(libc::O_NOFOLLOW | libc::O_NONBLOCK | libc::O_CLOEXEC)
+        .open(path)
+        .map_err(material_error)?;
+    let before = input.metadata().map_err(material_error)?;
+    if !before.is_file() || before.nlink() != 1 || before.len() > ARCHIVE_LIMIT {
+        return Err(material_error(
+            "original must be a bounded regular single-link file",
+        ));
+    }
+    let mut file = tempfile::tempfile().map_err(material_error)?;
+    let mut sha256 = Sha256::new();
+    let mut sha512 = Sha512::new();
+    let mut length = 0_u64;
+    let mut buffer = [0_u8; 64 * 1024];
+    loop {
+        check_limits(deadline, cancellation)?;
+        let count = input.read(&mut buffer).map_err(material_error)?;
+        if count == 0 {
+            break;
+        }
+        length += count as u64;
+        if length > ARCHIVE_LIMIT {
+            return Err(material_error("original exceeds archive limit"));
+        }
+        sha256.update(&buffer[..count]);
+        sha512.update(&buffer[..count]);
+        file.write_all(&buffer[..count]).map_err(material_error)?;
+    }
+    if length != before.len() || stamp(&before) != stamp(&input.metadata().map_err(material_error)?)
+    {
+        return Err(material_error(
+            "original changed while reading its held descriptor",
+        ));
+    }
+    let digest = hex::encode(sha256.finalize());
+    let matches = match expected {
+        Expected::Sha256(wanted) => digest == wanted,
+        Expected::Sha512(wanted) => sha512.finalize()[..] == wanted[..],
+    };
+    if !matches {
+        return Err(material_error(
+            "original archive differs from its approved lockfile identity",
+        ));
+    }
+    check_limits(deadline, cancellation)?;
+    Ok(VerifiedOriginal {
+        file,
+        source_commit: source_commit.to_owned(),
+        identity: identity.to_owned(),
+        sha256: digest,
+        length,
+        deadline,
+        cancellation: cancellation.clone(),
+    })
+}
diff --git a/crates/trusted-server-release/src/materials/cargo_vendor.rs b/crates/trusted-server-release/src/materials/cargo_vendor.rs
new file mode 100644
index 0000000000..d44df109a7
--- /dev/null
+++ b/crates/trusted-server-release/src/materials/cargo_vendor.rs
@@ -0,0 +1,629 @@
+//! Cargo directory-source vendoring from verified originals.
+//!
+//! Registry crates come from archives already authenticated against the
+//! approved `Cargo.lock` checksum and extracted under the archive policy.
+//! Git packages come from a verified object closure. Each registry crate
+//! becomes `vendor/<name>-<version>/` and each Git package `vendor/<name>/`
+//! (so sibling paths inside its own workspace still resolve), with a
+//! producer-written `.cargo-checksum.json` (see [`writer`]). The result is a
+//! [`PreparedCargoMaterials`] token whose digest covers the whole vendor tree.
+//!
+//! # Normalized Git manifests
+//!
+//! A Git package whose manifest inherits from its workspace
+//! (`version.workspace = true`) cannot be used from a directory source as it
+//! is. The producer resolves that inheritance itself (see [`normalize`]) from
+//! the package manifest and the enclosing workspace root manifest of the same
+//! verified tree, writes the result as `Cargo.toml` and keeps the committed
+//! manifest as `Cargo.toml.orig`. No caller-supplied manifest is accepted.
+//! The normalization is a reviewed producer transformation: its digests are
+//! recorded in [`PreparedCargoMaterials::normalized_manifest_digests`] and do
+//! not by themselves make a build unqualified.
+
+#[cfg(test)]
+mod differential;
+mod git_tree;
+mod index;
+mod normalize;
+mod source;
+mod writer;
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::fs::{self, DirBuilder};
+use std::os::unix::fs::{DirBuilderExt as _, MetadataExt as _};
+use std::path::{Path, PathBuf};
+use std::time::Instant;
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256};
+
+use super::git::VerifiedGitMaterial;
+use super::locked::CARGO_REGISTRY;
+use super::locked::GitPackage;
+use super::{LockedMaterials, material_error};
+use crate::error::ReleaseError;
+use crate::process::Cancellation;
+use crate::tool_tree::tool_tree_digest;
+#[cfg(all(test, target_os = "linux"))]
+pub(crate) use differential::resolution_differences;
+use git_tree::{Store, ancestor_manifests, find_package, materialize};
+pub(crate) use index::{CargoOrigin, VerifiedCargoPackage};
+use normalize::{PackageManifest, check_target_paths, normalize_manifest};
+pub(crate) use source::GitSourceConfig;
+use writer::PackageWriter;
+
+/// Name of the directory below the materials root that holds every package.
+pub(crate) const VENDOR_DIRECTORY: &str = "vendor";
+/// Largest manifest parsed.
+const MANIFEST_LIMIT: u64 = 1024 * 1024;
+/// Largest single vendored file.
+const FILE_LIMIT: u64 = 128 * 1024 * 1024;
+/// Most files copied from one extracted crate.
+const FILE_COUNT_LIMIT: usize = 100_000;
+
+/// A verified Git closure for one locked Git package.
+///
+/// It carries no manifest: every vendored manifest comes from the verified
+/// tree, normalized by the producer when it inherits from its workspace.
+pub(crate) struct GitVendorInput<'a> {
+    /// The verified closure for the package's locked source and revision.
+    pub(crate) material: &'a VerifiedGitMaterial,
+    /// Locked package name.
+    pub(crate) name: &'a str,
+    /// Locked package version.
+    pub(crate) version: &'a str,
+}
+
+/// Every original the vendor tree is prepared from.
+pub(crate) struct VendorInputs<'a> {
+    /// Registry archive paths by exact locked `(name, version)`.
+    pub(crate) registry_archives: &'a BTreeMap<(String, String), PathBuf>,
+    /// One verified closure per locked Git package.
+    pub(crate) git: &'a [GitVendorInput<'a>],
+}
+
+/// A prepared, digest-bound vendor tree.
+///
+/// Only [`LockedMaterials::prepare_cargo_vendor`] constructs it outside tests.
+#[derive(Debug)]
+pub(crate) struct PreparedCargoMaterials {
+    root: PathBuf,
+    vendor: PathBuf,
+    digest: String,
+    source_commit: String,
+    cargo_lock_sha256: String,
+    git_sources: Vec<GitSourceConfig>,
+    normalized_manifests: BTreeMap<String, String>,
+    derived_manifests: BTreeMap<String, String>,
+    packages: BTreeMap<String, VerifiedCargoPackage>,
+}
+
+impl PreparedCargoMaterials {
+    /// Verified original identities, keyed by the prepared vendor directory.
+    ///
+    /// This includes prepared but uncompiled dependencies. Observed compiler
+    /// units must be joined separately before claiming artifact membership.
+    pub(crate) fn packages(&self) -> &BTreeMap<String, VerifiedCargoPackage> {
+        &self.packages
+    }
+
+    /// The materials root that holds only the vendor directory.
+    pub(crate) fn root(&self) -> &Path {
+        &self.root
+    }
+
+    /// The directory-source root passed to Cargo.
+    pub(crate) fn vendor_dir(&self) -> &Path {
+        &self.vendor
+    }
+
+    /// Digest of every vendored path, mode, size and content.
+    pub(crate) fn digest(&self) -> &str {
+        &self.digest
+    }
+
+    /// The approved source commit whose lock selected these originals.
+    pub(crate) fn source_commit(&self) -> &str {
+        &self.source_commit
+    }
+
+    /// SHA-256 of the approved raw `Cargo.lock`.
+    pub(crate) fn cargo_lock_sha256(&self) -> &str {
+        &self.cargo_lock_sha256
+    }
+
+    /// Distinct locked Git sources, sorted by key, for source replacement.
+    pub(crate) fn git_sources(&self) -> &[GitSourceConfig] {
+        &self.git_sources
+    }
+
+    /// Digests of the manifests the producer normalized, by vendor directory.
+    ///
+    /// Each was derived by [`normalize`] from the verified tree alone, a
+    /// reviewed transformation; it does not make the build unqualified.
+    pub(crate) fn normalized_manifest_digests(&self) -> &BTreeMap<String, String> {
+        &self.normalized_manifests
+    }
+
+    /// Digests of caller-derived manifests, by vendor directory.
+    ///
+    /// [`LockedMaterials::prepare_cargo_vendor`] accepts no caller-supplied
+    /// manifest, so it always leaves this empty. It stays part of the token
+    /// so any caller-derived manifest, such as one a test constructs, still
+    /// marks the build unqualified.
+    pub(crate) fn derived_manifest_digests(&self) -> &BTreeMap<String, String> {
+        &self.derived_manifests
+    }
+
+    /// Recomputes the digest and requires the root to hold only the vendor tree.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Material`] when anything under the root was
+    /// edited, added, removed or linked since preparation.
+    pub(crate) fn rehash(&self) -> Result<(), Report<ReleaseError>> {
+        let names = fs::read_dir(&self.root)
+            .map_err(material_error)?
+            .map(|entry| entry.map(|entry| entry.file_name()))
+            .collect::<Result<Vec<_>, _>>()
+            .map_err(material_error)?;
+        if names != [std::ffi::OsString::from(VENDOR_DIRECTORY)] {
+            return Err(material_error(
+                "materials root holds something other than the vendor directory",
+            ));
+        }
+        if tool_tree_digest(&self.vendor, &|| Ok(()))? != self.digest {
+            return Err(material_error(
+                "vendored materials changed after preparation",
+            ));
+        }
+        Ok(())
+    }
+
+    /// Records a derived manifest digest on a test token.
+    #[cfg(test)]
+    #[must_use]
+    pub(crate) fn with_derived_for_tests(mut self, directory: &str, digest: &str) -> Self {
+        self.derived_manifests
+            .insert(directory.to_owned(), digest.to_owned());
+        self
+    }
+
+    /// Records a producer-normalized manifest digest on a test token.
+    #[cfg(test)]
+    #[must_use]
+    pub(crate) fn with_normalized_for_tests(mut self, directory: &str, digest: &str) -> Self {
+        self.normalized_manifests
+            .insert(directory.to_owned(), digest.to_owned());
+        self
+    }
+
+    /// Builds a token over an existing `root/vendor`, for tests only.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Material`] when the vendor tree cannot be
+    /// digested or a selector is not a supported Git source.
+    #[cfg(test)]
+    pub(crate) fn for_tests(
+        root: &Path,
+        source_commit: &str,
+        git_selectors: &[&str],
+    ) -> Result<Self, Report<ReleaseError>> {
+        let vendor = root.join(VENDOR_DIRECTORY);
+        match fs::create_dir(&vendor) {
+            Ok(()) => {}
+            Err(error) if error.kind() == std::io::ErrorKind::AlreadyExists => {}
+            Err(error) => return Err(material_error(error)),
+        }
+        Ok(Self {
+            root: root.to_owned(),
+            digest: tool_tree_digest(&vendor, &|| Ok(()))?,
+            vendor,
+            source_commit: source_commit.to_owned(),
+            cargo_lock_sha256: "b".repeat(64),
+            git_sources: git_selectors
+                .iter()
+                .map(|selector| GitSourceConfig::parse(selector))
+                .collect::<Result<_, _>>()?,
+            normalized_manifests: BTreeMap::new(),
+            derived_manifests: BTreeMap::new(),
+            packages: BTreeMap::new(),
+        })
+    }
+}
+
+fn attempt_check(
+    deadline: Instant,
+    cancellation: &Cancellation,
+) -> Result<(), Report<ReleaseError>> {
+    if cancellation.is_cancelled() || Instant::now() >= deadline {
+        return Err(material_error("Cargo vendoring cancelled or timed out"));
+    }
+    Ok(())
+}
+
+/// Requires a vendor directory name that cannot escape or hide.
+fn plain_directory(directory: String) -> Result<String, Report<ReleaseError>> {
+    let plain = !directory.is_empty()
+        && !directory.starts_with('.')
+        && directory
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'-' | b'+'));
+    if !plain {
+        return Err(material_error(format!(
+            "package identity {directory:?} is not a safe vendor directory name"
+        )));
+    }
+    Ok(directory)
+}
+
+/// Names a registry crate's vendor directory `<name>-<version>`.
+fn directory_name(name: &str, version: &str) -> Result<String, Report<ReleaseError>> {
+    plain_directory(format!("{name}-{version}"))
+}
+
+/// Names a Git package's vendor directory after the package alone.
+///
+/// This is the layout `cargo vendor` gives a unique name, and it keeps paths
+/// between sibling members of the package's own workspace resolving: a
+/// package that reads `../<sibling>/...` from its manifest directory, as a
+/// checkout allows, finds that sibling in the vendor directory too. A
+/// registry crate or second Git package with the same directory name still
+/// fails closed, because every vendor directory is created exclusively.
+fn git_directory_name(name: &str) -> Result<String, Report<ReleaseError>> {
+    plain_directory(name.to_owned())
+}
+
+/// Requires a real, empty directory that no symlink aliases.
+fn check_output_root(root: &Path) -> Result<(), Report<ReleaseError>> {
+    let metadata = fs::symlink_metadata(root).map_err(material_error)?;
+    let resolved = fs::canonicalize(root).map_err(material_error)?;
+    if !metadata.is_dir() || resolved.as_os_str() != root.as_os_str() {
+        return Err(material_error(
+            "materials root is not a real unaliased directory",
+        ));
+    }
+    if fs::read_dir(root).map_err(material_error)?.next().is_some() {
+        return Err(material_error("materials root already has entries"));
+    }
+    Ok(())
+}
+
+/// Parses a manifest of at most one MiB into a TOML table.
+fn parse_manifest(bytes: &[u8]) -> Result<toml::Table, Report<ReleaseError>> {
+    if bytes.len() as u64 > MANIFEST_LIMIT {
+        return Err(material_error("package manifest exceeds the size limit"));
+    }
+    let text = std::str::from_utf8(bytes).map_err(material_error)?;
+    toml::from_str(text).map_err(material_error)
+}
+
+/// Returns the declared `(name, version)`; the version is `None` when it is
+/// not a plain string (inherited from a workspace).
+fn declared_identity(table: &toml::Table) -> Option<(String, Option<String>)> {
+    let package = table.get("package")?;
+    let name = package.get("name")?.as_str()?.to_owned();
+    let version = package
+        .get("version")
+        .and_then(toml::Value::as_str)
+        .map(str::to_owned);
+    Some((name, version))
+}
+
+/// Reports whether any table below `value` has `workspace = true`.
+fn inherits_workspace(value: &toml::Value) -> bool {
+    match value {
+        toml::Value::Table(table) => {
+            table.get("workspace") == Some(&toml::Value::Boolean(true))
+                || table.values().any(inherits_workspace)
+        }
+        toml::Value::Array(values) => values.iter().any(inherits_workspace),
+        _ => false,
+    }
+}
+
+/// Requires a plain-string identity equal to the locked one.
+fn require_identity(
+    manifest: &[u8],
+    name: &str,
+    version: &str,
+) -> Result<(), Report<ReleaseError>> {
+    let table = parse_manifest(manifest)?;
+    match declared_identity(&table) {
+        Some((found_name, Some(found_version)))
+            if found_name == name && found_version == version =>
+        {
+            Ok(())
+        }
+        _ => Err(material_error(format!(
+            "manifest does not declare package {name} {version}"
+        ))),
+    }
+}
+
+/// Copies every file of an extracted crate into `writer`.
+fn copy_extracted(root: &Path, writer: &mut PackageWriter) -> Result<(), Report<ReleaseError>> {
+    let mut pending = vec![(root.to_owned(), String::new())];
+    let mut count = 0_usize;
+    while let Some((directory, prefix)) = pending.pop() {
+        for entry in fs::read_dir(&directory).map_err(material_error)? {
+            let entry = entry.map_err(material_error)?;
+            let name = entry
+                .file_name()
+                .into_string()
+                .map_err(|_| material_error("extracted member is not UTF-8"))?;
+            let relative = format!("{prefix}{name}");
+            let metadata = fs::symlink_metadata(entry.path()).map_err(material_error)?;
+            if metadata.is_dir() {
+                pending.push((entry.path(), format!("{relative}/")));
+            } else if metadata.is_file() && metadata.len() <= FILE_LIMIT {
+                count += 1;
+                if count > FILE_COUNT_LIMIT {
+                    return Err(material_error("extracted crate exceeds the file limit"));
+                }
+                let bytes = fs::read(entry.path()).map_err(material_error)?;
+                writer.write(&relative, &bytes, metadata.mode() & 0o111 != 0)?;
+            } else {
+                return Err(material_error(
+                    "extracted crate has an unsafe file type or an oversize file",
+                ));
+            }
+        }
+    }
+    Ok(())
+}
+
+impl LockedMaterials {
+    /// Requires the supplied inputs to be exactly the locked originals.
+    fn check_vendor_inputs(&self, inputs: &VendorInputs<'_>) -> Result<(), Report<ReleaseError>> {
+        let locked: BTreeSet<_> = self.cargo.registry.keys().collect();
+        let supplied: BTreeSet<_> = inputs.registry_archives.keys().collect();
+        if locked != supplied {
+            return Err(material_error(
+                "registry archives are not exactly the locked registry crates",
+            ));
+        }
+        if inputs.git.len() != self.cargo.git_packages.len() {
+            return Err(material_error(
+                "Git inputs are not exactly the locked Git packages",
+            ));
+        }
+        for package in &self.cargo.git_packages {
+            self.matching_git_input(package, inputs)?;
+        }
+        Ok(())
+    }
+
+    /// Finds the single input for a locked Git package and checks its bindings.
+    fn matching_git_input<'a>(
+        &self,
+        package: &GitPackage,
+        inputs: &'a VendorInputs<'a>,
+    ) -> Result<&'a GitVendorInput<'a>, Report<ReleaseError>> {
+        let mut matching = inputs
+            .git
+            .iter()
+            .filter(|input| input.name == package.name && input.version == package.version);
+        let (Some(input), None) = (matching.next(), matching.next()) else {
+            return Err(material_error(format!(
+                "Git package {} {} needs exactly one input",
+                package.name, package.version
+            )));
+        };
+        let material = input.material;
+        if material.selector() != package.selector
+            || material.revision() != package.revision
+            || material.source_commit() != self.source_commit
+            || material.cargo_lock_sha256() != self.cargo_lock_sha256
+        {
+            return Err(material_error(format!(
+                "Git closure for {} is not bound to its locked source, revision or approved lock",
+                package.name
+            )));
+        }
+        Ok(input)
+    }
+
+    /// Prepares `output_root/vendor` from verified originals.
+    ///
+    /// The root must be an empty real directory. On failure it may hold a
+    /// partial tree and must be discarded.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Material`] for a non-fresh root, a missing,
+    /// extra or unverifiable original, a manifest that does not declare the
+    /// locked identity, an ambiguous or missing Git package root, a Git
+    /// manifest whose workspace inheritance cannot be normalized, a repeated
+    /// vendor directory, or an expired or cancelled attempt.
+    pub(crate) fn prepare_cargo_vendor(
+        &self,
+        inputs: &VendorInputs<'_>,
+        output_root: &Path,
+        deadline: Instant,
+        cancellation: &Cancellation,
+    ) -> Result<PreparedCargoMaterials, Report<ReleaseError>> {
+        attempt_check(deadline, cancellation)?;
+        check_output_root(output_root)?;
+        self.check_vendor_inputs(inputs)?;
+        let sources: BTreeMap<String, GitSourceConfig> = self
+            .cargo
+            .git_packages
+            .iter()
+            .map(|package| {
+                GitSourceConfig::parse(&package.selector)
+                    .map(|source| (source.key().to_owned(), source))
+            })
+            .collect::<Result<_, _>>()?;
+        let vendor = output_root.join(VENDOR_DIRECTORY);
+        DirBuilder::new()
+            .mode(0o755)
+            .create(&vendor)
+            .map_err(material_error)?;
+        let mut packages = BTreeMap::new();
+        for ((name, version), path) in inputs.registry_archives {
+            attempt_check(deadline, cancellation)?;
+            let identity =
+                self.vendor_registry(name, version, path, &vendor, deadline, cancellation)?;
+            packages.insert(directory_name(name, version)?, identity);
+        }
+        let mut normalized = BTreeMap::new();
+        for package in &self.cargo.git_packages {
+            attempt_check(deadline, cancellation)?;
+            let input = self.matching_git_input(package, inputs)?;
+            let identity = vendor_git(package, input, &vendor)?;
+            if let CargoOrigin::Git {
+                normalized_manifest_sha256: Some(digest),
+                ..
+            } = &identity.origin
+            {
+                normalized.insert(git_directory_name(&package.name)?, digest.clone());
+            }
+            packages.insert(git_directory_name(&package.name)?, identity);
+        }
+        attempt_check(deadline, cancellation)?;
+        Ok(PreparedCargoMaterials {
+            root: output_root.to_owned(),
+            digest: tool_tree_digest(&vendor, &|| attempt_check(deadline, cancellation))?,
+            vendor,
+            source_commit: self.source_commit.clone(),
+            cargo_lock_sha256: self.cargo_lock_sha256.clone(),
+            git_sources: sources.into_values().collect(),
+            normalized_manifests: normalized,
+            derived_manifests: BTreeMap::new(),
+            packages,
+        })
+    }
+
+    fn vendor_registry(
+        &self,
+        name: &str,
+        version: &str,
+        path: &Path,
+        vendor: &Path,
+        deadline: Instant,
+        cancellation: &Cancellation,
+    ) -> Result<VerifiedCargoPackage, Report<ReleaseError>> {
+        let directory = directory_name(name, version)?;
+        let checksum = self
+            .cargo
+            .registry
+            .get(&(name.to_owned(), version.to_owned()))
+            .map(|material| material.sha256.clone())
+            .ok_or_else(|| material_error("registry crate is not locked"))?;
+        let original = self.verify_registry(name, version, path, deadline, cancellation)?;
+        let extracted = self.extract_registry(name, version, original)?;
+        extracted.verify_unchanged()?;
+        let manifest = extracted.read_member_checked("Cargo.toml")?;
+        require_identity(&manifest, name, version)?;
+        let mut writer = PackageWriter::create(vendor, &directory)?;
+        copy_extracted(extracted.root(), &mut writer)?;
+        extracted.verify_unchanged()?;
+        let files = writer.finish(Some(&checksum))?;
+        let prepared_manifest_sha256 = files
+            .get("Cargo.toml")
+            .ok_or_else(|| material_error("prepared registry manifest is missing"))?
+            .clone();
+        Ok(VerifiedCargoPackage {
+            name: name.to_owned(),
+            version: version.to_owned(),
+            source: CARGO_REGISTRY.to_owned(),
+            prepared_manifest_sha256,
+            origin: CargoOrigin::Registry {
+                archive_sha256: checksum,
+            },
+        })
+    }
+}
+
+/// Vendors one Git package and records its verified original and prepared identity.
+fn vendor_git(
+    package: &GitPackage,
+    input: &GitVendorInput<'_>,
+    vendor: &Path,
+) -> Result<VerifiedCargoPackage, Report<ReleaseError>> {
+    let directory = git_directory_name(&package.name)?;
+    let store = Store::new(input.material.object_store());
+    let root = find_package(&store, input.material.root_tree(), &package.name)?;
+    let committed = store.read("blob", &root.manifest, MANIFEST_LIMIT)?;
+    let committed_manifest_sha256 = hex::encode(Sha256::digest(&committed));
+    let table = parse_manifest(&committed)?;
+    check_target_paths(&table)?;
+    match declared_identity(&table) {
+        Some((name, _)) if name != package.name => {
+            return Err(material_error(format!(
+                "Git manifest declares package {name}, not {}",
+                package.name
+            )));
+        }
+        Some((_, Some(version))) if version != package.version => {
+            return Err(material_error(format!(
+                "Git manifest declares {} {version}, not {} {}",
+                package.name, package.name, package.version
+            )));
+        }
+        Some(_) => {}
+        None => return Err(material_error("Git manifest declares no package")),
+    }
+    let (manifest, original) = if inherits_workspace(&toml::Value::Table(table)) {
+        let ancestors = ancestor_manifests(&store, input.material.root_tree(), &root)?;
+        let normalized = normalize_manifest(
+            &PackageManifest {
+                name: &package.name,
+                version: &package.version,
+                directory: &root.path,
+                bytes: &committed,
+            },
+            &ancestors,
+        )?;
+        (normalized, Some(committed))
+    } else {
+        (committed, None)
+    };
+    let mut writer = PackageWriter::create(vendor, &directory)?;
+    materialize(&store, input.material.root_tree(), &root, &mut writer)?;
+    writer.write("Cargo.toml", &manifest, false)?;
+    if let Some(original) = &original {
+        writer.write("Cargo.toml.orig", original, false)?;
+    }
+    let normalized = original
+        .as_ref()
+        .and_then(|_| writer.digest_of("Cargo.toml").map(str::to_owned));
+    let files = writer.finish(None)?;
+    let prepared_manifest_sha256 = files
+        .get("Cargo.toml")
+        .ok_or_else(|| material_error("prepared Git manifest is missing"))?
+        .clone();
+    Ok(VerifiedCargoPackage {
+        name: package.name.clone(),
+        version: package.version.clone(),
+        source: format!("{}#{}", package.selector, package.revision),
+        prepared_manifest_sha256,
+        origin: CargoOrigin::Git {
+            revision: package.revision.clone(),
+            repository_tree: input.material.root_tree().to_owned(),
+            package_tree: root.tree,
+            package_path: root.path,
+            committed_manifest_blob: root.manifest,
+            committed_manifest_sha256,
+            normalized_manifest_sha256: normalized,
+        },
+    })
+}
+
+#[cfg(test)]
+mod tests;
+
+#[cfg(test)]
+impl PreparedCargoMaterials {
+    /// Adds an identity fixture without bypassing whole-tree rehashing.
+    pub(crate) fn with_package_for_tests(
+        mut self,
+        directory: &str,
+        package: VerifiedCargoPackage,
+    ) -> Self {
+        self.packages.insert(directory.to_owned(), package);
+        self
+    }
+}
diff --git a/crates/trusted-server-release/src/materials/cargo_vendor/differential.rs b/crates/trusted-server-release/src/materials/cargo_vendor/differential.rs
new file mode 100644
index 0000000000..794c72fe31
--- /dev/null
+++ b/crates/trusted-server-release/src/materials/cargo_vendor/differential.rs
@@ -0,0 +1,293 @@
+//! Differential evidence: producer-normalized manifests against `cargo vendor`.
+//!
+//! The ordinary CI candidate fixture records the manifests `cargo vendor`
+//! wrote for each Git package. They are a comparison fixture, never a vendor
+//! input. This module reduces two manifests to the facts dependency
+//! resolution reads (package identity, features, `links` and every
+//! dependency's source, requirement, rename, optionality, default features
+//! and feature set) and lists every fact on which they disagree. Equal
+//! facts are evidence that the producer resolved inheritance as Cargo does;
+//! they confer no authority.
+//!
+//! Two build-target facts are compared by their Cargo meaning, not their
+//! spelling, because `cargo vendor` makes target auto-discovery explicit
+//! while the producer leaves it to Cargo:
+//!
+//! - `package.build`: an absent key and `build = true` both mean "use
+//!   `build.rs` if the package directory has one", so they compare as
+//!   `"build.rs"` when that file exists and as `false` when it does not;
+//!   `build = false` and an explicit path compare as written.
+//! - `lib.proc-macro` (or `proc_macro`): absent means `false`.
+//!
+//! No other absent/explicit pair is treated as equal.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use error_stack::Report;
+use toml::{Table, Value};
+
+use super::parse_manifest;
+use crate::error::ReleaseError;
+use crate::materials::material_error;
+
+/// `[package]` fields that bear on identity or resolution.
+const PACKAGE_FACTS: [&str; 5] = ["edition", "links", "name", "rust-version", "version"];
+/// Dependency keys compared as written; `features` and defaults are normalized.
+const DEPENDENCY_FACTS: [&str; 10] = [
+    "branch", "git", "optional", "package", "path", "public", "registry", "rev", "tag", "version",
+];
+
+/// Lists every resolution fact on which the two manifests disagree.
+///
+/// An empty list means they are equivalent for dependency resolution.
+/// `build_rs_present` says whether the vendored package directory holds a
+/// `build.rs`, which decides what an auto-discovered build script means.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Material`] when either manifest does not parse
+/// or holds a malformed `build` or `proc-macro` value.
+pub(crate) fn resolution_differences(
+    producer: &[u8],
+    cargo_vendor: &[u8],
+    build_rs_present: bool,
+) -> Result<Vec<String>, Report<ReleaseError>> {
+    let producer = resolution_facts(&parse_manifest(producer)?, build_rs_present)?;
+    let cargo_vendor = resolution_facts(&parse_manifest(cargo_vendor)?, build_rs_present)?;
+    let keys: BTreeSet<&String> = producer.keys().chain(cargo_vendor.keys()).collect();
+    Ok(keys
+        .into_iter()
+        .filter(|key| producer.get(*key) != cargo_vendor.get(*key))
+        .map(|key| {
+            format!(
+                "{key}: producer={} cargo-vendor={}",
+                producer.get(key).map_or("<absent>", String::as_str),
+                cargo_vendor.get(key).map_or("<absent>", String::as_str),
+            )
+        })
+        .collect())
+}
+
+/// Flattens the resolution-relevant facts of one manifest.
+fn resolution_facts(
+    manifest: &Table,
+    build_rs_present: bool,
+) -> Result<BTreeMap<String, String>, Report<ReleaseError>> {
+    let mut facts = BTreeMap::new();
+    let package = manifest
+        .get("package")
+        .and_then(Value::as_table)
+        .ok_or_else(|| material_error("compared manifest has no [package] table"))?;
+    for key in PACKAGE_FACTS {
+        if let Some(value) = package.get(key) {
+            facts.insert(format!("package.{key}"), value.to_string());
+        }
+    }
+    facts.insert(
+        "package.build".to_owned(),
+        build_fact(package.get("build"), build_rs_present)?,
+    );
+    let lib = manifest.get("lib").and_then(Value::as_table);
+    let proc_macro =
+        match lib.and_then(|lib| lib.get("proc-macro").or_else(|| lib.get("proc_macro"))) {
+            None => false,
+            Some(Value::Boolean(value)) => *value,
+            Some(_) => return Err(material_error("compared lib.proc-macro is not a boolean")),
+        };
+    facts.insert("lib.proc-macro".to_owned(), proc_macro.to_string());
+    if let Some(features) = manifest.get("features").and_then(Value::as_table) {
+        for (name, members) in features {
+            facts.insert(format!("features.{name}"), sorted_strings(members)?);
+        }
+    }
+    dependency_facts(manifest, "", &mut facts)?;
+    if let Some(targets) = manifest.get("target").and_then(Value::as_table) {
+        for (cfg, target) in targets {
+            if let Some(target) = target.as_table() {
+                dependency_facts(target, &format!("target.{cfg}."), &mut facts)?;
+            }
+        }
+    }
+    Ok(facts)
+}
+
+/// The build script Cargo will run, by meaning rather than spelling.
+fn build_fact(
+    build: Option<&Value>,
+    build_rs_present: bool,
+) -> Result<String, Report<ReleaseError>> {
+    match build {
+        None | Some(Value::Boolean(true)) if build_rs_present => Ok("\"build.rs\"".to_owned()),
+        None | Some(Value::Boolean(true)) | Some(Value::Boolean(false)) => Ok("false".to_owned()),
+        Some(Value::String(path)) => Ok(format!("{path:?}")),
+        Some(_) => Err(material_error("compared package.build is malformed")),
+    }
+}
+
+/// Records the facts of every dependency table directly inside `scope`.
+fn dependency_facts(
+    scope: &Table,
+    prefix: &str,
+    facts: &mut BTreeMap<String, String>,
+) -> Result<(), Report<ReleaseError>> {
+    for (section, canonical) in [
+        ("dependencies", "dependencies"),
+        ("dev-dependencies", "dev-dependencies"),
+        ("dev_dependencies", "dev-dependencies"),
+        ("build-dependencies", "build-dependencies"),
+        ("build_dependencies", "build-dependencies"),
+    ] {
+        let Some(dependencies) = scope.get(section).and_then(Value::as_table) else {
+            continue;
+        };
+        for (name, dependency) in dependencies {
+            let base = format!("{prefix}{canonical}.{name}");
+            let detailed = match dependency {
+                Value::String(version) => {
+                    Table::from_iter([("version".to_owned(), Value::String(version.clone()))])
+                }
+                Value::Table(table) => table.clone(),
+                _ => return Err(material_error(format!("{base} is malformed"))),
+            };
+            for key in DEPENDENCY_FACTS {
+                if let Some(value) = detailed.get(key) {
+                    facts.insert(format!("{base}.{key}"), value.to_string());
+                }
+            }
+            let defaults = detailed
+                .get("default-features")
+                .or_else(|| detailed.get("default_features"))
+                .and_then(Value::as_bool)
+                .unwrap_or(true);
+            facts.insert(format!("{base}.default-features"), defaults.to_string());
+            if let Some(features) = detailed.get("features") {
+                facts.insert(format!("{base}.features"), sorted_strings(features)?);
+            }
+            if detailed.contains_key("workspace") {
+                facts.insert(format!("{base}.workspace"), "inherits".to_owned());
+            }
+        }
+    }
+    Ok(())
+}
+
+/// Renders an array of strings as a sorted, de-duplicated list.
+fn sorted_strings(value: &Value) -> Result<String, Report<ReleaseError>> {
+    let set: BTreeSet<&str> = value
+        .as_array()
+        .and_then(|values| values.iter().map(Value::as_str).collect::<Option<_>>())
+        .ok_or_else(|| material_error("compared feature list is not an array of strings"))?;
+    Ok(set.into_iter().collect::<Vec<_>>().join(","))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const PRODUCER: &str = "[package]\nname = \"example-core\"\nversion = \"0.4.0\"\nedition = \"2021\"\n\n[dependencies.example-dep]\nversion = \"1\"\nfeatures = [\"alpha\", \"beta\"]\n\n[dependencies.example-sibling]\npath = \"../example-sibling\"\ndefault-features = false\n";
+
+    #[test]
+    fn equal_resolution_ignores_order_repeats_and_presentation() {
+        let cargo_vendor = "[package]\nedition = \"2021\"\nname = \"example-core\"\nversion = \"0.4.0\"\nreadme = \"README.md\"\nautobins = false\n\n[dependencies]\nexample-dep = { version = \"1\", features = [\"beta\", \"alpha\", \"beta\"] }\nexample-sibling = { path = \"../example-sibling\", default_features = false }\n";
+        let differences =
+            resolution_differences(PRODUCER.as_bytes(), cargo_vendor.as_bytes(), false)
+                .expect("should compare both manifests");
+        assert!(
+            differences.is_empty(),
+            "should treat equal resolution facts as equivalent: {differences:?}"
+        );
+    }
+
+    #[test]
+    fn every_resolution_difference_is_reported() {
+        let cargo_vendor = "[package]\nname = \"example-core\"\nversion = \"0.4.1\"\nedition = \"2021\"\n\n[dependencies.example-dep]\nversion = \"1\"\nfeatures = [\"alpha\"]\n\n[dependencies.example-sibling]\npath = \"../example-sibling\"\n\n[dev-dependencies]\nexample-extra = \"2\"\n";
+        let differences =
+            resolution_differences(PRODUCER.as_bytes(), cargo_vendor.as_bytes(), false)
+                .expect("should compare both manifests");
+        let keys: Vec<&str> = differences
+            .iter()
+            .map(|line| line.split(':').next().unwrap_or_default())
+            .collect();
+        assert_eq!(
+            keys,
+            [
+                "dependencies.example-dep.features",
+                "dependencies.example-sibling.default-features",
+                "dev-dependencies.example-extra.default-features",
+                "dev-dependencies.example-extra.version",
+                "package.version",
+            ],
+            "should report the version, feature, default-features and missing dependency"
+        );
+    }
+
+    #[test]
+    fn build_targets_compare_by_cargo_meaning() {
+        let package = "[package]\nname = \"example-core\"\nversion = \"0.4.0\"\n";
+        let with = |extra: &str| format!("{package}{extra}");
+        let differs = |producer: &str, cargo_vendor: &str, build_rs_present: bool| {
+            !resolution_differences(
+                producer.as_bytes(),
+                cargo_vendor.as_bytes(),
+                build_rs_present,
+            )
+            .expect("should compare both manifests")
+            .is_empty()
+        };
+        let explicit_script = with("build = \"build.rs\"\n");
+        let no_script = with("build = false\n");
+        let proc_macro = with("\n[lib]\nproc-macro = true\n");
+        assert!(
+            !differs(package, &explicit_script, true),
+            "should equate auto-discovery with the explicit build.rs that exists"
+        );
+        assert!(
+            differs(package, &explicit_script, false),
+            "should not equate auto-discovery with a build.rs that is absent"
+        );
+        assert!(
+            !differs(package, &no_script, false),
+            "should equate auto-discovery with build = false when no build.rs exists"
+        );
+        assert!(
+            differs(package, &no_script, true),
+            "should not equate auto-discovery with build = false when build.rs exists"
+        );
+        assert!(
+            !differs(&with("build = true\n"), package, true),
+            "should equate build = true with an absent key"
+        );
+        assert!(
+            differs(
+                &with("build = \"tools/build.rs\"\n"),
+                &explicit_script,
+                true
+            ),
+            "should compare explicit build paths as written"
+        );
+        assert!(
+            !differs(package, &with("\n[lib]\nproc-macro = false\n"), false),
+            "should equate an absent proc-macro with false"
+        );
+        assert!(
+            differs(package, &proc_macro, false),
+            "should report a proc-macro difference"
+        );
+        assert!(
+            !differs(&with("\n[lib]\nproc_macro = true\n"), &proc_macro, false),
+            "should read the underscore spelling too"
+        );
+    }
+
+    #[test]
+    fn unparsable_manifests_are_errors() {
+        assert!(
+            resolution_differences(b"[package", PRODUCER.as_bytes(), false).is_err(),
+            "should refuse a manifest that does not parse"
+        );
+        assert!(
+            resolution_differences(b"[lib]\n", PRODUCER.as_bytes(), false).is_err(),
+            "should refuse a manifest without a package"
+        );
+    }
+}
diff --git a/crates/trusted-server-release/src/materials/cargo_vendor/git_tree.rs b/crates/trusted-server-release/src/materials/cargo_vendor/git_tree.rs
new file mode 100644
index 0000000000..46e20118c9
--- /dev/null
+++ b/crates/trusted-server-release/src/materials/cargo_vendor/git_tree.rs
@@ -0,0 +1,458 @@
+//! Reads a verified loose-object Git closure and materializes one package.
+//!
+//! [`VerifiedGitMaterial`](crate::materials::git::VerifiedGitMaterial) owns a
+//! private store of zlib-compressed loose objects whose SHA-1 identities were
+//! already checked. Every object is rehashed again here, so a store edited
+//! after verification is rejected instead of vendored.
+
+use std::cell::Cell;
+use std::collections::BTreeSet;
+use std::fs::OpenOptions;
+use std::io::Read as _;
+use std::os::unix::fs::{MetadataExt as _, OpenOptionsExt as _};
+use std::path::Path;
+
+use error_stack::Report;
+use flate2::read::ZlibDecoder;
+
+use super::normalize::AncestorManifest;
+use super::writer::PackageWriter;
+use crate::error::ReleaseError;
+use crate::git_objects::checked_sha1;
+use crate::materials::material_error;
+
+/// Largest single object read from the store.
+const OBJECT_LIMIT: u64 = 32 * 1024 * 1024;
+/// Total object bytes read per vendoring.
+const TOTAL_LIMIT: u64 = 512 * 1024 * 1024;
+/// Deepest accepted tree nesting.
+const DEPTH_LIMIT: usize = 256;
+/// Most tree entries visited per vendoring.
+const ENTRY_LIMIT: usize = 100_000;
+/// Largest manifest examined while looking for a package root.
+const MANIFEST_LIMIT: u64 = 1024 * 1024;
+
+/// One parsed tree entry.
+#[derive(Clone, Debug)]
+pub(super) struct TreeEntry {
+    pub(super) name: String,
+    pub(super) directory: bool,
+    pub(super) executable: bool,
+    symlink: bool,
+    pub(super) oid: String,
+}
+
+/// A rehashing reader over one verified loose-object store.
+pub(super) struct Store<'a> {
+    root: &'a Path,
+    remaining: Cell<u64>,
+    entries: Cell<usize>,
+}
+
+fn lower_oid(text: &str) -> bool {
+    text.len() == 40
+        && text
+            .bytes()
+            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+}
+
+/// Parses inert tree entries, rejecting submodules and unsafe names.
+fn parse_tree(mut bytes: &[u8]) -> Result<Vec<TreeEntry>, Report<ReleaseError>> {
+    let mut seen = BTreeSet::new();
+    let mut entries = Vec::new();
+    while !bytes.is_empty() {
+        let space = bytes
+            .iter()
+            .position(|byte| *byte == b' ')
+            .ok_or_else(|| material_error("malformed Git tree mode"))?;
+        let (directory, executable, symlink) = match &bytes[..space] {
+            b"40000" => (true, false, false),
+            b"100644" => (false, false, false),
+            b"100755" => (false, true, false),
+            b"120000" => (false, false, true),
+            _ => {
+                return Err(material_error(
+                    "Git package submodules and noncanonical modes are unreviewed",
+                ));
+            }
+        };
+        let rest = &bytes[space + 1..];
+        let nul = rest
+            .iter()
+            .position(|byte| *byte == 0)
+            .ok_or_else(|| material_error("malformed Git tree name"))?;
+        let name = &rest[..nul];
+        let unsafe_name = name.is_empty()
+            || !name.is_ascii()
+            || name
+                .iter()
+                .any(|byte| byte.is_ascii_control() || matches!(byte, b'/' | b'\\' | b':'))
+            || matches!(name, b"." | b"..")
+            || name.eq_ignore_ascii_case(b".git")
+            || name.len() > 255;
+        if unsafe_name {
+            return Err(material_error("unsafe Git package tree name"));
+        }
+        if symlink && name == b"Cargo.toml" {
+            return Err(material_error(
+                "Git package manifest aliases are unreviewed",
+            ));
+        }
+        if !seen.insert(name.to_ascii_lowercase()) {
+            return Err(material_error("Git package tree aliases or repeats a name"));
+        }
+        let oid = rest
+            .get(nul + 1..nul + 21)
+            .ok_or_else(|| material_error("truncated Git tree identity"))?;
+        entries.push(TreeEntry {
+            name: String::from_utf8_lossy(name).into_owned(),
+            directory,
+            executable,
+            symlink,
+            oid: hex::encode(oid),
+        });
+        bytes = &rest[nul + 21..];
+    }
+    Ok(entries)
+}
+
+impl<'a> Store<'a> {
+    /// Opens a store rooted at the verified material's object directory.
+    pub(super) fn new(root: &'a Path) -> Self {
+        Self {
+            root,
+            remaining: Cell::new(TOTAL_LIMIT),
+            entries: Cell::new(0),
+        }
+    }
+
+    /// Reads and rehashes one object of `kind`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Material`] for a missing, linked, oversize,
+    /// malformed or mis-identified object, or an exhausted total budget.
+    pub(super) fn read(
+        &self,
+        kind: &str,
+        oid: &str,
+        limit: u64,
+    ) -> Result<Vec<u8>, Report<ReleaseError>> {
+        if !lower_oid(oid) {
+            return Err(material_error("Git object id is not canonical"));
+        }
+        let path = self.root.join(&oid[..2]).join(&oid[2..]);
+        let file = OpenOptions::new()
+            .read(true)
+            .custom_flags(libc::O_NOFOLLOW | libc::O_NONBLOCK | libc::O_CLOEXEC)
+            .open(&path)
+            .map_err(|error| {
+                material_error(format!("Git object {oid} cannot be opened: {error}"))
+            })?;
+        let metadata = file.metadata().map_err(material_error)?;
+        if !metadata.is_file() || metadata.nlink() != 1 {
+            return Err(material_error("Git object is not one regular file"));
+        }
+        let allowed = limit.min(OBJECT_LIMIT);
+        let mut inflated = Vec::new();
+        ZlibDecoder::new(file)
+            .take(allowed + 64)
+            .read_to_end(&mut inflated)
+            .map_err(|error| material_error(format!("Git object {oid} is not zlib: {error}")))?;
+        let nul = inflated
+            .iter()
+            .position(|byte| *byte == 0)
+            .ok_or_else(|| material_error("Git object has no header terminator"))?;
+        let header = std::str::from_utf8(&inflated[..nul]).map_err(material_error)?;
+        let (found_kind, length) = header
+            .split_once(' ')
+            .ok_or_else(|| material_error("Git object header is malformed"))?;
+        let length: u64 = length
+            .parse()
+            .ok()
+            .filter(|length: &u64| length.to_string() == header[found_kind.len() + 1..])
+            .ok_or_else(|| material_error("Git object length is not canonical"))?;
+        let body = &inflated[nul + 1..];
+        if found_kind != kind || length != body.len() as u64 || length > allowed {
+            return Err(material_error(
+                "Git object kind or length differs from its reference or limit",
+            ));
+        }
+        let remaining = self
+            .remaining
+            .get()
+            .checked_sub(length)
+            .ok_or_else(|| material_error("Git package reads exceed the total byte budget"))?;
+        self.remaining.set(remaining);
+        if checked_sha1(&[&inflated[..=nul], body])? != oid {
+            return Err(material_error(
+                "Git object bytes do not match their identity",
+            ));
+        }
+        Ok(inflated.split_off(nul + 1))
+    }
+
+    fn tree(&self, oid: &str) -> Result<Vec<TreeEntry>, Report<ReleaseError>> {
+        let entries = parse_tree(&self.read("tree", oid, OBJECT_LIMIT)?)?;
+        let visited = self.entries.get() + entries.len();
+        if visited > ENTRY_LIMIT {
+            return Err(material_error("Git package tree exceeds the entry limit"));
+        }
+        self.entries.set(visited);
+        Ok(entries)
+    }
+
+    /// Resolves only direct relative file links through authenticated tree objects.
+    fn file_link(
+        &self,
+        repository_tree: &str,
+        path: &str,
+        target: &[u8],
+    ) -> Result<(Vec<u8>, bool), Report<ReleaseError>> {
+        if target.is_empty()
+            || target.len() > 4096
+            || !target.is_ascii()
+            || target.starts_with(b"/")
+            || target
+                .iter()
+                .any(|byte| byte.is_ascii_control() || matches!(byte, b'\\' | b':'))
+        {
+            return Err(material_error("unsafe Git file link target"));
+        }
+        let parent = path.rsplit_once('/').map_or("", |(parent, _)| parent);
+        let mut parts: Vec<&str> = parent.split('/').filter(|part| !part.is_empty()).collect();
+        let target = std::str::from_utf8(target).map_err(material_error)?;
+        if matches!(target.rsplit('/').next(), Some("" | "." | "..")) {
+            return Err(material_error("Git file link must name a file"));
+        }
+        let mut descended = false;
+        for part in target.split('/') {
+            match part {
+                "" => return Err(material_error("empty Git file link target component")),
+                "." => {}
+                ".." => {
+                    if descended {
+                        return Err(material_error(
+                            "Git file link traverses a parent after descending",
+                        ));
+                    }
+                    if parts.pop().is_none() {
+                        return Err(material_error("Git file link escapes its repository"));
+                    }
+                }
+                _ => {
+                    descended = true;
+                    parts.push(part);
+                }
+            }
+        }
+        if parts.is_empty() || parts.len() > DEPTH_LIMIT || parts.join("/").len() > 4096 {
+            return Err(material_error("Git file link target exceeds path limits"));
+        }
+        let mut tree = repository_tree.to_owned();
+        for (index, part) in parts.iter().enumerate() {
+            let entry = self
+                .tree(&tree)?
+                .into_iter()
+                .find(|entry| entry.name == *part)
+                .ok_or_else(|| material_error("Git file link target is missing"))?;
+            if index + 1 == parts.len() {
+                if entry.directory || entry.symlink {
+                    return Err(material_error(
+                        "Git file link must target a direct regular file",
+                    ));
+                }
+                return Ok((
+                    self.read("blob", &entry.oid, OBJECT_LIMIT)?,
+                    entry.executable,
+                ));
+            }
+            if !entry.directory {
+                return Err(material_error(
+                    "Git file link parent is not a direct directory",
+                ));
+            }
+            tree = entry.oid;
+        }
+        Err(material_error("Git file link target is missing"))
+    }
+}
+
+/// The unique directory of the requested package inside a repository tree.
+#[derive(Clone, Debug)]
+pub(super) struct PackageRoot {
+    pub(super) tree: String,
+    pub(super) manifest: String,
+    pub(super) path: String,
+}
+
+/// Returns the package name a manifest declares, if it parses as a manifest.
+fn declared_name(manifest: &[u8]) -> Option<String> {
+    let text = std::str::from_utf8(manifest).ok()?;
+    let table: toml::Table = toml::from_str(text).ok()?;
+    table
+        .get("package")?
+        .get("name")?
+        .as_str()
+        .map(str::to_owned)
+}
+
+/// Finds the only directory whose `Cargo.toml` declares package `name`.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Material`] when no directory or more than one
+/// directory declares the package, or the tree exceeds a limit. Manifests
+/// that do not parse are not candidates; Cargo could not use them either.
+pub(super) fn find_package(
+    store: &Store<'_>,
+    root_tree: &str,
+    name: &str,
+) -> Result<PackageRoot, Report<ReleaseError>> {
+    let mut candidates = Vec::new();
+    let mut pending = vec![(root_tree.to_owned(), String::new(), 1_usize)];
+    while let Some((tree, path, depth)) = pending.pop() {
+        if depth > DEPTH_LIMIT {
+            return Err(material_error("Git package tree exceeds the depth limit"));
+        }
+        for entry in store.tree(&tree)? {
+            let child = if path.is_empty() {
+                entry.name.clone()
+            } else {
+                format!("{path}/{}", entry.name)
+            };
+            if entry.directory {
+                pending.push((entry.oid, child, depth + 1));
+            } else if entry.name == "Cargo.toml" {
+                let manifest = store.read("blob", &entry.oid, MANIFEST_LIMIT)?;
+                if declared_name(&manifest).as_deref() == Some(name) {
+                    candidates.push(PackageRoot {
+                        tree: tree.clone(),
+                        manifest: entry.oid,
+                        path: path.clone(),
+                    });
+                }
+            }
+        }
+    }
+    match candidates.as_slice() {
+        [only] => Ok(only.clone()),
+        [] => Err(material_error(format!(
+            "no Git directory declares package {name}"
+        ))),
+        _ => Err(material_error(format!(
+            "ambiguous Git package roots: several directories declare package {name}"
+        ))),
+    }
+}
+
+/// Reads every `Cargo.toml` in the directories above `root`, nearest first.
+///
+/// The walk descends from the repository root along the package path within
+/// the same verified tree, so a workspace root can only come from that tree.
+/// The package directory's own manifest is not included.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Material`] when a directory on the package path
+/// is missing or not a tree, or an object cannot be read.
+pub(super) fn ancestor_manifests(
+    store: &Store<'_>,
+    root_tree: &str,
+    root: &PackageRoot,
+) -> Result<Vec<AncestorManifest>, Report<ReleaseError>> {
+    let mut found = Vec::new();
+    let mut tree = root_tree.to_owned();
+    let mut directory = String::new();
+    let parts: Vec<&str> = root
+        .path
+        .split('/')
+        .filter(|part| !part.is_empty())
+        .collect();
+    if parts.len() >= DEPTH_LIMIT {
+        return Err(material_error("Git package tree exceeds the depth limit"));
+    }
+    for part in parts {
+        let entries = store.tree(&tree)?;
+        if let Some(manifest) = entries
+            .iter()
+            .find(|entry| !entry.directory && entry.name == "Cargo.toml")
+        {
+            found.push(AncestorManifest {
+                directory: directory.clone(),
+                bytes: store.read("blob", &manifest.oid, MANIFEST_LIMIT)?,
+            });
+        }
+        tree = entries
+            .into_iter()
+            .find(|entry| entry.directory && entry.name == part)
+            .map(|entry| entry.oid)
+            .ok_or_else(|| {
+                material_error("Git package path is not a tree in the verified closure")
+            })?;
+        directory = if directory.is_empty() {
+            part.to_owned()
+        } else {
+            format!("{directory}/{part}")
+        };
+    }
+    if tree != root.tree {
+        return Err(material_error(
+            "Git package path does not lead to the package tree",
+        ));
+    }
+    found.reverse();
+    Ok(found)
+}
+
+/// Writes the package tree below `root.tree` through `writer`.
+///
+/// Subdirectories with their own `Cargo.toml` are separate packages and are
+/// skipped, as Cargo's own file listing does. The root `Cargo.toml` is not
+/// written here: the caller decides which manifest bytes represent it.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Material`] for an unreadable object or write.
+pub(super) fn materialize(
+    store: &Store<'_>,
+    repository_tree: &str,
+    root: &PackageRoot,
+    writer: &mut PackageWriter,
+) -> Result<(), Report<ReleaseError>> {
+    let mut pending = vec![(store.tree(&root.tree)?, String::new(), 1_usize)];
+    while let Some((entries, prefix, depth)) = pending.pop() {
+        if depth > DEPTH_LIMIT {
+            return Err(material_error("Git package tree exceeds the depth limit"));
+        }
+        for entry in &entries {
+            let relative = format!("{prefix}{}", entry.name);
+            if entry.directory {
+                let child = store.tree(&entry.oid)?;
+                let nested_package = child
+                    .iter()
+                    .any(|inner| !inner.directory && inner.name == "Cargo.toml");
+                if !nested_package {
+                    pending.push((child, format!("{relative}/"), depth + 1));
+                }
+            } else if relative != "Cargo.toml" {
+                let (bytes, executable) = if entry.symlink {
+                    let target = store.read("blob", &entry.oid, 4096)?;
+                    let path = if root.path.is_empty() {
+                        relative.clone()
+                    } else {
+                        format!("{}/{relative}", root.path)
+                    };
+                    store.file_link(repository_tree, &path, &target)?
+                } else {
+                    (
+                        store.read("blob", &entry.oid, OBJECT_LIMIT)?,
+                        entry.executable,
+                    )
+                };
+                writer.write(&relative, &bytes, executable)?;
+            }
+        }
+    }
+    Ok(())
+}
diff --git a/crates/trusted-server-release/src/materials/cargo_vendor/index.rs b/crates/trusted-server-release/src/materials/cargo_vendor/index.rs
new file mode 100644
index 0000000000..f75e600ac4
--- /dev/null
+++ b/crates/trusted-server-release/src/materials/cargo_vendor/index.rs
@@ -0,0 +1,108 @@
+//! Package identities recorded only after verified originals finish vendoring.
+
+use serde::Serialize;
+
+/// Original material behind one prepared Cargo directory-source package.
+#[derive(Clone, Debug, Serialize)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub(crate) enum CargoOrigin {
+    /// A distribution verified against the approved lock checksum.
+    Registry {
+        /// SHA-256 of the original crate archive.
+        archive_sha256: String,
+    },
+    /// A package extracted from a verified Git object closure.
+    Git {
+        /// Exact locked commit object identity.
+        revision: String,
+        /// Root tree of the verified repository commit.
+        repository_tree: String,
+        /// Tree containing the selected package.
+        package_tree: String,
+        /// Repository-relative package directory; empty for a root package.
+        package_path: String,
+        /// Committed manifest blob object identity.
+        committed_manifest_blob: String,
+        /// SHA-256 of the committed manifest bytes before normalization.
+        committed_manifest_sha256: String,
+        /// SHA-256 of a producer-normalized manifest, when normalization occurred.
+        normalized_manifest_sha256: Option<String>,
+    },
+}
+
+/// Identity of a package written by verified Cargo material preparation.
+///
+/// Membership is authoritative only through its owning
+/// [`PreparedCargoMaterials`](super::PreparedCargoMaterials), whose whole tree
+/// must be rehashed before any observed compiler identity is joined to it.
+#[derive(Clone, Debug, Serialize)]
+pub(crate) struct VerifiedCargoPackage {
+    /// Name checked against the approved lock identity.
+    pub(super) name: String,
+    /// Version checked against the approved lock identity.
+    pub(super) version: String,
+    /// Complete locked registry or Git source, including any revision.
+    pub(super) source: String,
+    /// SHA-256 of the manifest written into the directory source.
+    pub(super) prepared_manifest_sha256: String,
+    /// Verified original identity before any manifest normalization.
+    pub(super) origin: CargoOrigin,
+}
+
+impl VerifiedCargoPackage {
+    /// The package name checked against the locked identity.
+    pub(crate) fn name(&self) -> &str {
+        &self.name
+    }
+
+    /// The package version checked against the locked identity.
+    pub(crate) fn version(&self) -> &str {
+        &self.version
+    }
+
+    /// Complete original Cargo source identity, including a Git revision.
+    pub(crate) fn source(&self) -> &str {
+        &self.source
+    }
+
+    /// SHA-256 of the prepared manifest Cargo reads from the vendor tree.
+    pub(crate) fn prepared_manifest_sha256(&self) -> &str {
+        &self.prepared_manifest_sha256
+    }
+
+    /// Original archive or committed Git package material identity.
+    pub(crate) fn origin(&self) -> &CargoOrigin {
+        &self.origin
+    }
+}
+
+#[cfg(test)]
+impl VerifiedCargoPackage {
+    /// Creates an origin fixture whose prepared bytes are measured separately.
+    pub(crate) fn registry_for_tests(
+        name: &str,
+        version: &str,
+        source: &str,
+        manifest_sha256: &str,
+        archive_sha256: &str,
+    ) -> Self {
+        Self {
+            name: name.to_owned(),
+            version: version.to_owned(),
+            source: source.to_owned(),
+            prepared_manifest_sha256: manifest_sha256.to_owned(),
+            origin: CargoOrigin::Registry {
+                archive_sha256: archive_sha256.to_owned(),
+            },
+        }
+    }
+}
+
+#[cfg(test)]
+impl VerifiedCargoPackage {
+    /// Replaces a fictional original identity for exact-source join tests.
+    pub(crate) fn with_origin_for_tests(mut self, origin: CargoOrigin) -> Self {
+        self.origin = origin;
+        self
+    }
+}
diff --git a/crates/trusted-server-release/src/materials/cargo_vendor/normalize.rs b/crates/trusted-server-release/src/materials/cargo_vendor/normalize.rs
new file mode 100644
index 0000000000..9c8e7b98d5
--- /dev/null
+++ b/crates/trusted-server-release/src/materials/cargo_vendor/normalize.rs
@@ -0,0 +1,630 @@
+//! Producer-owned normalization of Git package manifests.
+//!
+//! A Git package whose `Cargo.toml` inherits from its workspace
+//! (`version.workspace = true`, `serde = { workspace = true }`, `[lints]
+//! workspace = true`) cannot be read from a directory source as committed.
+//! This module resolves that inheritance itself, from the package manifest
+//! and the workspace root manifest of the same verified Git tree, so no
+//! caller-supplied manifest is ever trusted. It is pure: it reads only the
+//! bytes it is handed.
+//!
+//! The rules follow the Cargo reference for workspace inheritance:
+//!
+//! - The workspace root is the package manifest itself when it has a
+//!   `[workspace]` table, else the nearest enclosing directory whose
+//!   `Cargo.toml` has one. A root whose `exclude` covers the package is
+//!   refused rather than skipped.
+//! - `[package]` fields listed in [`INHERITED_PACKAGE_FIELDS`] are copied from
+//!   `[workspace.package]`.
+//! - A dependency with `workspace = true` starts from the
+//!   `[workspace.dependencies]` entry of the same key. Its `features` are
+//!   added to the workspace features, its `optional` is taken as written, and
+//!   `default-features = true` re-enables defaults the workspace turned off.
+//!   A workspace `path` is rewritten relative to the package directory, as
+//!   Cargo does; in the vendor layout every Git package is `vendor/<name>/`,
+//!   so sibling paths keep resolving.
+//! - `[lints] workspace = true` is replaced by `[workspace.lints]`.
+//!
+//! Anything else that could change resolution is refused: unknown or
+//! path-relocating inherited fields (`readme`, `license-file`), `[patch]` and
+//! `[replace]`, a `package.workspace` pointer, unsupported keys on either side
+//! of an inherited dependency, and a member `default-features = false` that
+//! Cargo would ignore or reject. The output is serialized with every table's
+//! keys sorted, so equal inputs always yield equal bytes.
+
+use error_stack::Report;
+use toml::{Table, Value};
+
+use super::{inherits_workspace, parse_manifest, require_identity};
+use crate::error::ReleaseError;
+use crate::materials::material_error;
+
+/// `[package]` fields resolved from `[workspace.package]`.
+pub(super) const INHERITED_PACKAGE_FIELDS: [&str; 14] = [
+    "authors",
+    "categories",
+    "description",
+    "documentation",
+    "edition",
+    "exclude",
+    "homepage",
+    "include",
+    "keywords",
+    "license",
+    "publish",
+    "repository",
+    "rust-version",
+    "version",
+];
+/// Inheritable fields that hold a workspace-relative path; never relocated.
+const RELOCATING_PACKAGE_FIELDS: [&str; 2] = ["license-file", "readme"];
+/// Dependency tables, at the top level and under `[target.<cfg>]`.
+const DEPENDENCY_TABLES: [&str; 3] = ["build-dependencies", "dependencies", "dev-dependencies"];
+/// Legacy spellings that are refused instead of merged.
+const LEGACY_DEPENDENCY_TABLES: [&str; 2] = ["build_dependencies", "dev_dependencies"];
+/// Keys a member may write beside `workspace = true` on a dependency.
+const MEMBER_DEPENDENCY_KEYS: [&str; 4] = ["default-features", "features", "optional", "workspace"];
+/// Keys a `[workspace.dependencies]` entry may hold.
+const WORKSPACE_DEPENDENCY_KEYS: [&str; 5] =
+    ["default-features", "features", "package", "path", "version"];
+/// First lines of every producer-normalized manifest.
+const HEADER: &str = "# Normalized by trusted-server-release from the verified Git tree:\n\
+# workspace inheritance is resolved against the enclosing workspace root.\n\
+# The committed manifest is kept beside this file as Cargo.toml.orig.\n\n";
+
+/// The committed manifest of one locked Git package.
+pub(super) struct PackageManifest<'a> {
+    /// Locked package name.
+    pub(super) name: &'a str,
+    /// Locked package version.
+    pub(super) version: &'a str,
+    /// Repository-relative `/`-separated directory; empty at the root.
+    pub(super) directory: &'a str,
+    /// Committed manifest bytes.
+    pub(super) bytes: &'a [u8],
+}
+
+/// A `Cargo.toml` found in a directory above the package, in the same tree.
+#[derive(Debug)]
+pub(super) struct AncestorManifest {
+    /// Repository-relative `/`-separated directory; empty at the root.
+    pub(super) directory: String,
+    /// Committed manifest bytes.
+    pub(super) bytes: Vec<u8>,
+}
+
+/// The workspace a package inherits from.
+struct WorkspaceRoot {
+    directory: String,
+    table: Table,
+}
+
+/// Resolves the package's workspace inheritance and returns the new manifest.
+///
+/// `ancestors` must be ordered nearest first and come from the same verified
+/// tree as the package.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Material`] for a manifest that does not parse, no
+/// enclosing workspace root, an inherited value the root does not define, an
+/// unsupported or path-relocating inherited key, `[patch]`, `[replace]` or a
+/// `package.workspace` pointer, a result that still inherits, or a result
+/// whose name or version differs from the locked identity.
+pub(super) fn normalize_manifest(
+    package: &PackageManifest<'_>,
+    ancestors: &[AncestorManifest],
+) -> Result<Vec<u8>, Report<ReleaseError>> {
+    let mut manifest = parse_manifest(package.bytes)?;
+    for refused in ["patch", "replace"] {
+        if manifest.contains_key(refused) {
+            return Err(material_error(format!(
+                "Git package {} declares [{refused}], which normalization does not support",
+                package.name
+            )));
+        }
+    }
+    let root = match manifest.remove("workspace") {
+        Some(Value::Table(table)) => WorkspaceRoot {
+            directory: package.directory.to_owned(),
+            table,
+        },
+        Some(_) => return Err(material_error("[workspace] is not a table")),
+        None => enclosing_root(package, ancestors)?,
+    };
+    resolve_package_fields(&mut manifest, &root, package.name)?;
+    resolve_dependency_tables(&mut manifest, &root, package.directory)?;
+    resolve_lints(&mut manifest, &root)?;
+    if inherits_workspace(&Value::Table(manifest.clone())) {
+        return Err(material_error(format!(
+            "Git package {} still inherits from its workspace after normalization",
+            package.name
+        )));
+    }
+    let manifest = sorted_table(manifest);
+    let body = toml::to_string(&manifest).map_err(material_error)?;
+    let bytes = format!("{HEADER}{body}").into_bytes();
+    if parse_manifest(&bytes)? != manifest {
+        return Err(material_error(
+            "normalized manifest does not round-trip through TOML",
+        ));
+    }
+    require_identity(&bytes, package.name, package.version)?;
+    Ok(bytes)
+}
+
+/// Finds the nearest enclosing `[workspace]` root that does not exclude the package.
+fn enclosing_root(
+    package: &PackageManifest<'_>,
+    ancestors: &[AncestorManifest],
+) -> Result<WorkspaceRoot, Report<ReleaseError>> {
+    for ancestor in ancestors {
+        let mut table = parse_manifest(&ancestor.bytes)?;
+        let package_table = table.get("package").and_then(Value::as_table);
+        if package_table.is_some_and(|package| package.contains_key("workspace")) {
+            return Err(material_error(format!(
+                "ancestor manifest in {:?} points to another workspace root; unsupported",
+                ancestor.directory
+            )));
+        }
+        let has_package = package_table.is_some();
+        let workspace = match table.remove("workspace") {
+            Some(Value::Table(workspace)) => workspace,
+            Some(_) => return Err(material_error("[workspace] is not a table")),
+            None if has_package => continue,
+            None => {
+                return Err(material_error(format!(
+                    "ancestor manifest in {:?} has neither [package] nor [workspace]",
+                    ancestor.directory
+                )));
+            }
+        };
+        let relative = within(&ancestor.directory, package.directory).ok_or_else(|| {
+            material_error("workspace candidate does not enclose the Git package")
+        })?;
+        if excluded(&workspace, &relative)? {
+            return Err(material_error(format!(
+                "Git package {} is excluded from its nearest workspace root; unsupported",
+                package.name
+            )));
+        }
+        return Ok(WorkspaceRoot {
+            directory: ancestor.directory.clone(),
+            table: workspace,
+        });
+    }
+    Err(material_error(format!(
+        "Git package {} inherits from a workspace, but no workspace root encloses it in the verified tree",
+        package.name
+    )))
+}
+
+/// Splits a repository-relative directory into its components.
+fn components(directory: &str) -> Vec<&str> {
+    directory
+        .split('/')
+        .filter(|part| !part.is_empty())
+        .collect()
+}
+
+/// Returns `directory` relative to `ancestor`, if `ancestor` encloses it.
+fn within(ancestor: &str, directory: &str) -> Option<Vec<String>> {
+    let ancestor = components(ancestor);
+    let directory = components(directory);
+    directory
+        .strip_prefix(ancestor.as_slice())
+        .map(|rest| rest.iter().map(|part| (*part).to_owned()).collect())
+}
+
+/// Reports whether the root's `exclude` list covers `relative`.
+fn excluded(workspace: &Table, relative: &[String]) -> Result<bool, Report<ReleaseError>> {
+    let Some(exclude) = workspace.get("exclude") else {
+        return Ok(false);
+    };
+    for entry in string_array(exclude, "workspace.exclude")? {
+        let parts: Vec<&str> = components(&entry)
+            .into_iter()
+            .filter(|part| *part != ".")
+            .collect();
+        if parts.contains(&"..") {
+            return Err(material_error(
+                "workspace.exclude leaves the workspace root; unsupported",
+            ));
+        }
+        if relative.len() >= parts.len()
+            && parts
+                .iter()
+                .zip(relative)
+                .all(|(left, right)| left == right)
+        {
+            return Ok(true);
+        }
+    }
+    Ok(false)
+}
+
+/// Returns `value` as an array of strings.
+fn string_array(value: &Value, label: &str) -> Result<Vec<String>, Report<ReleaseError>> {
+    value
+        .as_array()
+        .and_then(|values| {
+            values
+                .iter()
+                .map(|value| value.as_str().map(str::to_owned))
+                .collect::<Option<Vec<_>>>()
+        })
+        .ok_or_else(|| material_error(format!("{label} is not an array of strings")))
+}
+
+/// Reports whether `value` is a `{ workspace = ... }` inheritance marker,
+/// requiring exactly `{ workspace = true }` when it is.
+fn is_marker(value: &Value, label: &str) -> Result<bool, Report<ReleaseError>> {
+    let Some(table) = value.as_table() else {
+        return Ok(false);
+    };
+    match table.get("workspace") {
+        None => Ok(false),
+        Some(Value::Boolean(true)) if table.len() == 1 => Ok(true),
+        Some(_) => Err(material_error(format!(
+            "{label} must be exactly {{ workspace = true }} to inherit"
+        ))),
+    }
+}
+
+/// Replaces inherited `[package]` fields with `[workspace.package]` values.
+fn resolve_package_fields(
+    manifest: &mut Table,
+    root: &WorkspaceRoot,
+    name: &str,
+) -> Result<(), Report<ReleaseError>> {
+    let package = manifest
+        .get_mut("package")
+        .and_then(Value::as_table_mut)
+        .ok_or_else(|| material_error("Git manifest has no [package] table"))?;
+    if package.get("name").and_then(Value::as_str) != Some(name) {
+        return Err(material_error(format!(
+            "Git manifest does not name package {name} as a plain string"
+        )));
+    }
+    if package.contains_key("workspace") {
+        return Err(material_error(
+            "package.workspace pointers are not supported by normalization",
+        ));
+    }
+    let defaults = root.table.get("package").and_then(Value::as_table);
+    for (key, value) in package.iter_mut() {
+        if !is_marker(value, &format!("package.{key}"))? {
+            continue;
+        }
+        if RELOCATING_PACKAGE_FIELDS.contains(&key.as_str()) {
+            return Err(material_error(format!(
+                "inherited package.{key} names a workspace-relative path; unsupported"
+            )));
+        }
+        if !INHERITED_PACKAGE_FIELDS.contains(&key.as_str()) {
+            return Err(material_error(format!(
+                "package.{key} is not an inheritable field"
+            )));
+        }
+        *value = defaults
+            .and_then(|defaults| defaults.get(key))
+            .cloned()
+            .ok_or_else(|| {
+                material_error(format!(
+                    "package.{key} inherits a value [workspace.package] does not define"
+                ))
+            })?;
+    }
+    Ok(())
+}
+
+/// Resolves inherited dependencies in every top-level and target table.
+fn resolve_dependency_tables(
+    manifest: &mut Table,
+    root: &WorkspaceRoot,
+    package_directory: &str,
+) -> Result<(), Report<ReleaseError>> {
+    let workspace_dependencies = root.table.get("dependencies").and_then(Value::as_table);
+    let resolver = DependencyResolver {
+        workspace_dependencies,
+        workspace_directory: &root.directory,
+        package_directory,
+    };
+    resolver.resolve_tables(manifest, "")?;
+    if let Some(targets) = manifest.get_mut("target") {
+        let targets = targets
+            .as_table_mut()
+            .ok_or_else(|| material_error("[target] is not a table"))?;
+        for (cfg, target) in targets.iter_mut() {
+            let target = target
+                .as_table_mut()
+                .ok_or_else(|| material_error(format!("target.{cfg} is not a table")))?;
+            resolver.resolve_tables(target, &format!("target.{cfg}."))?;
+        }
+    }
+    Ok(())
+}
+
+/// The workspace context one package's inherited dependencies resolve in.
+struct DependencyResolver<'a> {
+    workspace_dependencies: Option<&'a Table>,
+    workspace_directory: &'a str,
+    package_directory: &'a str,
+}
+
+impl DependencyResolver<'_> {
+    /// Resolves the dependency tables directly inside `scope`.
+    fn resolve_tables(&self, scope: &mut Table, prefix: &str) -> Result<(), Report<ReleaseError>> {
+        for legacy in LEGACY_DEPENDENCY_TABLES {
+            if scope.contains_key(legacy) {
+                return Err(material_error(format!(
+                    "{prefix}{legacy} is a legacy spelling normalization does not support"
+                )));
+            }
+        }
+        for section in DEPENDENCY_TABLES {
+            let Some(dependencies) = scope.get_mut(section) else {
+                continue;
+            };
+            let dependencies = dependencies
+                .as_table_mut()
+                .ok_or_else(|| material_error(format!("{prefix}{section} is not a table")))?;
+            for (key, dependency) in dependencies.iter_mut() {
+                let label = format!("{prefix}{section}.{key}");
+                if dependency
+                    .as_table()
+                    .is_some_and(|table| table.contains_key("workspace"))
+                {
+                    *dependency = Value::Table(self.inherit(key, dependency, &label)?);
+                }
+            }
+        }
+        Ok(())
+    }
+
+    /// Builds one inherited dependency from its workspace entry.
+    fn inherit(
+        &self,
+        key: &str,
+        member: &Value,
+        label: &str,
+    ) -> Result<Table, Report<ReleaseError>> {
+        let member = member
+            .as_table()
+            .ok_or_else(|| material_error(format!("{label} is not a table")))?;
+        if member.get("workspace") != Some(&Value::Boolean(true)) {
+            return Err(material_error(format!("{label} must set workspace = true")));
+        }
+        if let Some(unsupported) = member
+            .keys()
+            .find(|name| !MEMBER_DEPENDENCY_KEYS.contains(&name.as_str()))
+        {
+            return Err(material_error(format!(
+                "{label} sets {unsupported} beside workspace = true; unsupported"
+            )));
+        }
+        let mut resolved = match self.workspace_dependencies.and_then(|table| table.get(key)) {
+            Some(Value::String(version)) => {
+                Table::from_iter([("version".to_owned(), Value::String(version.clone()))])
+            }
+            Some(Value::Table(table)) => table.clone(),
+            Some(_) => {
+                return Err(material_error(format!(
+                    "workspace.dependencies.{key} is neither a version nor a table"
+                )));
+            }
+            None => {
+                return Err(material_error(format!(
+                    "{label} inherits workspace.dependencies.{key}, which is not defined"
+                )));
+            }
+        };
+        if let Some(unsupported) = resolved
+            .keys()
+            .find(|name| !WORKSPACE_DEPENDENCY_KEYS.contains(&name.as_str()))
+        {
+            return Err(material_error(format!(
+                "workspace.dependencies.{key} sets {unsupported}; unsupported"
+            )));
+        }
+        if let Some(path) = resolved.get("path") {
+            let path = path.as_str().ok_or_else(|| {
+                material_error(format!("workspace.dependencies.{key}.path is not a string"))
+            })?;
+            let relocated = relocate(self.workspace_directory, path, self.package_directory)?;
+            resolved.insert("path".to_owned(), Value::String(relocated));
+        }
+        merge_default_features(&mut resolved, member, label)?;
+        merge_features(&mut resolved, member, label)?;
+        if let Some(optional) = member.get("optional") {
+            if !optional.is_bool() {
+                return Err(material_error(format!("{label}.optional is not a boolean")));
+            }
+            resolved.insert("optional".to_owned(), optional.clone());
+        }
+        Ok(resolved)
+    }
+}
+
+/// Applies Cargo's `default-features` rule for an inherited dependency.
+fn merge_default_features(
+    resolved: &mut Table,
+    member: &Table,
+    label: &str,
+) -> Result<(), Report<ReleaseError>> {
+    let boolean = |table: &Table, side: &str| match table.get("default-features") {
+        None => Ok(None),
+        Some(Value::Boolean(value)) => Ok(Some(*value)),
+        Some(_) => Err(material_error(format!(
+            "{side} default-features of {label} is not a boolean"
+        ))),
+    };
+    let workspace = boolean(resolved, "workspace")?;
+    match (boolean(member, "member")?, workspace) {
+        (Some(true), Some(false)) => {
+            resolved.insert("default-features".to_owned(), Value::Boolean(true));
+        }
+        (Some(false), workspace) if workspace != Some(false) => {
+            return Err(material_error(format!(
+                "{label} sets default-features = false, which Cargo ignores unless the workspace entry does too"
+            )));
+        }
+        _ => {}
+    }
+    Ok(())
+}
+
+/// Appends member `features` to the workspace features, keeping the first
+/// occurrence of each, as Cargo's ordered feature set does.
+fn merge_features(
+    resolved: &mut Table,
+    member: &Table,
+    label: &str,
+) -> Result<(), Report<ReleaseError>> {
+    let workspace = match resolved.get("features") {
+        Some(value) => string_array(value, &format!("workspace features of {label}"))?,
+        None => Vec::new(),
+    };
+    let added = match member.get("features") {
+        Some(value) => string_array(value, &format!("{label}.features"))?,
+        None => Vec::new(),
+    };
+    let mut features: Vec<String> = Vec::new();
+    for feature in workspace.into_iter().chain(added) {
+        if !features.contains(&feature) {
+            features.push(feature);
+        }
+    }
+    if !features.is_empty() {
+        resolved.insert(
+            "features".to_owned(),
+            Value::Array(features.into_iter().map(Value::String).collect()),
+        );
+    }
+    Ok(())
+}
+
+/// Refuses a build script or target path that could leave the package directory.
+///
+/// Applies to every vendored Git manifest, inheriting or not: `package.build`
+/// (when a path) and the `path` of `[lib]` and each `[[bin]]`, `[[example]]`,
+/// `[[test]]` and `[[bench]]` must be relative and free of `..` components,
+/// so a vendored package only builds from files inside its own directory.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Material`] for a non-string, absolute or
+/// parent-relative path, or a malformed target table.
+pub(super) fn check_target_paths(manifest: &Table) -> Result<(), Report<ReleaseError>> {
+    let mut paths: Vec<(String, &Value)> = Vec::new();
+    if let Some(build) = manifest
+        .get("package")
+        .and_then(|package| package.get("build"))
+        .filter(|build| !build.is_bool())
+    {
+        paths.push(("package.build".to_owned(), build));
+    }
+    if let Some(path) = manifest.get("lib").and_then(|lib| lib.get("path")) {
+        paths.push(("lib.path".to_owned(), path));
+    }
+    for kind in ["bin", "example", "test", "bench"] {
+        let Some(targets) = manifest.get(kind) else {
+            continue;
+        };
+        let targets = targets
+            .as_array()
+            .ok_or_else(|| material_error(format!("[[{kind}]] is not an array of tables")))?;
+        for (index, target) in targets.iter().enumerate() {
+            if let Some(path) = target.get("path") {
+                paths.push((format!("{kind}[{index}].path"), path));
+            }
+        }
+    }
+    for (label, value) in paths {
+        let path = value
+            .as_str()
+            .ok_or_else(|| material_error(format!("{label} is not a string")))?;
+        if path.starts_with('/') || path.split(['/', '\\']).any(|part| part == "..") {
+            return Err(material_error(format!(
+                "{label} {path:?} leaves the vendored package directory; unsupported"
+            )));
+        }
+    }
+    Ok(())
+}
+
+/// Rewrites a workspace-relative `path` relative to the package directory.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Material`] for an empty, absolute or
+/// backslash path, or one that leaves the repository.
+pub(super) fn relocate(
+    workspace_directory: &str,
+    path: &str,
+    package_directory: &str,
+) -> Result<String, Report<ReleaseError>> {
+    if path.is_empty() || path.starts_with('/') || path.contains('\\') {
+        return Err(material_error(format!(
+            "workspace dependency path {path:?} is not a relative repository path"
+        )));
+    }
+    let mut target = components(workspace_directory);
+    for part in path.split('/') {
+        match part {
+            "" | "." => {}
+            ".." => {
+                target.pop().ok_or_else(|| {
+                    material_error(format!(
+                        "workspace dependency path {path:?} leaves the repository"
+                    ))
+                })?;
+            }
+            other => target.push(other),
+        }
+    }
+    let package = components(package_directory);
+    let common = target
+        .iter()
+        .zip(&package)
+        .take_while(|(left, right)| left == right)
+        .count();
+    let mut relative: Vec<&str> = vec![".."; package.len() - common];
+    relative.extend_from_slice(&target[common..]);
+    Ok(if relative.is_empty() {
+        ".".to_owned()
+    } else {
+        relative.join("/")
+    })
+}
+
+/// Replaces `[lints] workspace = true` with `[workspace.lints]`.
+fn resolve_lints(manifest: &mut Table, root: &WorkspaceRoot) -> Result<(), Report<ReleaseError>> {
+    let Some(lints) = manifest.get_mut("lints") else {
+        return Ok(());
+    };
+    if is_marker(lints, "[lints]")? {
+        *lints = root.table.get("lints").cloned().ok_or_else(|| {
+            material_error("[lints] inherits [workspace.lints], which is not defined")
+        })?;
+    }
+    Ok(())
+}
+
+/// Rebuilds every table with its keys in sorted order.
+fn sorted_table(table: Table) -> Table {
+    let mut entries: Vec<(String, Value)> = table.into_iter().collect();
+    entries.sort_by(|left, right| left.0.cmp(&right.0));
+    entries
+        .into_iter()
+        .map(|(key, value)| (key, sorted_value(value)))
+        .collect()
+}
+
+fn sorted_value(value: Value) -> Value {
+    match value {
+        Value::Table(table) => Value::Table(sorted_table(table)),
+        Value::Array(values) => Value::Array(values.into_iter().map(sorted_value).collect()),
+        other => other,
+    }
+}
diff --git a/crates/trusted-server-release/src/materials/cargo_vendor/source.rs b/crates/trusted-server-release/src/materials/cargo_vendor/source.rs
new file mode 100644
index 0000000000..b796997c33
--- /dev/null
+++ b/crates/trusted-server-release/src/materials/cargo_vendor/source.rs
@@ -0,0 +1,119 @@
+//! Cargo source identities of locked Git packages, for source replacement.
+
+use error_stack::Report;
+
+use crate::error::ReleaseError;
+use crate::materials::material_error;
+
+/// The Git reference a locked source was requested with.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) enum GitReference {
+    /// No `?` selector in the lock: the repository's default branch.
+    DefaultBranch,
+    /// `?tag=<name>`.
+    Tag(String),
+    /// `?branch=<name>`.
+    Branch(String),
+    /// `?rev=<name>`.
+    Rev(String),
+}
+
+/// One locked Git source as Cargo's `[source."<key>"]` table spells it.
+///
+/// The key is the exact lock source without its `#<commit>` suffix, which is
+/// how `cargo vendor` names the table. Cargo also needs the `git` location
+/// and the reference in the same table: a bare `replace-with` is rejected
+/// with "no source location specified".
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct GitSourceConfig {
+    key: String,
+    url: String,
+    reference: GitReference,
+}
+
+/// Characters a reference may carry; anything else would need escaping.
+///
+/// This deliberately rejects `/` (and so branch names such as `feature/x`,
+/// which Cargo writes percent-encoded) and `%`: a locked source needing them
+/// fails closed here until the encoding is reviewed and supported.
+fn reference_text(value: &str) -> bool {
+    !value.is_empty()
+        && value
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'-'))
+}
+
+/// Requires an `https` URL that can sit unescaped inside a TOML basic string.
+fn url_text(url: &str) -> bool {
+    url.strip_prefix("https://").is_some_and(|rest| {
+        !rest.is_empty()
+            && rest.bytes().all(|byte| {
+                byte.is_ascii_graphic() && !matches!(byte, b'"' | b'\\' | b'#' | b'?' | b'%')
+            })
+    })
+}
+
+impl GitSourceConfig {
+    /// Parses a lock source selector such as `git+https://example.com/org/repo?tag=v1`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Material`] for a selector that is not `git+https`,
+    /// carries more than one reference, an empty or unusual reference value,
+    /// or characters that would need escaping in a Cargo configuration.
+    pub(crate) fn parse(selector: &str) -> Result<Self, Report<ReleaseError>> {
+        let location = selector
+            .strip_prefix("git+")
+            .ok_or_else(|| material_error("Git source selector must start with git+"))?;
+        let (url, query) = match location.split_once('?') {
+            Some((url, query)) => (url, Some(query)),
+            None => (location, None),
+        };
+        if !url_text(url) {
+            return Err(material_error(
+                "Git source URL must be plain https text without escapes",
+            ));
+        }
+        let reference = match query {
+            None => GitReference::DefaultBranch,
+            Some(query) => match query.split_once('=') {
+                Some((kind, value)) if reference_text(value) => match kind {
+                    "tag" => GitReference::Tag(value.to_owned()),
+                    "branch" => GitReference::Branch(value.to_owned()),
+                    "rev" => GitReference::Rev(value.to_owned()),
+                    _ => return Err(material_error("Git source reference kind is unsupported")),
+                },
+                _ => {
+                    return Err(material_error(
+                        "Git source must carry exactly one plain tag, branch or rev",
+                    ));
+                }
+            },
+        };
+        Ok(Self {
+            key: selector.to_owned(),
+            url: url.to_owned(),
+            reference,
+        })
+    }
+
+    /// The exact locked selector, used as the Cargo source table name.
+    pub(crate) fn key(&self) -> &str {
+        &self.key
+    }
+
+    /// The repository URL for the table's `git` key.
+    pub(crate) fn url(&self) -> &str {
+        &self.url
+    }
+
+    /// The reference as a Cargo key and value, or `None` for the default branch.
+    pub(crate) fn reference(&self) -> Option<(&'static str, &str)> {
+        match &self.reference {
+            GitReference::DefaultBranch => None,
+            GitReference::Tag(value) => Some(("tag", value)),
+            GitReference::Branch(value) => Some(("branch", value)),
+            GitReference::Rev(value) => Some(("rev", value)),
+        }
+    }
+}
diff --git a/crates/trusted-server-release/src/materials/cargo_vendor/tests.rs b/crates/trusted-server-release/src/materials/cargo_vendor/tests.rs
new file mode 100644
index 0000000000..ab96f95f6c
--- /dev/null
+++ b/crates/trusted-server-release/src/materials/cargo_vendor/tests.rs
@@ -0,0 +1,5 @@
+mod git;
+mod normalize;
+mod registry;
+mod source;
+mod support;
diff --git a/crates/trusted-server-release/src/materials/cargo_vendor/tests/git.rs b/crates/trusted-server-release/src/materials/cargo_vendor/tests/git.rs
new file mode 100644
index 0000000000..a5aa6bb4b1
--- /dev/null
+++ b/crates/trusted-server-release/src/materials/cargo_vendor/tests/git.rs
@@ -0,0 +1,801 @@
+use std::fs;
+use std::os::unix::fs::PermissionsExt as _;
+
+use serde_json::{Value, json};
+use sha2::{Digest as _, Sha256};
+
+use super::super::git_tree::{PackageRoot, Store, ancestor_manifests};
+use super::support::*;
+use crate::materials::locked::GitPackage;
+use crate::materials::{GitVendorInput, LockedMaterials, PreparedCargoMaterials, VendorInputs};
+
+const INHERITING: &str = "[package]\nname = \"example-core\"\nversion.workspace = true\nedition.workspace = true\n\n[dependencies]\nexample-dep = { workspace = true, features = [\"extra\"] }\n";
+const PLAIN: &str = "[package]\nname = \"example-core\"\nversion = \"0.4.0\"\nedition = \"2021\"\n";
+const WORKSPACE_ROOT: &str = "[workspace]\nmembers = [\"crates/core\"]\n\n[workspace.package]\nversion = \"0.4.0\"\nedition = \"2021\"\n\n[workspace.dependencies]\nexample-dep = { version = \"1\", features = [\"base\"] }\n";
+
+/// A fictional workspace: root manifest plus `crates/core` and a nested package.
+struct Workspace {
+    objects: Objects,
+    root_tree: String,
+    manifest_blob: String,
+}
+
+fn workspace(core_manifest: &str, extra_core_files: &[(&str, &[u8])]) -> Workspace {
+    workspace_with_root(core_manifest, Some(WORKSPACE_ROOT), extra_core_files)
+}
+
+fn workspace_with_root(
+    core_manifest: &str,
+    workspace_manifest: Option<&str>,
+    extra_core_files: &[(&str, &[u8])],
+) -> Workspace {
+    let objects = Objects::new();
+    let manifest_blob = objects.blob(core_manifest.as_bytes());
+    let lib = objects.blob(b"pub fn core() {}\n");
+    let script = objects.blob(b"#!/bin/sh\n");
+    let src = objects.tree(&[("100644", "lib.rs", &lib)]);
+    let nested_manifest = objects.blob(&manifest("example-nested", "0.1.0"));
+    let nested_lib = objects.blob(b"pub fn nested() {}\n");
+    let nested_src = objects.tree(&[("100644", "lib.rs", &nested_lib)]);
+    let nested = objects.tree(&[
+        ("100644", "Cargo.toml", &nested_manifest),
+        ("40000", "src", &nested_src),
+    ]);
+    let extra_blobs: Vec<(&str, String)> = extra_core_files
+        .iter()
+        .map(|(name, bytes)| (*name, objects.blob(bytes)))
+        .collect();
+    let mut entries: Vec<(&str, &str, &str)> = vec![
+        ("100644", "Cargo.toml", &manifest_blob),
+        ("100755", "run.sh", &script),
+        ("40000", "nested", &nested),
+        ("40000", "src", &src),
+    ];
+    entries.extend(
+        extra_blobs
+            .iter()
+            .map(|(name, oid)| ("100644", *name, oid.as_str())),
+    );
+    entries.sort_by_key(|entry| entry.1);
+    let core = objects.tree(&entries);
+    let crates = objects.tree(&[("40000", "core", &core)]);
+    let root_blob = workspace_manifest.map(|text| objects.blob(text.as_bytes()));
+    let mut root_entries = vec![("40000", "crates", crates.as_str())];
+    if let Some(blob) = &root_blob {
+        root_entries.insert(0, ("100644", "Cargo.toml", blob.as_str()));
+    }
+    let root_tree = objects.tree(&root_entries);
+    Workspace {
+        objects,
+        root_tree,
+        manifest_blob,
+    }
+}
+
+struct Run {
+    _output: tempfile::TempDir,
+    root: std::path::PathBuf,
+    outcome: Result<PreparedCargoMaterials, String>,
+}
+
+fn run(locked: &LockedMaterials, material: &crate::materials::git::VerifiedGitMaterial) -> Run {
+    let output = temporary();
+    let root = output.path().to_owned();
+    let package = &locked.cargo.git_packages[0];
+    let inputs = [GitVendorInput {
+        material,
+        name: &package.name,
+        version: &package.version,
+    }];
+    let outcome = locked
+        .prepare_cargo_vendor(
+            &VendorInputs {
+                registry_archives: &Default::default(),
+                git: &inputs,
+            },
+            &root,
+            deadline(),
+            &cancellation(),
+        )
+        .map_err(|error| format!("{error:?}"));
+    Run {
+        _output: output,
+        root,
+        outcome,
+    }
+}
+
+fn locked_core() -> LockedMaterials {
+    locked(&[], vec![git_package("example-core", "0.4.0")])
+}
+
+fn documentation_links(readme_target: &[u8]) -> Workspace {
+    let objects = Objects::new();
+    let manifest_blob = objects.blob(PLAIN.as_bytes());
+    let license = objects.blob(b"example license bytes\n");
+    let readme = objects.blob(b"example readme bytes\n");
+    let license_link = objects.blob(b"../LICENSE");
+    let readme_link = objects.blob(readme_target);
+    let indirect = objects.blob(b"README.md");
+    let directory = objects.tree(&[]);
+    let package = objects.tree(&[
+        ("100644", "Cargo.toml", &manifest_blob),
+        ("120000", "LICENSE", &license_link),
+        ("120000", "README.md", &readme_link),
+    ]);
+    let root_tree = objects.tree(&[
+        ("100644", "LICENSE", &license),
+        ("100755", "README.md", &readme),
+        ("120000", "alias", &indirect),
+        ("40000", "directory", &directory),
+        ("40000", "package", &package),
+    ]);
+    Workspace {
+        objects,
+        root_tree,
+        manifest_blob,
+    }
+}
+
+#[test]
+fn git_documentation_links_copy_verified_parent_files_as_regular_files() {
+    let built = documentation_links(b"../README.md");
+    let material = built.objects.material(SELECTOR, REVISION, &built.root_tree);
+    let result = run(&locked_core(), &material);
+    result
+        .outcome
+        .expect("should vendor direct documentation file links");
+    let package = result.root.join("vendor/example-core");
+    for (name, expected, mode) in [
+        ("LICENSE", &b"example license bytes\n"[..], 0o644),
+        ("README.md", &b"example readme bytes\n"[..], 0o755),
+    ] {
+        let path = package.join(name);
+        assert!(
+            fs::symlink_metadata(&path)
+                .expect("should inspect copied file")
+                .is_file(),
+            "should write a regular file"
+        );
+        assert_eq!(
+            fs::metadata(&path)
+                .expect("should inspect copied permissions")
+                .permissions()
+                .mode()
+                & 0o7777,
+            mode,
+            "should preserve the target executable mode"
+        );
+        assert_eq!(
+            fs::read(path).expect("should read copied file"),
+            expected,
+            "should copy the authenticated target bytes"
+        );
+    }
+}
+
+#[test]
+fn git_documentation_links_reject_unsafe_or_indirect_targets() {
+    for target in [
+        &b"../../outside"[..],
+        b"/outside",
+        b"../missing",
+        b"../alias",
+        b"../directory",
+        b"../README.md\0",
+        b"..\\README.md",
+        b"../README.md\n",
+        b"../missing/../README.md",
+        b"../alias/README.md",
+        b"../README.md/.",
+        b"../directory/..",
+    ] {
+        let built = documentation_links(target);
+        let material = built.objects.material(SELECTOR, REVISION, &built.root_tree);
+        assert!(
+            run(&locked_core(), &material).outcome.is_err(),
+            "should reject an unsafe or indirect file link"
+        );
+    }
+}
+
+#[test]
+fn git_manifest_links_are_rejected_during_package_discovery() {
+    let objects = Objects::new();
+    let manifest = objects.blob(PLAIN.as_bytes());
+    let target = objects.blob(b"manifest.toml");
+    let root = objects.tree(&[
+        ("120000", "Cargo.toml", &target),
+        ("100644", "manifest.toml", &manifest),
+    ]);
+    let material = objects.material(SELECTOR, REVISION, &root);
+    assert!(
+        rejection(run(&locked_core(), &material)).contains("manifest aliases"),
+        "should reject an aliased manifest before using its bytes"
+    );
+}
+
+#[test]
+fn git_file_link_targets_are_rehashed_before_copying() {
+    let built = documentation_links(b"../README.md");
+    let target = built.objects.blob(b"example readme bytes\n");
+    let material = built.objects.material(SELECTOR, REVISION, &built.root_tree);
+    fs::write(
+        material
+            .object_store()
+            .join(&target[..2])
+            .join(&target[2..]),
+        b"changed object bytes",
+    )
+    .expect("should corrupt the target object");
+    assert!(
+        run(&locked_core(), &material).outcome.is_err(),
+        "should reject a target changed after object verification"
+    );
+}
+
+fn rejection(run: Run) -> String {
+    run.outcome.expect_err("should reject the Git package")
+}
+
+#[test]
+fn plain_manifest_package_is_vendored_without_derivation() {
+    let built = workspace(PLAIN, &[]);
+    let material = built.objects.material(SELECTOR, REVISION, &built.root_tree);
+    let result = run(&locked_core(), &material);
+    let materials = result.outcome.expect("should vendor the plain package");
+    let index = serde_json::to_value(materials.packages()).expect("should encode Git index");
+    let identity = &index["example-core"];
+    assert_eq!(
+        identity["source"],
+        format!("{SELECTOR}#{REVISION}"),
+        "should preserve the complete locked source"
+    );
+    assert_eq!(
+        identity["origin"]["kind"], "git",
+        "should identify verified Git originals"
+    );
+    assert_eq!(
+        identity["origin"]["repository_tree"], built.root_tree,
+        "should bind verified repository tree"
+    );
+    assert_eq!(
+        identity["origin"]["committed_manifest_blob"], built.manifest_blob,
+        "should retain the exact committed manifest blob"
+    );
+    assert_eq!(
+        identity["origin"]["committed_manifest_sha256"],
+        hex::encode(Sha256::digest(PLAIN.as_bytes())),
+        "should bind original manifest bytes"
+    );
+    assert_eq!(
+        identity["origin"]["package_path"], "crates/core",
+        "should bind package location within repository"
+    );
+    assert!(
+        identity["origin"]["normalized_manifest_sha256"].is_null(),
+        "should not invent normalization for a plain manifest"
+    );
+    let package = result.root.join("vendor/example-core");
+    assert_eq!(
+        fs::read(package.join("Cargo.toml")).expect("should read manifest"),
+        PLAIN.as_bytes(),
+        "should keep the committed manifest"
+    );
+    assert_eq!(
+        fs::read(package.join("src/lib.rs")).expect("should read source"),
+        b"pub fn core() {}\n",
+        "should copy the tree"
+    );
+    assert_eq!(
+        fs::metadata(package.join("run.sh"))
+            .expect("should stat script")
+            .permissions()
+            .mode()
+            & 0o7777,
+        0o755,
+        "should keep the executable bit"
+    );
+    assert!(
+        !package.join("nested").exists(),
+        "should skip nested packages"
+    );
+    assert!(
+        !package.join("Cargo.toml.orig").exists(),
+        "should not invent an original"
+    );
+    let checksum: Value = serde_json::from_slice(
+        &fs::read(package.join(".cargo-checksum.json")).expect("should read checksums"),
+    )
+    .expect("should be JSON");
+    assert_eq!(
+        checksum,
+        json!({
+            "files": {
+                "Cargo.toml": hex::encode(Sha256::digest(PLAIN.as_bytes())),
+                "run.sh": hex::encode(Sha256::digest(b"#!/bin/sh\n")),
+                "src/lib.rs": hex::encode(Sha256::digest(b"pub fn core() {}\n")),
+            },
+            "package": null,
+        }),
+        "should list files and a null package checksum like cargo vendor"
+    );
+    assert!(
+        materials.normalized_manifest_digests().is_empty()
+            && materials.derived_manifest_digests().is_empty(),
+        "should record no normalized or derived manifest"
+    );
+    assert_eq!(
+        materials.git_sources().len(),
+        1,
+        "should list the locked Git source"
+    );
+    assert_eq!(
+        materials.git_sources()[0].key(),
+        SELECTOR,
+        "should key the source by its selector"
+    );
+    materials.rehash().expect("should rehash the vendor tree");
+}
+
+#[test]
+fn workspace_inheritance_is_normalized_by_the_producer_from_the_verified_tree() {
+    let built = workspace(INHERITING, &[]);
+    let material = built.objects.material(SELECTOR, REVISION, &built.root_tree);
+    let accepted = run(&locked_core(), &material);
+    let materials = accepted
+        .outcome
+        .expect("should normalize the inheriting manifest itself");
+    let package = accepted.root.join("vendor/example-core");
+    let written = fs::read(package.join("Cargo.toml")).expect("should read manifest");
+    let parsed: toml::Table =
+        toml::from_str(std::str::from_utf8(&written).expect("should write a UTF-8 manifest"))
+            .expect("should write TOML");
+    let expected: toml::Table = toml::from_str(
+        "[package]\nname = \"example-core\"\nversion = \"0.4.0\"\nedition = \"2021\"\n\n[dependencies.example-dep]\nversion = \"1\"\nfeatures = [\"base\", \"extra\"]\n",
+    )
+    .expect("should parse the expected manifest");
+    assert_eq!(
+        parsed, expected,
+        "should resolve inherited fields and dependencies from the workspace root"
+    );
+    assert_eq!(
+        fs::read(package.join("Cargo.toml.orig")).expect("should read original"),
+        INHERITING.as_bytes(),
+        "should keep the committed manifest as the original"
+    );
+    let digest = hex::encode(Sha256::digest(&written));
+    let index = serde_json::to_value(materials.packages()).expect("should encode normalized index");
+    let identity = &index["example-core"];
+    assert_eq!(
+        identity["prepared_manifest_sha256"], digest,
+        "should identify the prepared normalized manifest"
+    );
+    assert_eq!(
+        identity["origin"]["normalized_manifest_sha256"], digest,
+        "should retain reviewed normalization identity"
+    );
+    assert_eq!(
+        identity["origin"]["committed_manifest_sha256"],
+        hex::encode(Sha256::digest(INHERITING.as_bytes())),
+        "should retain distinct original bytes"
+    );
+    assert_eq!(
+        materials.normalized_manifest_digests().get("example-core"),
+        Some(&digest),
+        "should record the producer-normalized manifest digest"
+    );
+    assert!(
+        materials.derived_manifest_digests().is_empty(),
+        "should record no caller-derived manifest"
+    );
+    let checksum: Value = serde_json::from_slice(
+        &fs::read(package.join(".cargo-checksum.json")).expect("should read checksums"),
+    )
+    .expect("should be JSON");
+    assert_eq!(
+        checksum["files"]["Cargo.toml"],
+        json!(digest),
+        "should checksum the normalized manifest"
+    );
+    assert_eq!(
+        checksum["files"]["Cargo.toml.orig"],
+        json!(hex::encode(Sha256::digest(INHERITING.as_bytes()))),
+        "should checksum the original"
+    );
+
+    let again = run(&locked_core(), &material);
+    again.outcome.expect("should normalize again");
+    assert_eq!(
+        fs::read(again.root.join("vendor/example-core/Cargo.toml"))
+            .expect("should read the second manifest"),
+        written,
+        "should normalize to identical bytes every time"
+    );
+}
+
+#[test]
+fn unresolvable_workspace_inheritance_fails_closed() {
+    let cases: [(&str, Workspace, &str, &str); 4] = [
+        (
+            "no workspace root in the tree",
+            workspace_with_root(INHERITING, None, &[]),
+            "0.4.0",
+            "no workspace root encloses it",
+        ),
+        (
+            "root without the inherited dependency",
+            workspace_with_root(
+                INHERITING,
+                Some(
+                    "[workspace]\n\n[workspace.package]\nversion = \"0.4.0\"\nedition = \"2021\"\n",
+                ),
+                &[],
+            ),
+            "0.4.0",
+            "which is not defined",
+        ),
+        (
+            "inherited version other than the lock",
+            workspace(INHERITING, &[]),
+            "0.5.0",
+            "does not declare package example-core 0.5.0",
+        ),
+        (
+            "member patch section",
+            workspace(
+                &format!("{INHERITING}\n[patch.crates-io]\nexample-dep = {{ path = \"x\" }}\n"),
+                &[],
+            ),
+            "0.4.0",
+            "declares [patch]",
+        ),
+    ];
+    for (label, built, version, expected) in cases {
+        let material = built.objects.material(SELECTOR, REVISION, &built.root_tree);
+        let locked = locked(&[], vec![git_package("example-core", version)]);
+        let message = rejection(run(&locked, &material));
+        assert!(
+            message.contains(expected),
+            "should reject {label}: {message}"
+        );
+    }
+}
+
+#[test]
+fn package_identity_and_root_must_be_unambiguous() {
+    let built = workspace(PLAIN, &[]);
+    let material = built.objects.material(SELECTOR, REVISION, &built.root_tree);
+    let other_version = locked(&[], vec![git_package("example-core", "0.5.0")]);
+    assert!(
+        rejection(run(&other_version, &material)).contains("declares example-core 0.4.0"),
+        "should reject a manifest whose version differs from the lock"
+    );
+    let unknown = locked(&[], vec![git_package("example-missing", "0.4.0")]);
+    assert!(
+        rejection(run(&unknown, &material)).contains("no Git directory declares"),
+        "should reject a package no directory declares"
+    );
+
+    let objects = Objects::new();
+    let blob = objects.blob(PLAIN.as_bytes());
+    let first = objects.tree(&[("100644", "Cargo.toml", &blob)]);
+    let second = objects.tree(&[("100644", "Cargo.toml", &blob)]);
+    let root = objects.tree(&[("40000", "a", &first), ("40000", "b", &second)]);
+    let material = objects.material(SELECTOR, REVISION, &root);
+    assert!(
+        rejection(run(&locked_core(), &material)).contains("ambiguous Git package roots"),
+        "should reject two directories declaring the package"
+    );
+}
+
+#[test]
+fn tree_entries_that_would_alias_the_manifest_or_escape_are_rejected() {
+    let built = workspace(INHERITING, &[("Cargo.toml.orig", b"committed orig\n")]);
+    let material = built.objects.material(SELECTOR, REVISION, &built.root_tree);
+    let conflict = rejection(run(&locked_core(), &material));
+    assert!(
+        conflict.contains("repeated"),
+        "should reject a committed Cargo.toml.orig beside a normalized manifest: {conflict}"
+    );
+
+    for (label, mode, name) in [
+        ("symlink", "120000", "link"),
+        ("submodule", "160000", "module"),
+        ("group-writable file", "100664", "odd"),
+        ("dotdot name", "100644", ".."),
+        ("backslash name", "100644", "a\\b"),
+        ("git name", "100644", ".GIT"),
+    ] {
+        let objects = Objects::new();
+        let manifest = objects.blob(PLAIN.as_bytes());
+        let extra = objects.blob(b"x");
+        let tree = objects.tree(&[("100644", "Cargo.toml", &manifest), (mode, name, &extra)]);
+        let material = objects.material(SELECTOR, REVISION, &tree);
+        assert!(
+            run(&locked_core(), &material).outcome.is_err(),
+            "should reject a {label} entry"
+        );
+    }
+}
+
+#[test]
+fn git_inputs_must_be_exactly_the_locked_bound_closures() {
+    let built = workspace(PLAIN, &[]);
+    let material = built.objects.material(SELECTOR, REVISION, &built.root_tree);
+    let cases: [(&str, GitPackage); 3] = [
+        (
+            "selector",
+            GitPackage {
+                selector: "git+https://example.com/org/other?tag=v1".to_owned(),
+                ..git_package("example-core", "0.4.0")
+            },
+        ),
+        (
+            "revision",
+            GitPackage {
+                revision: "4".repeat(40),
+                ..git_package("example-core", "0.4.0")
+            },
+        ),
+        (
+            "tag",
+            GitPackage {
+                selector: "git+https://example.com/org/workspace?tag=v2".to_owned(),
+                ..git_package("example-core", "0.4.0")
+            },
+        ),
+    ];
+    for (label, package) in cases {
+        let locked = locked(&[], vec![package]);
+        assert!(
+            rejection(run(&locked, &material)).contains("not bound to its locked source"),
+            "should reject a closure with another {label}"
+        );
+    }
+
+    let output = temporary();
+    let locked = locked_core();
+    let none: [GitVendorInput<'_>; 0] = [];
+    assert!(
+        locked
+            .prepare_cargo_vendor(
+                &VendorInputs {
+                    registry_archives: &Default::default(),
+                    git: &none
+                },
+                output.path(),
+                deadline(),
+                &cancellation()
+            )
+            .expect_err("should reject a missing closure")
+            .to_string()
+            .contains("Original release material"),
+        "should reject a locked Git package without a closure"
+    );
+    let twice = [
+        GitVendorInput {
+            material: &material,
+            name: "example-core",
+            version: "0.4.0",
+        },
+        GitVendorInput {
+            material: &material,
+            name: "example-core",
+            version: "0.4.0",
+        },
+    ];
+    assert!(
+        locked
+            .prepare_cargo_vendor(
+                &VendorInputs {
+                    registry_archives: &Default::default(),
+                    git: &twice
+                },
+                output.path(),
+                deadline(),
+                &cancellation()
+            )
+            .is_err(),
+        "should reject an extra closure"
+    );
+}
+
+#[test]
+fn store_objects_are_rehashed_before_use() {
+    let built = workspace(PLAIN, &[]);
+    let store = built.objects.store.path().to_owned();
+    let blob = &built.manifest_blob;
+    let object = store.join(&blob[..2]).join(&blob[2..]);
+    let forged_store = Objects::new();
+    let forged = forged_store
+        .blob(b"[package]\nname = \"example-core\"\nversion = \"0.4.0\"\nedition = \"2018\"\n");
+    let other = forged_store
+        .store
+        .path()
+        .join(&forged[..2])
+        .join(&forged[2..]);
+    fs::copy(&other, &object).expect("should swap the committed manifest object for forged bytes");
+    let material = built.objects.material(SELECTOR, REVISION, &built.root_tree);
+    let message = rejection(run(&locked_core(), &material));
+    assert!(
+        message.contains("do not match their identity"),
+        "should reject an edited store object: {message}"
+    );
+
+    let built = workspace(PLAIN, &[]);
+    let lib = built
+        .objects
+        .store
+        .path()
+        .read_dir()
+        .expect("should list store")
+        .count();
+    assert!(lib > 3, "should have written several objects");
+    let missing_root = built.objects.material(SELECTOR, REVISION, &"5".repeat(40));
+    assert!(
+        rejection(run(&locked_core(), &missing_root)).contains("cannot be opened"),
+        "should reject a root tree absent from the store"
+    );
+}
+
+#[test]
+fn git_package_directory_is_its_bare_name_and_never_shared() {
+    let built = workspace(PLAIN, &[]);
+    let material = built.objects.material(SELECTOR, REVISION, &built.root_tree);
+    let accepted = run(&locked_core(), &material);
+    accepted.outcome.expect("should vendor the Git package");
+    assert!(
+        accepted
+            .root
+            .join("vendor/example-core/Cargo.toml")
+            .is_file()
+            && !accepted.root.join("vendor/example-core-0.4.0").exists(),
+        "should name the Git package directory after the package alone"
+    );
+
+    let registry_crate = plain_crate("example", "core");
+    let locked = locked(
+        &[("example", "core", &registry_crate)],
+        vec![git_package("example-core", "0.4.0")],
+    );
+    let archive_directory = temporary();
+    let registry = archives(
+        archive_directory.path(),
+        &[("example", "core", &registry_crate)],
+    );
+    let output = temporary();
+    let inputs = [GitVendorInput {
+        material: &material,
+        name: "example-core",
+        version: "0.4.0",
+    }];
+    let error = locked
+        .prepare_cargo_vendor(
+            &VendorInputs {
+                registry_archives: &registry,
+                git: &inputs,
+            },
+            output.path(),
+            deadline(),
+            &cancellation(),
+        )
+        .expect_err("should refuse a Git directory that a registry crate already holds");
+    assert!(
+        format!("{error:?}").contains("cannot be created exclusively"),
+        "should fail closed on the shared directory: {error:?}"
+    );
+}
+
+#[test]
+fn git_packages_sharing_a_name_fail_closed() {
+    let versions = ["0.4.0", "0.5.0"];
+    let materials = versions.map(|version| {
+        let root = WORKSPACE_ROOT.replace("0.4.0", version);
+        let built = workspace_with_root(INHERITING, Some(&root), &[]);
+        built.objects.material(SELECTOR, REVISION, &built.root_tree)
+    });
+    let locked = locked(
+        &[],
+        versions
+            .iter()
+            .map(|version| git_package("example-core", version))
+            .collect(),
+    );
+    let inputs: Vec<GitVendorInput<'_>> = versions
+        .iter()
+        .zip(&materials)
+        .map(|(version, material)| GitVendorInput {
+            material,
+            name: "example-core",
+            version,
+        })
+        .collect();
+    let output = temporary();
+    let error = locked
+        .prepare_cargo_vendor(
+            &VendorInputs {
+                registry_archives: &Default::default(),
+                git: &inputs,
+            },
+            output.path(),
+            deadline(),
+            &cancellation(),
+        )
+        .expect_err("should refuse a second Git package in the same bare-name directory");
+    assert!(
+        format!("{error:?}").contains("cannot be created exclusively"),
+        "should fail closed on the shared directory: {error:?}"
+    );
+}
+
+#[test]
+fn ancestor_walk_reads_every_manifest_above_the_package_nearest_first() {
+    let objects = Objects::new();
+    let core_manifest = objects.blob(INHERITING.as_bytes());
+    let core = objects.tree(&[("100644", "Cargo.toml", &core_manifest)]);
+    let umbrella = b"[package]\nname = \"example-umbrella\"\nversion = \"9.9.9\"\n";
+    let umbrella_manifest = objects.blob(umbrella);
+    let crates = objects.tree(&[
+        ("100644", "Cargo.toml", &umbrella_manifest),
+        ("40000", "core", &core),
+    ]);
+    let root_manifest = objects.blob(WORKSPACE_ROOT.as_bytes());
+    let root_tree = objects.tree(&[
+        ("100644", "Cargo.toml", &root_manifest),
+        ("40000", "crates", &crates),
+    ]);
+    let store = Store::new(objects.store.path());
+    let package = PackageRoot {
+        tree: core.clone(),
+        manifest: core_manifest.clone(),
+        path: "crates/core".to_owned(),
+    };
+    let found = ancestor_manifests(&store, &root_tree, &package)
+        .expect("should walk the verified package path");
+    let seen: Vec<(&str, &[u8])> = found
+        .iter()
+        .map(|ancestor| (ancestor.directory.as_str(), ancestor.bytes.as_slice()))
+        .collect();
+    assert_eq!(
+        seen,
+        [
+            ("crates", umbrella.as_slice()),
+            ("", WORKSPACE_ROOT.as_bytes()),
+        ],
+        "should list the intermediate package manifest before the workspace root"
+    );
+
+    let elsewhere = PackageRoot {
+        tree: crates.clone(),
+        ..package.clone()
+    };
+    let wrong_tree = ancestor_manifests(&store, &root_tree, &elsewhere)
+        .expect_err("should refuse a path that leads to another tree");
+    assert!(
+        format!("{wrong_tree:?}").contains("does not lead to the package tree"),
+        "should report the mismatched package tree: {wrong_tree:?}"
+    );
+    let absent = PackageRoot {
+        path: "crates/absent".to_owned(),
+        ..package
+    };
+    let missing = ancestor_manifests(&store, &root_tree, &absent)
+        .expect_err("should refuse a path absent from the tree");
+    assert!(
+        format!("{missing:?}").contains("is not a tree in the verified closure"),
+        "should report the missing directory: {missing:?}"
+    );
+}
+
+#[test]
+fn git_targets_that_leave_the_package_are_refused() {
+    let escaping = format!("{PLAIN}build = \"../shared/build.rs\"\n");
+    let built = workspace(&escaping, &[]);
+    let material = built.objects.material(SELECTOR, REVISION, &built.root_tree);
+    let message = rejection(run(&locked_core(), &material));
+    assert!(
+        message.contains("leaves the vendored package directory"),
+        "should refuse a build script outside the package: {message}"
+    );
+}
diff --git a/crates/trusted-server-release/src/materials/cargo_vendor/tests/normalize.rs b/crates/trusted-server-release/src/materials/cargo_vendor/tests/normalize.rs
new file mode 100644
index 0000000000..504e178caf
--- /dev/null
+++ b/crates/trusted-server-release/src/materials/cargo_vendor/tests/normalize.rs
@@ -0,0 +1,565 @@
+//! Pure tests of producer-owned manifest normalization over fictional workspaces.
+
+use super::super::normalize::{
+    AncestorManifest, INHERITED_PACKAGE_FIELDS, PackageManifest, check_target_paths,
+    normalize_manifest, relocate,
+};
+
+const ROOT: &str = r#"[workspace]
+members = ["crates/example-core", "crates/example-sibling"]
+exclude = ["examples/example-demo"]
+
+[workspace.package]
+authors = ["Example Team <team@example.com>"]
+categories = ["example-category"]
+description = "Fictional workspace description"
+documentation = "https://docs.example.com/example-core"
+edition = "2024"
+exclude = ["fixtures/"]
+homepage = "https://example.com"
+include = ["src/**", "Cargo.toml"]
+keywords = ["example"]
+license = "Apache-2.0"
+publish = false
+repository = "https://example.com/org/workspace"
+rust-version = "1.85"
+version = "0.4.0"
+
+[workspace.dependencies]
+example-plain = "1"
+example-featured = { version = "2", features = ["base"] }
+example-quiet = { version = "3", default-features = false, features = ["core"] }
+example-sibling = { path = "crates/example-sibling", default-features = false }
+example-renamed = { version = "4", package = "example-original" }
+
+[workspace.lints.rust]
+unsafe_code = "deny"
+
+[workspace.lints.clippy]
+pedantic = { level = "warn", priority = -1 }
+"#;
+
+const MEMBER: &str = r#"[package]
+name = "example-core"
+authors.workspace = true
+categories.workspace = true
+description.workspace = true
+documentation.workspace = true
+edition.workspace = true
+exclude.workspace = true
+homepage.workspace = true
+include.workspace = true
+keywords.workspace = true
+license.workspace = true
+publish.workspace = true
+repository.workspace = true
+rust-version.workspace = true
+version = { workspace = true }
+
+[features]
+default = ["example-featured/extra"]
+
+[dependencies]
+example-plain = { workspace = true }
+example-featured = { workspace = true, features = ["extra", "base"], optional = true }
+example-quiet = { workspace = true, default-features = true }
+example-sibling = { workspace = true, features = ["sibling-extra"] }
+example-own = { path = "../example-own", version = "5" }
+
+[target.'cfg(unix)'.dependencies]
+example-renamed = { workspace = true }
+
+[dev-dependencies]
+example-plain = { workspace = true, features = ["testing"] }
+
+[build-dependencies]
+example-plain.workspace = true
+
+[lints]
+workspace = true
+"#;
+
+const EXPECTED: &str = r#"[package]
+name = "example-core"
+authors = ["Example Team <team@example.com>"]
+categories = ["example-category"]
+description = "Fictional workspace description"
+documentation = "https://docs.example.com/example-core"
+edition = "2024"
+exclude = ["fixtures/"]
+homepage = "https://example.com"
+include = ["src/**", "Cargo.toml"]
+keywords = ["example"]
+license = "Apache-2.0"
+publish = false
+repository = "https://example.com/org/workspace"
+rust-version = "1.85"
+version = "0.4.0"
+
+[features]
+default = ["example-featured/extra"]
+
+[dependencies]
+example-plain = { version = "1" }
+example-featured = { version = "2", features = ["base", "extra"], optional = true }
+example-quiet = { version = "3", default-features = true, features = ["core"] }
+example-sibling = { path = "../example-sibling", default-features = false, features = ["sibling-extra"] }
+example-own = { path = "../example-own", version = "5" }
+
+[target.'cfg(unix)'.dependencies]
+example-renamed = { version = "4", package = "example-original" }
+
+[dev-dependencies]
+example-plain = { version = "1", features = ["testing"] }
+
+[build-dependencies]
+example-plain = { version = "1" }
+
+[lints.rust]
+unsafe_code = "deny"
+
+[lints.clippy]
+pedantic = { level = "warn", priority = -1 }
+"#;
+
+fn root_ancestors(root: &str) -> Vec<AncestorManifest> {
+    vec![AncestorManifest {
+        directory: String::new(),
+        bytes: root.as_bytes().to_vec(),
+    }]
+}
+
+fn normalize(
+    member: &str,
+    version: &str,
+    ancestors: &[AncestorManifest],
+) -> Result<Vec<u8>, String> {
+    normalize_manifest(
+        &PackageManifest {
+            name: "example-core",
+            version,
+            directory: "crates/example-core",
+            bytes: member.as_bytes(),
+        },
+        ancestors,
+    )
+    .map_err(|error| format!("{error:?}"))
+}
+
+fn table(bytes: &[u8]) -> toml::Table {
+    toml::from_str(std::str::from_utf8(bytes).expect("should be UTF-8")).expect("should be TOML")
+}
+
+#[test]
+fn every_supported_inheritance_kind_resolves_against_the_workspace_root() {
+    let normalized =
+        normalize(MEMBER, "0.4.0", &root_ancestors(ROOT)).expect("should normalize the member");
+    assert_eq!(
+        table(&normalized),
+        table(EXPECTED.as_bytes()),
+        "should resolve package fields, dependencies, features, defaults, paths and lints"
+    );
+    let text = String::from_utf8(normalized).expect("should be UTF-8");
+    assert!(
+        !text.contains("workspace = true") && !text.contains("[workspace"),
+        "should leave no inheritance marker and no workspace table"
+    );
+    assert!(
+        text.starts_with("# Normalized by trusted-server-release"),
+        "should say who normalized the manifest"
+    );
+}
+
+#[test]
+fn every_listed_package_field_is_exercised() {
+    let member = table(MEMBER.as_bytes());
+    let package = member["package"]
+        .as_table()
+        .expect("should hold a package table");
+    for field in INHERITED_PACKAGE_FIELDS {
+        assert!(
+            package.get(field).and_then(toml::Value::as_table).is_some(),
+            "should inherit package.{field} in the fixture"
+        );
+    }
+}
+
+#[test]
+fn normalization_is_deterministic_and_independent_of_input_key_order() {
+    let ancestors = root_ancestors(ROOT);
+    let first = normalize(MEMBER, "0.4.0", &ancestors).expect("should normalize");
+    let second = normalize(MEMBER, "0.4.0", &ancestors).expect("should normalize again");
+    assert_eq!(
+        first, second,
+        "should produce identical bytes for equal input"
+    );
+    let reordered = MEMBER.replace(
+        "authors.workspace = true\ncategories.workspace = true\n",
+        "categories.workspace = true\nauthors.workspace = true\n",
+    );
+    assert_ne!(reordered, MEMBER, "should actually reorder the fixture");
+    assert_eq!(
+        normalize(&reordered, "0.4.0", &ancestors).expect("should normalize the reordered input"),
+        first,
+        "should sort keys so input order cannot change the bytes"
+    );
+}
+
+#[test]
+fn nearest_workspace_root_is_found_past_plain_ancestor_manifests() {
+    let ancestors = vec![
+        AncestorManifest {
+            directory: "crates".to_owned(),
+            bytes: b"[package]\nname = \"example-umbrella\"\nversion = \"9.9.9\"\n".to_vec(),
+        },
+        AncestorManifest {
+            directory: String::new(),
+            bytes: ROOT.as_bytes().to_vec(),
+        },
+    ];
+    let normalized = normalize(MEMBER, "0.4.0", &ancestors).expect("should skip plain manifests");
+    assert_eq!(
+        table(&normalized),
+        table(EXPECTED.as_bytes()),
+        "should resolve against the enclosing workspace root"
+    );
+}
+
+#[test]
+fn a_package_that_is_its_own_workspace_root_drops_the_workspace_table() {
+    let member = "[package]\nname = \"example-core\"\nversion.workspace = true\n\n[workspace]\n\n[workspace.package]\nversion = \"0.4.0\"\n\n[workspace.dependencies]\nexample-plain = \"1\"\n\n[dependencies]\nexample-plain.workspace = true\n";
+    let normalized = normalize_manifest(
+        &PackageManifest {
+            name: "example-core",
+            version: "0.4.0",
+            directory: "",
+            bytes: member.as_bytes(),
+        },
+        &[],
+    )
+    .expect("should resolve against its own workspace table");
+    assert_eq!(
+        table(&normalized),
+        table(b"[package]\nname = \"example-core\"\nversion = \"0.4.0\"\n\n[dependencies]\nexample-plain = { version = \"1\" }\n"),
+        "should drop [workspace] and resolve inheritance"
+    );
+}
+
+#[test]
+fn workspace_paths_are_relocated_relative_to_the_package() {
+    let cases = [
+        (
+            "",
+            "crates/example-sibling",
+            "crates/example-core",
+            "../example-sibling",
+        ),
+        (
+            "",
+            "./crates/deep/example-leaf",
+            "crates/example-core",
+            "../deep/example-leaf",
+        ),
+        (
+            "tools",
+            "../crates/example-sibling",
+            "crates/example-core",
+            "../example-sibling",
+        ),
+        (
+            "",
+            "crates/example-core/inner",
+            "crates/example-core",
+            "inner",
+        ),
+        ("", "example-top", "example-top", "."),
+    ];
+    for (workspace, path, package, expected) in cases {
+        assert_eq!(
+            relocate(workspace, path, package).expect("should relocate the path"),
+            expected,
+            "should rewrite {path} from {workspace:?} for {package}"
+        );
+    }
+    for (path, label) in [
+        ("/example/absolute", "absolute"),
+        ("../outside", "escaping"),
+        ("", "empty"),
+        ("crates\\example", "backslash"),
+    ] {
+        assert!(
+            relocate("", path, "crates/example-core").is_err(),
+            "should refuse a {label} workspace path"
+        );
+    }
+}
+
+#[test]
+fn unsupported_or_unresolvable_inheritance_fails_closed() {
+    let member_with = |extra: &str| format!("{MEMBER}{extra}");
+    let replace = |from: &str, to: &str| MEMBER.replacen(from, to, 1);
+    let cases: Vec<(&str, String, String, &str)> = vec![
+        (
+            "inherited readme",
+            replace("authors.workspace = true", "readme.workspace = true"),
+            ROOT.to_owned(),
+            "workspace-relative path",
+        ),
+        (
+            "inherited license-file",
+            replace("authors.workspace = true", "license-file.workspace = true"),
+            ROOT.to_owned(),
+            "workspace-relative path",
+        ),
+        (
+            "unknown inheritable key",
+            replace("authors.workspace = true", "links.workspace = true"),
+            ROOT.to_owned(),
+            "not an inheritable field",
+        ),
+        (
+            "workspace = false",
+            replace("authors.workspace = true", "authors.workspace = false"),
+            ROOT.to_owned(),
+            "exactly { workspace = true }",
+        ),
+        (
+            "missing workspace.package field",
+            MEMBER.to_owned(),
+            ROOT.replace("homepage = \"https://example.com\"\n", ""),
+            "does not define",
+        ),
+        (
+            "member key beside workspace",
+            replace(
+                "example-plain = { workspace = true }",
+                "example-plain = { workspace = true, version = \"1\" }",
+            ),
+            ROOT.to_owned(),
+            "sets version beside workspace = true",
+        ),
+        (
+            "ignored default-features = false",
+            replace(
+                "example-plain = { workspace = true }",
+                "example-plain = { workspace = true, default-features = false }",
+            ),
+            ROOT.to_owned(),
+            "default-features = false",
+        ),
+        (
+            "workspace git dependency",
+            MEMBER.to_owned(),
+            ROOT.replace(
+                "example-plain = \"1\"",
+                "example-plain = { git = \"https://example.com/org/plain\" }",
+            ),
+            "sets git; unsupported",
+        ),
+        (
+            "workspace optional dependency",
+            MEMBER.to_owned(),
+            ROOT.replace(
+                "example-plain = \"1\"",
+                "example-plain = { version = \"1\", optional = true }",
+            ),
+            "sets optional; unsupported",
+        ),
+        (
+            "missing workspace dependency",
+            MEMBER.to_owned(),
+            ROOT.replace("example-plain = \"1\"\n", ""),
+            "which is not defined",
+        ),
+        (
+            "missing workspace lints",
+            MEMBER.to_owned(),
+            ROOT.split("[workspace.lints.rust]")
+                .next()
+                .unwrap_or_default()
+                .to_owned(),
+            "[workspace.lints], which is not defined",
+        ),
+        (
+            "replace section",
+            member_with("\n[replace]\n\"example-plain:1.0.0\" = { path = \"x\" }\n"),
+            ROOT.to_owned(),
+            "declares [replace]",
+        ),
+        (
+            "package workspace pointer",
+            replace(
+                "name = \"example-core\"",
+                "name = \"example-core\"\nworkspace = \"../..\"",
+            ),
+            ROOT.to_owned(),
+            "package.workspace pointers",
+        ),
+        (
+            "legacy dependency spelling",
+            member_with("\n[dev_dependencies]\nexample-plain = \"1\"\n"),
+            ROOT.to_owned(),
+            "legacy spelling",
+        ),
+        (
+            "excluded package",
+            MEMBER.to_owned(),
+            ROOT.replace("examples/example-demo", "crates/example-core"),
+            "excluded from its nearest workspace root",
+        ),
+        (
+            "inherited badges",
+            member_with("\n[badges]\nworkspace = true\n"),
+            ROOT.to_owned(),
+            "still inherits",
+        ),
+        (
+            "other name",
+            replace("name = \"example-core\"", "name = \"example-other\""),
+            ROOT.to_owned(),
+            "does not name package example-core",
+        ),
+    ];
+    for (label, member, root, expected) in cases {
+        let message = normalize(&member, "0.4.0", &root_ancestors(&root))
+            .expect_err("should refuse the manifest");
+        assert!(
+            message.contains(expected),
+            "should reject {label} with {expected:?}: {message}"
+        );
+    }
+}
+
+#[test]
+fn missing_root_and_version_mismatch_fail_closed() {
+    let missing = normalize(MEMBER, "0.4.0", &[]).expect_err("should need a workspace root");
+    assert!(
+        missing.contains("no workspace root encloses it"),
+        "should report the missing workspace root: {missing}"
+    );
+    let plain_only = vec![AncestorManifest {
+        directory: String::new(),
+        bytes: b"[package]\nname = \"example-top\"\nversion = \"1.0.0\"\n".to_vec(),
+    }];
+    assert!(
+        normalize(MEMBER, "0.4.0", &plain_only)
+            .expect_err("should need a [workspace] table")
+            .contains("no workspace root encloses it"),
+        "should not treat a plain ancestor manifest as a workspace root"
+    );
+    let mismatch =
+        normalize(MEMBER, "0.5.0", &root_ancestors(ROOT)).expect_err("should check the version");
+    assert!(
+        mismatch.contains("does not declare package example-core 0.5.0"),
+        "should refuse an inherited version other than the locked one: {mismatch}"
+    );
+    let broken = normalize(MEMBER, "0.4.0", &root_ancestors("[workspace"))
+        .expect_err("should refuse an unparsable root");
+    assert!(
+        broken.contains("TOML parse error"),
+        "should report an unparsable workspace root: {broken}"
+    );
+}
+
+#[test]
+fn ancestor_pointers_and_non_manifests_are_refused() {
+    let nearer = |bytes: &[u8]| {
+        vec![
+            AncestorManifest {
+                directory: "crates".to_owned(),
+                bytes: bytes.to_vec(),
+            },
+            AncestorManifest {
+                directory: String::new(),
+                bytes: ROOT.as_bytes().to_vec(),
+            },
+        ]
+    };
+    let pointer = normalize(
+        MEMBER,
+        "0.4.0",
+        &nearer(
+            b"[package]
+name = \"example-umbrella\"\nversion = \"9.9.9\"\nworkspace = \"../elsewhere\"\n",
+        ),
+    )
+    .expect_err("should refuse an ancestor that points to another root");
+    assert!(
+        pointer.contains("points to another workspace root"),
+        "should report the workspace pointer instead of skipping it: {pointer}"
+    );
+    let neither = normalize(MEMBER, "0.4.0", &nearer(b"[profile.release]\nlto = true\n"))
+        .expect_err("should refuse an ancestor that is neither package nor workspace");
+    assert!(
+        neither.contains("neither [package] nor [workspace]"),
+        "should report the unrecognized ancestor manifest: {neither}"
+    );
+}
+
+#[test]
+fn matching_disabled_default_features_stay_disabled() {
+    let member = MEMBER.replace(
+        "example-quiet = { workspace = true, default-features = true }",
+        "example-quiet = { workspace = true, default-features = false }",
+    );
+    let normalized =
+        normalize(&member, "0.4.0", &root_ancestors(ROOT)).expect("should accept matching false");
+    assert_eq!(
+        table(&normalized)["dependencies"]["example-quiet"],
+        toml::Value::Table(table(
+            b"version = \"3\"\ndefault-features = false\nfeatures = [\"core\"]\n"
+        )),
+        "should keep default features off when both sides turn them off"
+    );
+}
+
+#[test]
+fn workspace_side_feature_repeats_are_dropped() {
+    let root = ROOT.replace(
+        "example-featured = { version = \"2\", features = [\"base\"] }",
+        "example-featured = { version = \"2\", features = [\"base\", \"extra\", \"base\"] }",
+    );
+    let normalized =
+        normalize(MEMBER, "0.4.0", &root_ancestors(&root)).expect("should normalize the member");
+    assert_eq!(
+        table(&normalized)["dependencies"]["example-featured"]["features"],
+        toml::Value::Array(vec![
+            toml::Value::String("base".to_owned()),
+            toml::Value::String("extra".to_owned()),
+        ]),
+        "should keep each feature once, in first-seen order"
+    );
+}
+
+#[test]
+fn target_paths_must_stay_inside_the_package() {
+    let manifest = |extra: &str| -> toml::Table {
+        table(
+            format!("[package]\nname = \"example-core\"\nversion = \"0.4.0\"\n{extra}").as_bytes(),
+        )
+    };
+    for accepted in [
+        "",
+        "build = false\n",
+        "build = \"tools/build.rs\"\n",
+        "\n[lib]\npath = \"src/lib.rs\"\n",
+        "\n[[bin]]\nname = \"example\"\npath = \"src/bin/example.rs\"\n",
+    ] {
+        check_target_paths(&manifest(accepted))
+            .unwrap_or_else(|error| panic!("should accept {accepted:?}: {error:?}"));
+    }
+    for refused in [
+        "build = \"../build.rs\"\n",
+        "\n[lib]\npath = \"../shared/lib.rs\"\n",
+        "\n[[bin]]\nname = \"example\"\npath = \"/example/main.rs\"\n",
+        "\n[[example]]\nname = \"demo\"\npath = \"examples/../../demo.rs\"\n",
+        "\n[[test]]\nname = \"suite\"\npath = \"..\\\\suite.rs\"\n",
+        "\n[[bench]]\nname = \"speed\"\npath = \"../benches/speed.rs\"\n",
+        "\n[lib]\npath = 7\n",
+    ] {
+        assert!(
+            check_target_paths(&manifest(refused)).is_err(),
+            "should refuse {refused:?}"
+        );
+    }
+}
diff --git a/crates/trusted-server-release/src/materials/cargo_vendor/tests/registry.rs b/crates/trusted-server-release/src/materials/cargo_vendor/tests/registry.rs
new file mode 100644
index 0000000000..2033926555
--- /dev/null
+++ b/crates/trusted-server-release/src/materials/cargo_vendor/tests/registry.rs
@@ -0,0 +1,493 @@
+use std::fs;
+use std::os::unix::fs::{MetadataExt as _, PermissionsExt as _};
+use std::path::Path;
+
+use serde_json::{Value, json};
+use sha2::{Digest as _, Sha256};
+
+use super::support::*;
+use crate::materials::{LockedMaterials, PreparedCargoMaterials, VendorInputs};
+
+struct Prepared {
+    _archives: tempfile::TempDir,
+    _output: tempfile::TempDir,
+    outcome: Result<PreparedCargoMaterials, String>,
+    root: std::path::PathBuf,
+}
+
+fn prepare(locked: &LockedMaterials, entries: &[(&str, &str, &[u8])]) -> Prepared {
+    prepare_with(locked, entries, |_| {})
+}
+
+/// Prepares from `entries`, letting `tweak` change the output root first.
+fn prepare_with(
+    locked: &LockedMaterials,
+    entries: &[(&str, &str, &[u8])],
+    tweak: impl FnOnce(&Path),
+) -> Prepared {
+    let archive_directory = temporary();
+    let output = temporary();
+    let registry = archives(archive_directory.path(), entries);
+    let root = output.path().to_owned();
+    tweak(&root);
+    let outcome = locked
+        .prepare_cargo_vendor(
+            &VendorInputs {
+                registry_archives: &registry,
+                git: &[],
+            },
+            &root,
+            deadline(),
+            &cancellation(),
+        )
+        .map_err(|error| format!("{error:?}"));
+    Prepared {
+        _archives: archive_directory,
+        _output: output,
+        outcome,
+        root,
+    }
+}
+
+fn two_crates() -> (Vec<u8>, Vec<u8>) {
+    (
+        plain_crate("example-one", "1.0.0"),
+        plain_crate("example-two", "0.3.1"),
+    )
+}
+
+#[test]
+fn registry_crates_become_directory_source_packages_with_cargo_checksums() {
+    let (one, two) = two_crates();
+    let entries: [(&str, &str, &[u8]); 2] = [
+        ("example-one", "1.0.0", &one),
+        ("example-two", "0.3.1", &two),
+    ];
+    let locked = locked(&entries, Vec::new());
+    let prepared = prepare(&locked, &entries);
+    let materials = prepared.outcome.expect("should prepare the vendor tree");
+    let vendor = materials.vendor_dir();
+    let index = serde_json::to_value(materials.packages()).expect("should encode verified index");
+    let identity = &index["example-one-1.0.0"];
+    assert_eq!(
+        identity["name"], "example-one",
+        "should retain locked package name"
+    );
+    assert_eq!(
+        identity["version"], "1.0.0",
+        "should retain locked package version"
+    );
+    assert_eq!(
+        identity["origin"]["kind"], "registry",
+        "should identify original source class"
+    );
+    assert_eq!(
+        identity["origin"]["archive_sha256"],
+        hex::encode(Sha256::digest(&one)),
+        "should bind the exact verified original archive"
+    );
+    assert_eq!(
+        identity["prepared_manifest_sha256"],
+        hex::encode(Sha256::digest(manifest("example-one", "1.0.0"))),
+        "should bind the manifest Cargo actually reads"
+    );
+    assert_eq!(
+        materials.packages().len(),
+        2,
+        "should index exactly the prepared packages"
+    );
+    assert_eq!(
+        vendor,
+        prepared.root.join("vendor"),
+        "should place packages under vendor"
+    );
+    let mut names: Vec<String> = fs::read_dir(vendor)
+        .expect("should list vendor")
+        .map(|entry| {
+            entry
+                .expect("should read entry")
+                .file_name()
+                .into_string()
+                .expect("should be UTF-8")
+        })
+        .collect();
+    names.sort();
+    assert_eq!(
+        names,
+        ["example-one-1.0.0", "example-two-0.3.1"],
+        "should create one directory per crate"
+    );
+
+    let package = vendor.join("example-one-1.0.0");
+    let manifest = manifest("example-one", "1.0.0");
+    let expected = json!({
+        "files": {
+            "Cargo.toml": hex::encode(Sha256::digest(&manifest)),
+            "build.sh": hex::encode(Sha256::digest(b"#!/bin/sh\n")),
+            "src/lib.rs": hex::encode(Sha256::digest(b"pub fn fictional() {}\n")),
+        },
+        "package": hex::encode(Sha256::digest(&one)),
+    });
+    let raw = fs::read(package.join(".cargo-checksum.json")).expect("should write checksum file");
+    let parsed: Value = serde_json::from_slice(&raw).expect("should write JSON");
+    assert_eq!(
+        parsed, expected,
+        "should list every file and the lock checksum"
+    );
+    assert!(
+        String::from_utf8(raw)
+            .expect("should be UTF-8")
+            .starts_with("{\"files\":{"),
+        "should write files before package like cargo vendor"
+    );
+    for (relative, mode) in [
+        ("Cargo.toml", 0o644),
+        ("src/lib.rs", 0o644),
+        ("build.sh", 0o755),
+    ] {
+        let metadata = fs::symlink_metadata(package.join(relative)).expect("should stat file");
+        assert_eq!(
+            metadata.permissions().mode() & 0o7777,
+            mode,
+            "should set mode of {relative}"
+        );
+        assert_eq!(metadata.nlink(), 1, "should write unlinked {relative}");
+    }
+    assert_eq!(materials.digest().len(), 64, "should digest the whole tree");
+    assert_eq!(
+        materials.source_commit(),
+        SOURCE_COMMIT,
+        "should bind the approved source"
+    );
+    assert_eq!(
+        materials.cargo_lock_sha256(),
+        LOCK_SHA256,
+        "should bind the lock digest"
+    );
+    assert!(
+        materials.git_sources().is_empty(),
+        "should list no Git sources"
+    );
+    materials
+        .rehash()
+        .expect("should rehash the untouched tree");
+}
+
+#[test]
+fn preparation_is_deterministic_and_content_sensitive() {
+    let (one, two) = two_crates();
+    let entries: [(&str, &str, &[u8]); 2] = [
+        ("example-one", "1.0.0", &one),
+        ("example-two", "0.3.1", &two),
+    ];
+    let locked_a = locked(&entries, Vec::new());
+    let first = prepare(&locked_a, &entries)
+        .outcome
+        .expect("should prepare");
+    let second = prepare(&locked_a, &entries)
+        .outcome
+        .expect("should prepare again");
+    assert_eq!(
+        first.digest(),
+        second.digest(),
+        "should reproduce the digest across roots"
+    );
+    assert_eq!(
+        serde_json::to_value(first.packages()).expect("should encode first index"),
+        serde_json::to_value(second.packages()).expect("should encode second index"),
+        "should keep original identities independent of staging paths"
+    );
+
+    let changed = plain_crate_with("example-one", "1.0.0", b"pub fn other() {}\n");
+    let changed_entries: [(&str, &str, &[u8]); 2] = [
+        ("example-one", "1.0.0", &changed),
+        ("example-two", "0.3.1", &two),
+    ];
+    let changed_locked = locked(&changed_entries, Vec::new());
+    let third = prepare(&changed_locked, &changed_entries)
+        .outcome
+        .expect("should prepare changed");
+    assert_ne!(
+        first.digest(),
+        third.digest(),
+        "should change the digest with content"
+    );
+    assert_ne!(
+        serde_json::to_value(first.packages()).expect("should encode original index"),
+        serde_json::to_value(third.packages()).expect("should encode changed index"),
+        "should bind changed original archives even when package names and versions match"
+    );
+}
+
+fn plain_crate_with(name: &str, version: &str, source: &[u8]) -> Vec<u8> {
+    crate_archive(
+        name,
+        version,
+        &[
+            ("Cargo.toml", &manifest(name, version), 0o644),
+            ("src/lib.rs", source, 0o644),
+        ],
+    )
+}
+
+#[test]
+fn rehash_detects_edits_additions_removals_and_extra_root_entries() {
+    let one = plain_crate("example-one", "1.0.0");
+    let entries: [(&str, &str, &[u8]); 1] = [("example-one", "1.0.0", &one)];
+    let locked = locked(&entries, Vec::new());
+    let package = |root: &Path| root.join("vendor/example-one-1.0.0");
+    type Tamper = fn(&Path);
+    let tampers: [(&str, Tamper); 6] = [
+        ("edit", |root| {
+            let path = root.join("vendor/example-one-1.0.0/src/lib.rs");
+            fs::set_permissions(&path, fs::Permissions::from_mode(0o644)).expect("should chmod");
+            fs::write(path, b"tampered").expect("should edit");
+        }),
+        ("add", |root| {
+            fs::write(root.join("vendor/example-one-1.0.0/extra.rs"), b"x").expect("should add");
+        }),
+        ("remove", |root| {
+            fs::remove_file(root.join("vendor/example-one-1.0.0/src/lib.rs"))
+                .expect("should remove");
+        }),
+        ("chmod", |root| {
+            fs::set_permissions(
+                root.join("vendor/example-one-1.0.0/build.sh"),
+                fs::Permissions::from_mode(0o644),
+            )
+            .expect("should chmod");
+        }),
+        ("extra root entry", |root| {
+            fs::create_dir(root.join("cargo-home")).expect("should add root entry");
+        }),
+        ("hard link", |root| {
+            fs::hard_link(
+                root.join("vendor/example-one-1.0.0/src/lib.rs"),
+                root.join("vendor/example-one-1.0.0/linked.rs"),
+            )
+            .expect("should link");
+        }),
+    ];
+    for (label, tamper) in tampers {
+        let prepared = prepare(&locked, &entries);
+        let materials = prepared.outcome.expect("should prepare");
+        assert!(
+            package(&prepared.root).is_dir(),
+            "should create the package directory"
+        );
+        tamper(&prepared.root);
+        assert!(
+            materials.rehash().is_err(),
+            "should reject {label} after preparation"
+        );
+    }
+}
+
+#[test]
+fn registry_inputs_must_be_exactly_the_locked_crates() {
+    let (one, two) = two_crates();
+    let locked_both = locked(
+        &[
+            ("example-one", "1.0.0", &one),
+            ("example-two", "0.3.1", &two),
+        ],
+        Vec::new(),
+    );
+    let missing = prepare(&locked_both, &[("example-one", "1.0.0", &one)]);
+    assert!(
+        missing
+            .outcome
+            .expect_err("should reject a missing original")
+            .contains("exactly the locked"),
+        "should reject a missing archive"
+    );
+    let locked_one = locked(&[("example-one", "1.0.0", &one)], Vec::new());
+    let extra = prepare(
+        &locked_one,
+        &[
+            ("example-one", "1.0.0", &one),
+            ("example-two", "0.3.1", &two),
+        ],
+    );
+    assert!(
+        extra
+            .outcome
+            .expect_err("should reject an extra original")
+            .contains("exactly the locked"),
+        "should reject an unlocked archive"
+    );
+    let wrong_version = prepare(&locked_one, &[("example-one", "1.0.1", &one)]);
+    assert!(
+        wrong_version.outcome.is_err(),
+        "should reject an archive for another version"
+    );
+}
+
+#[test]
+fn archive_bytes_must_match_the_locked_checksum() {
+    let one = plain_crate("example-one", "1.0.0");
+    let entries: [(&str, &str, &[u8]); 1] = [("example-one", "1.0.0", &one)];
+    let locked = locked(&entries, Vec::new());
+    let other = plain_crate_with("example-one", "1.0.0", b"different\n");
+    let prepared = prepare(&locked, &[("example-one", "1.0.0", &other)]);
+    assert!(
+        prepared.outcome.is_err(),
+        "should reject bytes that do not match the lock checksum"
+    );
+}
+
+#[test]
+fn manifests_must_declare_the_locked_identity_and_nothing_reserved() {
+    let cases: [(&str, Vec<u8>); 5] = [
+        (
+            "other name",
+            crate_archive(
+                "example-one",
+                "1.0.0",
+                &[("Cargo.toml", &manifest("example-other", "1.0.0"), 0o644)],
+            ),
+        ),
+        (
+            "other version",
+            crate_archive(
+                "example-one",
+                "1.0.0",
+                &[("Cargo.toml", &manifest("example-one", "1.0.1"), 0o644)],
+            ),
+        ),
+        (
+            "missing manifest",
+            crate_archive("example-one", "1.0.0", &[("src/lib.rs", b"x", 0o644)]),
+        ),
+        (
+            "unparsable manifest",
+            crate_archive(
+                "example-one",
+                "1.0.0",
+                &[("Cargo.toml", b"[package", 0o644)],
+            ),
+        ),
+        (
+            "reserved checksum file",
+            crate_archive(
+                "example-one",
+                "1.0.0",
+                &[
+                    ("Cargo.toml", &manifest("example-one", "1.0.0"), 0o644),
+                    (".cargo-checksum.json", b"{}", 0o644),
+                ],
+            ),
+        ),
+    ];
+    for (label, bytes) in cases {
+        let entries: [(&str, &str, &[u8]); 1] = [("example-one", "1.0.0", &bytes)];
+        let locked = locked(&entries, Vec::new());
+        assert!(
+            prepare(&locked, &entries).outcome.is_err(),
+            "should reject a crate with {label}"
+        );
+    }
+}
+
+#[test]
+fn output_root_must_be_a_fresh_real_directory() {
+    let one = plain_crate("example-one", "1.0.0");
+    let entries: [(&str, &str, &[u8]); 1] = [("example-one", "1.0.0", &one)];
+    let locked = locked(&entries, Vec::new());
+    let populated = prepare_with(&locked, &entries, |root| {
+        fs::write(root.join("leftover"), b"x").expect("should populate root");
+    });
+    assert!(
+        populated
+            .outcome
+            .expect_err("should reject a populated root")
+            .contains("already has entries"),
+        "should reject a root with prior entries"
+    );
+    let archive_directory = temporary();
+    let registry = archives(archive_directory.path(), &entries);
+    let real = archive_directory.path().join("real-root");
+    fs::create_dir(&real).expect("should create real root");
+    let alias = archive_directory.path().join("alias-root");
+    std::os::unix::fs::symlink(&real, &alias).expect("should alias root");
+    assert!(
+        locked
+            .prepare_cargo_vendor(
+                &VendorInputs {
+                    registry_archives: &registry,
+                    git: &[]
+                },
+                &alias,
+                deadline(),
+                &cancellation(),
+            )
+            .expect_err("should reject a symlinked root")
+            .to_string()
+            .contains("Original release material"),
+        "should reject a symlinked root as a material error"
+    );
+    let missing = archive_directory.path().join("missing-root");
+    assert!(
+        locked
+            .prepare_cargo_vendor(
+                &VendorInputs {
+                    registry_archives: &registry,
+                    git: &[]
+                },
+                &missing,
+                deadline(),
+                &cancellation(),
+            )
+            .is_err(),
+        "should reject a root that does not exist"
+    );
+    let file = archive_directory.path().join("a-file");
+    fs::write(&file, b"x").expect("should write file");
+    assert!(
+        locked
+            .prepare_cargo_vendor(
+                &VendorInputs {
+                    registry_archives: &registry,
+                    git: &[]
+                },
+                &file,
+                deadline(),
+                &cancellation(),
+            )
+            .is_err(),
+        "should reject a root that is a file"
+    );
+}
+
+#[test]
+fn cancelled_or_expired_attempt_prepares_nothing() {
+    let one = plain_crate("example-one", "1.0.0");
+    let entries: [(&str, &str, &[u8]); 1] = [("example-one", "1.0.0", &one)];
+    let locked = locked(&entries, Vec::new());
+    let archive_directory = temporary();
+    let registry = archives(archive_directory.path(), &entries);
+    let output = temporary();
+    let token = cancellation();
+    token.cancel();
+    assert!(
+        locked
+            .prepare_cargo_vendor(
+                &VendorInputs {
+                    registry_archives: &registry,
+                    git: &[]
+                },
+                output.path(),
+                deadline(),
+                &token,
+            )
+            .is_err(),
+        "should reject a cancelled attempt"
+    );
+    assert!(
+        fs::read_dir(output.path())
+            .expect("should list root")
+            .next()
+            .is_none(),
+        "should write nothing for a cancelled attempt"
+    );
+}
diff --git a/crates/trusted-server-release/src/materials/cargo_vendor/tests/source.rs b/crates/trusted-server-release/src/materials/cargo_vendor/tests/source.rs
new file mode 100644
index 0000000000..23b2eeeaef
--- /dev/null
+++ b/crates/trusted-server-release/src/materials/cargo_vendor/tests/source.rs
@@ -0,0 +1,102 @@
+use crate::materials::cargo_vendor::GitSourceConfig;
+use crate::materials::locked::parse_cargo;
+
+/// Selector, derived URL and derived reference of one locked Git source.
+type Case = (
+    &'static str,
+    &'static str,
+    Option<(&'static str, &'static str)>,
+);
+
+#[test]
+fn locked_selectors_map_to_exact_cargo_source_tables() {
+    let cases: [Case; 4] = [
+        (
+            "git+https://example.com/org/repo?tag=v1.2.3",
+            "https://example.com/org/repo",
+            Some(("tag", "v1.2.3")),
+        ),
+        (
+            "git+https://example.com/org/repo?branch=release-1",
+            "https://example.com/org/repo",
+            Some(("branch", "release-1")),
+        ),
+        (
+            "git+https://example.com/org/repo?rev=abc123",
+            "https://example.com/org/repo",
+            Some(("rev", "abc123")),
+        ),
+        (
+            "git+https://example.com:8443/org/repo.git",
+            "https://example.com:8443/org/repo.git",
+            None,
+        ),
+    ];
+    for (selector, url, reference) in cases {
+        let config = GitSourceConfig::parse(selector).expect("should parse the selector");
+        assert_eq!(
+            config.key(),
+            selector,
+            "should keep the exact selector as the key"
+        );
+        assert_eq!(config.url(), url, "should derive the repository URL");
+        assert_eq!(config.reference(), reference, "should derive the reference");
+    }
+    assert_eq!(
+        GitSourceConfig::parse("git+https://example.com/org/repo")
+            .expect("should parse")
+            .reference(),
+        None,
+        "should report the default branch without a reference"
+    );
+}
+
+#[test]
+fn unusual_selectors_are_rejected() {
+    for selector in [
+        "",
+        "https://example.com/org/repo?tag=v1",
+        "git+http://example.com/org/repo?tag=v1",
+        "git+ssh://example.com/org/repo",
+        "git+file:///local/repo",
+        "git+https://",
+        "git+https://example.com/org/repo?tag=",
+        "git+https://example.com/org/repo?tag=a&branch=b",
+        "git+https://example.com/org/repo?tag=a%2Fb",
+        "git+https://example.com/org/repo?tag=a/b",
+        "git+https://example.com/org/repo?unknown=a",
+        "git+https://example.com/org/repo?tag",
+        "git+https://example.com/org/\"repo",
+        "git+https://example.com/org\\repo",
+        "git+https://example.com/org repo",
+        "git+https://example.com/org/repo#abc",
+        "git+https://example.com/org/repo\n",
+        "git+https://example.com/org/%2Frepo",
+    ] {
+        assert!(
+            GitSourceConfig::parse(selector).is_err(),
+            "should reject selector {selector:?}"
+        );
+    }
+}
+
+#[test]
+fn tracked_lockfile_git_packages_all_parse_as_sources() {
+    let lock = std::fs::read(concat!(env!("CARGO_MANIFEST_DIR"), "/../../Cargo.lock"))
+        .expect("should read the tracked Cargo.lock");
+    let materials = parse_cargo(&lock).expect("should parse the tracked lockfile");
+    assert!(
+        !materials.git_packages.is_empty(),
+        "should select a nonzero number of locked Git packages"
+    );
+    for package in &materials.git_packages {
+        let config = GitSourceConfig::parse(&package.selector)
+            .expect("should parse every tracked Git source");
+        assert!(
+            config.reference().is_some(),
+            "should pin {} with a tag, branch or rev",
+            package.name
+        );
+        assert_eq!(package.revision.len(), 40, "should carry a full revision");
+    }
+}
diff --git a/crates/trusted-server-release/src/materials/cargo_vendor/tests/support.rs b/crates/trusted-server-release/src/materials/cargo_vendor/tests/support.rs
new file mode 100644
index 0000000000..23c855137e
--- /dev/null
+++ b/crates/trusted-server-release/src/materials/cargo_vendor/tests/support.rs
@@ -0,0 +1,187 @@
+//! Fictional originals for vendoring tests; nothing here spawns a process.
+
+use std::collections::BTreeMap;
+use std::fs;
+use std::io::Write as _;
+use std::path::{Path, PathBuf};
+use std::time::{Duration, Instant};
+
+use flate2::Compression;
+use flate2::write::{GzEncoder, ZlibEncoder};
+use sha2::{Digest as _, Sha256};
+
+use crate::git_objects::checked_sha1;
+use crate::materials::LockedMaterials;
+use crate::materials::git::VerifiedGitMaterial;
+use crate::materials::locked::{CargoMaterials, GitPackage, RegistryMaterial};
+use crate::process::Cancellation;
+
+pub(super) const SOURCE_COMMIT: &str = "1111111111111111111111111111111111111111";
+pub(super) const LOCK_SHA256: &str =
+    "2222222222222222222222222222222222222222222222222222222222222222";
+pub(super) const SELECTOR: &str = "git+https://example.com/org/workspace?tag=v1";
+
+/// A canonical temporary directory.
+pub(super) fn temporary() -> tempfile::TempDir {
+    let root = fs::canonicalize(std::env::temp_dir()).expect("should resolve temporary parent");
+    tempfile::tempdir_in(root).expect("should create canonical temporary directory")
+}
+
+pub(super) fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(60)
+}
+
+/// Builds a `.crate` archive whose members sit under `<name>-<version>/`.
+pub(super) fn crate_archive(name: &str, version: &str, files: &[(&str, &[u8], u32)]) -> Vec<u8> {
+    let mut builder = tar::Builder::new(GzEncoder::new(Vec::new(), Compression::fast()));
+    for (path, bytes, mode) in files {
+        let mut header = tar::Header::new_ustar();
+        header.set_mode(*mode);
+        header.set_size(bytes.len() as u64);
+        header.set_cksum();
+        builder
+            .append_data(&mut header, format!("{name}-{version}/{path}"), *bytes)
+            .expect("should append fictional member");
+    }
+    builder
+        .into_inner()
+        .expect("should finish fictional TAR")
+        .finish()
+        .expect("should finish fictional gzip")
+}
+
+pub(super) fn manifest(name: &str, version: &str) -> Vec<u8> {
+    format!("[package]\nname = \"{name}\"\nversion = \"{version}\"\nedition = \"2021\"\n")
+        .into_bytes()
+}
+
+/// A standard two-file crate.
+pub(super) fn plain_crate(name: &str, version: &str) -> Vec<u8> {
+    crate_archive(
+        name,
+        version,
+        &[
+            ("Cargo.toml", &manifest(name, version), 0o644),
+            ("src/lib.rs", b"pub fn fictional() {}\n", 0o644),
+            ("build.sh", b"#!/bin/sh\n", 0o755),
+        ],
+    )
+}
+
+/// Lock state for `registry` archives and `git` packages.
+pub(super) fn locked(registry: &[(&str, &str, &[u8])], git: Vec<GitPackage>) -> LockedMaterials {
+    LockedMaterials {
+        source_commit: SOURCE_COMMIT.to_owned(),
+        cargo_lock_sha256: LOCK_SHA256.to_owned(),
+        npm_lock_sha256: "c".repeat(64),
+        cargo: CargoMaterials {
+            registry: registry
+                .iter()
+                .map(|(name, version, bytes)| {
+                    (
+                        ((*name).to_owned(), (*version).to_owned()),
+                        RegistryMaterial {
+                            name: (*name).to_owned(),
+                            version: (*version).to_owned(),
+                            sha256: hex::encode(Sha256::digest(bytes)),
+                        },
+                    )
+                })
+                .collect(),
+            git: git
+                .iter()
+                .map(|package| (package.selector.clone(), package.revision.clone()))
+                .collect(),
+            git_packages: git,
+        },
+        npm: BTreeMap::new(),
+    }
+}
+
+/// Writes registry archives into `directory` and returns them by identity.
+pub(super) fn archives(
+    directory: &Path,
+    entries: &[(&str, &str, &[u8])],
+) -> BTreeMap<(String, String), PathBuf> {
+    entries
+        .iter()
+        .map(|(name, version, bytes)| {
+            let path = directory.join(format!("{name}-{version}.crate"));
+            fs::write(&path, bytes).expect("should write fictional archive");
+            (((*name).to_owned(), (*version).to_owned()), path)
+        })
+        .collect()
+}
+
+pub(super) fn cancellation() -> Cancellation {
+    Cancellation::default()
+}
+
+/// Builds loose Git objects by hand.
+pub(super) struct Objects {
+    pub(super) store: tempfile::TempDir,
+}
+
+impl Objects {
+    pub(super) fn new() -> Self {
+        Self { store: temporary() }
+    }
+
+    pub(super) fn object(&self, kind: &str, bytes: &[u8]) -> String {
+        let header = format!("{kind} {}\0", bytes.len());
+        let oid = checked_sha1(&[header.as_bytes(), bytes]).expect("should hash fixture object");
+        let path = self.store.path().join(&oid[..2]).join(&oid[2..]);
+        fs::create_dir_all(path.parent().expect("should have parent"))
+            .expect("should create object directory");
+        let mut encoder = ZlibEncoder::new(Vec::new(), Compression::default());
+        encoder
+            .write_all(header.as_bytes())
+            .expect("should encode header");
+        encoder.write_all(bytes).expect("should encode body");
+        fs::write(path, encoder.finish().expect("should finish object"))
+            .expect("should write fixture object");
+        oid
+    }
+
+    pub(super) fn blob(&self, bytes: &[u8]) -> String {
+        self.object("blob", bytes)
+    }
+
+    /// Entries are `(mode, name, oid)`; callers list them in Git order.
+    pub(super) fn tree(&self, entries: &[(&str, &str, &str)]) -> String {
+        let mut body = Vec::new();
+        for (mode, name, oid) in entries {
+            body.extend_from_slice(format!("{mode} {name}\0").as_bytes());
+            body.extend(hex::decode(oid).expect("should decode oid"));
+        }
+        self.object("tree", &body)
+    }
+
+    /// Wraps the store as verified material for `selector` at `revision`.
+    pub(super) fn material(
+        self,
+        selector: &str,
+        revision: &str,
+        root_tree: &str,
+    ) -> VerifiedGitMaterial {
+        VerifiedGitMaterial::for_tests(
+            SOURCE_COMMIT,
+            LOCK_SHA256,
+            selector,
+            revision,
+            root_tree,
+            self.store,
+        )
+    }
+}
+
+pub(super) const REVISION: &str = "3333333333333333333333333333333333333333";
+
+pub(super) fn git_package(name: &str, version: &str) -> GitPackage {
+    GitPackage {
+        name: name.to_owned(),
+        version: version.to_owned(),
+        selector: SELECTOR.to_owned(),
+        revision: REVISION.to_owned(),
+    }
+}
diff --git a/crates/trusted-server-release/src/materials/cargo_vendor/writer.rs b/crates/trusted-server-release/src/materials/cargo_vendor/writer.rs
new file mode 100644
index 0000000000..435f0fe49d
--- /dev/null
+++ b/crates/trusted-server-release/src/materials/cargo_vendor/writer.rs
@@ -0,0 +1,160 @@
+//! Writes one Cargo directory-source package and its `.cargo-checksum.json`.
+//!
+//! The file format is the one `cargo vendor` writes and Cargo's directory
+//! source reads: `{"files":{"<path>":"<sha256>"},"package":<sha256|null>}`.
+//! Every listed file is rehashed by Cargo when the package is used; `package`
+//! must equal the `Cargo.lock` checksum for registry crates and is `null` for
+//! Git packages.
+
+use std::collections::BTreeMap;
+use std::fs::{self, DirBuilder, OpenOptions};
+use std::io::Write as _;
+use std::os::unix::fs::{DirBuilderExt as _, OpenOptionsExt as _, PermissionsExt as _};
+use std::path::{Path, PathBuf};
+
+use error_stack::Report;
+use serde::Serialize;
+use sha2::{Digest as _, Sha256};
+
+use crate::error::ReleaseError;
+use crate::materials::material_error;
+
+/// Reserved name Cargo reads the checksums from.
+pub(super) const CHECKSUM_FILE: &str = ".cargo-checksum.json";
+/// Longest accepted package-relative path.
+const PATH_LIMIT: usize = 4096;
+
+#[derive(Serialize)]
+struct Checksum<'a> {
+    files: &'a BTreeMap<String, String>,
+    package: Option<&'a str>,
+}
+
+/// One package directory under the vendor root, being written.
+pub(super) struct PackageWriter {
+    directory: PathBuf,
+    files: BTreeMap<String, String>,
+}
+
+/// Requires a nonempty `/`-separated path of plain components.
+fn check_relative(relative: &str) -> Result<(), Report<ReleaseError>> {
+    let plain = !relative.is_empty()
+        && relative.len() <= PATH_LIMIT
+        && relative.split('/').all(|part| {
+            !part.is_empty()
+                && part != "."
+                && part != ".."
+                && !part.contains(['\\', '\0', ':'])
+                && !part.chars().any(char::is_control)
+        });
+    if !plain || relative == CHECKSUM_FILE {
+        return Err(material_error(format!(
+            "vendored path {relative:?} is unsafe or reserved"
+        )));
+    }
+    Ok(())
+}
+
+impl PackageWriter {
+    /// Creates `vendor/<directory_name>`, which must not exist yet.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Material`] when the directory exists already
+    /// (two locked packages with one name and version) or cannot be created.
+    pub(super) fn create(
+        vendor: &Path,
+        directory_name: &str,
+    ) -> Result<Self, Report<ReleaseError>> {
+        let directory = vendor.join(directory_name);
+        DirBuilder::new()
+            .mode(0o755)
+            .create(&directory)
+            .map_err(|error| {
+                material_error(format!(
+                    "vendor directory {directory_name} cannot be created exclusively: {error}"
+                ))
+            })?;
+        Ok(Self {
+            directory,
+            files: BTreeMap::new(),
+        })
+    }
+
+    /// Writes one file exactly once and records its SHA-256.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Material`] for an unsafe or reserved path, a
+    /// repeated path, or a failed write.
+    pub(super) fn write(
+        &mut self,
+        relative: &str,
+        bytes: &[u8],
+        executable: bool,
+    ) -> Result<(), Report<ReleaseError>> {
+        check_relative(relative)?;
+        if self.files.contains_key(relative) {
+            return Err(material_error(format!(
+                "vendored path {relative} is repeated"
+            )));
+        }
+        let path = self.directory.join(relative);
+        if let Some(parent) = path.parent() {
+            DirBuilder::new()
+                .recursive(true)
+                .mode(0o755)
+                .create(parent)
+                .map_err(material_error)?;
+        }
+        let mode = if executable { 0o755 } else { 0o644 };
+        let mut file = OpenOptions::new()
+            .write(true)
+            .create_new(true)
+            .mode(0o600)
+            .custom_flags(libc::O_NOFOLLOW | libc::O_CLOEXEC)
+            .open(&path)
+            .map_err(material_error)?;
+        file.write_all(bytes).map_err(material_error)?;
+        file.set_permissions(fs::Permissions::from_mode(mode))
+            .map_err(material_error)?;
+        file.sync_all().map_err(material_error)?;
+        self.files
+            .insert(relative.to_owned(), hex::encode(Sha256::digest(bytes)));
+        Ok(())
+    }
+
+    /// Returns the recorded SHA-256 of a written file.
+    pub(super) fn digest_of(&self, relative: &str) -> Option<&str> {
+        self.files.get(relative).map(String::as_str)
+    }
+
+    /// Writes `.cargo-checksum.json` and returns the written file digests.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Material`] when the file cannot be written.
+    pub(super) fn finish(
+        self,
+        package_checksum: Option<&str>,
+    ) -> Result<BTreeMap<String, String>, Report<ReleaseError>> {
+        let body = serde_json::to_vec(&Checksum {
+            files: &self.files,
+            package: package_checksum,
+        })
+        .map_err(material_error)?;
+        let path = self.directory.join(CHECKSUM_FILE);
+        let mut file = OpenOptions::new()
+            .write(true)
+            .create_new(true)
+            .mode(0o600)
+            .custom_flags(libc::O_NOFOLLOW | libc::O_CLOEXEC)
+            .open(&path)
+            .map_err(material_error)?;
+        file.write_all(&body).map_err(material_error)?;
+        file.set_permissions(fs::Permissions::from_mode(0o644))
+            .map_err(material_error)?;
+        file.sync_all().map_err(material_error)?;
+        Ok(self.files)
+    }
+}
diff --git a/crates/trusted-server-release/src/materials/extract.rs b/crates/trusted-server-release/src/materials/extract.rs
new file mode 100644
index 0000000000..debbfc9573
--- /dev/null
+++ b/crates/trusted-server-release/src/materials/extract.rs
@@ -0,0 +1,611 @@
+//! Extracts authenticated originals into fresh private state, without execution.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::fs::{self, File};
+use std::io::{self, BufReader, Read, Seek as _, Write as _};
+use std::os::unix::fs::{OpenOptionsExt as _, PermissionsExt as _};
+use std::path::{Path, PathBuf};
+
+use error_stack::Report;
+use flate2::bufread::GzDecoder;
+use sha2::{Digest as _, Sha256};
+use tempfile::TempDir;
+
+use super::{VerifiedOriginal, material_error};
+use crate::documents::{Role, hash_bounded_with_check, read_bounded};
+use crate::error::ReleaseError;
+
+#[derive(Clone, Copy)]
+pub(super) struct Selection<'a> {
+    pub(super) root: &'a str,
+    pub(super) index_alias: bool,
+    pub(super) node_tar_timestamps: bool,
+    pub(super) local_pax: bool,
+    /// Accepts the two encodings `cargo package` itself writes into `.crate`
+    /// archives: a GNU long-name record before a member whose path exceeds
+    /// the 100-byte header field, and (in older Cargo releases) the regular
+    /// file or directory type bits inside the mode field.
+    pub(super) cargo_package: bool,
+}
+
+mod compatibility;
+
+const DECODED_LIMIT: u64 = 512 * 1024 * 1024;
+// The approved npm lock includes a 110,275,248-byte optional native member.
+// Keep the compressed-original and total decoded limits independent.
+const MEMBER_LIMIT: u64 = 128 * 1024 * 1024;
+const ENTRY_LIMIT: usize = 100_000;
+const DEPTH_LIMIT: usize = 64;
+const PATH_LIMIT: usize = 4096;
+
+#[derive(PartialEq, Eq)]
+struct MemberFacts {
+    size: u64,
+    mode: u32,
+    sha256: String,
+}
+
+/// A privately extracted original, without installation or execution authority.
+pub(crate) struct ExtractedOriginal {
+    original: VerifiedOriginal,
+    directory: TempDir,
+    root: PathBuf,
+    files: BTreeMap<String, MemberFacts>,
+    root_name: String,
+    directories: BTreeSet<String>,
+}
+
+impl ExtractedOriginal {
+    /// Returns a rechecked regular member's original digest, length and mode.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the tree changed or the member was not recorded.
+    pub(super) fn member_facts(
+        &self,
+        relative: &str,
+    ) -> Result<(String, u64, u32), Report<ReleaseError>> {
+        self.verify_unchanged()?;
+        let facts = self
+            .files
+            .get(&format!("{}/{relative}", self.root_name))
+            .ok_or_else(|| {
+                material_error("required native tool is not an authenticated archive member")
+            })?;
+        Ok((facts.sha256.clone(), facts.size, facts.mode))
+    }
+    /// Rejoins the entire private extraction before it is consumed again.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for a changed, missing or added member, unsafe type,
+    /// changed executable mode, or an expired attempt.
+    pub(crate) fn verify_unchanged(&self) -> Result<(), Report<ReleaseError>> {
+        self.original.check()?;
+        let mut remaining: BTreeSet<_> = self.files.keys().cloned().collect();
+        let mut remaining_directories = self.directories.clone();
+        let mut pending = vec![self.root_name.clone()];
+        while let Some(directory) = pending.pop() {
+            self.original.check()?;
+            let metadata = fs::symlink_metadata(self.directory.path().join(&directory))
+                .map_err(material_error)?;
+            if !metadata.is_dir() {
+                return Err(material_error(
+                    "extracted directory changed type or became an alias",
+                ));
+            }
+            remaining_directories.remove(&directory);
+            let entries =
+                fs::read_dir(self.directory.path().join(&directory)).map_err(material_error)?;
+            for entry in entries {
+                self.original.check()?;
+                let entry = entry.map_err(material_error)?;
+                let name = entry
+                    .file_name()
+                    .into_string()
+                    .map_err(|_| material_error("extracted member is not UTF-8"))?;
+                let key = format!("{directory}/{name}");
+                let metadata = fs::symlink_metadata(entry.path()).map_err(material_error)?;
+                if metadata.is_dir() {
+                    if !self.directories.contains(&key) {
+                        return Err(material_error("unrecorded extracted directory appeared"));
+                    }
+                    pending.push(key);
+                } else {
+                    let expected = self
+                        .files
+                        .get(&key)
+                        .ok_or_else(|| material_error("unrecorded extracted member appeared"))?;
+                    if !metadata.is_file()
+                        || metadata.len() != expected.size
+                        || metadata.permissions().mode() & 0o7777 != 0o600 | (expected.mode & 0o111)
+                    {
+                        return Err(material_error(
+                            "extracted member type, size or permissions changed",
+                        ));
+                    }
+                    let raw = hash_bounded_with_check(&entry.path(), MEMBER_LIMIT, &|| {
+                        self.original.check()
+                    })?;
+                    if raw.sha256 != expected.sha256
+                        || raw.size != expected.size
+                        || raw.mode & 0o7777 != 0o600 | (expected.mode & 0o111)
+                    {
+                        return Err(material_error("extracted member bytes changed"));
+                    }
+                    remaining.remove(&key);
+                }
+            }
+        }
+        if !remaining.is_empty() || !remaining_directories.is_empty() {
+            return Err(material_error("recorded extracted member is missing"));
+        }
+        self.original.check()
+    }
+
+    /// Copies only the retained authenticated compressed original.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the retained original changed or the copy fails.
+    pub(super) fn copy_original(
+        &mut self,
+        destination: &mut impl io::Write,
+    ) -> Result<(), Report<ReleaseError>> {
+        self.original.copy_verified(destination)
+    }
+    /// Returns the locked acquisition identity supplying this extracted tree.
+    pub(super) fn identity(&self) -> &str {
+        self.original.identity()
+    }
+
+    /// Reads a bounded manifest input and rejoins its extraction-time digest.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for an unrecorded, changed, linked or oversized input,
+    /// or when the original's deadline/cancellation boundary has expired.
+    pub(super) fn read_member_checked(
+        &self,
+        relative: &str,
+    ) -> Result<Vec<u8>, Report<ReleaseError>> {
+        self.original.check()?;
+        let key = format!("{}/{relative}", self.root_name);
+        let expected = self
+            .files
+            .get(&key)
+            .ok_or_else(|| material_error("manifest input is not a recorded archive member"))?;
+        let raw = read_bounded(&self.root.join(relative), Role::Metadata)?;
+        if raw.sha256 != expected.sha256 || raw.bytes.len() as u64 != expected.size {
+            return Err(material_error("extracted manifest input changed"));
+        }
+        self.original.check()?;
+        Ok(raw.bytes)
+    }
+
+    /// Checks recorded manifest-input presence without allowing a later omission.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the selected original input was removed or changed,
+    /// an unrecorded input appeared, or the attempt expired.
+    pub(super) fn contains_member_checked(
+        &self,
+        relative: &str,
+    ) -> Result<bool, Report<ReleaseError>> {
+        self.original.check()?;
+        let key = format!("{}/{relative}", self.root_name);
+        if self.files.contains_key(&key) {
+            self.read_member_checked(relative)?;
+            return Ok(true);
+        }
+        match fs::symlink_metadata(self.root.join(relative)) {
+            Err(error) if error.kind() == io::ErrorKind::NotFound => Ok(false),
+            _ => Err(material_error(
+                "unrecorded or invalid manifest input appeared",
+            )),
+        }
+    }
+    /// Returns the privately owned package root for later preparation checks.
+    pub(crate) fn root(&self) -> &Path {
+        &self.root
+    }
+
+    /// Returns the approved source identity of the retained original.
+    pub(crate) fn source_commit(&self) -> &str {
+        self.original.source_commit()
+    }
+}
+
+/// Checks cancellation and decoded expansion on every bounded read.
+struct Decoded<'a, R> {
+    reader: R,
+    original: &'a VerifiedOriginal,
+    count: u64,
+}
+
+impl<R: Read> Read for Decoded<'_, R> {
+    fn read(&mut self, bytes: &mut [u8]) -> io::Result<usize> {
+        self.original
+            .check()
+            .map_err(|_| io::Error::other("archive cancelled or timed out"))?;
+        let maximum = bytes.len().min(64 * 1024);
+        let count = self.reader.read(&mut bytes[..maximum])?;
+        self.count += count as u64;
+        if self.count > DECODED_LIMIT {
+            return Err(io::Error::other("archive exceeds decoded byte limit"));
+        }
+        Ok(count)
+    }
+}
+
+fn field(bytes: &[u8]) -> Result<&str, Report<ReleaseError>> {
+    let end = bytes
+        .iter()
+        .position(|byte| *byte == 0)
+        .unwrap_or(bytes.len());
+    if bytes[end..].iter().any(|byte| *byte != 0) {
+        return Err(material_error(
+            "TAR name has hidden bytes after its terminator",
+        ));
+    }
+    std::str::from_utf8(&bytes[..end]).map_err(material_error)
+}
+
+/// Uses raw fields because [`tar::Entry::path_bytes`] normalizes backslashes.
+fn raw_name(
+    header: &tar::Header,
+    selection: &Selection<'_>,
+) -> Result<String, Report<ReleaseError>> {
+    let name = field(&header.as_old().name)?;
+    match header.as_ustar() {
+        Some(ustar) => {
+            let prefix =
+                if selection.node_tar_timestamps && ustar.prefix.iter().any(|byte| *byte != 0) {
+                    compatibility::timestamp_prefix(header)?
+                } else {
+                    field(&ustar.prefix)?
+                };
+            Ok(if prefix.is_empty() {
+                name.to_owned()
+            } else {
+                format!("{prefix}/{name}")
+            })
+        }
+        None => Ok(name.to_owned()),
+    }
+}
+
+fn member_name(
+    raw: &str,
+    directory: bool,
+    selection: &Selection<'_>,
+) -> Result<String, Report<ReleaseError>> {
+    if raw.is_empty()
+        || raw.len() > PATH_LIMIT
+        || !raw.is_ascii()
+        || raw
+            .bytes()
+            .any(|byte| byte.is_ascii_control() || matches!(byte, b'\\' | b':'))
+    {
+        return Err(material_error("TAR path is not a bounded portable name"));
+    }
+    let name = if directory {
+        raw.strip_suffix('/').unwrap_or(raw)
+    } else {
+        raw
+    };
+    let name = if !directory && selection.index_alias && name == "package/./dist/index.js" {
+        "package/dist/index.js"
+    } else {
+        name
+    };
+    let parts: Vec<&str> = name.split('/').collect();
+    if parts.len() > DEPTH_LIMIT
+        || parts
+            .iter()
+            .any(|part| part.is_empty() || *part == "." || *part == "..")
+        || parts[0] != selection.root
+        || (!directory && parts.len() == 1)
+    {
+        return Err(material_error("TAR path leaves its exact locked root"));
+    }
+    Ok(name.to_owned())
+}
+
+struct State {
+    directory: TempDir,
+    spellings: BTreeSet<String>,
+    portable: BTreeMap<String, String>,
+    files: BTreeMap<String, MemberFacts>,
+    first_spelling: BTreeMap<String, String>,
+    directories: BTreeSet<String>,
+}
+
+impl State {
+    fn portable_name(&mut self, name: &str) -> Result<(), Report<ReleaseError>> {
+        let mut prefix = String::new();
+        for part in name.split('/') {
+            if !prefix.is_empty() {
+                prefix.push('/');
+            }
+            prefix.push_str(part);
+            let lower = prefix.to_ascii_lowercase();
+            if let Some(previous) = self.portable.insert(lower, prefix.clone())
+                && previous != prefix
+            {
+                return Err(material_error("TAR has case-aliased paths"));
+            }
+        }
+        Ok(())
+    }
+
+    fn entry<R: Read>(
+        &mut self,
+        mut entry: tar::Entry<'_, R>,
+        selection: &Selection<'_>,
+        long_name: Option<String>,
+    ) -> Result<(), Report<ReleaseError>> {
+        let header = entry.header();
+        let directory = header.entry_type().is_dir();
+        if !directory && !header.entry_type().is_file() {
+            return Err(material_error(
+                "TAR member is not a regular file or directory",
+            ));
+        }
+        let raw = match long_name {
+            Some(long) => compatibility::join_long_name(long, &raw_name(header, selection)?)?,
+            None => raw_name(header, selection)?,
+        };
+        let name = member_name(&raw, directory, selection)?;
+        if !self.spellings.insert(raw.clone()) {
+            return Err(material_error("TAR repeats a member spelling"));
+        }
+        self.portable_name(&name)?;
+        let mode = header.mode().map_err(material_error)?;
+        let mode = if selection.cargo_package {
+            compatibility::strip_member_type(mode, directory)?
+        } else {
+            mode
+        };
+        let size = entry.size();
+        if mode & !0o777 != 0 || (directory && size != 0) {
+            return Err(material_error(format!(
+                "TAR member `{name}` has privileged mode {mode:o} or invalid size {size}",
+            )));
+        }
+        if size > MEMBER_LIMIT {
+            return Err(material_error(format!(
+                "TAR member `{name}` size {size} exceeds member byte limit {MEMBER_LIMIT}",
+            )));
+        }
+        let path = self.directory.path().join(&name);
+        if directory {
+            if !self.directories.insert(name) {
+                return Err(material_error("TAR repeats a directory path"));
+            }
+            fs::create_dir_all(&path).map_err(material_error)?;
+            return Ok(());
+        }
+        let duplicate = self.files.contains_key(&name);
+        if duplicate
+            && !(selection.index_alias
+                && name == "package/dist/index.js"
+                && matches!(
+                    (
+                        self.first_spelling.get(&name).map(String::as_str),
+                        raw.as_str()
+                    ),
+                    (Some("package/./dist/index.js"), "package/dist/index.js")
+                        | (Some("package/dist/index.js"), "package/./dist/index.js")
+                ))
+        {
+            return Err(material_error("TAR has an unreviewed duplicate path"));
+        }
+        let mut file = if duplicate {
+            None
+        } else {
+            fs::create_dir_all(
+                path.parent()
+                    .ok_or_else(|| material_error("member has no parent"))?,
+            )
+            .map_err(material_error)?;
+            Some(
+                File::options()
+                    .write(true)
+                    .create_new(true)
+                    .mode(0o600)
+                    .open(&path)
+                    .map_err(material_error)?,
+            )
+        };
+        let mut hasher = Sha256::new();
+        let mut count = 0_u64;
+        let mut buffer = [0_u8; 64 * 1024];
+        loop {
+            let read = entry.read(&mut buffer).map_err(material_error)?;
+            if read == 0 {
+                break;
+            }
+            count += read as u64;
+            if count > size {
+                return Err(material_error("TAR member exceeds declared size"));
+            }
+            hasher.update(&buffer[..read]);
+            if let Some(file) = &mut file {
+                file.write_all(&buffer[..read]).map_err(material_error)?;
+            }
+        }
+        if count != size {
+            return Err(material_error("TAR member is truncated"));
+        }
+        let facts = MemberFacts {
+            size,
+            mode,
+            sha256: hex::encode(hasher.finalize()),
+        };
+        if duplicate {
+            if self.files.get(&name) != Some(&facts) {
+                return Err(material_error("reviewed TAR aliases differ"));
+            }
+        } else {
+            // Only executable bits carry across; ownership and ambient write access do not.
+            file.as_ref()
+                .expect("should have exclusively created member")
+                .set_permissions(fs::Permissions::from_mode(0o600 | (mode & 0o111)))
+                .map_err(material_error)?;
+            self.first_spelling.insert(name.clone(), raw);
+            self.files.insert(name, facts);
+        }
+        Ok(())
+    }
+}
+
+pub(super) fn extract(
+    original: VerifiedOriginal,
+    selection: Selection<'_>,
+) -> Result<ExtractedOriginal, Report<ReleaseError>> {
+    extract_bounded(original, selection, ENTRY_LIMIT)
+}
+
+fn extract_bounded(
+    mut original: VerifiedOriginal,
+    selection: Selection<'_>,
+    entry_limit: usize,
+) -> Result<ExtractedOriginal, Report<ReleaseError>> {
+    let mut compressed = tempfile::tempfile().map_err(material_error)?;
+    original.copy_verified(&mut compressed)?;
+    compressed.rewind().map_err(material_error)?;
+    let decoder = GzDecoder::new(BufReader::new(compressed));
+    let decoded = Decoded {
+        reader: decoder,
+        original: &original,
+        count: 0,
+    };
+    let mut archive = tar::Archive::new(decoded);
+    let mut state = State {
+        directory: tempfile::tempdir().map_err(material_error)?,
+        spellings: BTreeSet::new(),
+        portable: BTreeMap::new(),
+        files: BTreeMap::new(),
+        first_spelling: BTreeMap::new(),
+        directories: BTreeSet::new(),
+    };
+    let mut pending_pax: Option<compatibility::LocalPax> = None;
+    let mut pending_long: Option<String> = None;
+    for (index, entry) in archive
+        .entries()
+        .map_err(material_error)?
+        .raw(true)
+        .enumerate()
+    {
+        if index >= entry_limit {
+            return Err(material_error("TAR exceeds entry count limit"));
+        }
+        let mut entry = entry.map_err(material_error)?;
+        if entry.header().entry_type().is_gnu_longname() {
+            if !selection.cargo_package || pending_long.is_some() || pending_pax.is_some() {
+                return Err(material_error(
+                    "unreviewed, consecutive or mixed GNU long-name record",
+                ));
+            }
+            pending_long = Some(compatibility::read_long_name(&mut entry, PATH_LIMIT)?);
+            continue;
+        }
+        if entry.header().entry_type().as_byte() == b'x' {
+            if pending_long.is_some() {
+                return Err(material_error(
+                    "GNU long-name record must immediately precede its member",
+                ));
+            }
+            if !selection.local_pax || pending_pax.is_some() || entry.size() > 64 * 1024 {
+                return Err(material_error(
+                    "unreviewed, consecutive or oversized local PAX header",
+                ));
+            }
+            let mut bytes = Vec::new();
+            entry.read_to_end(&mut bytes).map_err(material_error)?;
+            let pax = compatibility::parse_pax(&bytes)?;
+            if raw_name(entry.header(), &selection)? != pax.header_name()
+                || entry.header().mode().map_err(material_error)? & !0o777 != 0
+                || !field(&entry.header().as_old().linkname)?.is_empty()
+            {
+                return Err(material_error("unsafe reviewed local PAX header"));
+            }
+            pending_pax = Some(pax);
+            continue;
+        }
+        if let Some(pax) = pending_pax.take() {
+            if !entry.header().entry_type().is_file() {
+                return Err(material_error(
+                    "local PAX must immediately precede a regular file",
+                ));
+            }
+            pax.join(
+                &raw_name(entry.header(), &selection)?,
+                entry.header().size().map_err(material_error)?,
+            )?;
+        }
+        state.entry(entry, &selection, pending_long.take())?;
+    }
+    if pending_pax.is_some() {
+        return Err(material_error("dangling local PAX header"));
+    }
+    if pending_long.is_some() {
+        return Err(material_error("dangling GNU long-name record"));
+    }
+    if state.spellings.contains("package/./dist/index.js")
+        && !state.spellings.contains("package/dist/index.js")
+    {
+        return Err(material_error(
+            "reviewed dot alias lacks its canonical partner",
+        ));
+    }
+    // The parser consumed the first zero header. Require at least the second,
+    // then only complete zero blocks through the checked gzip trailer.
+    let mut decoded = archive.into_inner();
+    let mut tail = 0_u64;
+    let mut buffer = [0_u8; 64 * 1024];
+    loop {
+        let count = decoded.read(&mut buffer).map_err(material_error)?;
+        if count == 0 {
+            break;
+        }
+        tail += count as u64;
+        if buffer[..count].iter().any(|byte| *byte != 0) {
+            return Err(material_error("TAR hides data after its terminator"));
+        }
+    }
+    if tail < 512 || !tail.is_multiple_of(512) {
+        return Err(material_error("TAR lacks complete terminator blocks"));
+    }
+    let mut compressed = decoded.reader.into_inner();
+    if compressed.read(&mut buffer[..1]).map_err(material_error)? != 0 {
+        return Err(material_error(
+            "gzip has additional members or trailing bytes",
+        ));
+    }
+    original.check()?;
+    let root = state.directory.path().join(selection.root);
+    if !root.is_dir() || state.files.is_empty() {
+        return Err(material_error("archive has no package files"));
+    }
+    for file in state.files.keys() {
+        let mut current = file.as_str();
+        while let Some((parent, _)) = current.rsplit_once('/') {
+            state.directories.insert(parent.to_owned());
+            current = parent;
+        }
+    }
+    Ok(ExtractedOriginal {
+        root_name: selection.root.to_owned(),
+        original,
+        root,
+        directory: state.directory,
+        files: state.files,
+        directories: state.directories,
+    })
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/trusted-server-release/src/materials/extract/compatibility.rs b/crates/trusted-server-release/src/materials/extract/compatibility.rs
new file mode 100644
index 0000000000..f4dc546d09
--- /dev/null
+++ b/crates/trusted-server-release/src/materials/extract/compatibility.rs
@@ -0,0 +1,219 @@
+//! Closed compatibility for authenticated, exact-version npm originals and
+//! for the encodings `cargo package` writes into registry crates.
+use super::{field, material_error};
+use crate::error::ReleaseError;
+use error_stack::Report;
+use std::collections::BTreeMap;
+
+pub(super) fn timestamp_prefix(header: &tar::Header) -> Result<&str, Report<ReleaseError>> {
+    let bytes = header.as_bytes();
+    if &bytes[257..265] != b"ustar\x0000"
+        || bytes[345..476].iter().any(|byte| *byte != 0)
+        || bytes[500..].iter().any(|byte| *byte != 0)
+        || [476, 488].iter().any(|start| {
+            bytes[*start..*start + 11]
+                .iter()
+                .any(|byte| !matches!(byte, b'0'..=b'7'))
+                || bytes[*start + 11] != 0
+        })
+    {
+        return Err(material_error("invalid reviewed node-tar timestamp layout"));
+    }
+    field(&bytes[345..475])
+}
+
+pub(super) struct LocalPax {
+    path: String,
+    size: u64,
+}
+impl LocalPax {
+    pub(super) fn header_name(&self) -> String {
+        format!("PaxHeader/{}", self.path)
+    }
+    pub(super) fn join(&self, path: &str, size: u64) -> Result<(), Report<ReleaseError>> {
+        if self.path != path || self.size != size {
+            return Err(material_error(
+                "local PAX path or size would override raw member",
+            ));
+        }
+        Ok(())
+    }
+}
+const KEYS: &[&str] = &[
+    "NODETAR.blksize",
+    "NODETAR.blocks",
+    "NODETAR.depth",
+    "NODETAR.follow",
+    "NODETAR.ignoreFiles.0",
+    "NODETAR.ignoreFiles.1",
+    "NODETAR.ignoreFiles.2",
+    "NODETAR.package.author.email",
+    "NODETAR.package.author.name",
+    "NODETAR.package.author.url",
+    "NODETAR.package.contributors.0.email",
+    "NODETAR.package.contributors.0.name",
+    "NODETAR.package.contributors.0.url",
+    "NODETAR.package.dependencies.consolidate",
+    "NODETAR.package.dependencies.es6-promise",
+    "NODETAR.package.dependencies.fs-readfile-promise",
+    "NODETAR.package.dependencies.js-yaml",
+    "NODETAR.package.dependencies.lodash",
+    "NODETAR.package.dependencies.node.extend",
+    "NODETAR.package.dependencies.plugin-error",
+    "NODETAR.package.dependencies.through2",
+    "NODETAR.package.dependencies.tryit",
+    "NODETAR.package.dependencies.vinyl-bufferstream",
+    "NODETAR.package.description",
+    "NODETAR.package.devDependencies.eslint",
+    "NODETAR.package.devDependencies.expect.js",
+    "NODETAR.package.devDependencies.istanbul",
+    "NODETAR.package.devDependencies.istanbul-coveralls",
+    "NODETAR.package.devDependencies.jscs",
+    "NODETAR.package.devDependencies.mocha",
+    "NODETAR.package.devDependencies.simple-bufferstream",
+    "NODETAR.package.devDependencies.vinyl",
+    "NODETAR.package.engines.node",
+    "NODETAR.package.engines.npm",
+    "NODETAR.package.files.0",
+    "NODETAR.package.jscsConfig.maximumLineLength",
+    "NODETAR.package.jscsConfig.preset",
+    "NODETAR.package.jscsConfig.requireBlocksOnNewline",
+    "NODETAR.package.jscsConfig.validateLineBreaks",
+    "NODETAR.package.keywords.0",
+    "NODETAR.package.keywords.1",
+    "NODETAR.package.keywords.2",
+    "NODETAR.package.keywords.3",
+    "NODETAR.package.keywords.4",
+    "NODETAR.package.keywords.5",
+    "NODETAR.package.licenses.0.type",
+    "NODETAR.package.licenses.0.url",
+    "NODETAR.package.name",
+    "NODETAR.package.repository",
+    "NODETAR.package.scripts.coverage",
+    "NODETAR.package.scripts.coveralls",
+    "NODETAR.package.scripts.pretest",
+    "NODETAR.package.scripts.test",
+    "NODETAR.package.version",
+    "NODETAR.type",
+    "SCHILY.dev",
+    "SCHILY.ino",
+    "SCHILY.nlink",
+    "gid",
+    "path",
+    "size",
+    "uid",
+];
+pub(super) fn parse_pax(mut bytes: &[u8]) -> Result<LocalPax, Report<ReleaseError>> {
+    let mut values = BTreeMap::new();
+    while !bytes.is_empty() {
+        let space = bytes
+            .iter()
+            .position(|byte| *byte == b' ')
+            .ok_or_else(|| material_error("invalid PAX length framing"))?;
+        let digits = std::str::from_utf8(&bytes[..space]).map_err(material_error)?;
+        if digits.is_empty()
+            || digits.starts_with('0')
+            || !digits.bytes().all(|byte| byte.is_ascii_digit())
+        {
+            return Err(material_error("noncanonical PAX length"));
+        }
+        let length = digits.parse::<usize>().map_err(material_error)?;
+        if length <= space + 2 || length > bytes.len() || bytes[length - 1] != b'\n' {
+            return Err(material_error("invalid PAX record length"));
+        }
+        let record = std::str::from_utf8(&bytes[space + 1..length - 1]).map_err(material_error)?;
+        let (key, value) = record
+            .split_once('=')
+            .ok_or_else(|| material_error("invalid PAX assignment"))?;
+        if !KEYS.contains(&key)
+            || value.contains(['\0', '\n', '\r'])
+            || values.insert(key, value).is_some()
+        {
+            return Err(material_error("unknown or repeated PAX metadata field"));
+        }
+        bytes = &bytes[length..];
+    }
+    let path = values
+        .get("path")
+        .ok_or_else(|| material_error("PAX lacks path"))?
+        .to_string();
+    let size = values
+        .get("size")
+        .ok_or_else(|| material_error("PAX lacks size"))?;
+    if size.is_empty()
+        || (size.len() > 1 && size.starts_with('0'))
+        || !size.bytes().all(|byte| byte.is_ascii_digit())
+        || values.get("NODETAR.type") != Some(&"File")
+    {
+        return Err(material_error("invalid PAX size or member type"));
+    }
+    Ok(LocalPax {
+        path,
+        size: size.parse().map_err(material_error)?,
+    })
+}
+
+/// Name field width of a TAR header.
+const HEADER_NAME_WIDTH: usize = 100;
+/// Name `cargo package` gives every GNU long-name record.
+const LONG_NAME_RECORD: &str = "././@LongLink";
+/// File-type bits of a mode field.
+const TYPE_BITS: u32 = 0o170_000;
+
+/// Reads one GNU long-name record as `cargo package` writes it: named
+/// `././@LongLink`, with a plain regular-file mode and no link target, holding
+/// at most `limit` path bytes followed by exactly one NUL.
+pub(super) fn read_long_name<R: std::io::Read>(
+    entry: &mut tar::Entry<'_, R>,
+    limit: usize,
+) -> Result<String, Report<ReleaseError>> {
+    let header = entry.header();
+    let mode = strip_member_type(header.mode().map_err(material_error)?, false)?;
+    if field(&header.as_old().name)? != LONG_NAME_RECORD
+        || !field(&header.as_old().linkname)?.is_empty()
+        || mode & !0o777 != 0
+    {
+        return Err(material_error("unreviewed GNU long-name record header"));
+    }
+    let size = entry.size();
+    if size < 2 || size > limit as u64 + 1 {
+        return Err(material_error("GNU long-name record has an invalid size"));
+    }
+    let mut bytes = Vec::new();
+    std::io::Read::read_to_end(entry, &mut bytes).map_err(material_error)?;
+    let name = bytes
+        .strip_suffix(b"\0")
+        .filter(|name| bytes.len() as u64 == size && !name.contains(&0))
+        .ok_or_else(|| material_error("GNU long name is not one NUL-terminated path"))?;
+    String::from_utf8(name.to_vec()).map_err(material_error)
+}
+
+/// Joins a long name with the member header it describes.
+///
+/// The header must hold exactly the first 100 bytes of the long name, so a
+/// record can only lengthen the member it precedes, never rename it.
+pub(super) fn join_long_name(
+    long: String,
+    header_name: &str,
+) -> Result<String, Report<ReleaseError>> {
+    let consistent = long.len() > HEADER_NAME_WIDTH
+        && header_name.len() == HEADER_NAME_WIDTH
+        && long.as_bytes().starts_with(header_name.as_bytes());
+    if !consistent {
+        return Err(material_error(
+            "GNU long name does not extend its member's header name",
+        ));
+    }
+    Ok(long)
+}
+
+/// Removes the regular-file or directory type bits older `cargo package`
+/// releases left in the mode field; any other type is rejected.
+pub(super) fn strip_member_type(mode: u32, directory: bool) -> Result<u32, Report<ReleaseError>> {
+    let expected = if directory { 0o040_000 } else { 0o100_000 };
+    match mode & TYPE_BITS {
+        0 => Ok(mode),
+        kind if kind == expected => Ok(mode & !TYPE_BITS),
+        _ => Err(material_error("TAR member mode names another file type")),
+    }
+}
diff --git a/crates/trusted-server-release/src/materials/extract/tests.rs b/crates/trusted-server-release/src/materials/extract/tests.rs
new file mode 100644
index 0000000000..15a4db8386
--- /dev/null
+++ b/crates/trusted-server-release/src/materials/extract/tests.rs
@@ -0,0 +1,667 @@
+use std::fs;
+use std::io;
+use std::time::{Duration, Instant};
+
+use base64::{Engine as _, engine::general_purpose::STANDARD};
+use flate2::{Compression, write::GzEncoder};
+use serde_json::json;
+use sha2::{Sha256, Sha512};
+
+use super::*;
+use crate::materials::archive::{Expected, verify};
+use crate::materials::{LockedMaterials, locked};
+use crate::process::Cancellation;
+
+fn compressed(tar: &[u8]) -> Vec<u8> {
+    let mut encoder = GzEncoder::new(Vec::new(), Compression::default());
+    encoder.write_all(tar).expect("should compress TAR bytes");
+    encoder.finish().expect("should finish gzip trailer")
+}
+
+fn tar_bytes(entries: &[(&str, u8, u32, &[u8])]) -> Vec<u8> {
+    let mut builder = tar::Builder::new(Vec::new());
+    for (name, kind, mode, bytes) in entries {
+        let mut header = tar::Header::new_ustar();
+        header.set_entry_type(tar::EntryType::new(*kind));
+        header.set_mode(*mode);
+        header.set_size(bytes.len() as u64);
+        if name.len() <= 100 {
+            header.as_mut_bytes()[..name.len()].copy_from_slice(name.as_bytes());
+        } else {
+            let (prefix, leaf) = name
+                .rsplit_once('/')
+                .expect("should split long fixture name");
+            let ustar = header.as_ustar_mut().expect("should have USTAR header");
+            ustar.prefix[..prefix.len()].copy_from_slice(prefix.as_bytes());
+            ustar.name[..leaf.len()].copy_from_slice(leaf.as_bytes());
+        }
+        header.set_cksum();
+        builder
+            .append(&header, *bytes)
+            .expect("should append fixture entry");
+    }
+    builder.into_inner().expect("should finish TAR")
+}
+
+fn original(bytes: &[u8]) -> VerifiedOriginal {
+    original_with_timeout(bytes, Duration::from_secs(10))
+}
+
+fn original_with_timeout(bytes: &[u8], timeout: Duration) -> VerifiedOriginal {
+    let directory = tempfile::tempdir().expect("should create archive directory");
+    let path = directory.path().join("original.tgz");
+    fs::write(&path, bytes).expect("should write archive");
+    verify(
+        &path,
+        Expected::Sha256(&hex::encode(Sha256::digest(bytes))),
+        &"a".repeat(40),
+        "npm:node_modules/fictional-package",
+        Instant::now() + timeout,
+        &Cancellation::default(),
+    )
+    .expect("should verify original bytes")
+}
+
+#[test]
+fn extracts_verified_regular_files_and_preserves_original_bytes() {
+    let bytes = compressed(&tar_bytes(&[(
+        "package/bin/tool",
+        b'0',
+        0o755,
+        b"fictional executable",
+    )]));
+    let extracted = extract(
+        original(&bytes),
+        Selection {
+            root: "package",
+            index_alias: false,
+            node_tar_timestamps: false,
+            local_pax: false,
+            cargo_package: false,
+        },
+    )
+    .expect("should extract verified regular file");
+    assert_eq!(
+        fs::read(extracted.directory.path().join("package/bin/tool")).expect("should read file"),
+        b"fictional executable",
+        "should retain exact member bytes"
+    );
+    let mut retained = Vec::new();
+    let mut original = extracted.original;
+    original
+        .copy_verified(&mut retained)
+        .expect("should retain authenticated compressed original");
+    assert_eq!(retained, bytes, "should preserve exact compressed bytes");
+}
+
+#[test]
+fn accepts_bounded_native_members_above_64_mib() {
+    let size = 64 * 1024 * 1024 + 1;
+    let encoder = GzEncoder::new(Vec::new(), Compression::fast());
+    let mut builder = tar::Builder::new(encoder);
+    let mut header = tar::Header::new_ustar();
+    header.set_mode(0o644);
+    header.set_size(size);
+    header.set_cksum();
+    builder
+        .append_data(&mut header, "package/native.node", io::repeat(0).take(size))
+        .expect("should stream a bounded large native member");
+    let bytes = builder
+        .into_inner()
+        .expect("should finish native fixture TAR")
+        .finish()
+        .expect("should finish native fixture gzip");
+    let extracted = extract(
+        original_with_timeout(&bytes, Duration::from_secs(60)),
+        Selection {
+            root: "package",
+            index_alias: false,
+            node_tar_timestamps: false,
+            local_pax: false,
+            cargo_package: false,
+        },
+    )
+    .expect("should support authenticated native members larger than 64 MiB");
+    assert_eq!(
+        fs::metadata(extracted.root().join("native.node"))
+            .expect("should inspect native member")
+            .len(),
+        size,
+        "should retain every original native byte"
+    );
+    extracted
+        .verify_unchanged()
+        .expect("should stream recheck the entire large native member");
+}
+
+#[test]
+fn rejects_unsafe_paths_types_modes_duplicates_and_collisions() {
+    for entries in [
+        vec![("other/file", b'0', 0o644, b"x".as_slice())],
+        vec![("package/../file", b'0', 0o644, b"x".as_slice())],
+        vec![("package/./file", b'0', 0o644, b"x".as_slice())],
+        vec![("package\\file", b'0', 0o644, b"x".as_slice())],
+        vec![("/package/file", b'0', 0o644, b"x".as_slice())],
+        vec![("package/file", b'0', 0o4644, b"x".as_slice())],
+        vec![("package/file", b'2', 0o644, b"".as_slice())],
+        vec![("package/file", b'1', 0o644, b"".as_slice())],
+        vec![("package/file", b'6', 0o644, b"".as_slice())],
+        vec![("package/file", b'x', 0o644, b"x".as_slice())],
+        vec![
+            ("package/file", b'0', 0o644, b"x".as_slice()),
+            ("package/file", b'0', 0o644, b"x".as_slice()),
+        ],
+        vec![
+            ("package/file", b'0', 0o644, b"x".as_slice()),
+            ("package/file/child", b'0', 0o644, b"x".as_slice()),
+        ],
+        vec![
+            ("package/File", b'0', 0o644, b"x".as_slice()),
+            ("package/file", b'0', 0o644, b"x".as_slice()),
+        ],
+        vec![
+            ("package/", b'5', 0o755, b"".as_slice()),
+            ("package", b'5', 0o755, b"".as_slice()),
+            ("package/file", b'0', 0o644, b"x".as_slice()),
+        ],
+    ] {
+        assert!(
+            extract(
+                original(&compressed(&tar_bytes(&entries))),
+                Selection {
+                    root: "package",
+                    index_alias: false,
+                    node_tar_timestamps: false,
+                    local_pax: false,
+                    cargo_package: false,
+                }
+            )
+            .is_err(),
+            "should reject unsafe member set"
+        );
+    }
+}
+
+#[test]
+fn rejects_excessive_depth_member_size_and_cancelled_extraction() {
+    let name = format!("package/{}file", "a/".repeat(64));
+    let bytes = compressed(&tar_bytes(&[(&name, b'0', 0o644, b"x")]));
+    assert!(
+        extract(
+            original(&bytes),
+            Selection {
+                root: "package",
+                index_alias: false,
+                node_tar_timestamps: false,
+                local_pax: false,
+                cargo_package: false,
+            }
+        )
+        .is_err(),
+        "should reject excessive member depth"
+    );
+    let mut tar = tar_bytes(&[("package/file", b'0', 0o644, b"x")]);
+    let mut header = tar::Header::new_ustar();
+    header.as_mut_bytes().copy_from_slice(&tar[..512]);
+    header.set_size(MEMBER_LIMIT + 1);
+    header.set_cksum();
+    tar[..512].copy_from_slice(header.as_bytes());
+    let rejected = extract(
+        original(&compressed(&tar)),
+        Selection {
+            root: "package",
+            index_alias: false,
+            node_tar_timestamps: false,
+            local_pax: false,
+            cargo_package: false,
+        },
+    )
+    .err()
+    .expect("should reject oversized member before reading body");
+    let diagnostic = format!("{rejected:?}");
+    assert!(
+        diagnostic.contains("package/file")
+            && diagnostic.contains("134217729")
+            && diagnostic.contains("134217728"),
+        "should identify the rejected member, actual size and enforced bound"
+    );
+    let bytes = compressed(&tar_bytes(&[("package/file", b'0', 0o644, b"x")]));
+    let cancellation = Cancellation::default();
+    // Reverification binds the extraction to the same cancellation token.
+    let directory = tempfile::tempdir().expect("should create archive directory");
+    let path = directory.path().join("original.tgz");
+    fs::write(&path, &bytes).expect("should write archive");
+    let original = verify(
+        &path,
+        Expected::Sha256(&hex::encode(Sha256::digest(&bytes))),
+        &"a".repeat(40),
+        "npm:node_modules/fictional-package",
+        Instant::now() + Duration::from_secs(10),
+        &cancellation,
+    )
+    .expect("should verify original");
+    cancellation.cancel();
+    assert!(
+        extract(
+            original,
+            Selection {
+                root: "package",
+                index_alias: false,
+                node_tar_timestamps: false,
+                local_pax: false,
+                cargo_package: false,
+            }
+        )
+        .is_err(),
+        "should carry cancellation into extraction"
+    );
+}
+
+#[test]
+fn index_alias_exception_requires_identical_pair_and_no_third_entry() {
+    let pair = [
+        ("package/./dist/index.js", b'0', 0o644, b"same".as_slice()),
+        ("package/dist/index.js", b'0', 0o644, b"same".as_slice()),
+    ];
+    let bytes = compressed(&tar_bytes(&pair));
+    assert!(
+        extract(
+            original(&compressed(&tar_bytes(&pair[..1]))),
+            Selection {
+                root: "package",
+                index_alias: true,
+                node_tar_timestamps: false,
+                local_pax: false,
+                cargo_package: false,
+            }
+        )
+        .is_err(),
+        "should require canonical partner for dot alias"
+    );
+    assert!(
+        extract(
+            original(&bytes),
+            Selection {
+                root: "package",
+                index_alias: true,
+                node_tar_timestamps: false,
+                local_pax: false,
+                cargo_package: false,
+            }
+        )
+        .is_ok(),
+        "should allow exactly reviewed identical pair"
+    );
+    assert!(
+        extract(
+            original(&bytes),
+            Selection {
+                root: "package",
+                index_alias: false,
+                node_tar_timestamps: false,
+                local_pax: false,
+                cargo_package: false,
+            }
+        )
+        .is_err(),
+        "should reject pair for other locked identities"
+    );
+    let mut changed = pair;
+    changed[1].3 = b"evil";
+    assert!(
+        extract(
+            original(&compressed(&tar_bytes(&changed))),
+            Selection {
+                root: "package",
+                index_alias: true,
+                node_tar_timestamps: false,
+                local_pax: false,
+                cargo_package: false,
+            }
+        )
+        .is_err(),
+        "should reject different alias bytes"
+    );
+    let mut third = pair.to_vec();
+    third.push(pair[0]);
+    assert!(
+        extract(
+            original(&compressed(&tar_bytes(&third))),
+            Selection {
+                root: "package",
+                index_alias: true,
+                node_tar_timestamps: false,
+                local_pax: false,
+                cargo_package: false,
+            }
+        )
+        .is_err(),
+        "should reject third occurrence"
+    );
+    let directory_alias = [
+        ("package/./dist/index.js/", b'5', 0o755, b"".as_slice()),
+        ("package/file", b'0', 0o644, b"x".as_slice()),
+    ];
+    assert!(
+        extract(
+            original(&compressed(&tar_bytes(&directory_alias))),
+            Selection {
+                root: "package",
+                index_alias: true,
+                node_tar_timestamps: false,
+                local_pax: false,
+                cargo_package: false,
+            }
+        )
+        .is_err(),
+        "should restrict dot alias exception to regular files"
+    );
+}
+
+#[test]
+fn rejects_hidden_data_bad_trailers_concatenation_and_truncation() {
+    let tar = tar_bytes(&[("package/file", b'0', 0o644, b"x")]);
+    let mut hidden = tar.clone();
+    hidden.extend_from_slice(&tar);
+    let bytes = compressed(&tar);
+    let mut corrupt = bytes.clone();
+    let last = corrupt.len() - 8;
+    corrupt[last] ^= 1;
+    let mut concatenated = bytes.clone();
+    concatenated.extend_from_slice(&bytes);
+    let mut trailing = bytes.clone();
+    trailing.push(0);
+    for bad in [
+        compressed(&hidden),
+        corrupt,
+        concatenated,
+        trailing,
+        bytes[..bytes.len() - 1].to_vec(),
+        compressed(&tar[..512]),
+    ] {
+        assert!(
+            extract(
+                original(&bad),
+                Selection {
+                    root: "package",
+                    index_alias: false,
+                    node_tar_timestamps: false,
+                    local_pax: false,
+                    cargo_package: false,
+                }
+            )
+            .is_err(),
+            "should reject incomplete or ambiguous archive"
+        );
+    }
+}
+
+fn catalog(bytes: &[u8]) -> LockedMaterials {
+    let lock = serde_json::to_vec(&json!({"lockfileVersion":3, "packages": {
+        "": {}, "node_modules/fictional-package": {
+            "version":"1.0.0", "resolved":format!("{}fictional-package/-/fictional-package-1.0.0.tgz", locked::NPM_REGISTRY),
+            "integrity":format!("sha512-{}", STANDARD.encode(Sha512::digest(bytes)))
+        }
+    }})).expect("should encode locked original identity");
+    LockedMaterials {
+        source_commit: "a".repeat(40),
+        cargo_lock_sha256: "0".repeat(64),
+        npm_lock_sha256: "0".repeat(64),
+        cargo: locked::parse_cargo(b"version = 4\npackage = []\n")
+            .expect("should parse empty Cargo lock"),
+        npm: locked::parse_npm(&lock).expect("should parse fixture npm lock"),
+    }
+}
+
+#[test]
+fn catalog_extraction_rejoins_source_and_locked_acquisition_identity() {
+    let bytes = compressed(&tar_bytes(&[("package/file", b'0', 0o644, b"x")]));
+    let mut catalog = catalog(&bytes);
+    assert!(
+        catalog
+            .extract_npm("node_modules/fictional-package", original(&bytes))
+            .is_ok(),
+        "should extract bound locked original"
+    );
+    assert!(
+        catalog
+            .extract_npm("node_modules/other", original(&bytes))
+            .is_err(),
+        "should reject unknown installation identity"
+    );
+    assert!(
+        catalog
+            .extract_registry("fictional-package", "1.0.0", original(&bytes))
+            .is_err(),
+        "should reject npm original as a crate"
+    );
+    catalog.source_commit = "b".repeat(40);
+    assert!(
+        catalog
+            .extract_npm("node_modules/fictional-package", original(&bytes))
+            .is_err(),
+        "should reject original bound to different approved source"
+    );
+}
+
+#[test]
+fn manifest_review_uses_original_members_and_rejects_later_changes() {
+    let manifest = serde_json::to_vec(&json!({"name":"fictional-package","version":"1.0.0"}))
+        .expect("should encode fixture manifest");
+    for binding in [false, true] {
+        let mut entries = vec![("package/package.json", b'0', 0o644, manifest.as_slice())];
+        if binding {
+            entries.push((
+                "package/binding.gyp",
+                b'0',
+                0o644,
+                b"fictional binding".as_slice(),
+            ));
+        }
+        let bytes = compressed(&tar_bytes(&entries));
+        let catalog = catalog(&bytes);
+        let extract_package = || {
+            catalog
+                .extract_npm("node_modules/fictional-package", original(&bytes))
+                .expect("should extract original manifest")
+        };
+        let reviewed = catalog.review_npm("node_modules/fictional-package", extract_package());
+        if binding {
+            assert!(reviewed.is_err(), "should reject original implicit install");
+            let extracted = extract_package();
+            fs::remove_file(extracted.root().join("binding.gyp"))
+                .expect("should remove fixture binding");
+            assert!(
+                catalog
+                    .review_npm("node_modules/fictional-package", extracted)
+                    .is_err(),
+                "should reject removed original binding"
+            );
+        } else {
+            assert!(
+                reviewed
+                    .expect("should review hook-free original")
+                    .hooks()
+                    .is_empty(),
+                "should declare no execution"
+            );
+            let extracted = extract_package();
+            fs::write(extracted.root().join("binding.gyp"), b"added binding")
+                .expect("should add fixture binding");
+            assert!(
+                catalog
+                    .review_npm("node_modules/fictional-package", extracted)
+                    .is_err(),
+                "should reject unrecorded binding"
+            );
+        }
+        let extracted = extract_package();
+        fs::write(extracted.root().join("package.json"), b"{}").expect("should change manifest");
+        assert!(
+            catalog
+                .review_npm("node_modules/fictional-package", extracted)
+                .is_err(),
+            "should reject changed manifest bytes"
+        );
+        assert!(
+            catalog
+                .review_npm("node_modules/other", extract_package())
+                .is_err(),
+            "should reject another locked location"
+        );
+    }
+}
+
+#[test]
+fn enforces_decoded_byte_and_entry_budgets() {
+    let bytes = compressed(&tar_bytes(&[
+        ("package/file", b'0', 0o644, b"x"),
+        ("package/other", b'0', 0o644, b"y"),
+    ]));
+    assert!(
+        extract_bounded(
+            original(&bytes),
+            Selection {
+                root: "package",
+                index_alias: false,
+                node_tar_timestamps: false,
+                local_pax: false,
+                cargo_package: false,
+            },
+            1
+        )
+        .is_err(),
+        "should reject entry exceeding bounded parser budget"
+    );
+    let original = original(&bytes);
+    let mut decoded = Decoded {
+        reader: io::repeat(0).take(DECODED_LIMIT + 1),
+        original: &original,
+        count: 0,
+    };
+    assert!(
+        io::copy(&mut decoded, &mut io::sink()).is_err(),
+        "should stop unbounded decoded expansion"
+    );
+}
+
+#[test]
+fn extracted_tree_review_rejects_changed_or_added_members() {
+    let bytes = compressed(&tar_bytes(&[(
+        "package/index.js",
+        b'0',
+        0o644,
+        b"original",
+    )]));
+    let extracted = extract(
+        original(&bytes),
+        Selection {
+            root: "package",
+            index_alias: false,
+            node_tar_timestamps: false,
+            local_pax: false,
+            cargo_package: false,
+        },
+    )
+    .expect("should extract original");
+    extracted
+        .verify_unchanged()
+        .expect("should verify original tree");
+    fs::write(extracted.root().join("added.js"), b"added").expect("should add unrecorded file");
+    assert!(
+        extracted.verify_unchanged().is_err(),
+        "should reject unrecorded member"
+    );
+    fs::remove_file(extracted.root().join("added.js")).expect("should remove extra file");
+    fs::write(extracted.root().join("index.js"), b"changed").expect("should change recorded file");
+    assert!(
+        extracted.verify_unchanged().is_err(),
+        "should reject changed recorded member"
+    );
+}
+
+#[test]
+fn npm_bundle_rechecks_and_retains_originals_for_independent_caches() {
+    let manifest = serde_json::to_vec(&json!({"name":"fictional-package","version":"1.0.0"}))
+        .expect("should encode manifest");
+    let bytes = compressed(&tar_bytes(&[(
+        "package/package.json",
+        b'0',
+        0o644,
+        &manifest,
+    )]));
+    let catalog = catalog(&bytes);
+    let inputs = tempfile::tempdir().expect("should create input directory");
+    let name = format!("{}.tgz", hex::encode(Sha512::digest(&bytes)));
+    fs::write(inputs.path().join(&name), &bytes).expect("should write original");
+    let prepared = catalog
+        .prepare_npm_originals(
+            inputs.path(),
+            Instant::now() + Duration::from_secs(10),
+            &Cancellation::default(),
+        )
+        .expect("should authenticate complete original set");
+    assert_eq!(
+        prepared.archive_paths().len(),
+        1,
+        "should retain every locked original"
+    );
+    assert_eq!(
+        fs::read(&prepared.archive_paths()[0]).expect("should read retained original"),
+        bytes,
+        "should retain compressed identity rather than repacked bytes"
+    );
+    fs::write(inputs.path().join(name), b"changed").expect("should replace caller input");
+    prepared
+        .verify_unchanged()
+        .expect("should own originals independently of caller input");
+    assert!(
+        catalog
+            .prepare_npm_originals(
+                inputs.path(),
+                Instant::now() + Duration::from_secs(10),
+                &Cancellation::default()
+            )
+            .is_err(),
+        "should reject changed original on next preparation"
+    );
+}
+
+#[test]
+fn extraction_recheck_rejects_root_alias_and_missing_empty_directory() {
+    let bytes = compressed(&tar_bytes(&[
+        ("package/index.js", b'0', 0o644, b"original"),
+        ("package/empty", b'5', 0o755, b""),
+    ]));
+    let extracted = extract(
+        original(&bytes),
+        Selection {
+            root: "package",
+            index_alias: false,
+            node_tar_timestamps: false,
+            local_pax: false,
+            cargo_package: false,
+        },
+    )
+    .expect("should extract original");
+    extracted
+        .verify_unchanged()
+        .expect("should recheck explicit empty directory");
+    fs::remove_dir(extracted.root().join("empty")).expect("should remove empty directory");
+    assert!(
+        extracted.verify_unchanged().is_err(),
+        "should reject missing recorded empty directory"
+    );
+    fs::create_dir(extracted.root().join("empty")).expect("should restore directory");
+    let saved = extracted.directory.path().join("saved");
+    fs::rename(extracted.root(), &saved).expect("should move original root");
+    std::os::unix::fs::symlink("saved", extracted.root())
+        .expect("should substitute matching root alias");
+    assert!(
+        extracted.verify_unchanged().is_err(),
+        "should reject replaced extraction root even with identical members"
+    );
+}
+
+mod cargo_package;
+mod npm_compatibility;
diff --git a/crates/trusted-server-release/src/materials/extract/tests/cargo_package.rs b/crates/trusted-server-release/src/materials/extract/tests/cargo_package.rs
new file mode 100644
index 0000000000..992e211a27
--- /dev/null
+++ b/crates/trusted-server-release/src/materials/extract/tests/cargo_package.rs
@@ -0,0 +1,154 @@
+//! Encodings `cargo package` writes into registry crates: GNU long names and
+//! file-type bits in the mode field.
+
+use super::*;
+
+fn crate_selection(cargo_package: bool) -> Selection<'static> {
+    Selection {
+        root: "example-1.0.0",
+        index_alias: false,
+        node_tar_timestamps: false,
+        local_pax: false,
+        cargo_package,
+    }
+}
+
+/// A member path longer than the 100-byte header name field.
+fn long_member() -> String {
+    format!("example-1.0.0/{}/file.rs", "nested".repeat(18))
+}
+
+/// A crate as `cargo package` writes it: a GNU long-name record and a
+/// regular file whose mode carries the regular-file type bits.
+fn cargo_package_archive() -> Vec<u8> {
+    let mut builder = tar::Builder::new(GzEncoder::new(Vec::new(), Compression::fast()));
+    let mut long = tar::Header::new_gnu();
+    long.set_mode(0o644);
+    long.set_size(5);
+    builder
+        .append_data(&mut long, long_member(), &b"long\n"[..])
+        .expect("should append a GNU long-name member");
+    let mut typed = tar::Header::new_ustar();
+    typed.set_mode(0o100_755);
+    typed.set_size(4);
+    typed.set_cksum();
+    builder
+        .append_data(&mut typed, "example-1.0.0/build.sh", &b"#!\n\n"[..])
+        .expect("should append a typed-mode member");
+    builder
+        .into_inner()
+        .expect("should finish crate TAR")
+        .finish()
+        .expect("should finish crate gzip")
+}
+
+#[test]
+fn cargo_package_long_names_and_typed_modes_extract_only_for_crates() {
+    let bytes = cargo_package_archive();
+    let extracted = extract(original(&bytes), crate_selection(true))
+        .expect("should extract the encodings cargo package writes");
+    assert_eq!(
+        fs::read(extracted.directory.path().join(long_member())).expect("should read long member"),
+        b"long\n",
+        "should place the member at its full long name"
+    );
+    let (_, _, mode) = extracted
+        .member_facts("build.sh")
+        .expect("should record the typed-mode member");
+    assert_eq!(mode, 0o755, "should keep only the permission bits");
+    let error = extract(original(&bytes), crate_selection(false))
+        .err()
+        .expect("should keep npm extraction closed to both encodings");
+    assert!(
+        format!("{error:?}").contains("GNU long-name"),
+        "should name the unreviewed record: {error:?}"
+    );
+}
+
+/// One raw TAR member: name, entry type, mode and contents.
+type Member<'a> = (&'a str, u8, u32, &'a [u8]);
+
+#[test]
+fn cargo_package_encodings_never_rename_or_privilege_a_member() {
+    let long = long_member();
+    let record = format!("{long}\0");
+    let header_name = &long[..100];
+    let other_name = format!("example-1.0.0/{}", "x".repeat(86));
+    let control = compressed(&tar_bytes(&[
+        ("././@LongLink", b'L', 0o644, record.as_bytes()),
+        (header_name, b'0', 0o100_644, b"data"),
+    ]));
+    let extracted = extract(original(&control), crate_selection(true))
+        .expect("should accept the hand-built record the negatives below alter");
+    assert!(
+        extracted.directory.path().join(&long).is_file(),
+        "should extract the control member at its long name"
+    );
+    let cases: [(&str, Vec<Member<'_>>); 9] = [
+        (
+            "renaming header",
+            vec![
+                ("././@LongLink", b'L', 0o644, record.as_bytes()),
+                (other_name.as_str(), b'0', 0o644, b"data"),
+            ],
+        ),
+        (
+            "consecutive records",
+            vec![
+                ("././@LongLink", b'L', 0o644, record.as_bytes()),
+                ("././@LongLink", b'L', 0o644, record.as_bytes()),
+                (header_name, b'0', 0o644, b"data"),
+            ],
+        ),
+        (
+            "dangling record",
+            vec![
+                ("example-1.0.0/lib.rs", b'0', 0o644, b"data"),
+                ("././@LongLink", b'L', 0o644, record.as_bytes()),
+            ],
+        ),
+        (
+            "unterminated record",
+            vec![
+                ("././@LongLink", b'L', 0o644, long.as_bytes()),
+                (header_name, b'0', 0o644, b"data"),
+            ],
+        ),
+        (
+            "foreign record name",
+            vec![
+                ("example-1.0.0/LongLink", b'L', 0o644, record.as_bytes()),
+                (header_name, b'0', 0o644, b"data"),
+            ],
+        ),
+        (
+            "directory-mode record",
+            vec![
+                ("././@LongLink", b'L', 0o040_755, record.as_bytes()),
+                (header_name, b'0', 0o644, b"data"),
+            ],
+        ),
+        (
+            "set-user-ID record",
+            vec![
+                ("././@LongLink", b'L', 0o104_644, record.as_bytes()),
+                (header_name, b'0', 0o644, b"data"),
+            ],
+        ),
+        (
+            "symlink type bits",
+            vec![("example-1.0.0/lib.rs", b'0', 0o120_777, b"data")],
+        ),
+        (
+            "set-user-ID mode",
+            vec![("example-1.0.0/lib.rs", b'0', 0o104_755, b"data")],
+        ),
+    ];
+    for (label, entries) in cases {
+        let bytes = compressed(&tar_bytes(&entries));
+        assert!(
+            extract(original(&bytes), crate_selection(true)).is_err(),
+            "should reject a crate with a {label}"
+        );
+    }
+}
diff --git a/crates/trusted-server-release/src/materials/extract/tests/npm_compatibility.rs b/crates/trusted-server-release/src/materials/extract/tests/npm_compatibility.rs
new file mode 100644
index 0000000000..9e1c9cdb9b
--- /dev/null
+++ b/crates/trusted-server-release/src/materials/extract/tests/npm_compatibility.rs
@@ -0,0 +1,177 @@
+//! Reviewed npm compatibility: node-tar timestamp prefixes and local PAX headers.
+
+use super::*;
+
+#[test]
+fn accepts_only_reviewed_node_tar_timestamp_layout() {
+    let mut header = tar::Header::new_ustar();
+    header.as_mut_bytes()[476..488].copy_from_slice(b"15075543223\0");
+    header.as_mut_bytes()[488..500].copy_from_slice(b"15075543223\0");
+    header.as_mut_bytes()[..12].copy_from_slice(b"chai/file.js");
+    let selection = Selection {
+        root: "chai",
+        index_alias: false,
+        node_tar_timestamps: true,
+        local_pax: false,
+        cargo_package: false,
+    };
+    assert_eq!(
+        raw_name(&header, &selection).expect("should parse reviewed layout"),
+        "chai/file.js"
+    );
+    assert!(
+        raw_name(
+            &header,
+            &Selection {
+                node_tar_timestamps: false,
+                ..selection
+            }
+        )
+        .is_err(),
+        "should reject layout outside approved tuple"
+    );
+    header.as_mut_bytes()[475] = b'x';
+    assert!(
+        raw_name(&header, &selection).is_err(),
+        "should reject hidden prefix bytes"
+    );
+    header.as_mut_bytes()[475] = 0;
+    header.as_mut_bytes()[476] = b'9';
+    assert!(
+        raw_name(&header, &selection).is_err(),
+        "should reject nonoctal timestamps"
+    );
+}
+
+fn pax_record(key: &str, value: &str) -> Vec<u8> {
+    let content = format!(" {key}={value}\n");
+    let mut length = content.len() + 1;
+    loop {
+        let next = content.len() + length.to_string().len();
+        if next == length {
+            return format!("{length}{content}").into_bytes();
+        }
+        length = next;
+    }
+}
+#[test]
+fn reviewed_local_pax_never_overrides_member_selection() {
+    let mut body = pax_record("path", "package/file.js");
+    body.extend(pax_record("size", "3"));
+    body.extend(pax_record("NODETAR.type", "File"));
+    let parsed = compatibility::parse_pax(&body).expect("should parse reviewed metadata");
+    assert!(
+        parsed.join("package/file.js", 3).is_ok(),
+        "should accept redundant selectors"
+    );
+    assert!(
+        parsed.join("package/other.js", 3).is_err(),
+        "should reject path override"
+    );
+    assert!(
+        parsed.join("package/file.js", 4).is_err(),
+        "should reject size override"
+    );
+    for (key, value) in [
+        ("linkpath", "package/other"),
+        ("GNU.sparse.size", "3"),
+        ("size", "03"),
+    ] {
+        let mut invalid = body.clone();
+        invalid.extend(pax_record(key, value));
+        assert!(
+            compatibility::parse_pax(&invalid).is_err(),
+            "should reject semantic or duplicate fields"
+        );
+    }
+    assert!(
+        compatibility::parse_pax(b"99 path=package/file.js\n").is_err(),
+        "should reject malformed framing"
+    );
+}
+
+#[test]
+fn reviewed_pax_is_local_bounded_and_never_redirects_extraction() {
+    let metadata = |path: &str, size: &str| {
+        let mut bytes = pax_record("path", path);
+        bytes.extend(pax_record("size", size));
+        bytes.extend(pax_record("NODETAR.type", "File"));
+        bytes
+    };
+    let valid = metadata("package/file.js", "3");
+    let selection = Selection {
+        root: "package",
+        index_alias: false,
+        node_tar_timestamps: false,
+        local_pax: true,
+        cargo_package: false,
+    };
+    let archive = compressed(&tar_bytes(&[
+        ("PaxHeader/package/file.js", b'x', 0o644, &valid),
+        ("package/file.js", b'0', 0o644, b"abc"),
+    ]));
+    let extracted =
+        extract(original(&archive), selection).expect("should extract redundant local metadata");
+    extracted
+        .verify_unchanged()
+        .expect("should preserve regular member facts");
+    let bad_path = metadata("package/other.js", "3");
+    let bad_size = metadata("package/file.js", "4");
+    let cases = [
+        vec![("PaxHeader/package/file.js", b'x', 0o644, valid.as_slice())],
+        vec![
+            ("PaxHeader/package/file.js", b'x', 0o644, valid.as_slice()),
+            ("PaxHeader/other.js", b'x', 0o644, valid.as_slice()),
+        ],
+        vec![
+            ("PaxHeader/package/file.js", b'g', 0o644, valid.as_slice()),
+            ("package/file.js", b'0', 0o644, b"abc"),
+        ],
+        vec![
+            (
+                "PaxHeader/package/file.js",
+                b'x',
+                0o644,
+                bad_path.as_slice(),
+            ),
+            ("package/file.js", b'0', 0o644, b"abc"),
+        ],
+        vec![
+            (
+                "PaxHeader/package/file.js",
+                b'x',
+                0o644,
+                bad_size.as_slice(),
+            ),
+            ("package/file.js", b'0', 0o644, b"abc"),
+        ],
+    ];
+    for entries in cases {
+        let bytes = compressed(&tar_bytes(&entries));
+        assert!(
+            extract(original(&bytes), selection).is_err(),
+            "should reject nonlocal or overriding metadata"
+        );
+    }
+    for (name, mode) in [
+        ("PaxHeader/../file.js", 0o644),
+        ("PaxHeader/package/file.js", 0o4644),
+    ] {
+        let bytes = compressed(&tar_bytes(&[
+            (name, b'x', mode, &valid),
+            ("package/file.js", b'0', 0o644, b"abc"),
+        ]));
+        assert!(
+            extract(original(&bytes), selection).is_err(),
+            "should reject unsafe PAX header itself"
+        );
+    }
+    let unreviewed = Selection {
+        local_pax: false,
+        ..selection
+    };
+    assert!(
+        extract(original(&archive), unreviewed).is_err(),
+        "should reject PAX outside exact approved tuple"
+    );
+}
diff --git a/crates/trusted-server-release/src/materials/git.rs b/crates/trusted-server-release/src/materials/git.rs
new file mode 100644
index 0000000000..21e74bce64
--- /dev/null
+++ b/crates/trusted-server-release/src/materials/git.rs
@@ -0,0 +1,530 @@
+//! Locked Git commit snapshots, distinct from acquisition and Cargo checkouts.
+
+mod input;
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::ffi::OsString;
+use std::fs::{self, File, OpenOptions};
+use std::io::{Read as _, Write as _};
+use std::os::unix::fs::{MetadataExt as _, OpenOptionsExt as _, PermissionsExt as _};
+use std::path::{Path, PathBuf};
+use std::time::{Duration, Instant};
+
+use error_stack::Report;
+use flate2::Compression;
+use flate2::write::ZlibEncoder;
+use sha2::{Digest as _, Sha256};
+
+use super::{LockedMaterials, material_error};
+use crate::error::ReleaseError;
+use crate::git_objects::ObjectReader;
+use crate::process::{BoundedCommand, Cancellation, ProcessLimits, ProcessResult};
+
+const TREE_DEPTH: usize = 256;
+const TREE_ENTRIES: usize = 100_000;
+
+/// One bounded collection shares its decoded object budget across dependencies.
+///
+/// A locally selected executable is not an authenticated release-tool selection.
+pub(crate) struct GitCollection<'a> {
+    locked: &'a LockedMaterials,
+    program: PathBuf,
+    program_sha256: String,
+    deadline: Instant,
+    cancellation: Cancellation,
+    objects: ObjectReader,
+}
+
+/// A selected commit's complete verified closure in an owned private object store.
+///
+/// Parent history and unselected objects are deliberately absent. This value
+/// proves an object snapshot, not an installed Cargo checkout or tool qualification.
+pub(crate) struct VerifiedGitMaterial {
+    source_commit: String,
+    cargo_lock_sha256: String,
+    selector: String,
+    revision: String,
+    root_tree: String,
+    store: tempfile::TempDir,
+    object_ids: BTreeSet<String>,
+}
+
+impl VerifiedGitMaterial {
+    /// Wraps a hand-built loose-object store without verifying it, for tests.
+    #[cfg(test)]
+    pub(super) fn for_tests(
+        source_commit: &str,
+        cargo_lock_sha256: &str,
+        selector: &str,
+        revision: &str,
+        root_tree: &str,
+        store: tempfile::TempDir,
+    ) -> Self {
+        Self {
+            source_commit: source_commit.to_owned(),
+            cargo_lock_sha256: cargo_lock_sha256.to_owned(),
+            selector: selector.to_owned(),
+            revision: revision.to_owned(),
+            root_tree: root_tree.to_owned(),
+            store,
+            object_ids: BTreeSet::new(),
+        }
+    }
+
+    /// Returns the independently approved source binding.
+    pub(crate) fn source_commit(&self) -> &str {
+        &self.source_commit
+    }
+    /// Returns the approved raw Cargo lockfile digest.
+    pub(crate) fn cargo_lock_sha256(&self) -> &str {
+        &self.cargo_lock_sha256
+    }
+    /// Returns the exact locked Git source selector.
+    pub(crate) fn selector(&self) -> &str {
+        &self.selector
+    }
+    /// Returns the exact locked commit identity.
+    pub(crate) fn revision(&self) -> &str {
+        &self.revision
+    }
+    /// Returns the selected commit's collision-checked root tree identity.
+    pub(crate) fn root_tree(&self) -> &str {
+        &self.root_tree
+    }
+    /// Borrows the owned verified-only object directory, never the input store.
+    pub(crate) fn object_store(&self) -> &Path {
+        self.store.path()
+    }
+    /// Returns the verified selected closure's distinct object count.
+    pub(crate) fn object_count(&self) -> usize {
+        self.object_ids.len()
+    }
+}
+
+fn program_digest(
+    path: &Path,
+    deadline: Instant,
+    cancellation: &Cancellation,
+) -> Result<String, Report<ReleaseError>> {
+    let mut file = OpenOptions::new()
+        .read(true)
+        .custom_flags(libc::O_NOFOLLOW | libc::O_NONBLOCK | libc::O_CLOEXEC)
+        .open(path)
+        .map_err(material_error)?;
+    let metadata = file.metadata().map_err(material_error)?;
+    if !metadata.is_file()
+        || metadata.permissions().mode() & 0o111 == 0
+        || metadata.len() > 64 * 1024 * 1024
+    {
+        return Err(material_error(
+            "selected Git must be a bounded regular executable",
+        ));
+    }
+    let mut digest = Sha256::new();
+    let mut length = 0_u64;
+    let mut buffer = [0_u8; 64 * 1024];
+    loop {
+        if cancellation.is_cancelled() || Instant::now() >= deadline {
+            return Err(material_error(
+                "Git executable verification cancelled or timed out",
+            ));
+        }
+        let count = file.read(&mut buffer).map_err(material_error)?;
+        if count == 0 {
+            break;
+        }
+        length += count as u64;
+        if length > metadata.len() {
+            return Err(material_error("selected Git executable grew"));
+        }
+        digest.update(&buffer[..count]);
+    }
+    let after = file.metadata().map_err(material_error)?;
+    let stamp = |value: &std::fs::Metadata| {
+        (
+            value.dev(),
+            value.ino(),
+            value.nlink(),
+            value.len(),
+            value.mode(),
+            value.mtime(),
+            value.mtime_nsec(),
+            value.ctime(),
+            value.ctime_nsec(),
+        )
+    };
+    if length != metadata.len() || stamp(&metadata) != stamp(&after) {
+        return Err(material_error("selected Git executable changed"));
+    }
+    Ok(hex::encode(digest.finalize()))
+}
+
+impl<'a> GitCollection<'a> {
+    pub(super) fn new(
+        locked: &'a LockedMaterials,
+        program: &Path,
+        deadline: Instant,
+        cancellation: &Cancellation,
+    ) -> Result<Self, Report<ReleaseError>> {
+        if !program.is_absolute() {
+            return Err(material_error("selected Git path must be absolute"));
+        }
+        let program = fs::canonicalize(program).map_err(material_error)?;
+        let program_sha256 = program_digest(&program, deadline, cancellation)?;
+        let collection = Self {
+            locked,
+            program,
+            program_sha256,
+            deadline,
+            cancellation: cancellation.clone(),
+            objects: ObjectReader::cargo_materials(),
+        };
+        collection.check()?;
+        Ok(collection)
+    }
+
+    fn check(&self) -> Result<(), Report<ReleaseError>> {
+        if self.cancellation.is_cancelled() || Instant::now() >= self.deadline {
+            return Err(material_error(
+                "Git material verification cancelled or timed out",
+            ));
+        }
+        Ok(())
+    }
+
+    fn execute(
+        &self,
+        repository: &Path,
+        arguments: &[&str],
+        input: Vec<u8>,
+        limit: u64,
+    ) -> Result<Vec<u8>, Report<ReleaseError>> {
+        self.check()?;
+        if program_digest(&self.program, self.deadline, &self.cancellation)? != self.program_sha256
+        {
+            return Err(material_error("selected Git executable changed"));
+        }
+        let home = repository.join("home");
+        let mut git_dir = OsString::from("--git-dir=");
+        git_dir.push(repository);
+        let mut fixed = vec![git_dir, OsString::from("--no-replace-objects")];
+        fixed.extend(
+            [
+                "-c",
+                "core.hooksPath=/dev/null",
+                "-c",
+                "core.fsmonitor=false",
+                "-c",
+                "core.untrackedCache=false",
+                "-c",
+                "protocol.allow=never",
+            ]
+            .into_iter()
+            .chain(arguments.iter().copied())
+            .map(OsString::from),
+        );
+        let wall = self
+            .deadline
+            .checked_duration_since(Instant::now())
+            .ok_or_else(|| material_error("Git material deadline expired"))?;
+        let output = BoundedCommand::new(
+            &self.program,
+            repository,
+            ProcessLimits {
+                wall: wall.min(Duration::from_secs(120)),
+                stdout_max: limit,
+                stderr_max: 64 * 1024,
+            },
+        )?
+        .arguments(fixed)
+        .environment("HOME", &home)?
+        .environment(
+            "PATH",
+            self.program
+                .parent()
+                .ok_or_else(|| material_error("Git has no parent"))?,
+        )?
+        .environment("GIT_CONFIG_NOSYSTEM", "1")?
+        .environment("GIT_NO_REPLACE_OBJECTS", "1")?
+        .environment("GIT_TERMINAL_PROMPT", "0")?
+        .environment("GIT_OPTIONAL_LOCKS", "0")?
+        .environment("LC_ALL", "C")?
+        .stdin_bytes(input)
+        .cancellation(self.cancellation.clone())
+        .run()
+        .and_then(ProcessResult::require_success)
+        .map_err(|report| report.change_context(ReleaseError::Material))?;
+        self.check()?;
+        Ok(output)
+    }
+
+    fn read(
+        &self,
+        repository: &Path,
+        kind: &'static str,
+        oid: &str,
+    ) -> Result<Vec<u8>, Report<ReleaseError>> {
+        self.check()?;
+        let mut body = Vec::new();
+        self.objects
+            .read_objects(
+                kind,
+                &[oid],
+                &mut |arguments, input, limit| self.execute(repository, arguments, input, limit),
+                |_, bytes| {
+                    body.extend_from_slice(bytes);
+                    Ok(())
+                },
+            )
+            .map_err(|report| report.change_context(ReleaseError::Material))?;
+        Ok(body)
+    }
+
+    fn retain(
+        &self,
+        store: &Path,
+        kind: &str,
+        oid: &str,
+        bytes: &[u8],
+    ) -> Result<(), Report<ReleaseError>> {
+        self.check()?;
+        let directory = store.join(&oid[..2]);
+        match fs::create_dir(&directory) {
+            Ok(()) => {}
+            Err(error) if error.kind() == std::io::ErrorKind::AlreadyExists => {}
+            Err(error) => return Err(material_error(error)),
+        }
+        let output = File::create_new(directory.join(&oid[2..])).map_err(material_error)?;
+        let mut encoded = ZlibEncoder::new(output, Compression::default());
+        encoded
+            .write_all(format!("{kind} {}\0", bytes.len()).as_bytes())
+            .map_err(material_error)?;
+        for chunk in bytes.chunks(64 * 1024) {
+            self.check()?;
+            encoded.write_all(chunk).map_err(material_error)?;
+        }
+        encoded.finish().map_err(material_error)?;
+        self.check()
+    }
+
+    /// Verifies only an approved locked selector and its full commit identity.
+    ///
+    /// Input objects are copied as untrusted data. Their repository configuration,
+    /// refs, hooks and alternates are never consulted. All selected trees and blobs
+    /// are independently rehashed, including subtrees outside Cargo package roots.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for an unlocked selection, unsafe input, changed executable,
+    /// missing/corrupt objects, unsafe tree entry or exceeded shared limits.
+    pub(crate) fn verify(
+        &self,
+        selector: &str,
+        revision: &str,
+        objects: &Path,
+    ) -> Result<VerifiedGitMaterial, Report<ReleaseError>> {
+        self.check()?;
+        if !lower_oid(revision.as_bytes()) {
+            return Err(material_error(
+                "Git revision must be a full canonical object identity",
+            ));
+        }
+        if !self
+            .locked
+            .cargo
+            .git
+            .contains(&(selector.to_owned(), revision.to_owned()))
+        {
+            return Err(material_error(
+                "Git selection is absent from approved Cargo lockfile",
+            ));
+        }
+        let repository = tempfile::Builder::new()
+            .prefix("release-git-input-")
+            .tempdir()
+            .map_err(material_error)?;
+        fs::create_dir(repository.path().join("objects")).map_err(material_error)?;
+        fs::create_dir(repository.path().join("refs")).map_err(material_error)?;
+        fs::create_dir(repository.path().join("home")).map_err(material_error)?;
+        fs::write(repository.path().join("HEAD"), b"ref: refs/heads/unused\n")
+            .map_err(material_error)?;
+        fs::write(
+            repository.path().join("config"),
+            b"[core]\nrepositoryformatversion = 0\nbare = true\n",
+        )
+        .map_err(material_error)?;
+        input::copy(objects, &repository.path().join("objects"), self)?;
+        let store = tempfile::Builder::new()
+            .prefix("release-git-verified-")
+            .tempdir()
+            .map_err(material_error)?;
+        let commit = self.read(repository.path(), "commit", revision)?;
+        let root_tree = commit_tree(&commit)?;
+        self.retain(store.path(), "commit", revision, &commit)?;
+        let mut object_kinds = BTreeMap::from([(revision.to_owned(), "commit")]);
+        let mut trees = BTreeMap::<String, Vec<Entry>>::new();
+        let mut pending = vec![(root_tree.clone(), 1_usize, 0_usize)];
+        let mut entry_count = 0_usize;
+        while let Some((oid, depth, prefix_length)) = pending.pop() {
+            self.check()?;
+            if depth > TREE_DEPTH {
+                return Err(material_error("Git dependency tree exceeds depth limit"));
+            }
+            let entries = if let Some(entries) = trees.get(&oid) {
+                entries.clone()
+            } else {
+                let bytes = self.read(repository.path(), "tree", &oid)?;
+                let entries = parse_tree(&bytes)?;
+                self.retain(store.path(), "tree", &oid, &bytes)?;
+                if object_kinds.insert(oid.clone(), "tree").is_some() {
+                    return Err(material_error(
+                        "Git object is referenced with conflicting types",
+                    ));
+                }
+                trees.insert(oid, entries.clone());
+                entries
+            };
+            entry_count = entry_count
+                .checked_add(entries.len())
+                .ok_or_else(|| material_error("tree entry count overflow"))?;
+            if entry_count > TREE_ENTRIES {
+                return Err(material_error("Git dependency tree exceeds entry limit"));
+            }
+            for entry in entries {
+                let path_length = prefix_length + entry.name_length;
+                if path_length > 4096 {
+                    return Err(material_error("Git dependency path exceeds byte limit"));
+                }
+                if entry.tree {
+                    pending.push((entry.oid, depth + 1, path_length + 1));
+                } else if let Some(kind) = object_kinds.get(&entry.oid) {
+                    if *kind != "blob" {
+                        return Err(material_error(
+                            "Git object is referenced with conflicting types",
+                        ));
+                    }
+                } else {
+                    let bytes = self.read(repository.path(), "blob", &entry.oid)?;
+                    self.retain(store.path(), "blob", &entry.oid, &bytes)?;
+                    object_kinds.insert(entry.oid, "blob");
+                }
+            }
+        }
+        self.check()?;
+        Ok(VerifiedGitMaterial {
+            source_commit: self.locked.source_commit.clone(),
+            cargo_lock_sha256: self.locked.cargo_lock_sha256.clone(),
+            selector: selector.to_owned(),
+            revision: revision.to_owned(),
+            root_tree,
+            store,
+            object_ids: object_kinds.into_keys().collect(),
+        })
+    }
+}
+
+fn lower_oid(bytes: &[u8]) -> bool {
+    bytes.len() == 40
+        && bytes
+            .iter()
+            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(byte))
+}
+
+fn commit_tree(bytes: &[u8]) -> Result<String, Report<ReleaseError>> {
+    if bytes.contains(&0) {
+        return Err(material_error("Git commit contains a NUL"));
+    }
+    let end = bytes
+        .windows(2)
+        .position(|window| window == b"\n\n")
+        .ok_or_else(|| material_error("Git commit has no header terminator"))?;
+    let mut headers = bytes[..end].split(|byte| *byte == b'\n');
+    let tree = headers
+        .next()
+        .and_then(|line| line.strip_prefix(b"tree "))
+        .filter(|oid| lower_oid(oid))
+        .ok_or_else(|| material_error("Git commit has no canonical root tree"))?;
+    if headers.any(|line| line.starts_with(b"tree ")) {
+        return Err(material_error("Git commit repeats its root tree"));
+    }
+    String::from_utf8(tree.to_vec()).map_err(material_error)
+}
+
+#[derive(Clone)]
+struct Entry {
+    tree: bool,
+    oid: String,
+    name_length: usize,
+}
+
+fn parse_tree(mut bytes: &[u8]) -> Result<Vec<Entry>, Report<ReleaseError>> {
+    let mut names = BTreeSet::new();
+    let mut previous = None::<Vec<u8>>;
+    let mut entries = Vec::new();
+    while !bytes.is_empty() {
+        let space = bytes
+            .iter()
+            .position(|byte| *byte == b' ')
+            .ok_or_else(|| material_error("malformed Git tree mode"))?;
+        let mode = &bytes[..space];
+        let tree = match mode {
+            b"40000" => true,
+            // Link targets remain authenticated blob data; no filesystem link is created.
+            b"100644" | b"100755" | b"120000" => false,
+            _ => {
+                return Err(material_error(
+                    "Git dependency submodules and noncanonical modes are unreviewed",
+                ));
+            }
+        };
+        let rest = &bytes[space + 1..];
+        let nul = rest
+            .iter()
+            .position(|byte| *byte == 0)
+            .ok_or_else(|| material_error("malformed Git tree name"))?;
+        let name = &rest[..nul];
+        if name.is_empty()
+            || !name.is_ascii()
+            || name
+                .iter()
+                .any(|byte| byte.is_ascii_control() || matches!(byte, b'/' | b'\\' | b':'))
+            || matches!(name, b"." | b"..")
+            || name.eq_ignore_ascii_case(b".git")
+            || name.ends_with(b".")
+            || name.ends_with(b" ")
+            || name.len() > 255
+        {
+            return Err(material_error("unsafe Git dependency tree name"));
+        }
+        let folded: Vec<_> = name.iter().map(u8::to_ascii_lowercase).collect();
+        if !names.insert(folded) {
+            return Err(material_error(
+                "Git dependency tree aliases or repeats a name",
+            ));
+        }
+        let mut key = name.to_vec();
+        if tree {
+            key.push(b'/');
+        }
+        if previous.as_ref().is_some_and(|previous| *previous >= key) {
+            return Err(material_error("Git dependency tree order is noncanonical"));
+        }
+        previous = Some(key);
+        let raw_oid = rest
+            .get(nul + 1..nul + 21)
+            .ok_or_else(|| material_error("truncated Git tree identity"))?;
+        entries.push(Entry {
+            tree,
+            oid: hex::encode(raw_oid),
+            name_length: name.len(),
+        });
+        if entries.len() > TREE_ENTRIES {
+            return Err(material_error("Git tree exceeds entry limit"));
+        }
+        bytes = &rest[nul + 21..];
+    }
+    Ok(entries)
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/trusted-server-release/src/materials/git/input.rs b/crates/trusted-server-release/src/materials/git/input.rs
new file mode 100644
index 0000000000..149973f16e
--- /dev/null
+++ b/crates/trusted-server-release/src/materials/git/input.rs
@@ -0,0 +1,260 @@
+//! Object-only copies anchored to held descriptors, never input Git config.
+
+use std::collections::BTreeSet;
+use std::ffi::{CStr, CString};
+use std::fs::{self, File, Metadata};
+use std::io::{Read as _, Write as _};
+use std::os::fd::{AsRawFd as _, FromRawFd as _, OwnedFd};
+use std::os::unix::ffi::OsStrExt as _;
+use std::os::unix::fs::MetadataExt as _;
+use std::path::{Component, Path};
+
+use error_stack::Report;
+
+use super::{GitCollection, material_error};
+use crate::error::ReleaseError;
+
+const RAW_LIMIT: u64 = 512 * 1024 * 1024;
+const ENTRY_LIMIT: usize = 100_000;
+
+fn stamp(metadata: &Metadata) -> (u64, u64, u64, u64, i64, i64, i64, i64) {
+    (
+        metadata.dev(),
+        metadata.ino(),
+        metadata.nlink(),
+        metadata.len(),
+        metadata.mtime(),
+        metadata.mtime_nsec(),
+        metadata.ctime(),
+        metadata.ctime_nsec(),
+    )
+}
+
+/// Opens each ancestor without following a symlink or accepting relative syntax.
+fn anchor(path: &Path) -> Result<File, Report<ReleaseError>> {
+    if !path.is_absolute() || path.as_os_str().as_bytes().contains(&0) {
+        return Err(material_error(
+            "Git object root must be an absolute canonical path",
+        ));
+    }
+    let mut directory = File::open("/").map_err(material_error)?;
+    for component in path.components() {
+        match component {
+            Component::RootDir => {}
+            Component::Normal(name) => {
+                directory = open_at(&directory, name.as_bytes(), true)?;
+            }
+            _ => return Err(material_error("noncanonical Git object root")),
+        }
+    }
+    Ok(directory)
+}
+
+fn open_at(parent: &File, name: &[u8], directory: bool) -> Result<File, Report<ReleaseError>> {
+    let name = CString::new(name).map_err(material_error)?;
+    let flags = libc::O_RDONLY
+        | libc::O_NOFOLLOW
+        | libc::O_NONBLOCK
+        | libc::O_CLOEXEC
+        | if directory { libc::O_DIRECTORY } else { 0 };
+    // The parent descriptor stays alive throughout openat, and name is NUL terminated.
+    let descriptor = unsafe { libc::openat(parent.as_raw_fd(), name.as_ptr(), flags) };
+    if descriptor < 0 {
+        return Err(material_error(std::io::Error::last_os_error()));
+    }
+    // A successful openat transfers one fresh descriptor to this File.
+    Ok(unsafe { File::from_raw_fd(descriptor) })
+}
+
+struct Directory(*mut libc::DIR);
+
+impl Drop for Directory {
+    fn drop(&mut self) {
+        // fdopendir returned this stream, which is closed exactly once.
+        unsafe { libc::closedir(self.0) };
+    }
+}
+
+#[cfg(target_os = "macos")]
+fn errno() -> *mut libc::c_int {
+    // libc exposes the calling thread's errno location.
+    unsafe { libc::__error() }
+}
+
+#[cfg(target_os = "linux")]
+fn errno() -> *mut libc::c_int {
+    // libc exposes the calling thread's errno location.
+    unsafe { libc::__errno_location() }
+}
+
+fn names(
+    directory: &File,
+    collection: &GitCollection<'_>,
+) -> Result<Vec<String>, Report<ReleaseError>> {
+    // A duplicate keeps fdopendir ownership separate from the held anchor.
+    let descriptor = unsafe { libc::fcntl(directory.as_raw_fd(), libc::F_DUPFD_CLOEXEC, 0) };
+    if descriptor < 0 {
+        return Err(material_error(std::io::Error::last_os_error()));
+    }
+    // A successful fcntl returns a fresh owned descriptor.
+    let owned = unsafe { OwnedFd::from_raw_fd(descriptor) };
+    // fdopendir takes ownership only on success.
+    let stream = unsafe { libc::fdopendir(owned.as_raw_fd()) };
+    if stream.is_null() {
+        return Err(material_error(std::io::Error::last_os_error()));
+    }
+    std::mem::forget(owned);
+    let stream = Directory(stream);
+    let mut output = Vec::new();
+    let mut seen = BTreeSet::new();
+    loop {
+        collection.check()?;
+        // Reset errno before readdir so EOF can be distinguished from failure.
+        unsafe { *errno() = 0 };
+        // The stream remains owned until all returned name bytes are copied.
+        let entry = unsafe { libc::readdir(stream.0) };
+        if entry.is_null() {
+            // readdir sets errno on error and leaves the cleared value at EOF.
+            if unsafe { *errno() } != 0 {
+                return Err(material_error(std::io::Error::last_os_error()));
+            }
+            break;
+        }
+        // readdir supplies a NUL-terminated d_name valid until its next call.
+        let name = unsafe { CStr::from_ptr((*entry).d_name.as_ptr()) }.to_bytes();
+        if matches!(name, b"." | b"..") {
+            continue;
+        }
+        let name = std::str::from_utf8(name)
+            .map_err(material_error)?
+            .to_owned();
+        if !seen.insert(name.clone()) || output.len() >= ENTRY_LIMIT {
+            return Err(material_error(
+                "Git object directory repeats names or exceeds entry limit",
+            ));
+        }
+        output.push(name);
+    }
+    output.sort();
+    Ok(output)
+}
+
+fn hex(value: &str, length: usize) -> bool {
+    value.len() == length
+        && value
+            .bytes()
+            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+}
+
+struct CopyBudget {
+    bytes: u64,
+    entries: usize,
+}
+
+fn copy_file(
+    parent: &File,
+    name: &str,
+    destination: &Path,
+    budget: &mut CopyBudget,
+    collection: &GitCollection<'_>,
+) -> Result<(), Report<ReleaseError>> {
+    collection.check()?;
+    let mut input = open_at(parent, name.as_bytes(), false)?;
+    let before = input.metadata().map_err(material_error)?;
+    if !before.is_file() || before.nlink() != 1 || before.len() > RAW_LIMIT - budget.bytes {
+        return Err(material_error(
+            "Git object input must be a bounded regular single-link file",
+        ));
+    }
+    budget.entries += 1;
+    if budget.entries > ENTRY_LIMIT {
+        return Err(material_error("Git object input exceeds entry limit"));
+    }
+    let mut output = File::create_new(destination).map_err(material_error)?;
+    let mut copied = 0_u64;
+    let mut buffer = [0_u8; 64 * 1024];
+    loop {
+        collection.check()?;
+        let count = input.read(&mut buffer).map_err(material_error)?;
+        if count == 0 {
+            break;
+        }
+        copied += count as u64;
+        if copied > before.len() {
+            return Err(material_error("Git object input grew"));
+        }
+        output.write_all(&buffer[..count]).map_err(material_error)?;
+    }
+    if copied != before.len() || stamp(&before) != stamp(&input.metadata().map_err(material_error)?)
+    {
+        return Err(material_error("Git object input changed while copying"));
+    }
+    budget.bytes += copied;
+    Ok(())
+}
+
+/// Copies only canonical loose and pack objects under independent raw limits.
+pub(super) fn copy(
+    input: &Path,
+    destination: &Path,
+    collection: &GitCollection<'_>,
+) -> Result<(), Report<ReleaseError>> {
+    collection.check()?;
+    let root = anchor(input)?;
+    let before = root.metadata().map_err(material_error)?;
+    let mut budget = CopyBudget {
+        bytes: 0,
+        entries: 0,
+    };
+    for name in names(&root, collection)? {
+        if !(hex(&name, 2) || name == "pack" || name == "info") {
+            return Err(material_error("unsupported Git object input entry"));
+        }
+        let directory = open_at(&root, name.as_bytes(), true)?;
+        let directory_before = directory.metadata().map_err(material_error)?;
+        let children = names(&directory, collection)?;
+        fs::create_dir(destination.join(&name)).map_err(material_error)?;
+        let mut pack = BTreeSet::new();
+        let mut index = BTreeSet::new();
+        for child in children {
+            if name == "info" {
+                return Err(material_error("Git object info/indirection is forbidden"));
+            }
+            if name == "pack" {
+                let (base, extension) = child
+                    .rsplit_once('.')
+                    .ok_or_else(|| material_error("noncanonical Git pack name"))?;
+                if !base.strip_prefix("pack-").is_some_and(|oid| hex(oid, 40))
+                    || !matches!(extension, "pack" | "idx" | "rev")
+                {
+                    return Err(material_error("unsupported Git pack entry"));
+                }
+                if extension == "pack" {
+                    pack.insert(base.to_owned());
+                }
+                if extension == "idx" {
+                    index.insert(base.to_owned());
+                }
+            } else if !hex(&child, 38) {
+                return Err(material_error("noncanonical loose Git object name"));
+            }
+            copy_file(
+                &directory,
+                &child,
+                &destination.join(&name).join(&child),
+                &mut budget,
+                collection,
+            )?;
+        }
+        if name == "pack" && pack != index {
+            return Err(material_error("Git pack and index sets differ"));
+        }
+        if stamp(&directory_before) != stamp(&directory.metadata().map_err(material_error)?) {
+            return Err(material_error("Git object directory changed while copying"));
+        }
+    }
+    if stamp(&before) != stamp(&root.metadata().map_err(material_error)?) {
+        return Err(material_error("Git object root changed while copying"));
+    }
+    collection.check()
+}
diff --git a/crates/trusted-server-release/src/materials/git/tests.rs b/crates/trusted-server-release/src/materials/git/tests.rs
new file mode 100644
index 0000000000..98414e0df6
--- /dev/null
+++ b/crates/trusted-server-release/src/materials/git/tests.rs
@@ -0,0 +1,876 @@
+use std::collections::{BTreeMap, BTreeSet};
+use std::fs;
+use std::path::Path;
+use std::time::{Duration, Instant};
+
+use flate2::Compression;
+use flate2::write::ZlibEncoder;
+
+use super::*;
+use crate::git_objects::checked_sha1;
+use crate::materials::locked::CargoMaterials;
+
+const SELECTOR: &str = "git+https://example.com/fictional?rev=locked";
+
+fn temporary() -> tempfile::TempDir {
+    let root = fs::canonicalize(std::env::temp_dir()).expect("should resolve temporary parent");
+    tempfile::tempdir_in(root).expect("should create canonical temporary directory")
+}
+
+fn object(root: &Path, kind: &str, bytes: &[u8]) -> String {
+    let header = format!("{kind} {}\0", bytes.len());
+    let oid = checked_sha1(&[header.as_bytes(), bytes]).expect("should hash fixture object");
+    let path = root.join(&oid[..2]).join(&oid[2..]);
+    fs::create_dir_all(path.parent().expect("should have object parent"))
+        .expect("should create object directory");
+    let mut encoder = ZlibEncoder::new(Vec::new(), Compression::default());
+    encoder
+        .write_all(header.as_bytes())
+        .expect("should encode header");
+    encoder.write_all(bytes).expect("should encode body");
+    fs::write(path, encoder.finish().expect("should finish object"))
+        .expect("should write fixture object");
+    oid
+}
+
+fn fixture(root: &Path) -> String {
+    let blob = object(root, "blob", b"fictional dependency\n");
+    let mut tree = b"100644 Cargo.toml\0".to_vec();
+    tree.extend(hex::decode(blob).expect("should decode object id"));
+    let tree = object(root, "tree", &tree);
+    object(root, "commit", format!("tree {tree}\nauthor Fictional <author@example.com> 1 +0000\ncommitter Fictional <author@example.com> 1 +0000\n\nfictional commit\n").as_bytes())
+}
+
+fn locked(revision: &str) -> LockedMaterials {
+    LockedMaterials {
+        source_commit: "a".repeat(40),
+        cargo_lock_sha256: "b".repeat(64),
+        npm_lock_sha256: "c".repeat(64),
+        cargo: CargoMaterials {
+            registry: BTreeMap::new(),
+            git: BTreeSet::from([(SELECTOR.to_owned(), revision.to_owned())]),
+            git_packages: Vec::new(),
+        },
+        npm: BTreeMap::new(),
+    }
+}
+
+#[test]
+fn complete_loose_snapshot_is_verified_from_locked_commit() {
+    let input = temporary();
+    let revision = fixture(input.path());
+    let locked = locked(&revision);
+    let snapshot = locked
+        .git_collection(
+            Path::new("/usr/bin/git"),
+            Instant::now() + Duration::from_secs(30),
+            &Cancellation::default(),
+        )
+        .expect("should select local Git fixture")
+        .verify(SELECTOR, &revision, input.path())
+        .expect("should verify all selected objects");
+    assert_eq!(
+        snapshot.source_commit(),
+        "a".repeat(40),
+        "should bind source"
+    );
+    assert_eq!(
+        snapshot.cargo_lock_sha256(),
+        "b".repeat(64),
+        "should bind raw lockfile"
+    );
+    assert_eq!(snapshot.selector(), SELECTOR, "should bind exact selector");
+    assert_eq!(snapshot.revision(), revision, "should bind locked commit");
+    assert_eq!(
+        snapshot.root_tree().len(),
+        40,
+        "should retain root identity"
+    );
+    assert_eq!(snapshot.object_count(), 3, "should retain the full closure");
+    assert_ne!(
+        snapshot.object_store(),
+        input.path(),
+        "should own a new store"
+    );
+}
+
+fn collection(locked: &LockedMaterials) -> GitCollection<'_> {
+    locked
+        .git_collection(
+            Path::new("/usr/bin/git"),
+            Instant::now() + Duration::from_secs(60),
+            &Cancellation::default(),
+        )
+        .expect("should select Git for a bounded local fixture")
+}
+
+fn commit(root: &Path, tree: &str) -> String {
+    object(root, "commit", format!("tree {tree}\nauthor Fictional <author@example.com> 1 +0000\ncommitter Fictional <author@example.com> 1 +0000\n\nfixture\n").as_bytes())
+}
+
+fn tree(root: &Path, entries: &[(&[u8], &[u8], &str)]) -> String {
+    let mut bytes = Vec::new();
+    for (mode, name, oid) in entries {
+        bytes.extend_from_slice(mode);
+        bytes.push(b' ');
+        bytes.extend_from_slice(name);
+        bytes.push(0);
+        bytes.extend(hex::decode(oid).expect("should decode fixture identity"));
+    }
+    object(root, "tree", &bytes)
+}
+
+#[test]
+fn unselected_objects_are_not_retained_and_input_replacement_is_irrelevant() {
+    let input = temporary();
+    let revision = fixture(input.path());
+    let extra = object(input.path(), "blob", b"unselected material");
+    let locked = locked(&revision);
+    let snapshot = collection(&locked)
+        .verify(SELECTOR, &revision, input.path())
+        .expect("should verify selected closure");
+    assert!(
+        !snapshot
+            .object_store()
+            .join(&extra[..2])
+            .join(&extra[2..])
+            .exists(),
+        "should exclude unselected objects"
+    );
+    let retained = snapshot
+        .object_store()
+        .join(&revision[..2])
+        .join(&revision[2..]);
+    let before = fs::read(&retained).expect("should read retained commit");
+    fs::write(
+        input.path().join(&revision[..2]).join(&revision[2..]),
+        b"changed input",
+    )
+    .expect("should replace untrusted input");
+    assert_eq!(
+        fs::read(retained).expect("should read independent retained commit"),
+        before,
+        "should own an independent verified snapshot"
+    );
+}
+
+#[test]
+fn caller_cannot_choose_an_unlocked_selector_or_revision() {
+    let input = temporary();
+    let revision = fixture(input.path());
+    let locked = locked(&revision);
+    let collection = collection(&locked);
+    assert!(
+        collection
+            .verify("git+https://example.com/other", &revision, input.path())
+            .is_err(),
+        "should reject an unlocked selector"
+    );
+    assert!(
+        collection
+            .verify(SELECTOR, &"f".repeat(40), input.path())
+            .is_err(),
+        "should reject an unlocked revision"
+    );
+}
+
+#[test]
+fn locked_revision_must_select_a_commit_object() {
+    let input = temporary();
+    let revision = object(input.path(), "blob", b"not a commit");
+    let locked = locked(&revision);
+    assert!(
+        collection(&locked)
+            .verify(SELECTOR, &revision, input.path())
+            .is_err(),
+        "should reject an object of the wrong type"
+    );
+}
+
+#[test]
+fn changed_blob_bytes_fail_the_selected_object_identity() {
+    let input = temporary();
+    let revision = fixture(input.path());
+    let blob = object(input.path(), "blob", b"fictional dependency\n");
+    let different = object(input.path(), "blob", b"changed dependency\n");
+    fs::copy(
+        input.path().join(&different[..2]).join(&different[2..]),
+        input.path().join(&blob[..2]).join(&blob[2..]),
+    )
+    .expect("should replace blob bytes under old name");
+    let locked = locked(&revision);
+    assert!(
+        collection(&locked)
+            .verify(SELECTOR, &revision, input.path())
+            .is_err(),
+        "should rehash blob content independently of its filename"
+    );
+}
+
+#[test]
+fn unsafe_entry_outside_cargo_package_root_still_rejects() {
+    let input = temporary();
+    let blob = object(input.path(), "blob", b"fictional dependency");
+    let unrelated = tree(input.path(), &[(b"160000", b"unreviewed-submodule", &blob)]);
+    let root = tree(
+        input.path(),
+        &[
+            (b"100644", b"Cargo.toml", &blob),
+            (b"40000", b"unrelated", &unrelated),
+        ],
+    );
+    let revision = commit(input.path(), &root);
+    let locked = locked(&revision);
+    assert!(
+        collection(&locked)
+            .verify(SELECTOR, &revision, input.path())
+            .is_err(),
+        "should walk every selected subtree"
+    );
+}
+
+#[test]
+fn missing_blob_in_unrelated_subtree_still_rejects() {
+    let input = temporary();
+    let blob = object(input.path(), "blob", b"fictional dependency");
+    let unrelated = tree(input.path(), &[(b"100644", b"missing", &"d".repeat(40))]);
+    let root = tree(
+        input.path(),
+        &[
+            (b"100644", b"Cargo.toml", &blob),
+            (b"40000", b"unrelated", &unrelated),
+        ],
+    );
+    let revision = commit(input.path(), &root);
+    let locked = locked(&revision);
+    assert!(
+        collection(&locked)
+            .verify(SELECTOR, &revision, input.path())
+            .is_err(),
+        "should authenticate blobs outside selected crate roots"
+    );
+}
+
+#[test]
+fn unsafe_or_noncanonical_tree_entries_reject() {
+    let oid = "d".repeat(40);
+    for (mode, name) in [
+        (&b"160000"[..], &b"submodule"[..]),
+        (b"100664", b"mode"),
+        (b"100644", b".."),
+        (b"100644", b".Git"),
+        (b"100644", b"back\\slash"),
+        (b"100644", b"line\nbreak"),
+        (b"100644", b"a/b"),
+        (b"100644", b"trailing."),
+        (b"100644", b"trailing "),
+        (b"100644", b"colon:name"),
+        (b"100644", b"\xc3\xa9"),
+    ] {
+        let mut bytes = mode.to_vec();
+        bytes.push(b' ');
+        bytes.extend_from_slice(name);
+        bytes.push(0);
+        bytes.extend(hex::decode(&oid).expect("should decode fixture id"));
+        assert!(
+            parse_tree(&bytes).is_err(),
+            "should reject unsafe tree entry"
+        );
+    }
+    for names in [["A", "a"], ["a", "a"], ["z", "a"]] {
+        let mut bytes = Vec::new();
+        for name in names {
+            bytes.extend_from_slice(format!("100644 {name}\0").as_bytes());
+            bytes.extend(hex::decode(&oid).expect("should decode fixture id"));
+        }
+        assert!(
+            parse_tree(&bytes).is_err(),
+            "should reject aliases, duplicate names and noncanonical ordering"
+        );
+    }
+}
+
+#[test]
+fn linked_blobs_are_retained_as_inert_verified_objects() {
+    let input = temporary();
+    let target = object(input.path(), "blob", b"example readme bytes\n");
+    let link = object(input.path(), "blob", b"../README.md");
+    let package = tree(input.path(), &[(b"120000", b"README.md", &link)]);
+    let root = tree(
+        input.path(),
+        &[
+            (b"100644", b"README.md", &target),
+            (b"40000", b"package", &package),
+        ],
+    );
+    let revision = commit(input.path(), &root);
+    let locked = locked(&revision);
+    let snapshot = collection(&locked)
+        .verify(SELECTOR, &revision, input.path())
+        .expect("should retain authenticated link blobs without creating links");
+    assert_eq!(
+        snapshot.object_count(),
+        5,
+        "should retain the complete commit closure"
+    );
+    assert!(
+        snapshot
+            .object_store()
+            .join(&link[..2])
+            .join(&link[2..])
+            .is_file(),
+        "should retain the link target as an inert object"
+    );
+}
+
+#[test]
+fn input_configuration_and_alternates_never_supply_objects() {
+    let input = temporary();
+    let revision = fixture(input.path());
+    fs::create_dir(input.path().join("info")).expect("should create object info fixture");
+    fs::write(
+        input.path().join("info/alternates"),
+        b"/fictional/untrusted\n",
+    )
+    .expect("should write forbidden indirection");
+    let locked = locked(&revision);
+    assert!(
+        collection(&locked)
+            .verify(SELECTOR, &revision, input.path())
+            .is_err(),
+        "should reject object-store indirection"
+    );
+    fs::remove_file(input.path().join("info/alternates"))
+        .expect("should remove forbidden indirection");
+    fs::write(
+        input.path().join("config"),
+        b"[core]\nrepositoryformatversion=999\n",
+    )
+    .expect("should write forbidden configuration");
+    assert!(
+        collection(&locked)
+            .verify(SELECTOR, &revision, input.path())
+            .is_err(),
+        "should reject configuration inside object input"
+    );
+}
+
+#[test]
+fn input_ancestor_symlink_and_object_hardlink_are_rejected() {
+    let parent = temporary();
+    let input = parent.path().join("objects");
+    fs::create_dir(&input).expect("should create object root");
+    let revision = fixture(&input);
+    let locked = locked(&revision);
+    let alias = parent.path().join("alias");
+    std::os::unix::fs::symlink(&input, &alias).expect("should create ancestor alias");
+    assert!(
+        collection(&locked)
+            .verify(SELECTOR, &revision, &alias)
+            .is_err(),
+        "should reject aliased input ancestors"
+    );
+    let original = input.join(&revision[..2]).join(&revision[2..]);
+    fs::hard_link(&original, parent.path().join("hardlink"))
+        .expect("should create outside hardlink");
+    assert!(
+        collection(&locked)
+            .verify(SELECTOR, &revision, &input)
+            .is_err(),
+        "should reject hard-linked input files"
+    );
+}
+
+#[test]
+fn cancelled_and_expired_collections_fail_closed() {
+    let input = temporary();
+    let revision = fixture(input.path());
+    let locked = locked(&revision);
+    let cancellation = Cancellation::default();
+    let collection = locked
+        .git_collection(
+            Path::new("/usr/bin/git"),
+            Instant::now() + Duration::from_secs(60),
+            &cancellation,
+        )
+        .expect("should create live collection");
+    cancellation.cancel();
+    assert!(
+        collection
+            .verify(SELECTOR, &revision, input.path())
+            .is_err(),
+        "should reject cancelled work"
+    );
+    assert!(
+        locked
+            .git_collection(
+                Path::new("/usr/bin/git"),
+                Instant::now() - Duration::from_secs(1),
+                &Cancellation::default()
+            )
+            .is_err(),
+        "should reject an expired collection"
+    );
+}
+
+fn pack(input: &Path, revision: &str) {
+    let repository = input.parent().expect("should have repository parent");
+    fs::create_dir(repository.join("refs")).expect("should create bare refs");
+    fs::write(repository.join("HEAD"), b"ref: refs/heads/unused\n")
+        .expect("should write bare HEAD");
+    fs::write(
+        repository.join("config"),
+        b"[core]\nbare=true\nrepositoryformatversion=0\n",
+    )
+    .expect("should write bare config");
+    fs::create_dir(input.join("pack")).expect("should create pack directory");
+    let output = BoundedCommand::new(
+        Path::new("/usr/bin/git"),
+        repository,
+        ProcessLimits {
+            wall: Duration::from_secs(30),
+            stdout_max: 1024,
+            stderr_max: 4096,
+        },
+    )
+    .expect("should describe real Git fixture")
+    .arguments([
+        OsString::from("--git-dir"),
+        repository.as_os_str().to_owned(),
+        OsString::from("pack-objects"),
+        OsString::from("--revs"),
+        input.join("pack/pack").into_os_string(),
+    ])
+    .environment("HOME", repository)
+    .expect("should pin HOME")
+    .environment("GIT_CONFIG_NOSYSTEM", "1")
+    .expect("should disable system config")
+    .stdin_bytes(format!("{revision}\n").into_bytes())
+    .run()
+    .and_then(ProcessResult::require_success)
+    .expect("should create real Git pack and index");
+    assert_eq!(output.len(), 41, "should emit one pack identity");
+    for entry in fs::read_dir(input).expect("should read fixture object root") {
+        let entry = entry.expect("should read object entry");
+        if entry.file_name().len() == 2 {
+            fs::remove_dir_all(entry.path()).expect("should remove loose originals");
+        }
+    }
+}
+
+#[test]
+fn real_packed_objects_are_verified_and_reemitted_as_selected_loose_objects() {
+    let parent = temporary();
+    let input = parent.path().join("objects");
+    fs::create_dir(&input).expect("should create object root");
+    let revision = fixture(&input);
+    pack(&input, &revision);
+    let locked = locked(&revision);
+    let snapshot = collection(&locked)
+        .verify(SELECTOR, &revision, &input)
+        .expect("should independently verify real packed objects");
+    assert_eq!(
+        snapshot.object_count(),
+        3,
+        "should retain all selected objects"
+    );
+    assert!(
+        !snapshot.object_store().join("pack").exists(),
+        "should not retain incoming pack extras"
+    );
+}
+
+#[test]
+fn malformed_packed_material_fails_closed() {
+    let parent = temporary();
+    let input = parent.path().join("objects");
+    fs::create_dir(&input).expect("should create object root");
+    let revision = fixture(&input);
+    pack(&input, &revision);
+    let index = fs::read_dir(input.join("pack"))
+        .expect("should list packs")
+        .map(|entry| entry.expect("should read pack entry").path())
+        .find(|path| path.extension().is_some_and(|extension| extension == "idx"))
+        .expect("should have pack index");
+    fs::remove_file(&index).expect("should remove read-only fixture index");
+    fs::write(index, b"truncated index").expect("should corrupt pack index");
+    let locked = locked(&revision);
+    assert!(
+        collection(&locked)
+            .verify(SELECTOR, &revision, &input)
+            .is_err(),
+        "should reject malformed packed material"
+    );
+}
+
+#[test]
+fn decoded_budget_is_shared_across_separate_dependency_verifications() {
+    let input = temporary();
+    let revision = fixture(input.path());
+    let locked = locked(&revision);
+    let collection = collection(&locked);
+    collection
+        .verify(SELECTOR, &revision, input.path())
+        .expect("should verify first snapshot");
+    collection.objects.set_budget_for_tests(1);
+    assert!(
+        collection
+            .verify(SELECTOR, &revision, input.path())
+            .is_err(),
+        "should preserve collection budget instead of resetting per repository"
+    );
+}
+
+#[test]
+fn object_symlink_and_fifo_are_rejected_without_blocking() {
+    let input = temporary();
+    let revision = fixture(input.path());
+    let locked = locked(&revision);
+    let path = input.path().join(&revision[..2]).join(&revision[2..]);
+    fs::remove_file(&path).expect("should remove selected loose object");
+    std::os::unix::fs::symlink("/fictional/untrusted", &path)
+        .expect("should create dangling object alias");
+    assert!(
+        collection(&locked)
+            .verify(SELECTOR, &revision, input.path())
+            .is_err(),
+        "should reject symlink input objects"
+    );
+    fs::remove_file(&path).expect("should remove object alias");
+    let raw = std::ffi::CString::new(std::os::unix::ffi::OsStrExt::as_bytes(path.as_os_str()))
+        .expect("should encode FIFO path");
+    // The NUL-terminated path stays alive while mkfifo creates a test-only inode.
+    assert_eq!(
+        unsafe { libc::mkfifo(raw.as_ptr(), 0o600) },
+        0,
+        "should create FIFO fixture"
+    );
+    assert!(
+        collection(&locked)
+            .verify(SELECTOR, &revision, input.path())
+            .is_err(),
+        "should reject FIFO objects without waiting for a writer"
+    );
+}
+
+#[test]
+fn changed_selected_git_is_rejected_before_execution() {
+    let input = temporary();
+    let revision = fixture(input.path());
+    let locked = locked(&revision);
+    let tool_root = temporary();
+    let program = tool_root.path().join("git");
+    fs::copy("/usr/bin/git", &program).expect("should copy selected executable fixture");
+    let collection = locked
+        .git_collection(
+            &program,
+            Instant::now() + Duration::from_secs(30),
+            &Cancellation::default(),
+        )
+        .expect("should select fixture executable");
+    fs::write(&program, b"changed selected executable").expect("should mutate executable fixture");
+    assert!(
+        collection
+            .verify(SELECTOR, &revision, input.path())
+            .is_err(),
+        "should rejoin selected executable bytes before spawning"
+    );
+}
+
+#[test]
+fn deeply_nested_selected_tree_rejects_under_depth_bound() {
+    let input = temporary();
+    let mut root = object(input.path(), "tree", b"");
+    for _ in 0..TREE_DEPTH {
+        root = tree(input.path(), &[(b"40000", b"d", &root)]);
+    }
+    let revision = commit(input.path(), &root);
+    let locked = locked(&revision);
+    assert!(
+        collection(&locked)
+            .verify(SELECTOR, &revision, input.path())
+            .is_err(),
+        "should reject a selected tree deeper than the fixed bound"
+    );
+}
+
+#[test]
+fn truncated_pack_body_is_rejected() {
+    let parent = temporary();
+    let input = parent.path().join("objects");
+    fs::create_dir(&input).expect("should create object root");
+    let revision = fixture(&input);
+    pack(&input, &revision);
+    let body = fs::read_dir(input.join("pack"))
+        .expect("should list packs")
+        .map(|entry| entry.expect("should read pack entry").path())
+        .find(|path| {
+            path.extension()
+                .is_some_and(|extension| extension == "pack")
+        })
+        .expect("should have pack body");
+    fs::remove_file(&body).expect("should remove read-only fixture pack");
+    fs::write(body, b"PACK").expect("should truncate pack body");
+    let locked = locked(&revision);
+    assert!(
+        collection(&locked)
+            .verify(SELECTOR, &revision, &input)
+            .is_err(),
+        "should reject truncated packed material"
+    );
+}
+
+#[test]
+fn duplicate_root_tree_header_is_not_accepted() {
+    let input = temporary();
+    let tree = object(input.path(), "tree", b"");
+    let revision = object(
+        input.path(),
+        "commit",
+        format!("tree {tree}\ntree {tree}\n\nfixture\n").as_bytes(),
+    );
+    let locked = locked(&revision);
+    assert!(
+        collection(&locked)
+            .verify(SELECTOR, &revision, input.path())
+            .is_err(),
+        "should reject an ambiguous root-tree binding"
+    );
+}
+
+#[test]
+fn fifo_replacement_of_selected_git_does_not_wait_for_a_writer() {
+    let input = temporary();
+    let revision = fixture(input.path());
+    let locked = locked(&revision);
+    let tools = temporary();
+    let program = tools.path().join("git");
+    fs::copy("/usr/bin/git", &program).expect("should copy executable fixture");
+    let collection = locked
+        .git_collection(
+            &program,
+            Instant::now() + Duration::from_secs(30),
+            &Cancellation::default(),
+        )
+        .expect("should select copied executable");
+    fs::remove_file(&program).expect("should remove selected executable");
+    let raw = std::ffi::CString::new(std::os::unix::ffi::OsStrExt::as_bytes(program.as_os_str()))
+        .expect("should encode FIFO path");
+    // The test replaces an owned executable path with a test-only FIFO.
+    assert_eq!(
+        unsafe { libc::mkfifo(raw.as_ptr(), 0o700) },
+        0,
+        "should create FIFO replacement"
+    );
+    std::thread::scope(|scope| {
+        let (sender, receiver) = std::sync::mpsc::channel();
+        let worker = scope.spawn(move || {
+            let rejected = collection
+                .verify(SELECTOR, &revision, input.path())
+                .is_err();
+            sender
+                .send(rejected)
+                .expect("should report the FIFO verification outcome");
+        });
+        let outcome = receiver.recv_timeout(Duration::from_secs(10));
+        // A read/write nonblocking descriptor also releases a regressed reader
+        // that reaches open after the timeout, without relying on timer ordering.
+        let rescued = if outcome.is_err() {
+            Some(
+                std::fs::OpenOptions::new()
+                    .read(true)
+                    .write(true)
+                    .custom_flags(libc::O_NONBLOCK)
+                    .open(&program)
+                    .expect("should release a regressed blocking FIFO reader"),
+            )
+        } else {
+            None
+        };
+        worker
+            .join()
+            .expect("should join the FIFO verification worker");
+        let rejected = outcome
+            .unwrap_or_else(|_| receiver.recv().expect("should receive the rescued outcome"));
+        assert!(rejected, "should reject FIFO executable replacement");
+        assert!(
+            rescued.is_none(),
+            "should reject without requiring a FIFO writer"
+        );
+    });
+}
+
+fn independent_object_copy(input: &Path, output: &Path) {
+    let mut total = 0_u64;
+    let mut count = 0_usize;
+    for entry in fs::read_dir(input).expect("should list original object data") {
+        let entry = entry.expect("should read original object directory");
+        assert!(
+            fs::symlink_metadata(entry.path())
+                .expect("should inspect original object directory")
+                .is_dir(),
+            "should copy object directories only"
+        );
+        let name = entry.file_name();
+        let name = name.to_str().expect("should use canonical object names");
+        assert!(
+            name == "pack"
+                || name == "info"
+                || super::lower_oid(format!("{name}{}", "0".repeat(38)).as_bytes()),
+            "should reject unrelated object-store entries"
+        );
+        fs::create_dir(output.join(name)).expect("should create independent object directory");
+        for member in fs::read_dir(entry.path()).expect("should list object directory") {
+            let member = member.expect("should read original object member");
+            let metadata =
+                fs::symlink_metadata(member.path()).expect("should inspect original object member");
+            assert!(metadata.is_file(), "should not follow original aliases");
+            total += metadata.len();
+            count += 1;
+            assert!(
+                total <= 512 * 1024 * 1024 && count <= 100_000,
+                "should bound diagnostic input copying before original verification"
+            );
+            let destination = output.join(name).join(member.file_name());
+            fs::copy(member.path(), &destination).expect("should independently copy object bytes");
+            assert_eq!(
+                fs::metadata(destination)
+                    .expect("should inspect private copy")
+                    .nlink(),
+                1,
+                "should detach ambient cache hard links"
+            );
+        }
+    }
+}
+
+#[test]
+#[ignore = "requires explicitly selected current-lock Git object data; no acquisition qualification"]
+fn actual_current_lock_git_material_closure() {
+    let input = std::env::var_os("TS_RELEASE_CARGO_GIT_FIXTURE")
+        .map(PathBuf::from)
+        .expect("should explicitly select original Git object data");
+    let bytes = fs::read(Path::new(env!("CARGO_MANIFEST_DIR")).join("../../Cargo.lock"))
+        .expect("should read the actual current source lockfile");
+    let cargo = crate::materials::locked::parse_cargo(&bytes)
+        .expect("should parse all current locked identities");
+    assert_eq!(
+        cargo.git.len(),
+        1,
+        "should explicitly review the current unique Git material"
+    );
+    let (selector, revision) = cargo
+        .git
+        .iter()
+        .next()
+        .expect("should select locked Git material")
+        .clone();
+    let locked = LockedMaterials {
+        // This diagnostic fixture supplies no official source approval.
+        source_commit: "a".repeat(40),
+        cargo_lock_sha256: hex::encode(Sha256::digest(&bytes)),
+        npm_lock_sha256: "b".repeat(64),
+        cargo,
+        npm: BTreeMap::new(),
+    };
+    let copied = temporary();
+    independent_object_copy(&input, copied.path());
+    let snapshot = locked
+        .git_collection(
+            Path::new("/usr/bin/git"),
+            Instant::now() + Duration::from_secs(180),
+            &Cancellation::default(),
+        )
+        .expect("should select bounded local diagnostic Git")
+        .verify(&selector, &revision, copied.path())
+        .expect("should verify the actual current locked whole-tree material");
+    assert_eq!(
+        snapshot.revision(),
+        revision,
+        "should retain the exact current locked revision"
+    );
+    assert_eq!(
+        snapshot.selector(),
+        selector,
+        "should retain the exact current locked selector"
+    );
+    assert_eq!(
+        snapshot.object_count(),
+        557,
+        "should cover the independently measured current whole closure"
+    );
+    assert_eq!(
+        snapshot.cargo_lock_sha256(),
+        hex::encode(Sha256::digest(&bytes)),
+        "should bind exact current raw lock bytes"
+    );
+    let mut total = 0_u64;
+    let mut largest = 0_u64;
+    let mut blob_path = None;
+    for directory in
+        fs::read_dir(snapshot.object_store()).expect("should inspect retained object directories")
+    {
+        for member in fs::read_dir(directory.expect("should read retained directory").path())
+            .expect("should inspect retained objects")
+        {
+            let path = member.expect("should read retained object").path();
+            let decoder = flate2::read::ZlibDecoder::new(
+                fs::File::open(&path).expect("should open verified loose object"),
+            );
+            let mut decoded = Vec::new();
+            decoder
+                .take(32 * 1024 * 1024 + 128)
+                .read_to_end(&mut decoded)
+                .expect("should decode bounded verified loose object");
+            let end = decoded
+                .iter()
+                .position(|byte| *byte == 0)
+                .expect("should retain canonical object header");
+            let size = (decoded.len() - end - 1) as u64;
+            assert!(
+                size <= 32 * 1024 * 1024,
+                "should preserve the Cargo per-object bound"
+            );
+            total += size;
+            largest = largest.max(size);
+            if decoded.starts_with(b"blob ") {
+                blob_path = Some(path);
+            }
+        }
+    }
+    assert_eq!(
+        total, 6_334_558,
+        "should retain exactly the independently measured decoded closure bytes"
+    );
+    assert_eq!(
+        largest, 636_919,
+        "should retain the independently measured largest object"
+    );
+    assert!(
+        total <= 512 * 1024 * 1024,
+        "should remain within the shared Cargo budget"
+    );
+    let altered = temporary();
+    independent_object_copy(snapshot.object_store(), altered.path());
+    let blob = blob_path.expect("should retain at least one real blob");
+    let relative = blob
+        .strip_prefix(snapshot.object_store())
+        .expect("should select a private retained object");
+    fs::write(altered.path().join(relative), b"corrupt object")
+        .expect("should corrupt only independently copied data");
+    assert!(
+        collection(&locked)
+            .verify(&selector, &revision, altered.path())
+            .is_err(),
+        "should reject changed actual selected object bytes"
+    );
+    let root = snapshot.root_tree();
+    fs::remove_file(altered.path().join(&root[..2]).join(&root[2..]))
+        .expect("should remove the actual selected root tree from private data");
+    assert!(
+        collection(&locked)
+            .verify(&selector, &revision, altered.path())
+            .is_err(),
+        "should reject missing actual selected root tree"
+    );
+}
diff --git a/crates/trusted-server-release/src/materials/locked.rs b/crates/trusted-server-release/src/materials/locked.rs
new file mode 100644
index 0000000000..fd78954f87
--- /dev/null
+++ b/crates/trusted-server-release/src/materials/locked.rs
@@ -0,0 +1,262 @@
+//! Parses identities without granting acquisition or execution authority.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use base64::Engine as _;
+use base64::engine::general_purpose::STANDARD;
+use error_stack::Report;
+use serde_json::Value;
+
+use super::material_error;
+use crate::documents::{Role, lower_hex, parse_json};
+use crate::error::ReleaseError;
+
+// This runtime acquisition identity must match the approved lockfile registry.
+pub(super) const NPM_REGISTRY: &str = "https://registry.npmjs.org/"; // allow-domain: registry.npmjs.org
+pub(super) const CARGO_REGISTRY: &str = "registry+https://github.com/rust-lang/crates.io-index";
+
+/// One original npm distribution, retaining its installation-path join.
+pub(super) struct NpmMaterial {
+    pub(super) name: String,
+    pub(super) version: String,
+    pub(super) resolved: String,
+    pub(super) sha512: [u8; 64],
+}
+
+/// One registry crate's exact original distribution identity.
+pub(super) struct RegistryMaterial {
+    pub(super) name: String,
+    pub(super) version: String,
+    pub(super) sha256: String,
+}
+
+/// One Git package's exact locked identity.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(super) struct GitPackage {
+    pub(super) name: String,
+    pub(super) version: String,
+    /// Lock source without its `#<commit>` suffix, for example
+    /// `git+https://example.com/org/repo?tag=v1`.
+    pub(super) selector: String,
+    pub(super) revision: String,
+}
+
+/// Cargo acquisition expectations, not verified dependency trees.
+pub(super) struct CargoMaterials {
+    pub(super) registry: BTreeMap<(String, String), RegistryMaterial>,
+    pub(super) git: BTreeSet<(String, String)>,
+    pub(super) git_packages: Vec<GitPackage>,
+}
+
+fn text<'a>(value: &'a Value, field: &str) -> Result<&'a str, Report<ReleaseError>> {
+    value
+        .get(field)
+        .and_then(Value::as_str)
+        .filter(|value| !value.is_empty())
+        .ok_or_else(|| material_error(format!("locked npm package has no {field}")))
+}
+
+fn integrity(value: &str) -> Result<[u8; 64], Report<ReleaseError>> {
+    let encoded = value
+        .strip_prefix("sha512-")
+        .ok_or_else(|| material_error("npm archive requires one SHA-512 integrity"))?;
+    let bytes = STANDARD.decode(encoded).map_err(material_error)?;
+    if STANDARD.encode(&bytes) != encoded {
+        return Err(material_error("npm integrity is not canonical base64"));
+    }
+    bytes
+        .try_into()
+        .map_err(|_| material_error("npm SHA-512 identity must have 64 bytes"))
+}
+
+fn component(value: &str) -> bool {
+    !value.is_empty()
+        && value != "."
+        && value != ".."
+        && value
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'-'))
+}
+
+fn npm_name(name: &str) -> bool {
+    let parts: Vec<&str> = name.split('/').collect();
+    match parts.as_slice() {
+        [name] => component(name),
+        [scope, name] => scope.strip_prefix('@').is_some_and(component) && component(name),
+        _ => false,
+    }
+}
+
+pub(super) fn parse_npm(
+    bytes: &[u8],
+) -> Result<BTreeMap<String, NpmMaterial>, Report<ReleaseError>> {
+    let document = parse_json(bytes, Role::Metadata)?;
+    if document.get("lockfileVersion").and_then(Value::as_u64) != Some(3) {
+        return Err(material_error("npm lockfile must use version 3"));
+    }
+    let packages = document
+        .get("packages")
+        .and_then(Value::as_object)
+        .ok_or_else(|| material_error("npm lockfile has no package table"))?;
+    let mut result = BTreeMap::new();
+    for (path, package) in packages {
+        if path.is_empty() {
+            continue;
+        }
+        if !path.starts_with("node_modules/")
+            || path.contains('\\')
+            || path
+                .split('/')
+                .any(|part| part.is_empty() || part == "." || part == "..")
+            || path.chars().any(char::is_control)
+        {
+            return Err(material_error(
+                "npm installation path is not a safe locked location",
+            ));
+        }
+        let locations = path
+            .strip_prefix("node_modules/")
+            .ok_or_else(|| material_error("missing locked installation prefix"))?;
+        if locations
+            .split("/node_modules/")
+            .any(|name| !npm_name(name))
+        {
+            return Err(material_error("invalid nested npm installation location"));
+        }
+        let inferred = path
+            .rsplit("node_modules/")
+            .next()
+            .ok_or_else(|| material_error("missing npm package name"))?;
+        let name = package
+            .get("name")
+            .map(|value| {
+                value
+                    .as_str()
+                    .ok_or_else(|| material_error("locked npm name must be a string"))
+            })
+            .transpose()?
+            .unwrap_or(inferred);
+        if name != inferred {
+            return Err(material_error(
+                "npm aliases are outside the supported material contract",
+            ));
+        }
+        let linked = package
+            .get("link")
+            .map(|value| {
+                value
+                    .as_bool()
+                    .ok_or_else(|| material_error("locked npm link selector must be a boolean"))
+            })
+            .transpose()?
+            .unwrap_or(false);
+        let version = text(package, "version")?;
+        if !npm_name(name)
+            || !version
+                .bytes()
+                .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'-' | b'+'))
+        {
+            return Err(material_error(
+                "npm identity contains unsupported path or version characters",
+            ));
+        }
+        let resolved = text(package, "resolved")?;
+        let basename = name
+            .rsplit('/')
+            .next()
+            .ok_or_else(|| material_error("invalid npm package name"))?;
+        let expected = format!("{NPM_REGISTRY}{name}/-/{basename}-{version}.tgz");
+        if resolved != expected || linked {
+            return Err(material_error(
+                "npm distribution is not its canonical registry archive",
+            ));
+        }
+        result.insert(
+            path.clone(),
+            NpmMaterial {
+                name: name.to_owned(),
+                version: version.to_owned(),
+                resolved: resolved.to_owned(),
+                sha512: integrity(text(package, "integrity")?)?,
+            },
+        );
+    }
+    Ok(result)
+}
+
+pub(super) fn parse_cargo(bytes: &[u8]) -> Result<CargoMaterials, Report<ReleaseError>> {
+    let text = std::str::from_utf8(bytes).map_err(material_error)?;
+    let lock: toml::Value = toml::from_str(text).map_err(material_error)?;
+    if lock.get("version").and_then(toml::Value::as_integer) != Some(4) {
+        return Err(material_error("Cargo lockfile must use version 4"));
+    }
+    let packages = lock
+        .get("package")
+        .and_then(toml::Value::as_array)
+        .ok_or_else(|| material_error("Cargo lockfile has no package array"))?;
+    let mut result = CargoMaterials {
+        registry: BTreeMap::new(),
+        git: BTreeSet::new(),
+        git_packages: Vec::new(),
+    };
+    let mut identities = BTreeSet::new();
+    for package in packages {
+        let field = |key| {
+            package
+                .get(key)
+                .and_then(toml::Value::as_str)
+                .ok_or_else(|| material_error(format!("Cargo package has no {key}")))
+        };
+        let name = field("name")?;
+        let version = field("version")?;
+        let source = package
+            .get("source")
+            .map(|value| {
+                value
+                    .as_str()
+                    .ok_or_else(|| material_error("Cargo source must be a string"))
+            })
+            .transpose()?;
+        if !identities.insert((name, version, source)) {
+            return Err(material_error("duplicate Cargo package identity"));
+        }
+        match source {
+            None => {}
+            Some(CARGO_REGISTRY) => {
+                let checksum = field("checksum")?;
+                if !lower_hex(checksum, 64) {
+                    return Err(material_error("registry archive has no exact SHA-256"));
+                }
+                result.registry.insert(
+                    (name.to_owned(), version.to_owned()),
+                    RegistryMaterial {
+                        name: name.to_owned(),
+                        version: version.to_owned(),
+                        sha256: checksum.to_owned(),
+                    },
+                );
+            }
+            Some(source) if source.starts_with("git+https://") => {
+                let (repository, commit) = source
+                    .rsplit_once('#')
+                    .ok_or_else(|| material_error("Git material lacks a locked revision"))?;
+                if !lower_hex(commit, 40) || repository.chars().any(char::is_control) {
+                    return Err(material_error(
+                        "Git material requires a full lowercase revision",
+                    ));
+                }
+                result
+                    .git
+                    .insert((repository.to_owned(), commit.to_owned()));
+                result.git_packages.push(GitPackage {
+                    name: name.to_owned(),
+                    version: version.to_owned(),
+                    selector: repository.to_owned(),
+                    revision: commit.to_owned(),
+                });
+            }
+            Some(_) => return Err(material_error("unsupported Cargo material source")),
+        }
+    }
+    Ok(result)
+}
diff --git a/crates/trusted-server-release/src/materials/manifest.rs b/crates/trusted-server-release/src/materials/manifest.rs
new file mode 100644
index 0000000000..37bd717325
--- /dev/null
+++ b/crates/trusted-server-release/src/materials/manifest.rs
@@ -0,0 +1,391 @@
+//! Reviews declarations only; this module never observes or executes hooks.
+
+use error_stack::Report;
+use serde_json::{Map, Value};
+use sha2::{Digest as _, Sha256};
+
+use super::{ExtractedOriginal, material_error};
+use crate::documents::{Role, parse_json};
+use crate::error::ReleaseError;
+use crate::source::ApprovedSource;
+
+const ROOT_MANIFEST: &str = "crates/trusted-server-js/lib/package.json";
+const ROOT_BINDING: &str = "crates/trusted-server-js/lib/binding.gyp";
+const ROOT_EVENTS: [&str; 10] = [
+    "preinstall",
+    "install",
+    "postinstall",
+    "prepublish",
+    "preprepare",
+    "prepare",
+    "postprepare",
+    "predependencies",
+    "dependencies",
+    "postdependencies",
+];
+
+// These exact declarations are source-owned policy, separate from observations.
+const REVIEWED_HOOKS: [(&str, &str, &str, &str); 2] = [
+    (
+        "core-js",
+        "3.48.0",
+        "postinstall",
+        "node -e \"try{require('./postinstall')}catch(e){}\"",
+    ),
+    ("esbuild", "0.27.3", "postinstall", "node install.js"),
+];
+
+/// Approved root manifest declarations, without lifecycle execution authority.
+pub(crate) struct RootManifestReview {
+    source_commit: String,
+    manifest_sha256: String,
+}
+
+impl RootManifestReview {
+    /// Returns the approved source identity supplying the reviewed declarations.
+    pub(crate) fn source_commit(&self) -> &str {
+        &self.source_commit
+    }
+}
+
+/// A declared install hook; this is not an observed lifecycle event.
+pub(crate) struct DeclaredHook {
+    event: String,
+    script_sha256: String,
+}
+
+impl DeclaredHook {
+    /// Returns the reviewed npm event name.
+    pub(crate) fn event(&self) -> &str {
+        &self.event
+    }
+
+    /// Returns the hash of exact UTF-8 command bytes from the verified manifest.
+    pub(crate) fn script_sha256(&self) -> &str {
+        &self.script_sha256
+    }
+}
+
+/// Reviewed declarations from one retained, authenticated npm original.
+///
+/// This type cannot construct a lifecycle observation or completed build.
+pub(crate) struct ReviewedNpmManifest {
+    extracted: ExtractedOriginal,
+    manifest_sha256: String,
+    hooks: Vec<DeclaredHook>,
+}
+
+impl ReviewedNpmManifest {
+    /// Returns exact original member facts after rechecking retained extraction.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for a stale extraction or absent member.
+    pub(super) fn member_facts(
+        &self,
+        relative: &str,
+    ) -> Result<(String, u64, u32), Report<ReleaseError>> {
+        self.extracted.member_facts(relative)
+    }
+    /// Rechecks all archive members before preparation consumes this review.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the retained extraction changed or expired.
+    pub(crate) fn verify_unchanged(&self) -> Result<(), Report<ReleaseError>> {
+        self.extracted.verify_unchanged()
+    }
+
+    /// Copies the authenticated compressed original for a new private cache.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if retained original bytes changed or copying fails.
+    pub(super) fn copy_original(
+        &mut self,
+        destination: &mut impl std::io::Write,
+    ) -> Result<(), Report<ReleaseError>> {
+        self.extracted.copy_original(destination)
+    }
+    /// Returns declarations only, without claiming any hook was executed.
+    pub(crate) fn hooks(&self) -> &[DeclaredHook] {
+        &self.hooks
+    }
+}
+
+/// Reviews only approved tracked root declarations.
+///
+/// # Errors
+///
+/// Returns an error for changed source, malformed manifests or root lifecycle hooks.
+pub(super) fn review_root(
+    source: &ApprovedSource,
+) -> Result<RootManifestReview, Report<ReleaseError>> {
+    source.snapshot().verify_unchanged()?;
+    let bytes = source.read_tracked(ROOT_MANIFEST, Role::Metadata)?;
+    let document = parse_json(&bytes, Role::Metadata)?;
+    review_root_document(&document, source.tracked_sha256(ROOT_BINDING).is_some())?;
+    source.snapshot().verify_unchanged()?;
+    Ok(RootManifestReview {
+        source_commit: source.commit().as_str().to_owned(),
+        manifest_sha256: hex::encode(Sha256::digest(&bytes)),
+    })
+}
+
+/// Reviews exact dependency declarations from authenticated archive members.
+///
+/// # Errors
+///
+/// Returns an error for changed members, identity substitutions or unreviewed hooks.
+pub(super) fn review_npm(
+    extracted: ExtractedOriginal,
+    name: &str,
+    version: &str,
+) -> Result<ReviewedNpmManifest, Report<ReleaseError>> {
+    let bytes = extracted.read_member_checked("package.json")?;
+    let document = parse_json(&bytes, Role::Metadata)?;
+    let binding = extracted.contains_member_checked("binding.gyp")?;
+    let hooks = declared_hooks(&document, name, version, binding)?;
+    Ok(ReviewedNpmManifest {
+        extracted,
+        manifest_sha256: hex::encode(Sha256::digest(&bytes)),
+        hooks,
+    })
+}
+
+fn scripts(document: &Value) -> Result<Option<&Map<String, Value>>, Report<ReleaseError>> {
+    let object = document
+        .as_object()
+        .ok_or_else(|| material_error("package manifest must be an object"))?;
+    match object.get("scripts") {
+        None => Ok(None),
+        Some(Value::Object(scripts)) if scripts.values().all(Value::is_string) => Ok(Some(scripts)),
+        Some(_) => Err(material_error(
+            "manifest scripts must contain command strings",
+        )),
+    }
+}
+
+fn review_root_document(document: &Value, binding: bool) -> Result<(), Report<ReleaseError>> {
+    let scripts = scripts(document)?;
+    if binding
+        || ROOT_EVENTS
+            .iter()
+            .any(|event| scripts.is_some_and(|scripts| scripts.contains_key(*event)))
+    {
+        return Err(material_error(
+            "root npm ci lifecycle hooks and implicit installs are not allowed",
+        ));
+    }
+    Ok(())
+}
+
+fn declared_hooks(
+    document: &Value,
+    name: &str,
+    version: &str,
+    binding: bool,
+) -> Result<Vec<DeclaredHook>, Report<ReleaseError>> {
+    if document.get("name").and_then(Value::as_str) != Some(name)
+        || document.get("version").and_then(Value::as_str) != Some(version)
+    {
+        return Err(material_error(
+            "verified package manifest differs from locked package identity",
+        ));
+    }
+    let scripts = scripts(document)?;
+    if binding
+        && !scripts.is_some_and(|scripts| {
+            scripts.contains_key("preinstall") || scripts.contains_key("install")
+        })
+    {
+        return Err(material_error(
+            "implicit binding.gyp installs are not reviewed",
+        ));
+    }
+    let mut result = Vec::new();
+    for event in ["preinstall", "install", "postinstall"] {
+        let Some(command) = scripts
+            .and_then(|scripts| scripts.get(event))
+            .and_then(Value::as_str)
+        else {
+            continue;
+        };
+        if !REVIEWED_HOOKS.contains(&(name, version, event, command)) {
+            return Err(material_error(
+                "dependency install hook has no exact source-owned review",
+            ));
+        }
+        result.push(DeclaredHook {
+            event: event.to_owned(),
+            script_sha256: hex::encode(Sha256::digest(command.as_bytes())),
+        });
+    }
+    Ok(result)
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use super::*;
+
+    #[test]
+    fn empty_development_script_does_not_authorize_a_lifecycle_hook() {
+        let mut manifest =
+            json!({"name":"fictional-package","version":"1.0.0","scripts":{"test":""}});
+        assert!(
+            declared_hooks(&manifest, "fictional-package", "1.0.0", false)
+                .expect("should accept an unused empty development script")
+                .is_empty(),
+            "should declare no install execution from a development script"
+        );
+        assert!(
+            review_root_document(&manifest, false).is_ok(),
+            "should allow a root development script without lifecycle declarations"
+        );
+        manifest["scripts"]["postinstall"] = json!("");
+        assert!(
+            declared_hooks(&manifest, "fictional-package", "1.0.0", false).is_err(),
+            "should still reject an unreviewed empty lifecycle declaration"
+        );
+        assert!(
+            review_root_document(&manifest, false).is_err(),
+            "should still reject root lifecycle declarations"
+        );
+    }
+
+    #[test]
+    fn root_review_allows_build_scripts_but_rejects_all_ci_hooks() {
+        let mut manifest = json!({"name":"fictional-project", "scripts":{"build":"node build.mjs", "test":"vitest run"}});
+        assert!(
+            review_root_document(&manifest, false).is_ok(),
+            "should allow ordinary explicit build and test scripts"
+        );
+        assert!(
+            review_root_document(&manifest, true).is_err(),
+            "should reject implicit root binding install"
+        );
+        for event in [
+            "preinstall",
+            "install",
+            "postinstall",
+            "prepublish",
+            "preprepare",
+            "prepare",
+            "postprepare",
+            "predependencies",
+            "dependencies",
+            "postdependencies",
+        ] {
+            manifest["scripts"][event] = json!("node fictional-hook.mjs");
+            assert!(
+                review_root_document(&manifest, false).is_err(),
+                "should reject root lifecycle hook"
+            );
+            manifest["scripts"]
+                .as_object_mut()
+                .expect("should have scripts object")
+                .remove(event);
+        }
+    }
+
+    #[test]
+    fn dependency_review_requires_exact_source_owned_hook_tuples() {
+        let manifest = json!({"name":"fictional-package", "version":"1.0.0"});
+        assert!(
+            declared_hooks(&manifest, "fictional-package", "1.0.0", false)
+                .expect("should accept package without hooks")
+                .is_empty(),
+            "should declare no hook execution"
+        );
+        assert!(
+            declared_hooks(&manifest, "other-package", "1.0.0", false).is_err(),
+            "should reject manifest identity substitution"
+        );
+        assert!(
+            declared_hooks(&manifest, "fictional-package", "1.0.0", true).is_err(),
+            "should reject implicit binding install"
+        );
+        for (name, version, command) in [
+            (
+                "core-js",
+                "3.48.0",
+                "node -e \"try{require('./postinstall')}catch(e){}\"",
+            ),
+            ("esbuild", "0.27.3", "node install.js"),
+        ] {
+            let mut manifest =
+                json!({"name":name,"version":version,"scripts":{"postinstall":command}});
+            assert_eq!(
+                declared_hooks(&manifest, name, version, false)
+                    .expect("should match exact reviewed declaration")
+                    .len(),
+                1,
+                "should return one declaration"
+            );
+            manifest["scripts"]["postinstall"] = json!(format!("{command} "));
+            assert!(
+                declared_hooks(&manifest, name, version, false).is_err(),
+                "should reject changed command bytes"
+            );
+            manifest["scripts"]["postinstall"] = json!(command);
+            manifest["scripts"]["install"] = json!("node other.mjs");
+            assert!(
+                declared_hooks(&manifest, name, version, false).is_err(),
+                "should reject added lifecycle command"
+            );
+        }
+    }
+
+    #[test]
+    fn rejects_malformed_scripts_and_hashes_the_exact_declared_command() {
+        for scripts in [
+            Value::Null,
+            json!([]),
+            json!({"postinstall":42}),
+            json!({"postinstall":""}),
+        ] {
+            let manifest =
+                json!({"name":"fictional-package", "version":"1.0.0", "scripts":scripts});
+            assert!(
+                declared_hooks(&manifest, "fictional-package", "1.0.0", false).is_err(),
+                "should reject malformed script declarations"
+            );
+        }
+        let manifest = json!({"name":"esbuild", "version":"0.27.3", "scripts":{"postinstall":"node install.js"}});
+        let declarations = declared_hooks(&manifest, "esbuild", "0.27.3", false)
+            .expect("should match reviewed command");
+        assert_eq!(
+            declarations[0].event(),
+            "postinstall",
+            "should preserve declared event"
+        );
+        assert_eq!(
+            declarations[0].script_sha256(),
+            "912d4d8f507b7b392ae422a459f98da94669a742e4cc43cfe061e630ee2846fe",
+            "should hash exact UTF-8 command bytes"
+        );
+        let mut changed = manifest;
+        changed["version"] = json!("0.27.4");
+        assert!(
+            declared_hooks(&changed, "esbuild", "0.27.4", false).is_err(),
+            "should reject unreviewed locked version"
+        );
+        let prepare = json!({"name":"fictional-package", "version":"1.0.0", "scripts":{"prepare":"node source-only.mjs"}});
+        assert!(
+            declared_hooks(&prepare, "fictional-package", "1.0.0", false)
+                .expect("should parse registry manifest")
+                .is_empty(),
+            "should not infer registry prepare execution"
+        );
+        assert!(
+            parse_json(
+                br#"{"name":"fictional-package","name":"substitute","version":"1.0.0"}"#,
+                Role::Metadata
+            )
+            .is_err(),
+            "should reject duplicate manifest keys before selection"
+        );
+    }
+}
diff --git a/crates/trusted-server-release/src/materials/npm_bundle.rs b/crates/trusted-server-release/src/materials/npm_bundle.rs
new file mode 100644
index 0000000000..d76575079a
--- /dev/null
+++ b/crates/trusted-server-release/src/materials/npm_bundle.rs
@@ -0,0 +1,314 @@
+//! Original-only inputs shared read-only by fresh npm installations.
+
+use std::collections::BTreeMap;
+use std::collections::btree_map::Entry;
+use std::fs::File;
+use std::path::{Path, PathBuf};
+use std::time::Instant;
+
+use error_stack::Report;
+use tempfile::TempDir;
+
+use super::{LockedMaterials, ReviewedNpmManifest, material_error};
+use crate::documents::hash_bounded_with_check;
+use crate::error::ReleaseError;
+use crate::process::Cancellation;
+
+/// Retained originals and manifest reviews, without installed build authority.
+pub(crate) struct PreparedNpmOriginals {
+    directory: TempDir,
+    originals: BTreeMap<String, String>,
+    reviews: BTreeMap<String, ReviewedNpmManifest>,
+    source_commit: String,
+    lock_sha256: String,
+    deadline: Instant,
+    cancellation: Cancellation,
+}
+
+impl PreparedNpmOriginals {
+    /// Measures the selected Linux esbuild executable from its original archive.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for unsupported architectures, absent originals or a
+    /// stale extraction. These are original facts, not installed observations.
+    pub(crate) fn native_esbuild(
+        &self,
+        architecture: &str,
+    ) -> Result<serde_json::Value, Report<ReleaseError>> {
+        let architecture = match architecture {
+            "x86_64" => "x64",
+            "aarch64" => "arm64",
+            other => other,
+        };
+        if !matches!(architecture, "x64" | "arm64") {
+            return Err(material_error(
+                "unsupported Linux JS preparation architecture",
+            ));
+        }
+        let location = format!("node_modules/@esbuild/linux-{architecture}");
+        let review = self
+            .reviews
+            .get(&location)
+            .ok_or_else(|| material_error("required native esbuild original is absent"))?;
+        let (sha256, size, mode) = review.member_facts("bin/esbuild")?;
+        Ok(serde_json::json!({"lock_path":location,"sha256":sha256,"size":size,"mode":mode}))
+    }
+    /// Returns exact reviewed declarations for joining real lifecycle events.
+    pub(crate) fn declared_hooks(&self) -> BTreeMap<(String, String), String> {
+        self.reviews
+            .iter()
+            .flat_map(|(location, review)| {
+                review.hooks().iter().map(|hook| {
+                    (
+                        (location.clone(), hook.event().to_owned()),
+                        hook.script_sha256().to_owned(),
+                    )
+                })
+            })
+            .collect()
+    }
+    /// Returns the private original archive root for a read-only mount.
+    pub(crate) fn root(&self) -> &Path {
+        self.directory.path()
+    }
+
+    /// Returns sorted authenticated archive paths, never extracted replacements.
+    pub(crate) fn archive_paths(&self) -> Vec<PathBuf> {
+        self.originals
+            .keys()
+            .map(|name| self.root().join(name))
+            .collect()
+    }
+
+    /// Returns the approved source and raw lockfile bindings.
+    pub(crate) fn source_binding(&self) -> (&str, &str) {
+        (&self.source_commit, &self.lock_sha256)
+    }
+
+    /// Rechecks every retained original and reviewed extraction before use.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for changed originals, stale extractions or expiration.
+    pub(crate) fn verify_unchanged(&self) -> Result<(), Report<ReleaseError>> {
+        let check = || check_attempt(self.deadline, &self.cancellation);
+        check()?;
+        for (name, expected) in &self.originals {
+            let raw = hash_bounded_with_check(&self.root().join(name), 64 * 1024 * 1024, &check)?;
+            if raw.sha256 != *expected {
+                return Err(material_error("retained npm original changed"));
+            }
+        }
+        for review in self.reviews.values() {
+            check()?;
+            review.verify_unchanged()?;
+        }
+        check()
+    }
+}
+
+impl LockedMaterials {
+    /// Authenticates and reviews all locked npm originals into private state.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for any absent or changed archive, unsafe extraction,
+    /// unreviewed manifest, canceled attempt or failed private write. Optional
+    /// platform packages receive the same original checks before npm selects
+    /// which ones to install. Input filenames come only from locked SHA-512.
+    pub(crate) fn prepare_npm_originals(
+        &self,
+        inputs: &Path,
+        deadline: Instant,
+        cancellation: &Cancellation,
+    ) -> Result<PreparedNpmOriginals, Report<ReleaseError>> {
+        let directory = tempfile::tempdir().map_err(material_error)?;
+        let mut originals = BTreeMap::new();
+        let mut reviews = BTreeMap::new();
+        for (location, locked) in &self.npm {
+            check_attempt(deadline, cancellation)?;
+            let name = format!("{}.tgz", hex::encode(locked.sha512));
+            let verified = self
+                .verify_npm(location, &inputs.join(&name), deadline, cancellation)
+                .map_err(|report| {
+                    report.attach(format!(
+                        "authenticating locked npm package `{location}` original `{name}`"
+                    ))
+                })?;
+            let expected_sha256 = verified.sha256().to_owned();
+            let extracted = self.extract_npm(location, verified).map_err(|report| {
+                report.attach(format!(
+                    "extracting authenticated locked npm package `{location}`"
+                ))
+            })?;
+            let mut reviewed = self.review_npm(location, extracted).map_err(|report| {
+                report.attach(format!(
+                    "reviewing authenticated locked npm package `{location}`"
+                ))
+            })?;
+            reviewed.verify_unchanged()?;
+            if let Entry::Vacant(entry) = originals.entry(name) {
+                let name = entry.key();
+                let path = directory.path().join(name);
+                let mut file = File::create_new(&path).map_err(material_error)?;
+                reviewed.copy_original(&mut file)?;
+                drop(file);
+                let measured = hash_bounded_with_check(&path, 64 * 1024 * 1024, &|| {
+                    check_attempt(deadline, cancellation)
+                })?;
+                if measured.sha256 != expected_sha256 {
+                    return Err(material_error(
+                        "copied npm original differs from authenticated bytes",
+                    ));
+                }
+                entry.insert(expected_sha256);
+            }
+            reviews.insert(location.to_owned(), reviewed);
+        }
+        let prepared = PreparedNpmOriginals {
+            directory,
+            originals,
+            reviews,
+            source_commit: self.source_commit.clone(),
+            lock_sha256: self.npm_lock_sha256.clone(),
+            deadline,
+            cancellation: cancellation.clone(),
+        };
+        prepared.verify_unchanged()?;
+        Ok(prepared)
+    }
+}
+
+fn check_attempt(
+    deadline: Instant,
+    cancellation: &Cancellation,
+) -> Result<(), Report<ReleaseError>> {
+    if cancellation.is_cancelled() || Instant::now() >= deadline {
+        return Err(material_error(
+            "npm original collection cancelled or timed out",
+        ));
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use std::fs;
+    use std::time::Duration;
+
+    use sha2::{Digest as _, Sha256};
+
+    use super::*;
+
+    fn fixture() -> PreparedNpmOriginals {
+        let directory = tempfile::tempdir().expect("should create retained originals");
+        fs::write(directory.path().join("original.tgz"), b"original")
+            .expect("should retain fixture original");
+        PreparedNpmOriginals {
+            directory,
+            originals: BTreeMap::from([(
+                "original.tgz".to_owned(),
+                hex::encode(Sha256::digest(b"original")),
+            )]),
+            reviews: BTreeMap::new(),
+            source_commit: "a".repeat(40),
+            lock_sha256: "b".repeat(64),
+            deadline: Instant::now() + Duration::from_secs(30),
+            cancellation: Cancellation::default(),
+        }
+    }
+
+    #[test]
+    fn retained_original_rechecks_obey_attempt_controls() {
+        let prepared = fixture();
+        prepared
+            .verify_unchanged()
+            .expect("should hash retained original");
+        prepared.cancellation.cancel();
+        assert!(
+            prepared.verify_unchanged().is_err(),
+            "should reject retained canceled attempts"
+        );
+        let mut prepared = fixture();
+        prepared.deadline = Instant::now();
+        assert!(
+            prepared.verify_unchanged().is_err(),
+            "should reject retained expired attempts"
+        );
+    }
+
+    #[test]
+    fn retained_original_rechecks_keep_the_archive_bound_and_digest() {
+        let prepared = fixture();
+        let path = prepared.archive_paths().remove(0);
+        fs::write(&path, b"tampered").expect("should change retained bytes");
+        assert!(
+            prepared.verify_unchanged().is_err(),
+            "should reject changed retained digest"
+        );
+        fs::File::create(path)
+            .expect("should create sparse oversized archive")
+            .set_len(64 * 1024 * 1024 + 1)
+            .expect("should exceed original archive limit");
+        assert!(
+            prepared.verify_unchanged().is_err(),
+            "should reject oversized retained archives before allocation"
+        );
+    }
+
+    #[test]
+    #[ignore = "requires explicitly supplied current-lock original archives; no acquisition qualification"]
+    fn actual_current_lock_npm_originals() {
+        let inputs = std::env::var_os("TS_RELEASE_NPM_ORIGINALS")
+            .map(PathBuf::from)
+            .expect("should explicitly supply current locked compressed originals");
+        let bytes = include_bytes!("../../../trusted-server-js/lib/package-lock.json");
+        let npm = crate::materials::locked::parse_npm(bytes)
+            .expect("should parse every actual current npm lock identity");
+        let count = npm.len();
+        let archives: std::collections::BTreeSet<_> =
+            npm.values().map(|entry| entry.sha512).collect();
+        assert!(count > 0, "should select nonzero current locked packages");
+        let locked = LockedMaterials {
+            // This original-format diagnostic supplies no official source approval.
+            source_commit: "a".repeat(40),
+            cargo_lock_sha256: "b".repeat(64),
+            npm_lock_sha256: hex::encode(Sha256::digest(bytes)),
+            cargo: crate::materials::locked::CargoMaterials {
+                registry: BTreeMap::new(),
+                git: std::collections::BTreeSet::new(),
+                git_packages: Vec::new(),
+            },
+            npm,
+        };
+        let prepared = locked
+            .prepare_npm_originals(
+                &inputs,
+                Instant::now() + Duration::from_secs(600),
+                &Cancellation::default(),
+            )
+            .expect("should authenticate, extract and review every actual current npm original");
+        assert_eq!(
+            prepared.reviews.len(),
+            count,
+            "should review every locked package including optional platform entries"
+        );
+        assert_eq!(
+            prepared.archive_paths().len(),
+            archives.len(),
+            "should retain every distinct original compressed distribution"
+        );
+        assert_eq!(
+            prepared.source_binding(),
+            (
+                "a".repeat(40).as_str(),
+                hex::encode(Sha256::digest(bytes)).as_str()
+            ),
+            "should retain the diagnostic source and exact current raw lock binding"
+        );
+        prepared
+            .verify_unchanged()
+            .expect("should rejoin every retained original and complete reviewed extraction");
+    }
+}
diff --git a/crates/trusted-server-release/src/materials/tests.rs b/crates/trusted-server-release/src/materials/tests.rs
new file mode 100644
index 0000000000..9d71426a40
--- /dev/null
+++ b/crates/trusted-server-release/src/materials/tests.rs
@@ -0,0 +1,417 @@
+use crate::process::Cancellation;
+use base64::Engine as _;
+use base64::engine::general_purpose::STANDARD;
+use flate2::{Compression, write::GzEncoder};
+use serde_json::json;
+use sha2::Sha512;
+use std::ffi::CString;
+use std::os::unix::ffi::OsStrExt as _;
+use std::os::unix::fs::symlink;
+use std::time::{Duration, Instant};
+
+use super::*;
+
+fn compatibility_original(root: &str, local_pax: bool) -> Vec<u8> {
+    let encoder = GzEncoder::new(Vec::new(), Compression::fast());
+    let mut builder = tar::Builder::new(encoder);
+    if local_pax {
+        let mut body = String::new();
+        for assignment in ["path=package/file", "size=1", "NODETAR.type=File"] {
+            let mut length = assignment.len() + 3;
+            loop {
+                let record = format!("{length} {assignment}\n");
+                if record.len() == length {
+                    body.push_str(&record);
+                    break;
+                }
+                length = record.len();
+            }
+        }
+        let mut header = tar::Header::new_ustar();
+        header.set_mode(0o644);
+        header.set_entry_type(tar::EntryType::XHeader);
+        header.set_size(body.len() as u64);
+        header.set_cksum();
+        builder
+            .append_data(&mut header, "PaxHeader/package/file", body.as_bytes())
+            .expect("should append fictional local metadata");
+    }
+    let mut header = tar::Header::new_ustar();
+    header.set_mode(0o644);
+    header.set_size(1);
+    header.set_cksum();
+    builder
+        .append_data(&mut header, format!("{root}/file"), b"x".as_slice())
+        .expect("should append fictional regular member");
+    builder
+        .into_inner()
+        .expect("should finish fictional TAR")
+        .finish()
+        .expect("should finish fictional gzip")
+}
+
+#[test]
+fn legacy_root_and_pax_compatibility_require_exact_locked_versions() {
+    for (name, accepted, rejected, root, pax) in [
+        ("@types/chai", "5.2.3", "5.2.4", "chai", false),
+        ("@types/node", "24.10.13", "24.10.14", "node v24.10", false),
+        ("gulp-wrap", "0.15.0", "0.15.1", "package", true),
+    ] {
+        let bytes = compatibility_original(root, pax);
+        let directory = tempfile::tempdir().expect("should own fictional distribution");
+        let path = directory.path().join("original.tgz");
+        std::fs::write(&path, &bytes).expect("should retain fictional original");
+        for (version, allowed) in [(accepted, true), (rejected, false)] {
+            let location = format!("node_modules/{name}");
+            let locked = LockedMaterials {
+                source_commit: "a".repeat(40),
+                cargo_lock_sha256: "b".repeat(64),
+                npm_lock_sha256: "c".repeat(64),
+                cargo: CargoMaterials {
+                    registry: BTreeMap::new(),
+                    git: Default::default(),
+                    git_packages: Vec::new(),
+                },
+                npm: BTreeMap::from([(
+                    location.clone(),
+                    NpmMaterial {
+                        name: name.to_owned(),
+                        version: version.to_owned(),
+                        resolved: "https://example.com/fixture.tgz".to_owned(),
+                        sha512: Sha512::digest(&bytes).into(),
+                    },
+                )]),
+            };
+            let original = locked
+                .verify_npm(
+                    &location,
+                    &path,
+                    Instant::now() + Duration::from_secs(10),
+                    &Cancellation::default(),
+                )
+                .expect("should authenticate exact fictional bytes before selection");
+            assert_eq!(
+                locked.extract_npm(&location, original).is_ok(),
+                allowed,
+                "should restrict legacy extraction to reviewed package/version: {name}@{version}"
+            );
+        }
+    }
+}
+
+fn npm_lock(integrity: &str) -> Vec<u8> {
+    serde_json::to_vec(&json!({
+        "lockfileVersion": 3,
+        "packages": {
+            "": {"name": "fictional-project"},
+            "node_modules/fictional-package": {
+                "version": "1.0.0",
+                "resolved": format!("{}fictional-package/-/fictional-package-1.0.0.tgz", locked::NPM_REGISTRY),
+                "integrity": integrity,
+                "optional": true
+            }
+        }
+    })).expect("should encode fictional lockfile")
+}
+
+#[test]
+fn npm_integrity_requires_one_canonical_sha512_identity() {
+    for integrity in [
+        "",
+        "sha256-AA==",
+        "sha512-AA==",
+        "sha512-???",
+        "sha512-AA== sha512-AA==",
+    ] {
+        assert!(
+            parse_npm(&npm_lock(integrity)).is_err(),
+            "should reject missing, ambiguous or unsupported archive integrity"
+        );
+    }
+}
+
+#[test]
+fn cargo_git_revision_cannot_be_only_a_tag() {
+    let lock = b"version = 4\n[[package]]\nname = \"fictional\"\nversion = \"1.0.0\"\nsource = \"git+https://example.com/fictional?tag=v1\"\n";
+    assert!(
+        parse_cargo(lock).is_err(),
+        "should require a full locked Git revision"
+    );
+}
+
+#[test]
+fn cargo_material_source_cannot_be_mistyped_as_a_local_package() {
+    let lock =
+        b"version = 4\n[[package]]\nname = \"fictional\"\nversion = \"1.0.0\"\nsource = 42\n";
+    assert!(
+        parse_cargo(lock).is_err(),
+        "should reject malformed acquisition identity"
+    );
+}
+
+#[test]
+fn npm_names_cannot_change_the_registry_path() {
+    let integrity = format!("sha512-{}", STANDARD.encode([0_u8; 64]));
+    let mut lock: serde_json::Value =
+        serde_json::from_slice(&npm_lock(&integrity)).expect("should parse fictional lockfile");
+    lock["packages"]["node_modules/fictional-package"]["name"] = json!("../fictional-package");
+    lock["packages"]["node_modules/fictional-package"]["resolved"] = json!(format!(
+        "{}../fictional-package/-/fictional-package-1.0.0.tgz",
+        locked::NPM_REGISTRY
+    ));
+    assert!(
+        parse_npm(&serde_json::to_vec(&lock).expect("should encode fixture")).is_err(),
+        "should reject traversal in the declared package identity"
+    );
+}
+
+#[test]
+fn source_lockfiles_account_for_each_supported_acquisition_class() {
+    let cargo = parse_cargo(include_bytes!("../../../../Cargo.lock"))
+        .expect("should parse the source-controlled Cargo lock");
+    assert!(
+        !cargo.registry.is_empty(),
+        "should retain registry originals"
+    );
+    assert!(
+        !cargo.git.is_empty(),
+        "should retain exact Git revisions as unverified expectations"
+    );
+    let npm = parse_npm(include_bytes!(
+        "../../../trusted-server-js/lib/package-lock.json"
+    ))
+    .expect("should parse the source-controlled npm lock");
+    for package in [
+        "node_modules/@esbuild/darwin-arm64",
+        "node_modules/@esbuild/darwin-x64",
+        "node_modules/@esbuild/linux-x64",
+    ] {
+        assert!(
+            npm.contains_key(package),
+            "should retain selected native esbuild originals despite optional flags"
+        );
+    }
+}
+
+#[test]
+fn optional_npm_original_still_requires_its_exact_bytes() {
+    let directory = tempfile::tempdir().expect("should create fixture directory");
+    let original = directory.path().join("original.tgz");
+    let bytes = b"fictional original archive bytes";
+    std::fs::write(&original, bytes).expect("should create fictional original");
+    let packages = parse_npm(&npm_lock(&format!(
+        "sha512-{}",
+        STANDARD.encode(Sha512::digest(bytes))
+    )))
+    .expect("should parse locked archive");
+    let deadline = Instant::now() + Duration::from_secs(5);
+    let expected = &packages["node_modules/fictional-package"].sha512;
+    let mut retained = archive::verify(
+        &original,
+        archive::Expected::Sha512(expected),
+        "fictional-source",
+        "npm:node_modules/fictional-package",
+        deadline,
+        &Cancellation::default(),
+    )
+    .expect("should verify the exact original");
+    let mut changed = bytes.to_vec();
+    changed[0] ^= 1;
+    std::fs::write(&original, changed).expect("should substitute one byte at the same path");
+    assert!(
+        archive::verify(
+            &original,
+            archive::Expected::Sha512(expected),
+            "fictional-source",
+            "npm:node_modules/fictional-package",
+            deadline,
+            &Cancellation::default()
+        )
+        .is_err(),
+        "should reject a changed original even when its filename is unchanged"
+    );
+    let mut copy = Vec::new();
+    retained
+        .copy_verified(&mut copy)
+        .expect("should retain the original verified bytes");
+    assert_eq!(
+        copy, bytes,
+        "should consume the held private bytes rather than reopening the replaced path"
+    );
+}
+
+#[test]
+fn npm_selectors_and_nested_locations_are_not_ambiguous() {
+    let integrity = format!("sha512-{}", STANDARD.encode([0_u8; 64]));
+    for (field, value) in [
+        ("name", json!(42)),
+        ("name", json!("another-package")),
+        ("link", json!("false")),
+    ] {
+        let mut lock: serde_json::Value =
+            serde_json::from_slice(&npm_lock(&integrity)).expect("should parse fixture");
+        lock["packages"]["node_modules/fictional-package"][field] = value;
+        assert!(
+            parse_npm(&serde_json::to_vec(&lock).expect("should encode fixture")).is_err(),
+            "should reject mistyped or conflicting package selectors"
+        );
+    }
+    let mut lock: serde_json::Value =
+        serde_json::from_slice(&npm_lock(&integrity)).expect("should parse fixture");
+    let package = lock["packages"]
+        .as_object_mut()
+        .expect("should have packages")
+        .remove("node_modules/fictional-package")
+        .expect("should have fictional package");
+    lock["packages"]["node_modules/not/a/package/node_modules/fictional-package"] = package;
+    assert!(
+        parse_npm(&serde_json::to_vec(&lock).expect("should encode fixture")).is_err(),
+        "should validate every nested installation component"
+    );
+}
+
+#[test]
+fn cancellation_after_verification_prevents_material_consumption() {
+    let directory = tempfile::tempdir().expect("should create fixture directory");
+    let original = directory.path().join("original.crate");
+    let bytes = b"fictional original";
+    std::fs::write(&original, bytes).expect("should create fixture original");
+    let cancellation = Cancellation::default();
+    let expected = hex::encode(sha2::Sha256::digest(bytes));
+    let mut retained = archive::verify(
+        &original,
+        archive::Expected::Sha256(&expected),
+        "fictional-source",
+        "crate:fictional-package@1.0.0",
+        Instant::now() + Duration::from_secs(5),
+        &cancellation,
+    )
+    .expect("should verify original before cancellation");
+    cancellation.cancel();
+    let mut destination = Vec::new();
+    assert!(
+        retained.copy_verified(&mut destination).is_err(),
+        "should retain the shared cancellation boundary through later use"
+    );
+    assert!(
+        destination.is_empty(),
+        "should not emit cancelled material bytes"
+    );
+}
+
+#[test]
+fn archive_inputs_reject_aliases_special_files_and_oversize() {
+    let directory = tempfile::tempdir().expect("should create fixture directory");
+    let regular = directory.path().join("original");
+    let alias = directory.path().join("alias");
+    let hard = directory.path().join("hard-link");
+    let fifo = directory.path().join("fifo");
+    let huge = directory.path().join("huge");
+    std::fs::write(&regular, b"fictional").expect("should write original");
+    symlink(&regular, &alias).expect("should create symlink");
+    std::fs::hard_link(&regular, &hard).expect("should create hard link");
+    let fifo_name = CString::new(fifo.as_os_str().as_bytes()).expect("should encode FIFO path");
+    // SAFETY: The path is a live NUL-terminated string and mode is valid.
+    assert_eq!(
+        unsafe { libc::mkfifo(fifo_name.as_ptr(), 0o600) },
+        0,
+        "should create FIFO"
+    );
+    std::fs::File::create(&huge)
+        .expect("should create sparse fixture")
+        .set_len(64 * 1024 * 1024 + 1)
+        .expect("should exceed archive limit");
+    let digest = hex::encode(sha2::Sha256::digest(b"fictional"));
+    for path in [
+        &regular,
+        &alias,
+        &hard,
+        &fifo,
+        &huge,
+        &directory.path().to_path_buf(),
+    ] {
+        assert!(
+            archive::verify(
+                path,
+                archive::Expected::Sha256(&digest),
+                "fictional-source",
+                "crate:fictional@1.0.0",
+                Instant::now() + Duration::from_secs(5),
+                &Cancellation::default()
+            )
+            .is_err(),
+            "should reject unsafe original before any blocking read"
+        );
+    }
+}
+
+#[test]
+fn registry_original_and_attempt_bounds_are_checked_before_use() {
+    let directory = tempfile::tempdir().expect("should create fixture directory");
+    let path = directory.path().join("fictional.crate");
+    let bytes = b"fictional original";
+    std::fs::write(&path, bytes).expect("should write original");
+    let digest = hex::encode(sha2::Sha256::digest(bytes));
+    let cancellation = Cancellation::default();
+    let deadline = Instant::now() + Duration::from_secs(5);
+    archive::verify(
+        &path,
+        archive::Expected::Sha256(&digest),
+        "fictional-source",
+        "crate:fictional@1.0.0",
+        deadline,
+        &cancellation,
+    )
+    .expect("should verify registry SHA-256");
+    let expired = Instant::now()
+        .checked_sub(Duration::from_secs(1))
+        .expect("should form expired deadline");
+    assert!(
+        archive::verify(
+            &path,
+            archive::Expected::Sha256(&digest),
+            "fictional-source",
+            "crate:fictional@1.0.0",
+            expired,
+            &cancellation
+        )
+        .is_err(),
+        "should reject an expired attempt"
+    );
+    cancellation.cancel();
+    assert!(
+        archive::verify(
+            &path,
+            archive::Expected::Sha256(&digest),
+            "fictional-source",
+            "crate:fictional@1.0.0",
+            deadline,
+            &cancellation
+        )
+        .is_err(),
+        "should reject cancellation before reading"
+    );
+    let mut changed = bytes.to_vec();
+    changed[0] ^= 1;
+    std::fs::write(&path, changed).expect("should alter one original byte");
+    assert!(
+        archive::verify(
+            &path,
+            archive::Expected::Sha256(&digest),
+            "fictional-source",
+            "crate:fictional@1.0.0",
+            deadline,
+            &Cancellation::default()
+        )
+        .is_err(),
+        "should reject changed registry bytes"
+    );
+}
+
+#[test]
+fn npm_lockfile_duplicate_keys_are_rejected_before_identity_selection() {
+    assert!(
+        parse_npm(br#"{"lockfileVersion":3,"packages":{},"packages":{}}"#).is_err(),
+        "should reject ambiguous archive selection before parsing package identities"
+    );
+}
diff --git a/crates/trusted-server-release/src/package.rs b/crates/trusted-server-release/src/package.rs
new file mode 100644
index 0000000000..4197f489b2
--- /dev/null
+++ b/crates/trusted-server-release/src/package.rs
@@ -0,0 +1,367 @@
+//! Read-only inspection of one manual Fastly transport envelope.
+//!
+//! The initial deployment profile accepts only the canonical two-line manifest
+//! (`manifest_version = 3` and a portable package name). It intentionally excludes
+//! every other field, table and comment. Service selection and observed resource
+//! bindings belong to the independently approved manual deployment procedure.
+
+use std::collections::BTreeSet;
+use std::fs::{self, File, Metadata, OpenOptions};
+use std::io::{self, BufReader, Read, Seek as _};
+use std::os::unix::fs::{MetadataExt as _, OpenOptionsExt as _};
+use std::path::{Path, PathBuf};
+
+use error_stack::Report;
+use flate2::bufread::GzDecoder;
+use serde_json::{Value, json};
+use sha2::{Digest as _, Sha256};
+
+use crate::documents::{Role, read_bounded};
+use crate::error::ReleaseError;
+use crate::inspect::inspect_wasm;
+
+const ARCHIVE_LIMIT: u64 = 768 * 1024 * 1024;
+const MODULE_LIMIT: u64 = 512 * 1024 * 1024;
+const MANIFEST_LIMIT: u64 = 1024 * 1024;
+const EXPANDED_LIMIT: u64 = MODULE_LIMIT + MANIFEST_LIMIT + 16 * 1024;
+
+fn rejected(message: impl std::fmt::Display) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Inspect).attach(message.to_string())
+}
+
+fn digest(bytes: &[u8]) -> String {
+    hex::encode(Sha256::digest(bytes))
+}
+
+fn approved_digest(value: &str) -> bool {
+    value.len() == 64
+        && value
+            .bytes()
+            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+}
+
+fn diagnostic_path(path: &Path) -> Result<Value, Report<ReleaseError>> {
+    let path = path
+        .to_str()
+        .ok_or_else(|| rejected("selected package path must be UTF-8 for diagnostics"))?;
+    Ok(json!(path))
+}
+
+fn manifest_name(bytes: &[u8]) -> Result<String, Report<ReleaseError>> {
+    let text = std::str::from_utf8(bytes).map_err(rejected)?;
+    let table: toml::Table = toml::from_str(text).map_err(rejected)?;
+    let name = table
+        .get("name")
+        .and_then(toml::Value::as_str)
+        .ok_or_else(|| rejected("deployment manifest requires a package name"))?;
+    let valid = !name.is_empty()
+        && name.len() <= 64
+        && name != "package"
+        && name.split('-').all(|part| {
+            !part.is_empty()
+                && part
+                    .bytes()
+                    .all(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit())
+        });
+    if !valid || bytes != format!("manifest_version = 3\nname = \"{name}\"\n").as_bytes() {
+        return Err(rejected(
+            "deployment manifest must match the canonical two-line version-3 profile and portable nonreserved name",
+        ));
+    }
+    Ok(name.to_owned())
+}
+
+#[derive(PartialEq, Eq)]
+struct Stamp {
+    device: u64,
+    inode: u64,
+    links: u64,
+    size: u64,
+    mode: u32,
+    modified: (i64, i64),
+    changed: (i64, i64),
+}
+
+impl From<&Metadata> for Stamp {
+    fn from(metadata: &Metadata) -> Self {
+        Self {
+            device: metadata.dev(),
+            inode: metadata.ino(),
+            links: metadata.nlink(),
+            size: metadata.len(),
+            mode: metadata.mode(),
+            modified: (metadata.mtime(), metadata.mtime_nsec()),
+            changed: (metadata.ctime(), metadata.ctime_nsec()),
+        }
+    }
+}
+
+fn check_path(path: &Path, expected: &Stamp) -> Result<(), Report<ReleaseError>> {
+    let metadata = fs::symlink_metadata(path).map_err(rejected)?;
+    if !metadata.is_file() || Stamp::from(&metadata) != *expected {
+        return Err(rejected(
+            "approved manifest inode, path or metadata changes",
+        ));
+    }
+    Ok(())
+}
+
+struct RetainedArchive {
+    path: PathBuf,
+    file: File,
+    stamp: Stamp,
+}
+
+impl RetainedArchive {
+    fn open(path: PathBuf) -> Result<Self, Report<ReleaseError>> {
+        let file = OpenOptions::new()
+            .read(true)
+            .custom_flags(libc::O_NOFOLLOW | libc::O_NONBLOCK | libc::O_CLOEXEC)
+            .open(&path)
+            .map_err(rejected)?;
+        let metadata = file.metadata().map_err(rejected)?;
+        if !metadata.is_file() || metadata.nlink() != 1 || metadata.len() > ARCHIVE_LIMIT {
+            return Err(rejected(
+                "archive must be a bounded regular file with one hard link",
+            ));
+        }
+        let retained = Self {
+            path,
+            file,
+            stamp: Stamp::from(&metadata),
+        };
+        retained.check()?;
+        Ok(retained)
+    }
+
+    fn check(&self) -> Result<(), Report<ReleaseError>> {
+        let path = fs::symlink_metadata(&self.path).map_err(rejected)?;
+        let held = self.file.metadata().map_err(rejected)?;
+        if !path.is_file() || Stamp::from(&path) != self.stamp || Stamp::from(&held) != self.stamp {
+            return Err(rejected("retained archive inode, path or metadata changes"));
+        }
+        Ok(())
+    }
+
+    fn hash(&mut self) -> Result<String, Report<ReleaseError>> {
+        self.check()?;
+        self.file.rewind().map_err(rejected)?;
+        let mut hash = Sha256::new();
+        let mut count = 0_u64;
+        let mut buffer = [0_u8; 64 * 1024];
+        loop {
+            let read = self.file.read(&mut buffer).map_err(rejected)?;
+            if read == 0 {
+                break;
+            }
+            count += read as u64;
+            if count > self.stamp.size || count > ARCHIVE_LIMIT {
+                return Err(rejected("archive grows while hashing"));
+            }
+            hash.update(&buffer[..read]);
+        }
+        if count != self.stamp.size {
+            return Err(rejected("archive size changes while hashing"));
+        }
+        self.check()?;
+        Ok(hex::encode(hash.finalize()))
+    }
+}
+
+struct Expanded<R> {
+    reader: R,
+    count: u64,
+}
+
+impl<R: Read> Read for Expanded<R> {
+    fn read(&mut self, buffer: &mut [u8]) -> io::Result<usize> {
+        let maximum = buffer.len().min(64 * 1024);
+        let count = self.reader.read(&mut buffer[..maximum])?;
+        self.count += count as u64;
+        if self.count > EXPANDED_LIMIT {
+            return Err(io::Error::other("package exceeds expanded byte bound"));
+        }
+        Ok(count)
+    }
+}
+
+fn raw_field(bytes: &[u8]) -> Result<&str, Report<ReleaseError>> {
+    let end = bytes
+        .iter()
+        .position(|byte| *byte == 0)
+        .unwrap_or(bytes.len());
+    if bytes[end..].iter().any(|byte| *byte != 0) {
+        return Err(rejected("TAR field hides bytes after its terminator"));
+    }
+    std::str::from_utf8(&bytes[..end]).map_err(rejected)
+}
+
+fn module_member(
+    retained: &mut RetainedArchive,
+    name: &str,
+    manifest: &[u8],
+) -> Result<Vec<u8>, Report<ReleaseError>> {
+    retained.check()?;
+    retained.file.rewind().map_err(rejected)?;
+    let decoded = Expanded {
+        reader: GzDecoder::new(BufReader::new(&mut retained.file)),
+        count: 0,
+    };
+    let mut archive = tar::Archive::new(decoded);
+    let root = format!("{name}/");
+    let bin = format!("{name}/bin/");
+    let module_name = format!("{name}/bin/main.wasm");
+    let manifest_name = format!("{name}/fastly.toml");
+    let mut seen = BTreeSet::new();
+    let mut module = Vec::new();
+    for entry in archive.entries().map_err(rejected)?.raw(true) {
+        let mut entry = entry.map_err(rejected)?;
+        if seen.len() >= 4 {
+            return Err(rejected("package contains extra entries"));
+        }
+        let header = entry.header();
+        let path = raw_field(&header.as_old().name)?.to_owned();
+        if header
+            .as_ustar()
+            .is_some_and(|ustar| ustar.prefix.iter().any(|byte| *byte != 0))
+            || !raw_field(&header.as_old().linkname)?.is_empty()
+            || !seen.insert(path.clone())
+        {
+            return Err(rejected(
+                "package has prefixed paths, links or duplicate entries",
+            ));
+        }
+        let kind = header.entry_type().as_byte();
+        let size = entry.size();
+        if path == root || path == bin {
+            if kind != b'5' || size != 0 {
+                return Err(rejected(
+                    "package directory has the wrong type or nonzero size",
+                ));
+            }
+        } else if path == module_name || path == manifest_name {
+            if !matches!(kind, b'0' | 0) {
+                return Err(rejected("package member is not a plain regular file"));
+            }
+            let limit = if path == module_name {
+                MODULE_LIMIT
+            } else {
+                MANIFEST_LIMIT
+            };
+            if size > limit {
+                return Err(rejected("package member exceeds its byte bound"));
+            }
+            let mut body = Vec::new();
+            body.try_reserve_exact(usize::try_from(size).map_err(rejected)?)
+                .map_err(rejected)?;
+            entry.read_to_end(&mut body).map_err(rejected)?;
+            if body.len() as u64 != size {
+                return Err(rejected("package member is truncated"));
+            }
+            if path == module_name {
+                module = body;
+            } else if body != manifest {
+                return Err(rejected(
+                    "package manifest differs from the approved manifest bytes",
+                ));
+            }
+        } else {
+            return Err(rejected(
+                "package contains an unexpected raw path or metadata header",
+            ));
+        }
+    }
+    if seen.len() != 4 {
+        return Err(rejected("package must contain all four exact members"));
+    }
+    let mut decoded = archive.into_inner();
+    let mut tail = 0_u64;
+    let mut buffer = [0_u8; 64 * 1024];
+    loop {
+        let count = decoded.read(&mut buffer).map_err(rejected)?;
+        if count == 0 {
+            break;
+        }
+        tail += count as u64;
+        if buffer[..count].iter().any(|byte| *byte != 0) {
+            return Err(rejected("TAR hides data after its terminator"));
+        }
+    }
+    if tail < 512 || !tail.is_multiple_of(512) {
+        return Err(rejected("TAR lacks complete terminator blocks"));
+    }
+    let mut compressed = decoded.reader.into_inner();
+    if compressed.read(&mut buffer[..1]).map_err(rejected)? != 0 {
+        return Err(rejected("gzip has additional members or trailing bytes"));
+    }
+    drop(compressed);
+    retained.check()?;
+    Ok(module)
+}
+
+/// Inspects a named manual package against independently approved identities.
+///
+/// This diagnostic supplies no release-verification, runtime or deployment
+/// authority. Call it again immediately before the separate submission.
+///
+/// # Errors
+///
+/// Rejects unsafe files, changed bytes, invalid expected hashes, noncanonical
+/// manifests, invalid core Wasm, or any archive outside the bounded four-member
+/// profile. Expected hashes must come from the successful independent release
+/// verification and context procedure, never from this package.
+pub(crate) fn inspect_package(
+    package_dir: &Path,
+    manifest: &Path,
+    expected_manifest_sha256: &str,
+    expected_wasm_sha256: &str,
+) -> Result<Value, Report<ReleaseError>> {
+    if !approved_digest(expected_manifest_sha256) || !approved_digest(expected_wasm_sha256) {
+        return Err(rejected(
+            "expected SHA-256 identities must be lowercase 64-digit hex",
+        ));
+    }
+    let manifest_stamp = Stamp::from(&fs::symlink_metadata(manifest).map_err(rejected)?);
+    let approved = read_bounded(manifest, Role::Metadata)
+        .map_err(|error| error.change_context(ReleaseError::Inspect))?;
+    check_path(manifest, &manifest_stamp)?;
+    if approved.sha256 != expected_manifest_sha256 {
+        return Err(rejected(
+            "deployment manifest differs from its independently approved digest",
+        ));
+    }
+    let name = manifest_name(&approved.bytes)?;
+    let directory = fs::canonicalize(package_dir).map_err(rejected)?;
+    let mut retained = RetainedArchive::open(directory.join(format!("{name}.tar.gz")))?;
+    let archive_sha256 = retained.hash()?;
+    let module = module_member(&mut retained, &name, &approved.bytes)?;
+    let facts = inspect_wasm(&module)?;
+    if facts.sha256() != expected_wasm_sha256 {
+        return Err(rejected(
+            "actual package module differs from independently verified executable",
+        ));
+    }
+    drop(module);
+    let rechecked_module = module_member(&mut retained, &name, &approved.bytes)?;
+    if digest(&rechecked_module) != expected_wasm_sha256 || retained.hash()? != archive_sha256 {
+        return Err(rejected(
+            "retained archive or actual module changes before acceptance",
+        ));
+    }
+    let rechecked_manifest = read_bounded(manifest, Role::Metadata)
+        .map_err(|error| error.change_context(ReleaseError::Inspect))?;
+    if rechecked_manifest.bytes != approved.bytes {
+        return Err(rejected("approved manifest changes before acceptance"));
+    }
+    check_path(manifest, &manifest_stamp)?;
+    retained.check()?;
+    let package_path = diagnostic_path(&retained.path)?;
+    Ok(
+        json!({ "check": "manual-fastly-package", "accepted": true, "package_path": package_path,
+        "archive_sha256": archive_sha256, "module_sha256": expected_wasm_sha256, "manifest_sha256": approved.sha256,
+        "limits": { "runtime_validated": false, "official_release_verified": false, "deployment_authorized": false } }),
+    )
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/trusted-server-release/src/package/tests.rs b/crates/trusted-server-release/src/package/tests.rs
new file mode 100644
index 0000000000..95433d2ccb
--- /dev/null
+++ b/crates/trusted-server-release/src/package/tests.rs
@@ -0,0 +1,398 @@
+use std::fs;
+use std::io::Write as _;
+use std::os::unix::ffi::OsStringExt as _;
+use std::os::unix::fs::symlink;
+
+use flate2::{Compression, write::GzEncoder};
+use sha2::Sha256;
+
+use super::*;
+
+const MANIFEST: &[u8] = b"manifest_version = 3\nname = \"example-package\"\n";
+const WASM: &[u8] = b"\0asm\x01\0\0\0";
+
+fn digest(bytes: &[u8]) -> String {
+    hex::encode(Sha256::digest(bytes))
+}
+
+fn archive(manifest: &[u8], wasm: &[u8]) -> Vec<u8> {
+    let mut archive = tar::Builder::new(Vec::new());
+    for (name, directory, body) in [
+        ("example-package/", true, &[][..]),
+        ("example-package/bin/", true, &[][..]),
+        ("example-package/bin/main.wasm", false, wasm),
+        ("example-package/fastly.toml", false, manifest),
+    ] {
+        let mut header = tar::Header::new_ustar();
+        header.set_size(body.len() as u64);
+        header.set_mode(if directory { 0o755 } else { 0o644 });
+        header.set_entry_type(if directory {
+            tar::EntryType::Directory
+        } else {
+            tar::EntryType::Regular
+        });
+        header.set_cksum();
+        archive
+            .append_data(&mut header, name, body)
+            .expect("should append package member");
+    }
+    let tar = archive.into_inner().expect("should finish archive");
+    let mut compressed = GzEncoder::new(Vec::new(), Compression::fast());
+    compressed.write_all(&tar).expect("should compress archive");
+    compressed.finish().expect("should finish gzip")
+}
+
+#[test]
+fn accepts_exact_named_package_with_independent_digests() {
+    let directory = tempfile::tempdir().expect("should create private fixture");
+    let manifest = directory.path().join("fastly.toml");
+    fs::write(&manifest, MANIFEST).expect("should write manifest");
+    fs::write(
+        directory.path().join("example-package.tar.gz"),
+        archive(MANIFEST, WASM),
+    )
+    .expect("should write package");
+    fs::write(
+        directory.path().join("package.tar.gz"),
+        b"ignored generic archive",
+    )
+    .expect("should write unrelated generic archive");
+    let accepted = inspect_package(
+        directory.path(),
+        &manifest,
+        &digest(MANIFEST),
+        &digest(WASM),
+    )
+    .expect("should accept exact package");
+    assert_eq!(
+        accepted["module_sha256"],
+        digest(WASM),
+        "should identify actual module bytes"
+    );
+}
+
+#[test]
+fn rejects_manifest_inode_substitution_even_when_bytes_match() {
+    let directory = tempfile::tempdir().expect("should create private fixture");
+    let path = directory.path().join("fastly.toml");
+    fs::write(&path, MANIFEST).expect("should write original manifest");
+    let before =
+        Stamp::from(&fs::symlink_metadata(&path).expect("should inspect original manifest"));
+    let replacement = directory.path().join("replacement");
+    fs::write(&replacement, MANIFEST).expect("should write replacement manifest");
+    fs::rename(&replacement, &path).expect("should replace manifest path");
+    assert!(
+        check_path(&path, &before).is_err(),
+        "should reject replacement with identical bytes"
+    );
+}
+
+fn check_archive(bytes: &[u8], expected_wasm: &str) -> Result<Value, Report<ReleaseError>> {
+    let directory = tempfile::tempdir().expect("should create private fixture");
+    let manifest = directory.path().join("fastly.toml");
+    fs::write(&manifest, MANIFEST).expect("should write manifest");
+    fs::write(directory.path().join("example-package.tar.gz"), bytes)
+        .expect("should write archive");
+    inspect_package(
+        directory.path(),
+        &manifest,
+        &digest(MANIFEST),
+        expected_wasm,
+    )
+}
+
+fn tar_bytes() -> Vec<u8> {
+    let compressed = archive(MANIFEST, WASM);
+    let mut decoded = Vec::new();
+    GzDecoder::new(compressed.as_slice())
+        .read_to_end(&mut decoded)
+        .expect("should decode fixture");
+    decoded
+}
+
+fn compress(tar: &[u8]) -> Vec<u8> {
+    let mut encoder = GzEncoder::new(Vec::new(), Compression::fast());
+    encoder.write_all(tar).expect("should compress mutated TAR");
+    encoder.finish().expect("should finish mutated gzip")
+}
+
+fn change_header(tar: &mut [u8], offset: usize, change: impl FnOnce(&mut tar::Header)) {
+    let mut header = tar::Header::new_ustar();
+    header
+        .as_mut_bytes()
+        .copy_from_slice(&tar[offset..offset + 512]);
+    change(&mut header);
+    header.set_cksum();
+    tar[offset..offset + 512].copy_from_slice(header.as_bytes());
+}
+
+#[test]
+fn rejects_manifest_only_generic_layout() {
+    let mut tar = tar_bytes();
+    tar.drain(1024..2048);
+    assert!(
+        check_archive(&compress(&tar), &digest(WASM)).is_err(),
+        "should require module and all four entries"
+    );
+}
+
+#[test]
+fn rejects_extra_members_and_duplicates() {
+    let mut tar = tar_bytes();
+    let root = tar[..512].to_vec();
+    tar.splice(3072..3072, root);
+    assert!(
+        check_archive(&compress(&tar), &digest(WASM)).is_err(),
+        "should reject swept-in extra directory"
+    );
+    let mut duplicate = tar_bytes();
+    duplicate.copy_within(0..512, 512);
+    assert!(
+        check_archive(&compress(&duplicate), &digest(WASM)).is_err(),
+        "should reject duplicate raw names"
+    );
+}
+
+#[test]
+fn rejects_raw_path_aliases_and_traversal() {
+    for path in [
+        "../main.wasm",
+        "/example-package/bin/main.wasm",
+        "example-package/./bin/main.wasm",
+        "example-package\\bin\\main.wasm",
+    ] {
+        let mut tar = tar_bytes();
+        change_header(&mut tar, 1024, |header| {
+            header.as_old_mut().name.fill(0);
+            header.as_old_mut().name[..path.len()].copy_from_slice(path.as_bytes());
+        });
+        assert!(
+            check_archive(&compress(&tar), &digest(WASM)).is_err(),
+            "should reject unsafe raw member {path}"
+        );
+    }
+}
+
+#[test]
+fn rejects_links_metadata_and_special_entries() {
+    for kind in *b"12346xgLKS" {
+        let mut tar = tar_bytes();
+        change_header(&mut tar, 1024, |header| {
+            header.set_entry_type(tar::EntryType::new(kind))
+        });
+        assert!(
+            check_archive(&compress(&tar), &digest(WASM)).is_err(),
+            "should reject unsupported TAR type {kind}"
+        );
+    }
+}
+
+#[test]
+fn rejects_changed_module_and_manifest_bytes() {
+    assert!(
+        check_archive(&archive(MANIFEST, WASM), &"0".repeat(64)).is_err(),
+        "should require independently verified module digest"
+    );
+    let other = b"manifest_version = 3\nname = \"other\"\n";
+    assert!(
+        check_archive(&archive(other, WASM), &digest(WASM)).is_err(),
+        "should compare exact approved manifest bytes"
+    );
+}
+
+#[test]
+fn rejects_malformed_and_component_modules_even_with_matching_hashes() {
+    for wasm in [
+        &b"not-wasm"[..],
+        &b"\0asm\x0d\0\x01\0"[..],
+        &b"\0asm\x01\0\0\0\x01\x01\xff"[..],
+    ] {
+        assert!(
+            check_archive(&archive(MANIFEST, wasm), &digest(wasm)).is_err(),
+            "should require validated actual core Wasm"
+        );
+    }
+}
+
+#[test]
+fn rejects_concatenated_gzip_trailing_bytes_and_bad_trailers() {
+    let original = archive(MANIFEST, WASM);
+    let mut concatenated = original.clone();
+    concatenated.extend_from_slice(&original);
+    let mut trailing = original.clone();
+    trailing.push(0);
+    let mut truncated = original.clone();
+    truncated.truncate(truncated.len() - 4);
+    let mut bad_crc = original;
+    let last = bad_crc.len() - 8;
+    bad_crc[last] ^= 1;
+    for invalid in [concatenated, trailing, truncated, bad_crc] {
+        assert!(
+            check_archive(&invalid, &digest(WASM)).is_err(),
+            "should consume and validate exact single gzip member"
+        );
+    }
+}
+
+#[test]
+fn rejects_hidden_tar_trailing_payload_and_missing_terminator() {
+    let mut hidden = tar_bytes();
+    hidden.push(1);
+    assert!(
+        check_archive(&compress(&hidden), &digest(WASM)).is_err(),
+        "should reject hidden nonzero trailing data"
+    );
+    let mut missing = tar_bytes();
+    missing.truncate(3072 + 512);
+    assert!(
+        check_archive(&compress(&missing), &digest(WASM)).is_err(),
+        "should require two complete zero terminator blocks"
+    );
+}
+
+#[test]
+fn rejects_oversized_members_and_nonzero_directories_before_allocation() {
+    for (offset, size) in [(0, 1), (1024, MODULE_LIMIT + 1), (2048, MANIFEST_LIMIT + 1)] {
+        let mut tar = tar_bytes();
+        change_header(&mut tar, offset, |header| header.set_size(size));
+        assert!(
+            check_archive(&compress(&tar), &digest(WASM)).is_err(),
+            "should reject declared size {size} at header {offset}"
+        );
+    }
+    let mut expanded = Expanded {
+        reader: &[0_u8][..],
+        count: EXPANDED_LIMIT,
+    };
+    assert!(
+        expanded.read(&mut [0_u8]).is_err(),
+        "should stop expansion at its bound"
+    );
+}
+
+#[test]
+fn rejects_noncanonical_private_and_reserved_manifests() {
+    for manifest in [
+        "manifest_version = 3\nname = \"\"\n",
+        "manifest_version = 3\nname = \"package\"\n",
+        "manifest_version = 3\nname = \"example_package\"\n",
+        "manifest_version = 3\nname = \"example--package\"\n",
+        "manifest_version = 3\nname = \"Example\"\n",
+        "manifest_version = 3\nname = \"example\"\n# private material\n",
+        "manifest_version = 3\nname = \"example\"\nservice_id = \"fictional-service\"\n",
+        "manifest_version = 3\nname = \"example\"\n[local_server]\n",
+        "manifest_version = 3\nname = \"example\"\n[scripts]\nbuild = \"false\"\n",
+    ] {
+        assert!(
+            manifest_name(manifest.as_bytes()).is_err(),
+            "should reject manifest outside narrow deployment profile"
+        );
+    }
+    let long = format!("manifest_version = 3\nname = \"{}\"\n", "a".repeat(65));
+    assert!(
+        manifest_name(long.as_bytes()).is_err(),
+        "should bound package name bytes"
+    );
+}
+
+#[test]
+fn rejects_unsafe_archive_files_and_substitution() {
+    let directory = tempfile::tempdir().expect("should create private fixture");
+    let original = directory.path().join("archive");
+    fs::write(&original, archive(MANIFEST, WASM)).expect("should write archive");
+    let alias = directory.path().join("alias");
+    symlink(&original, &alias).expect("should create symlink fixture");
+    assert!(
+        RetainedArchive::open(alias).is_err(),
+        "should reject leaf symlink"
+    );
+    let retained = RetainedArchive::open(original.clone()).expect("should open regular archive");
+    let replacement = directory.path().join("replacement");
+    fs::write(&replacement, archive(MANIFEST, WASM)).expect("should write replacement");
+    fs::rename(replacement, &original).expect("should replace path");
+    assert!(
+        retained.check().is_err(),
+        "should reject replaced archive path"
+    );
+    let hard = directory.path().join("hard");
+    fs::hard_link(&original, &hard).expect("should create hard link fixture");
+    assert!(
+        RetainedArchive::open(original.clone()).is_err(),
+        "should reject multiple hard links"
+    );
+    fs::remove_file(hard).expect("should remove hard link");
+    File::options()
+        .write(true)
+        .open(&original)
+        .expect("should open sparse fixture")
+        .set_len(ARCHIVE_LIMIT + 1)
+        .expect("should make oversized sparse fixture");
+    assert!(
+        RetainedArchive::open(original).is_err(),
+        "should reject archive length before reading"
+    );
+    assert!(
+        RetainedArchive::open(directory.path().to_owned()).is_err(),
+        "should reject directories"
+    );
+}
+
+#[test]
+fn rejects_prefixed_hidden_and_corrupt_tar_headers() {
+    let mut prefixed = tar_bytes();
+    change_header(&mut prefixed, 1024, |header| {
+        header
+            .as_ustar_mut()
+            .expect("should have USTAR header")
+            .prefix[0] = b'x';
+    });
+    let mut hidden = tar_bytes();
+    change_header(&mut hidden, 1024, |header| {
+        header.as_old_mut().name[90] = b'x';
+    });
+    let mut corrupt = tar_bytes();
+    corrupt[1024 + 148] ^= 1;
+    for tar in [prefixed, hidden, corrupt] {
+        assert!(
+            check_archive(&compress(&tar), &digest(WASM)).is_err(),
+            "should reject raw path prefixes, hidden bytes and bad checksums"
+        );
+    }
+}
+
+#[test]
+fn rejects_invalid_expected_digest_syntax() {
+    for invalid in [
+        String::new(),
+        "A".repeat(64),
+        "g".repeat(64),
+        "0".repeat(63),
+    ] {
+        assert!(
+            check_archive(&archive(MANIFEST, WASM), &invalid).is_err(),
+            "should require bounded lowercase SHA-256 identity"
+        );
+    }
+}
+
+#[test]
+fn detects_changed_held_archive_contents() {
+    let directory = tempfile::tempdir().expect("should create private fixture");
+    let path = directory.path().join("archive");
+    fs::write(&path, archive(MANIFEST, WASM)).expect("should write archive");
+    let retained = RetainedArchive::open(path.clone()).expect("should open original archive");
+    fs::write(path, b"changed").expect("should mutate held inode");
+    assert!(
+        retained.check().is_err(),
+        "should reject changed metadata on held inode"
+    );
+}
+
+#[test]
+fn rejects_non_utf8_package_directory_without_panicking() {
+    let package = PathBuf::from(std::ffi::OsString::from_vec(vec![b'p', 0xff]));
+    assert!(
+        diagnostic_path(&package).is_err(),
+        "should reject non-UTF-8 diagnostic path without panic"
+    );
+}
diff --git a/crates/trusted-server-release/src/policy.rs b/crates/trusted-server-release/src/policy.rs
new file mode 100644
index 0000000000..481f729558
--- /dev/null
+++ b/crates/trusted-server-release/src/policy.rs
@@ -0,0 +1,753 @@
+//! Compiled-in release cohort contract and strict parsing of tracked release inputs.
+//!
+//! The JSON inputs are compared against this source-owned contract; they never
+//! supply commands, packages, targets or authority. Pending or JSON-qualified
+//! pins remain diagnostics until authenticated acquisition receipts exist.
+
+use std::collections::BTreeSet;
+use std::path::Path;
+
+use error_stack::Report;
+use serde::Deserialize;
+use serde::de::DeserializeOwned;
+use serde_json::{Value, json};
+use sha2::{Digest as _, Sha256};
+
+use crate::documents::{Role, parse_json, read_bounded};
+use crate::error::ReleaseError;
+use tools::{BUILDER_ENVIRONMENT, ToolsDocument, check_tools};
+
+mod tools;
+
+/// Source-relative path of the tracked cohort selection.
+pub(crate) const COHORT_PATH: &str = "scripts/release/release-cohort.json";
+/// Source-relative path of the tracked tool, environment and recipe pins.
+pub(crate) const TOOLS_PATH: &str = "scripts/release/release-tools.json";
+/// Source-relative path of the tracked consumer release policy.
+pub(crate) const CLI_POLICY_PATH: &str = "crates/trusted-server-cli/release-policy.json";
+/// Branches whose tips may supply release sources; candidates cannot extend it.
+pub(crate) const ELIGIBLE_BRANCHES: [&str; 1] = ["main"];
+/// Version of the tracked consumer release policy the compiled contract accepts.
+pub(crate) const CLI_POLICY_VERSION: u64 = 1;
+/// Fixed release cohort identity named by every release index.
+pub(crate) const COHORT_ID: &str = "phase1-fastly-cli";
+/// Official repository named by every release index.
+pub(crate) const REPOSITORY: &str = "IABTechLab/trusted-server";
+const SCHEMA_VERSION: u64 = 1;
+const GH_VERSION: &str = "2.97.0";
+const ATTEST_VERSION: &str = "4.2.2";
+const ATTEST_REVISION: &str = "1e69f48acb82d1966a394da916b4c1698aa569d6";
+const READONLY_ACTIONS: [&str; 1] = ["readonly-verify"];
+const CLI_POLICY_FIELDS: [&str; 13] = [
+    "artifacts",
+    "bounds",
+    "cohort",
+    "github_host",
+    "historical_producer_policies",
+    "identity",
+    "policy_version",
+    "predicates",
+    "public_actions",
+    "repository",
+    "repository_id",
+    "repository_owner_id",
+    "tool_versions",
+];
+const NOT_ESTABLISHED: [&str; 4] = [
+    "authenticated acquisition receipts (Task 8)",
+    "git executable identity (Task 8)",
+    "rustup override/toolchain selection (bootstrap, Task 8)",
+    "remote branch-tip ancestry and ruleset validation (Task 14)",
+];
+
+/// Target triples the compiled cohort contract can build.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum ReleaseTarget {
+    Wasm32Wasip1,
+    Aarch64AppleDarwin,
+    X86_64AppleDarwin,
+    X86_64UnknownLinuxGnu,
+}
+
+impl ReleaseTarget {
+    const ALL: [Self; 4] = [
+        Self::Wasm32Wasip1,
+        Self::Aarch64AppleDarwin,
+        Self::X86_64AppleDarwin,
+        Self::X86_64UnknownLinuxGnu,
+    ];
+
+    /// Returns the Rust target triple.
+    pub(crate) fn triple(self) -> &'static str {
+        match self {
+            Self::Wasm32Wasip1 => "wasm32-wasip1",
+            Self::Aarch64AppleDarwin => "aarch64-apple-darwin",
+            Self::X86_64AppleDarwin => "x86_64-apple-darwin",
+            Self::X86_64UnknownLinuxGnu => "x86_64-unknown-linux-gnu",
+        }
+    }
+
+    /// Returns whether the target needs the explicit macOS loader floor.
+    // Only the Task 5/7 child-environment builder (`preflight::child`) calls this.
+    #[allow(dead_code)]
+    pub(crate) fn is_darwin(self) -> bool {
+        matches!(self, Self::Aarch64AppleDarwin | Self::X86_64AppleDarwin)
+    }
+
+    fn from_triple(triple: &str) -> Option<Self> {
+        Self::ALL
+            .into_iter()
+            .find(|target| target.triple() == triple)
+    }
+}
+
+/// One source-owned asset identity; JSON can only restate it.
+pub(crate) struct FixedArtifact {
+    pub(crate) name: &'static str,
+    pub(crate) package: &'static str,
+    pub(crate) bin: &'static str,
+    pub(crate) target: ReleaseTarget,
+    kind: &'static str,
+    role: &'static str,
+    pub(crate) assurance_profile: &'static str,
+    capability: &'static str,
+    architecture: &'static str,
+    minimum_version: &'static str,
+    runtime: &'static str,
+    recipe_environment: &'static str,
+}
+
+impl FixedArtifact {
+    /// Renders this asset's fixed release-index identity fields.
+    ///
+    /// The result is exactly the governing schema's per-asset `oneOf` row: the
+    /// name, role, kind, package, target, default variant, assurance profile,
+    /// the single compiled capability and the compatibility triple. Nothing in
+    /// it comes from JSON input, so it can never add `fastly-staging`.
+    pub(crate) fn index_identity(&self) -> Value {
+        json!({
+            "name": self.name,
+            "role": self.role,
+            "kind": self.kind,
+            "package": self.package,
+            "target": self.target.triple(),
+            "variant": "default",
+            "assurance_profile": self.assurance_profile,
+            "capabilities": [self.capability],
+            "compatibility": {
+                "runtime": self.runtime,
+                "minimum_version": self.minimum_version,
+                "architecture": self.architecture,
+            },
+        })
+    }
+}
+
+/// The complete phase-one cohort. Every asset uses default features only.
+pub(crate) const FIXED_ARTIFACTS: [FixedArtifact; 4] = [
+    FixedArtifact {
+        name: "trusted-server-fastly.wasm",
+        package: "trusted-server-adapter-fastly",
+        bin: "trusted-server-adapter-fastly",
+        target: ReleaseTarget::Wasm32Wasip1,
+        kind: "wasm-core",
+        role: "server",
+        assurance_profile: "provenance-sbom-repeatable",
+        capability: "fastly-production",
+        architecture: "wasm32",
+        minimum_version: "wasip1",
+        runtime: "fastly-compute",
+        recipe_environment: BUILDER_ENVIRONMENT,
+    },
+    FixedArtifact {
+        name: "ts-aarch64-apple-darwin",
+        package: "trusted-server-cli",
+        bin: "ts",
+        target: ReleaseTarget::Aarch64AppleDarwin,
+        kind: "native-executable",
+        role: "operator-cli",
+        assurance_profile: "provenance-sbom",
+        capability: "cli-execute",
+        architecture: "aarch64",
+        minimum_version: "13.0",
+        runtime: "macos",
+        recipe_environment: "macos15-aarch64",
+    },
+    FixedArtifact {
+        name: "ts-x86_64-apple-darwin",
+        package: "trusted-server-cli",
+        bin: "ts",
+        target: ReleaseTarget::X86_64AppleDarwin,
+        kind: "native-executable",
+        role: "operator-cli",
+        assurance_profile: "provenance-sbom",
+        capability: "cli-execute",
+        architecture: "x86_64",
+        minimum_version: "13.0",
+        runtime: "macos",
+        recipe_environment: "macos15-x86_64",
+    },
+    FixedArtifact {
+        name: "ts-x86_64-unknown-linux-gnu",
+        package: "trusted-server-cli",
+        bin: "ts",
+        target: ReleaseTarget::X86_64UnknownLinuxGnu,
+        kind: "native-executable",
+        role: "operator-cli",
+        assurance_profile: "provenance-sbom",
+        capability: "cli-execute",
+        architecture: "x86_64",
+        minimum_version: "glibc-2.34",
+        runtime: "linux-gnu",
+        recipe_environment: BUILDER_ENVIRONMENT,
+    },
+];
+
+/// Test-only rows naming the members of the Cargo denial fixture workspace.
+///
+/// They are never part of [`FIXED_ARTIFACTS`] or the cohort, so no request
+/// text can select them; only test code reaches them by package name.
+#[cfg(test)]
+pub(crate) const DENIAL_FIXTURE_ARTIFACTS: [FixedArtifact; 4] = [
+    denial_fixture_row("denial-build-direct.wasm", "build-direct"),
+    denial_fixture_row("denial-build-grandchild.wasm", "build-grandchild"),
+    denial_fixture_row("denial-macro-attempt.wasm", "macro-attempt"),
+    denial_fixture_row("denial-control.wasm", "control"),
+];
+
+/// Test-only rows naming the Cargo denial fixture members built for each
+/// macOS CPU, so the macOS candidate jobs can prove build-script, grandchild
+/// and procedural-macro denial through the actual Darwin recipe.
+///
+/// Like [`DENIAL_FIXTURE_ARTIFACTS`] they are outside [`FIXED_ARTIFACTS`]
+/// and the cohort; only test code reaches them by package and target.
+#[cfg(test)]
+pub(crate) const DARWIN_DENIAL_FIXTURE_ARTIFACTS: [FixedArtifact; 8] = [
+    darwin_denial_row(
+        "denial-build-direct-aarch64-apple-darwin",
+        "build-direct",
+        ARM64,
+    ),
+    darwin_denial_row(
+        "denial-build-grandchild-aarch64-apple-darwin",
+        "build-grandchild",
+        ARM64,
+    ),
+    darwin_denial_row(
+        "denial-macro-attempt-aarch64-apple-darwin",
+        "macro-attempt",
+        ARM64,
+    ),
+    darwin_denial_row("denial-control-aarch64-apple-darwin", "control", ARM64),
+    darwin_denial_row(
+        "denial-build-direct-x86_64-apple-darwin",
+        "build-direct",
+        INTEL,
+    ),
+    darwin_denial_row(
+        "denial-build-grandchild-x86_64-apple-darwin",
+        "build-grandchild",
+        INTEL,
+    ),
+    darwin_denial_row(
+        "denial-macro-attempt-x86_64-apple-darwin",
+        "macro-attempt",
+        INTEL,
+    ),
+    darwin_denial_row("denial-control-x86_64-apple-darwin", "control", INTEL),
+];
+
+/// The arm64 macOS target of the Darwin denial rows.
+#[cfg(test)]
+const ARM64: ReleaseTarget = ReleaseTarget::Aarch64AppleDarwin;
+/// The Intel macOS target of the Darwin denial rows.
+#[cfg(test)]
+const INTEL: ReleaseTarget = ReleaseTarget::X86_64AppleDarwin;
+
+/// One Darwin denial fixture row for `target`.
+#[cfg(test)]
+const fn darwin_denial_row(
+    name: &'static str,
+    package: &'static str,
+    target: ReleaseTarget,
+) -> FixedArtifact {
+    // Evaluated at compile time, so a non-Darwin row fails the build.
+    let architecture = match target {
+        ReleaseTarget::Aarch64AppleDarwin => "aarch64",
+        ReleaseTarget::X86_64AppleDarwin => "x86_64",
+        ReleaseTarget::Wasm32Wasip1 | ReleaseTarget::X86_64UnknownLinuxGnu => {
+            panic!("Darwin denial rows need a Darwin target")
+        }
+    };
+    FixedArtifact {
+        target,
+        architecture,
+        minimum_version: "13.0",
+        runtime: "macos",
+        ..denial_fixture_row(name, package)
+    }
+}
+
+/// One Wasm denial fixture row whose binary is named after its package.
+#[cfg(test)]
+const fn denial_fixture_row(name: &'static str, package: &'static str) -> FixedArtifact {
+    FixedArtifact {
+        name,
+        package,
+        bin: package,
+        target: ReleaseTarget::Wasm32Wasip1,
+        kind: "denial-fixture",
+        role: "test-fixture",
+        assurance_profile: "none",
+        capability: "none",
+        architecture: "wasm32",
+        minimum_version: "wasip1",
+        runtime: "none",
+        recipe_environment: "ordinary-ci",
+    }
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct CohortDocument {
+    artifacts: Vec<CohortArtifact>,
+    cohort: String,
+    eligible_branches: Vec<String>,
+    schema_version: u64,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct CohortArtifact {
+    assurance_profile: String,
+    bin: String,
+    capabilities: Vec<String>,
+    compatibility: Compatibility,
+    default_features: bool,
+    features: Vec<String>,
+    kind: String,
+    name: String,
+    package: String,
+    role: String,
+    target: String,
+    variant: String,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Compatibility {
+    architecture: String,
+    minimum_version: String,
+    runtime: String,
+}
+
+/// Raw-byte identity of one tracked input file.
+struct InputDigest {
+    path: &'static str,
+    sha256: String,
+}
+
+/// Parsed tracked release inputs that match the compiled contract.
+///
+/// This is not authorization: pins may still be pending or unauthenticated.
+pub(crate) struct ReleaseInputs {
+    digests: [InputDigest; 3],
+    tools: ToolsDocument,
+}
+
+impl ReleaseInputs {
+    /// Returns the source-relative path and raw SHA-256 of each input file.
+    pub(crate) fn input_digests(&self) -> [(&'static str, &str); 3] {
+        self.digests
+            .each_ref()
+            .map(|digest| (digest.path, digest.sha256.as_str()))
+    }
+
+    fn pending_items(&self) -> Vec<String> {
+        self.tools.pending_items()
+    }
+}
+
+/// An authenticated acquisition and measured-pin receipt.
+///
+/// No receipt verifier exists yet (Task 8), so this type is uninhabited and
+/// production selection cannot succeed.
+pub(crate) enum AcquisitionReceipt {}
+
+/// Production tool selection; constructed only by [`select_qualified`].
+pub(crate) struct QualifiedSelection<'a> {
+    receipts: Vec<String>,
+    inputs: &'a ReleaseInputs,
+}
+
+impl QualifiedSelection<'_> {
+    /// Summarizes the selected inputs for the caller's diagnostics.
+    pub(crate) fn summary(&self) -> String {
+        format!(
+            "selected {} authenticated pins from {} inputs",
+            self.receipts.len(),
+            self.inputs.digests.len()
+        )
+    }
+}
+
+/// Selects production pins only when every pin is qualified and authenticated.
+///
+/// # Errors
+///
+/// Fails on any pending qualification or null pin, and otherwise fails because
+/// authenticated acquisition receipts cannot be constructed yet.
+pub(crate) fn select_qualified<'a>(
+    inputs: &'a ReleaseInputs,
+    receipts: &[AcquisitionReceipt],
+) -> Result<QualifiedSelection<'a>, Report<ReleaseError>> {
+    let pending = inputs.pending_items();
+    if !pending.is_empty() {
+        return Err(Report::new(ReleaseError::Unqualified).attach(format!(
+            "{} release pins are pending or null; production selection requires every pin qualified: {}",
+            pending.len(),
+            pending.join("; ")
+        )));
+    }
+    let verified: Vec<String> = receipts.iter().map(|receipt| match *receipt {}).collect();
+    if verified.is_empty() {
+        return Err(Report::new(ReleaseError::Unqualified).attach(
+            "qualified pins require authenticated acquisition receipts (Task 8); \
+             production selection remains closed",
+        ));
+    }
+    Ok(QualifiedSelection {
+        receipts: verified,
+        inputs,
+    })
+}
+
+/// Diagnostic description of incomplete inputs. It authorizes nothing.
+pub(crate) struct InputAudit<'a> {
+    inputs: &'a ReleaseInputs,
+    pending: Vec<String>,
+}
+
+impl InputAudit<'_> {
+    /// Returns whether every JSON pin and external authentication is present.
+    ///
+    /// This is always `false` while [`NOT_ESTABLISHED`] lists facts this tool
+    /// cannot yet establish, so the diagnostic can never report completion.
+    pub(crate) fn is_complete(&self) -> bool {
+        self.pending.is_empty() && NOT_ESTABLISHED.is_empty()
+    }
+
+    /// Renders the deterministic diagnostic report.
+    pub(crate) fn to_json(&self) -> Value {
+        json!({
+            "inputs": self
+                .inputs
+                .input_digests()
+                .iter()
+                .map(|(path, sha256)| json!({"path": path, "sha256": sha256}))
+                .collect::<Vec<_>>(),
+            "not_established": NOT_ESTABLISHED,
+            "pending": self.pending,
+            "report": "release-input-audit",
+            "status": if self.is_complete() { "complete" } else { "incomplete" },
+        })
+    }
+}
+
+/// Lists pending and null items for diagnostics without constructing authority.
+pub(crate) fn audit_inputs(inputs: &ReleaseInputs) -> InputAudit<'_> {
+    InputAudit {
+        inputs,
+        pending: inputs.pending_items(),
+    }
+}
+
+/// Reads the three tracked inputs below `root` and checks them.
+///
+/// # Errors
+///
+/// Fails when any input cannot be read under its byte bound or violates the
+/// compiled contract.
+pub(crate) fn load_inputs(root: &Path) -> Result<ReleaseInputs, Report<ReleaseError>> {
+    let cohort = read_bounded(&root.join(COHORT_PATH), Role::Metadata)?;
+    let tools = read_bounded(&root.join(TOOLS_PATH), Role::Metadata)?;
+    let cli_policy = read_bounded(&root.join(CLI_POLICY_PATH), Role::Metadata)?;
+    check_inputs(&cohort.bytes, &tools.bytes, &cli_policy.bytes)
+}
+
+/// Parses and checks exact input bytes against the compiled contract.
+///
+/// # Errors
+///
+/// Fails on malformed JSON, unknown or missing fields, or any deviation from
+/// the compiled cohort, tool pins, recipes or consumer policy join.
+pub(crate) fn check_inputs(
+    cohort: &[u8],
+    tools: &[u8],
+    cli_policy: &[u8],
+) -> Result<ReleaseInputs, Report<ReleaseError>> {
+    let cohort_value = parse_json(cohort, Role::Metadata)?;
+    let cohort_document: CohortDocument = typed(&cohort_value, COHORT_PATH)?;
+    check_cohort(&cohort_document)?;
+    let tools_document: ToolsDocument = typed(&parse_json(tools, Role::Metadata)?, TOOLS_PATH)?;
+    check_tools(&tools_document)?;
+    check_cli_policy(&parse_json(cli_policy, Role::Metadata)?, &cohort_value)?;
+    let digest = |path, bytes: &[u8]| InputDigest {
+        path,
+        sha256: hex::encode(Sha256::digest(bytes)),
+    };
+    Ok(ReleaseInputs {
+        digests: [
+            digest(COHORT_PATH, cohort),
+            digest(TOOLS_PATH, tools),
+            digest(CLI_POLICY_PATH, cli_policy),
+        ],
+        tools: tools_document,
+    })
+}
+
+fn typed<T: DeserializeOwned>(value: &Value, path: &str) -> Result<T, Report<ReleaseError>> {
+    T::deserialize(value).map_err(|error| rejected(format!("{path}: {error}")))
+}
+
+fn rejected(message: impl Into<String>) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Policy).attach(message.into())
+}
+
+fn check_cohort(cohort: &CohortDocument) -> Result<(), Report<ReleaseError>> {
+    if cohort.schema_version != SCHEMA_VERSION {
+        return Err(rejected("cohort schema_version must be 1"));
+    }
+    if cohort.cohort != COHORT_ID {
+        return Err(rejected(format!("cohort must be {COHORT_ID}")));
+    }
+    if cohort.eligible_branches != ELIGIBLE_BRANCHES {
+        return Err(rejected(
+            "eligible_branches must be exactly [\"main\"]; a candidate cohort cannot \
+             approve its own branch without independent review",
+        ));
+    }
+    let mut seen = BTreeSet::new();
+    for artifact in &cohort.artifacts {
+        if !seen.insert(artifact.name.as_str()) {
+            return Err(rejected(format!("duplicate asset {}", artifact.name)));
+        }
+        let fixed = FIXED_ARTIFACTS
+            .iter()
+            .find(|fixed| fixed.name == artifact.name)
+            .ok_or_else(|| rejected(format!("unknown asset {}", artifact.name)))?;
+        check_artifact(fixed, artifact)?;
+    }
+    if let Some(missing) = FIXED_ARTIFACTS
+        .iter()
+        .find(|fixed| !seen.contains(fixed.name))
+    {
+        return Err(rejected(format!("missing asset {}", missing.name)));
+    }
+    Ok(())
+}
+
+fn check_artifact(
+    fixed: &FixedArtifact,
+    artifact: &CohortArtifact,
+) -> Result<(), Report<ReleaseError>> {
+    let name = fixed.name;
+    if ReleaseTarget::from_triple(&artifact.target).is_none() {
+        return Err(rejected(format!(
+            "asset {name} selects unknown target {}",
+            artifact.target
+        )));
+    }
+    if !artifact.features.is_empty() {
+        return Err(rejected(format!(
+            "asset {name} requests unsupported features {:?}; only the default variant \
+             with reusable-sandbox disabled is attested",
+            artifact.features
+        )));
+    }
+    if !artifact.default_features || artifact.variant != "default" {
+        return Err(rejected(format!(
+            "asset {name} must keep default_features true and variant default"
+        )));
+    }
+    for (field, expected, actual) in identity_fields(fixed, artifact) {
+        if expected != actual {
+            return Err(rejected(format!(
+                "asset {name} changes {field} from {expected} to {actual}"
+            )));
+        }
+    }
+    if artifact.capabilities != [fixed.capability] {
+        return Err(rejected(format!(
+            "asset {name} changes capabilities from [{}]",
+            fixed.capability
+        )));
+    }
+    Ok(())
+}
+
+/// Field name, compiled value and candidate value of each fixed identity field.
+fn identity_fields<'a>(
+    fixed: &FixedArtifact,
+    artifact: &'a CohortArtifact,
+) -> [(&'static str, &'static str, &'a str); 9] {
+    let compatibility = &artifact.compatibility;
+    [
+        ("package", fixed.package, artifact.package.as_str()),
+        ("bin", fixed.bin, artifact.bin.as_str()),
+        ("target", fixed.target.triple(), artifact.target.as_str()),
+        ("kind", fixed.kind, artifact.kind.as_str()),
+        ("role", fixed.role, artifact.role.as_str()),
+        (
+            "assurance_profile",
+            fixed.assurance_profile,
+            artifact.assurance_profile.as_str(),
+        ),
+        (
+            "compatibility.architecture",
+            fixed.architecture,
+            compatibility.architecture.as_str(),
+        ),
+        (
+            "compatibility.minimum_version",
+            fixed.minimum_version,
+            compatibility.minimum_version.as_str(),
+        ),
+        (
+            "compatibility.runtime",
+            fixed.runtime,
+            compatibility.runtime.as_str(),
+        ),
+    ]
+}
+
+/// Every non-artifact field of the tracked consumer release policy.
+fn compiled_consumer_policy() -> Value {
+    let workflow = "https://github.com/IABTechLab/trusted-server/.github/workflows/release-build.yml@refs/tags/<tag>";
+    json!({
+        "bounds": {
+            "attempt_seconds": 900,
+            "bundle_bytes": 33_554_432,
+            "child_seconds": 120,
+            "cohort_executables": FIXED_ARTIFACTS.len(),
+            "companion_bytes": 33_554_432,
+            "executable_bytes": 536_870_912,
+            "index_bytes": 1_048_576,
+            "inventory_bytes": 1_048_576,
+            "json_depth": 64,
+            "matching_attestations_per_bundle": 1,
+            "metadata_bytes": 1_048_576,
+            "policy_bytes": 1_048_576,
+            "spdx_bytes": 16_777_216,
+            "stderr_bytes": 1_048_576,
+            "stdout_bytes": 134_217_728,
+            "trusted_roots_bytes": 1_048_576,
+        },
+        "cohort": COHORT_ID,
+        "github_host": "github.com",
+        "historical_producer_policies": [],
+        "identity": {
+            "builder_id": workflow,
+            "caller_commit": "same-approved-source-commit",
+            "caller_path": ".github/workflows/release.yml",
+            "caller_repository": "https://github.com/IABTechLab/trusted-server",
+            "certificate_fields": [
+                "buildConfigDigest",
+                "buildConfigURI",
+                "buildTrigger",
+                "runInvocationURI",
+                "sourceRepositoryIdentifier",
+                "sourceRepositoryOwnerIdentifier",
+            ],
+            "certificate_san": workflow,
+            "event": "push",
+            "external_parameters": "exact-caller-workflow-only-no-inputs",
+            "invocation": "same-repository-run-and-attempt-across-certificate-and-provenance",
+            "issuer": "https://token.actions.githubusercontent.com",
+            "runner": "github-hosted",
+            "signer_commit": "same-approved-source-commit",
+            "source_commit": "independently-approved-40-lowercase-hex",
+            "source_dependency": "git+https://github.com/IABTechLab/trusted-server@refs/tags/<tag>",
+            "source_ref": "refs/tags/<tag>",
+        },
+        "policy_version": CLI_POLICY_VERSION,
+        "predicates": {
+            "build_type": "https://actions.github.io/buildtypes/workflow/v1",
+            "provenance": "https://slsa.dev/provenance/v1",
+            "sbom": "https://spdx.dev/Document/v2.3",
+        },
+        "public_actions": READONLY_ACTIONS,
+        "repository": REPOSITORY,
+        "repository_id": "950860906",
+        "repository_owner_id": "82903538",
+        "tool_versions": {
+            "actions_attest": ATTEST_VERSION,
+            "actions_attest_revision": ATTEST_REVISION,
+            "gh": GH_VERSION,
+        },
+    })
+}
+
+fn check_cli_policy(policy: &Value, cohort: &Value) -> Result<(), Report<ReleaseError>> {
+    let object = policy
+        .as_object()
+        .ok_or_else(|| rejected("release-policy must be an object"))?;
+    let keys: BTreeSet<&str> = object.keys().map(String::as_str).collect();
+    if keys != BTreeSet::from(CLI_POLICY_FIELDS) {
+        return Err(rejected(
+            "release-policy must contain exactly the reviewed top-level fields",
+        ));
+    }
+    let compiled = compiled_consumer_policy();
+    for key in CLI_POLICY_FIELDS.iter().filter(|key| **key != "artifacts") {
+        if object.get(*key) != compiled.get(*key) {
+            return Err(rejected(format!(
+                "release-policy field {key} differs from the compiled consumer policy"
+            )));
+        }
+    }
+    check_policy_artifacts(&object["artifacts"], cohort)
+}
+
+/// Joins each consumer policy artifact to its cohort artifact plus read-only actions.
+fn check_policy_artifacts(policy: &Value, cohort: &Value) -> Result<(), Report<ReleaseError>> {
+    let policy_artifacts = policy
+        .as_array()
+        .ok_or_else(|| rejected("release-policy artifacts must be an array"))?;
+    let cohort_artifacts = cohort["artifacts"]
+        .as_array()
+        .ok_or_else(|| rejected("cohort artifacts must be an array"))?;
+    if policy_artifacts.len() != cohort_artifacts.len() {
+        return Err(rejected(
+            "release-policy artifacts must list exactly the cohort artifacts",
+        ));
+    }
+    let readonly = json!(READONLY_ACTIONS);
+    for (policy_artifact, cohort_artifact) in policy_artifacts.iter().zip(cohort_artifacts) {
+        let policy_object = policy_artifact
+            .as_object()
+            .ok_or_else(|| rejected("release-policy artifact must be an object"))?;
+        let cohort_object = cohort_artifact
+            .as_object()
+            .ok_or_else(|| rejected("cohort artifact must be an object"))?;
+        if policy_object.get("actions") != Some(&readonly) {
+            return Err(rejected(
+                "release-policy artifact actions must be exactly [\"readonly-verify\"]",
+            ));
+        }
+        let joined = policy_object.len() == cohort_object.len() + 1
+            && cohort_object
+                .iter()
+                .all(|(key, value)| key != "actions" && policy_object.get(key) == Some(value));
+        if !joined {
+            return Err(rejected(format!(
+                "release-policy artifact {} differs from the cohort artifact",
+                cohort_artifact["name"]
+            )));
+        }
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/trusted-server-release/src/policy/tests.rs b/crates/trusted-server-release/src/policy/tests.rs
new file mode 100644
index 0000000000..5b56f863fc
--- /dev/null
+++ b/crates/trusted-server-release/src/policy/tests.rs
@@ -0,0 +1,674 @@
+use serde_json::json;
+use sha2::Sha256;
+
+use super::*;
+
+const COHORT: &[u8] = include_bytes!("../../../../scripts/release/release-cohort.json");
+const TOOLS: &[u8] = include_bytes!("../../../../scripts/release/release-tools.json");
+const CLI_POLICY: &[u8] =
+    include_bytes!("../../../../crates/trusted-server-cli/release-policy.json");
+
+#[test]
+fn pending_tool_versions_match_the_source_selected_toolchain() {
+    let tools = value(TOOLS);
+    let source = include_str!("../../../../.tool-versions");
+    for (release_name, source_name) in [
+        ("node", "nodejs"),
+        ("rust", "rust"),
+        ("fastly", "fastly"),
+        ("viceroy", "viceroy"),
+        ("wasmtime", "wasmtime"),
+    ] {
+        let version = source
+            .lines()
+            .find_map(|line| {
+                let mut fields = line.split_whitespace();
+                (fields.next() == Some(source_name))
+                    .then(|| fields.next())
+                    .flatten()
+            })
+            .expect("should contain the source tool version");
+        for tool in tools["tools"].as_array().expect("should hold tool pins") {
+            if tool["name"]
+                .as_str()
+                .is_some_and(|name| name.split(':').next() == Some(release_name))
+            {
+                assert_eq!(
+                    tool["version"], version,
+                    "should keep pending {release_name} pins aligned with source selection"
+                );
+            }
+        }
+    }
+}
+
+fn value(bytes: &[u8]) -> Value {
+    serde_json::from_slice(bytes).expect("should parse tracked fixture input")
+}
+
+fn encode(value: &Value) -> Vec<u8> {
+    serde_json::to_vec(value).expect("should encode mutated fixture input")
+}
+
+fn report_text(report: &Report<ReleaseError>) -> String {
+    format!("{report:?}")
+}
+
+fn cohort_with(mutate: impl FnOnce(&mut Value)) -> Result<ReleaseInputs, Report<ReleaseError>> {
+    let mut cohort = value(COHORT);
+    mutate(&mut cohort);
+    check_inputs(&encode(&cohort), TOOLS, CLI_POLICY)
+}
+
+fn tools_with(mutate: impl FnOnce(&mut Value)) -> Result<ReleaseInputs, Report<ReleaseError>> {
+    let mut tools = value(TOOLS);
+    mutate(&mut tools);
+    check_inputs(COHORT, &encode(&tools), CLI_POLICY)
+}
+
+fn policy_with(mutate: impl FnOnce(&mut Value)) -> Result<ReleaseInputs, Report<ReleaseError>> {
+    let mut policy = value(CLI_POLICY);
+    mutate(&mut policy);
+    check_inputs(COHORT, TOOLS, &encode(&policy))
+}
+
+fn artifact_index(document: &Value, name: &str) -> usize {
+    document["artifacts"]
+        .as_array()
+        .expect("should contain artifacts")
+        .iter()
+        .position(|artifact| artifact["name"] == name)
+        .expect("should contain named artifact")
+}
+
+fn expect_rejected(result: Result<ReleaseInputs, Report<ReleaseError>>, needle: &str) {
+    let report = result.err().expect("should reject mutated release input");
+    let text = report_text(&report);
+    assert!(
+        text.contains(needle),
+        "should explain rejection with `{needle}`, got: {text}"
+    );
+}
+
+#[test]
+fn accepts_tracked_inputs_and_preserves_raw_digests() {
+    let inputs = check_inputs(COHORT, TOOLS, CLI_POLICY).expect("should accept tracked inputs");
+    let digests = inputs
+        .input_digests()
+        .map(|(path, sha256)| (path, sha256.to_owned()));
+    assert_eq!(
+        digests,
+        [
+            (COHORT_PATH, hex::encode(Sha256::digest(COHORT))),
+            (TOOLS_PATH, hex::encode(Sha256::digest(TOOLS))),
+            (CLI_POLICY_PATH, hex::encode(Sha256::digest(CLI_POLICY))),
+        ],
+        "should preserve exact raw-byte digests of each input"
+    );
+}
+
+#[test]
+fn compiled_contract_maps_exactly_four_fixed_assets() {
+    let names: Vec<_> = FIXED_ARTIFACTS.iter().map(|fixed| fixed.name).collect();
+    assert_eq!(
+        names,
+        [
+            "trusted-server-fastly.wasm",
+            "ts-aarch64-apple-darwin",
+            "ts-x86_64-apple-darwin",
+            "ts-x86_64-unknown-linux-gnu",
+        ],
+        "should compile exactly the phase-one asset identities"
+    );
+    let fastly = &FIXED_ARTIFACTS[0];
+    assert_eq!(fastly.package, "trusted-server-adapter-fastly");
+    assert_eq!(fastly.bin, "trusted-server-adapter-fastly");
+    assert_eq!(fastly.target, ReleaseTarget::Wasm32Wasip1);
+    assert_eq!(fastly.assurance_profile, "provenance-sbom-repeatable");
+    for cli in &FIXED_ARTIFACTS[1..] {
+        assert_eq!(cli.package, "trusted-server-cli", "should build the CLI");
+        assert_eq!(cli.bin, "ts", "should build the ts binary");
+        assert_eq!(cli.assurance_profile, "provenance-sbom");
+    }
+    assert_eq!(ELIGIBLE_BRANCHES, ["main"], "should only allow main");
+}
+
+#[test]
+fn rejects_missing_artifact() {
+    expect_rejected(
+        cohort_with(|cohort| {
+            let index = artifact_index(cohort, "ts-x86_64-apple-darwin");
+            cohort["artifacts"]
+                .as_array_mut()
+                .expect("should contain artifacts")
+                .remove(index);
+        }),
+        "missing asset ts-x86_64-apple-darwin",
+    );
+}
+
+#[test]
+fn rejects_extra_artifact() {
+    expect_rejected(
+        cohort_with(|cohort| {
+            let mut extra = cohort["artifacts"][0].clone();
+            extra["name"] = json!("trusted-server-fastly-reuse.wasm");
+            cohort["artifacts"]
+                .as_array_mut()
+                .expect("should contain artifacts")
+                .push(extra);
+        }),
+        "unknown asset trusted-server-fastly-reuse.wasm",
+    );
+}
+
+#[test]
+fn rejects_duplicate_artifact() {
+    expect_rejected(
+        cohort_with(|cohort| {
+            let duplicate = cohort["artifacts"][0].clone();
+            cohort["artifacts"]
+                .as_array_mut()
+                .expect("should contain artifacts")
+                .push(duplicate);
+        }),
+        "duplicate asset",
+    );
+}
+
+#[test]
+fn rejects_profile_downgraded_after_failure() {
+    expect_rejected(
+        cohort_with(|cohort| {
+            let index = artifact_index(cohort, "trusted-server-fastly.wasm");
+            cohort["artifacts"][index]["assurance_profile"] = json!("provenance-sbom");
+        }),
+        "assurance_profile",
+    );
+}
+
+#[test]
+fn rejects_unknown_target() {
+    expect_rejected(
+        cohort_with(|cohort| {
+            let index = artifact_index(cohort, "ts-x86_64-unknown-linux-gnu");
+            cohort["artifacts"][index]["target"] = json!("x86_64-unknown-linux-musl");
+        }),
+        "unknown target x86_64-unknown-linux-musl",
+    );
+}
+
+#[test]
+fn rejects_reassigned_known_target() {
+    expect_rejected(
+        cohort_with(|cohort| {
+            let index = artifact_index(cohort, "ts-x86_64-apple-darwin");
+            cohort["artifacts"][index]["target"] = json!("aarch64-apple-darwin");
+        }),
+        "target",
+    );
+}
+
+#[test]
+fn rejects_unknown_or_reuse_feature() {
+    for feature in ["reusable-sandbox", "fictional-feature"] {
+        expect_rejected(
+            cohort_with(|cohort| {
+                let index = artifact_index(cohort, "trusted-server-fastly.wasm");
+                cohort["artifacts"][index]["features"] = json!([feature]);
+            }),
+            "unsupported features",
+        );
+    }
+}
+
+#[test]
+fn rejects_disabled_default_features_and_changed_variant() {
+    expect_rejected(
+        cohort_with(|cohort| {
+            cohort["artifacts"][0]["default_features"] = json!(false);
+        }),
+        "default_features",
+    );
+    expect_rejected(
+        cohort_with(|cohort| {
+            cohort["artifacts"][0]["variant"] = json!("reuse");
+        }),
+        "variant",
+    );
+}
+
+#[test]
+fn rejects_changed_package_bin_capability_and_compatibility() {
+    for (field, replacement) in [
+        ("package", json!("trusted-server-adapter-axum")),
+        ("bin", json!("other")),
+        ("capabilities", json!(["cli-execute"])),
+        ("kind", json!("native-executable")),
+        ("role", json!("operator-cli")),
+    ] {
+        expect_rejected(
+            cohort_with(|cohort| {
+                let index = artifact_index(cohort, "trusted-server-fastly.wasm");
+                cohort["artifacts"][index][field] = replacement;
+            }),
+            field,
+        );
+    }
+    expect_rejected(
+        cohort_with(|cohort| {
+            let index = artifact_index(cohort, "ts-x86_64-unknown-linux-gnu");
+            cohort["artifacts"][index]["compatibility"]["minimum_version"] = json!("glibc-2.39");
+        }),
+        "compatibility",
+    );
+}
+
+#[test]
+fn rejects_candidate_cohort_listing_its_own_rc_branch() {
+    for branches in [
+        json!(["main", "rc/202610"]),
+        json!(["rc/202610"]),
+        json!([]),
+    ] {
+        expect_rejected(
+            cohort_with(|cohort| {
+                cohort["eligible_branches"] = branches;
+            }),
+            "eligible_branches",
+        );
+    }
+}
+
+#[test]
+fn rejects_changed_cohort_identity_and_schema_version() {
+    expect_rejected(
+        cohort_with(|cohort| cohort["cohort"] = json!("phase2")),
+        "cohort",
+    );
+    expect_rejected(
+        cohort_with(|cohort| cohort["schema_version"] = json!(2)),
+        "schema_version",
+    );
+}
+
+#[test]
+fn rejects_unknown_and_missing_cohort_fields() {
+    assert!(
+        cohort_with(|cohort| cohort["commands"] = json!(["cargo build"])).is_err(),
+        "should reject JSON-supplied commands"
+    );
+    assert!(
+        cohort_with(|cohort| cohort["artifacts"][0]["command"] = json!("sh -c true")).is_err(),
+        "should reject artifact-level commands"
+    );
+    assert!(
+        cohort_with(|cohort| {
+            cohort["artifacts"][0]
+                .as_object_mut()
+                .expect("should be an artifact object")
+                .remove("variant");
+        })
+        .is_err(),
+        "should reject a missing artifact field"
+    );
+    assert!(
+        cohort_with(|cohort| {
+            cohort
+                .as_object_mut()
+                .expect("should be a cohort object")
+                .remove("eligible_branches");
+        })
+        .is_err(),
+        "should reject a missing cohort field"
+    );
+}
+
+#[test]
+fn rejects_duplicate_keys_through_strict_parser() {
+    let duplicated = String::from_utf8(COHORT.to_vec())
+        .expect("should be UTF-8")
+        .replacen(
+            "\"cohort\": \"phase1-fastly-cli\"",
+            "\"cohort\": \"phase1-fastly-cli\", \"cohort\": \"x\"",
+            1,
+        );
+    assert!(
+        check_inputs(duplicated.as_bytes(), TOOLS, CLI_POLICY).is_err(),
+        "should reject duplicate keys before semantic checks"
+    );
+}
+
+#[test]
+fn joins_cli_policy_artifacts_to_cohort_with_readonly_actions() {
+    expect_rejected(
+        policy_with(|policy| {
+            policy["artifacts"][0]["actions"] = json!(["readonly-verify", "deploy"])
+        }),
+        "actions",
+    );
+    expect_rejected(
+        policy_with(|policy| {
+            policy["artifacts"][1]
+                .as_object_mut()
+                .expect("should be a policy artifact")
+                .remove("actions");
+        }),
+        "actions",
+    );
+    expect_rejected(
+        policy_with(|policy| policy["artifacts"][1]["assurance_profile"] = json!("provenance")),
+        "release-policy",
+    );
+    expect_rejected(
+        policy_with(|policy| {
+            policy["artifacts"]
+                .as_array_mut()
+                .expect("should contain artifacts")
+                .pop();
+        }),
+        "release-policy",
+    );
+    assert!(
+        policy_with(|policy| policy["override_url"] = json!("https://example.com/policy.json"))
+            .is_err(),
+        "should reject unknown policy fields"
+    );
+    expect_rejected(
+        policy_with(|policy| policy["tool_versions"]["gh"] = json!("2.96.0")),
+        "tool_versions",
+    );
+    expect_rejected(
+        policy_with(|policy| policy["cohort"] = json!("phase2")),
+        "cohort",
+    );
+}
+
+#[test]
+fn preserves_exact_tool_versions_and_attest_revision() {
+    expect_rejected(
+        tools_with(|tools| {
+            let tool = tools["tools"]
+                .as_array_mut()
+                .expect("should contain tools")
+                .iter_mut()
+                .find(|tool| tool["name"] == "gh:x86_64-unknown-linux-gnu")
+                .expect("should contain gh");
+            tool["version"] = json!("2.96.0");
+        }),
+        "gh:x86_64-unknown-linux-gnu",
+    );
+    expect_rejected(
+        tools_with(|tools| {
+            tools["tools"][0]["revision"] = json!("0".repeat(40));
+        }),
+        "actions/attest:github-action",
+    );
+    expect_rejected(
+        tools_with(|tools| {
+            tools["tools"]
+                .as_array_mut()
+                .expect("should contain tools")
+                .retain(|tool| tool["name"] != "rust:x86_64-apple-darwin");
+        }),
+        "missing tool rust:x86_64-apple-darwin",
+    );
+    expect_rejected(
+        tools_with(|tools| {
+            let mut extra = tools["tools"][1].clone();
+            extra["name"] = json!("fastly:aarch64-unknown-linux-gnu");
+            tools["tools"]
+                .as_array_mut()
+                .expect("should contain tools")
+                .push(extra);
+        }),
+        "unknown tool fastly:aarch64-unknown-linux-gnu",
+    );
+}
+
+#[test]
+fn rejects_absent_nullable_pin_fields_and_unknown_tool_fields() {
+    assert!(
+        tools_with(|tools| {
+            tools["tools"][1]
+                .as_object_mut()
+                .expect("should be a tool object")
+                .remove("sha256");
+        })
+        .is_err(),
+        "should treat an absent digest as invalid rather than null"
+    );
+    assert!(
+        tools_with(|tools| tools["tools"][1]["qualified"] = json!(true)).is_err(),
+        "should reject serialized authority booleans"
+    );
+    assert!(
+        tools_with(|tools| tools["environments"][0]["authenticated"] = json!(true)).is_err(),
+        "should reject unknown environment fields"
+    );
+    assert!(
+        tools_with(|tools| tools["tools"][1]["qualification"] = json!("approved")).is_err(),
+        "should reject unknown qualification states"
+    );
+    assert!(
+        tools_with(|tools| tools["tools"][1]["sha256"] = json!("not-a-digest")).is_err(),
+        "should reject malformed digests"
+    );
+}
+
+#[test]
+fn rejects_recipe_script_and_environment_changes() {
+    expect_rejected(
+        tools_with(|tools| tools["recipes"][0]["script"] = json!("scripts/release/other.sh")),
+        "script",
+    );
+    expect_rejected(
+        tools_with(|tools| tools["recipes"][1]["environment_id"] = json!("gnu-builder-x86_64")),
+        "environment_id",
+    );
+    expect_rejected(
+        tools_with(|tools| tools["recipes"][0]["settings"]["aws_lc_use_system"] = json!(true)),
+        "settings",
+    );
+    expect_rejected(
+        tools_with(|tools| tools["recipes"][0]["settings"]["rust_toolchain"] = json!("1.96.0")),
+        "settings",
+    );
+    expect_rejected(
+        tools_with(|tools| {
+            tools["environments"][1]["glibc_maximum"] = json!("2.39");
+        }),
+        "gnu-builder-x86_64",
+    );
+}
+
+#[test]
+fn production_selector_rejects_tracked_pending_pins() {
+    let inputs = check_inputs(COHORT, TOOLS, CLI_POLICY).expect("should accept tracked inputs");
+    let report = select_qualified(&inputs, &[])
+        .err()
+        .expect("should reject pending pins");
+    let text = report_text(&report);
+    assert!(text.contains("pending"), "should name pending pins: {text}");
+}
+
+fn qualified_looking_tools() -> Value {
+    let digest = "ab".repeat(32);
+    let mut tools = value(TOOLS);
+    for section in ["environments", "recipes", "tools"] {
+        for entry in tools[section]
+            .as_array_mut()
+            .expect("should contain entries")
+        {
+            let object = entry.as_object_mut().expect("should be an object");
+            for (key, field) in object.iter_mut() {
+                if key == "qualification" {
+                    *field = json!("qualified");
+                } else if field.is_null() && key == "revision" {
+                    continue;
+                } else if field.is_null() && key.ends_with("sha256") {
+                    *field = json!(digest);
+                } else if field.is_null() {
+                    *field = json!("fictional.example.com/qualified");
+                }
+            }
+        }
+    }
+    tools
+}
+
+#[test]
+fn production_selector_rejects_qualified_looking_json_with_fake_digests() {
+    let inputs = check_inputs(COHORT, &encode(&qualified_looking_tools()), CLI_POLICY)
+        .expect("should parse structurally complete fictional pins");
+    let report = select_qualified(&inputs, &[])
+        .err()
+        .expect("should refuse JSON qualification without authenticated receipts");
+    let text = report_text(&report);
+    assert!(
+        text.contains("authenticated acquisition receipts")
+            && text.contains("production selection remains closed"),
+        "should explain the closed selector: {text}"
+    );
+}
+
+#[test]
+fn audit_lists_pending_items_without_authorization() {
+    let inputs = check_inputs(COHORT, TOOLS, CLI_POLICY).expect("should accept tracked inputs");
+    let audit = audit_inputs(&inputs);
+    assert!(!audit.is_complete(), "should report incomplete inputs");
+    let report = audit.to_json();
+    let pending = report["pending"]
+        .as_array()
+        .expect("should list pending items");
+    assert!(
+        pending.contains(&json!(
+            "tool gh:x86_64-unknown-linux-gnu: qualification pending"
+        )),
+        "should list pending tool qualification"
+    );
+    assert!(
+        pending.contains(&json!("tool gh:x86_64-unknown-linux-gnu: sha256 is null")),
+        "should list null tool digest"
+    );
+    assert!(
+        pending.contains(&json!("environment macos15-aarch64: sdk_sha256 is null")),
+        "should list null environment SDK digest"
+    );
+    assert_eq!(
+        report["inputs"][0],
+        json!({"path": COHORT_PATH, "sha256": hex::encode(Sha256::digest(COHORT))}),
+        "should report raw input digests"
+    );
+    assert_eq!(report["status"], json!("incomplete"));
+}
+
+#[test]
+fn audit_stays_incomplete_for_qualified_looking_json() {
+    let inputs = check_inputs(COHORT, &encode(&qualified_looking_tools()), CLI_POLICY)
+        .expect("should parse structurally complete fictional pins");
+    let audit = audit_inputs(&inputs);
+    assert!(
+        audit.to_json()["pending"]
+            .as_array()
+            .expect("should list pending items")
+            .is_empty(),
+        "should find no pending JSON fields"
+    );
+    assert!(
+        !audit.is_complete(),
+        "should remain incomplete without authenticated receipts"
+    );
+}
+
+fn recipe_index(tools: &Value, id: &str) -> usize {
+    tools["recipes"]
+        .as_array()
+        .expect("should contain recipes")
+        .iter()
+        .position(|recipe| recipe["id"] == id)
+        .expect("should contain recipe")
+}
+
+#[test]
+fn requires_exact_recipe_settings() {
+    let mutations: [(&str, &str, Value); 4] = [
+        ("tsjs", "mandatory_tests", json!(false)),
+        ("tsjs", "npm_lifecycle", json!("unrestricted")),
+        (
+            "trusted-server-fastly.wasm",
+            "cargo_args",
+            json!(["--offline"]),
+        ),
+        ("ts-aarch64-apple-darwin", "release_strip", json!("symbols")),
+    ];
+    for (id, key, replacement) in mutations {
+        expect_rejected(
+            tools_with(|tools| {
+                let index = recipe_index(tools, id);
+                tools["recipes"][index]["settings"][key] = replacement;
+            }),
+            "settings",
+        );
+    }
+    expect_rejected(
+        tools_with(|tools| {
+            let index = recipe_index(tools, "ts-x86_64-unknown-linux-gnu");
+            tools["recipes"][index]["settings"]["ambient_profiles"]["B"]["umask"] = json!("000");
+        }),
+        "settings",
+    );
+    expect_rejected(
+        tools_with(|tools| {
+            let index = recipe_index(tools, "tsjs");
+            tools["recipes"][index]["settings"]
+                .as_object_mut()
+                .expect("should be settings")
+                .remove("npm_offline");
+        }),
+        "settings",
+    );
+}
+
+#[test]
+fn requires_exact_consumer_policy_fields() {
+    for (pointer, replacement) in [
+        ("/repository_id", json!("1")),
+        ("/repository_owner_id", json!("2")),
+        ("/repository", json!("example/fictional")),
+        ("/github_host", json!("github.example.com")),
+        ("/identity/issuer", json!("https://issuer.example.com")),
+        ("/identity/builder_id", json!("https://example.com/builder")),
+        ("/predicates/sbom", json!("https://example.com/sbom")),
+        ("/predicates/build_type", json!("https://example.com/build")),
+        ("/bounds/child_seconds", json!(121)),
+        (
+            "/historical_producer_policies",
+            json!([{"policy_sha256": "a".repeat(64)}]),
+        ),
+        ("/policy_version", json!(2)),
+    ] {
+        expect_rejected(
+            policy_with(|policy| {
+                *policy
+                    .pointer_mut(pointer)
+                    .expect("should address a tracked policy field") = replacement;
+            }),
+            "release-policy",
+        );
+    }
+}
+
+#[test]
+fn audit_completion_stays_false_while_facts_are_not_established() {
+    assert!(
+        !NOT_ESTABLISHED.is_empty(),
+        "should still list facts this tool cannot establish"
+    );
+    let inputs = check_inputs(COHORT, &encode(&qualified_looking_tools()), CLI_POLICY)
+        .expect("should parse structurally complete fictional pins");
+    assert!(
+        !audit_inputs(&inputs).is_complete(),
+        "should never report completion while any fact is not established"
+    );
+}
diff --git a/crates/trusted-server-release/src/policy/tools.rs b/crates/trusted-server-release/src/policy/tools.rs
new file mode 100644
index 0000000000..fda46a4b21
--- /dev/null
+++ b/crates/trusted-server-release/src/policy/tools.rs
@@ -0,0 +1,539 @@
+//! Strict parsing and compiled-pin comparison of `release-tools.json`.
+//!
+//! Qualification states and digests parsed here are diagnostics only; they
+//! never construct production authority.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use error_stack::Report;
+use serde::{Deserialize, Deserializer};
+use serde_json::{Map, Value, json};
+
+use super::{
+    ATTEST_REVISION, ATTEST_VERSION, FIXED_ARTIFACTS, GH_VERSION, SCHEMA_VERSION, rejected,
+};
+use crate::documents::lower_hex;
+use crate::error::ReleaseError;
+use crate::recipe::AmbientProfile;
+
+const RUST_VERSION: &str = "1.98.1";
+const NODE_VERSION: &str = "24.20.0";
+const NPM_VERSION: &str = "11.19.0";
+const ATTEST_NAME: &str = "actions/attest:github-action";
+const ARTIFACT_SCRIPT: &str = "scripts/release/build.sh";
+const JS_RECIPE: &str = "tsjs";
+const JS_SCRIPT: &str = "scripts/release/build-js.sh";
+/// Builder environment shared by the Fastly, Linux CLI and JS recipes.
+pub(super) const BUILDER_ENVIRONMENT: &str = "gnu-builder-x86_64";
+const TOOL_HOSTS: [&str; 3] = [
+    "aarch64-apple-darwin",
+    "x86_64-apple-darwin",
+    "x86_64-unknown-linux-gnu",
+];
+const PER_HOST_TOOLS: [(&str, &str); 7] = [
+    ("fastly", "16.0.0"),
+    ("gh", GH_VERSION),
+    ("node", NODE_VERSION),
+    ("npm", NPM_VERSION),
+    ("rust", RUST_VERSION),
+    ("viceroy", "0.21.0"),
+    ("wasmtime", "48.0.1"),
+];
+
+/// Fixed environment identity: id, kind, role and kind-specific constant.
+const FIXED_ENVIRONMENTS: [(&str, &str, &str, &str); 6] = [
+    (
+        "debian12-x86_64",
+        "oci-runtime",
+        "compatibility-runtime",
+        "",
+    ),
+    (BUILDER_ENVIRONMENT, "oci-builder", "compilation", "2.34"),
+    (
+        "macos15-aarch64",
+        "github-hosted-macos",
+        "compilation",
+        "macos-15",
+    ),
+    (
+        "macos15-x86_64",
+        "github-hosted-macos",
+        "compilation",
+        "macos-15-intel",
+    ),
+    ("ubi9-x86_64", "oci-runtime", "compatibility-runtime", ""),
+    (
+        "ubuntu22.04-x86_64",
+        "oci-runtime",
+        "compatibility-runtime",
+        "",
+    ),
+];
+
+#[derive(Clone, Copy, Debug, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "lowercase")]
+enum Qualification {
+    Pending,
+    Qualified,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+/// Parsed `release-tools.json` with closed per-kind field sets.
+pub(super) struct ToolsDocument {
+    environments: Vec<Environment>,
+    recipes: Vec<Recipe>,
+    schema_version: u64,
+    tools: Vec<ToolPin>,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct ToolPin {
+    #[serde(deserialize_with = "nullable")]
+    acquisition: Option<Value>,
+    name: String,
+    qualification: Qualification,
+    #[serde(deserialize_with = "nullable")]
+    revision: Option<String>,
+    #[serde(deserialize_with = "nullable")]
+    sha256: Option<String>,
+    version: String,
+}
+
+#[derive(Deserialize)]
+#[serde(tag = "kind", deny_unknown_fields)]
+enum Environment {
+    #[serde(rename = "oci-runtime")]
+    OciRuntime {
+        #[serde(deserialize_with = "nullable")]
+        acquisition: Option<Value>,
+        id: String,
+        #[serde(deserialize_with = "nullable")]
+        image_reference: Option<String>,
+        #[serde(deserialize_with = "nullable")]
+        oci_index_sha256: Option<String>,
+        #[serde(deserialize_with = "nullable")]
+        oci_manifest_sha256: Option<String>,
+        qualification: Qualification,
+        role: String,
+    },
+    #[serde(rename = "oci-builder")]
+    OciBuilder {
+        #[serde(deserialize_with = "nullable")]
+        acquisition: Option<Value>,
+        glibc_maximum: String,
+        id: String,
+        #[serde(deserialize_with = "nullable")]
+        image_reference: Option<String>,
+        #[serde(deserialize_with = "nullable")]
+        oci_index_sha256: Option<String>,
+        #[serde(deserialize_with = "nullable")]
+        oci_manifest_sha256: Option<String>,
+        qualification: Qualification,
+        role: String,
+        #[serde(deserialize_with = "nullable")]
+        sdk_sha256: Option<String>,
+    },
+    #[serde(rename = "github-hosted-macos")]
+    HostedMacos {
+        #[serde(deserialize_with = "nullable")]
+        acquisition: Option<Value>,
+        id: String,
+        qualification: Qualification,
+        role: String,
+        #[serde(deserialize_with = "nullable")]
+        runner_image_version: Option<String>,
+        runner_label: String,
+        #[serde(deserialize_with = "nullable")]
+        sdk_sha256: Option<String>,
+    },
+}
+
+/// A nullable pin field: present-or-null, never absent.
+struct PinField<'a> {
+    name: &'static str,
+    value: Option<&'a str>,
+    digest: bool,
+}
+
+impl<'a> PinField<'a> {
+    fn new(name: &'static str, value: &'a Option<String>, digest: bool) -> Self {
+        Self {
+            name,
+            value: value.as_deref(),
+            digest,
+        }
+    }
+}
+
+impl Environment {
+    fn identity(&self) -> (&str, &'static str, &str, &str) {
+        match self {
+            Self::OciRuntime { id, role, .. } => (id, "oci-runtime", role, ""),
+            Self::OciBuilder {
+                id,
+                role,
+                glibc_maximum,
+                ..
+            } => (id, "oci-builder", role, glibc_maximum),
+            Self::HostedMacos {
+                id,
+                role,
+                runner_label,
+                ..
+            } => (id, "github-hosted-macos", role, runner_label),
+        }
+    }
+
+    fn qualification(&self) -> Qualification {
+        match self {
+            Self::OciRuntime { qualification, .. }
+            | Self::OciBuilder { qualification, .. }
+            | Self::HostedMacos { qualification, .. } => *qualification,
+        }
+    }
+
+    fn acquisition(&self) -> Option<&Value> {
+        match self {
+            Self::OciRuntime { acquisition, .. }
+            | Self::OciBuilder { acquisition, .. }
+            | Self::HostedMacos { acquisition, .. } => acquisition.as_ref(),
+        }
+    }
+
+    fn pins(&self) -> Vec<PinField<'_>> {
+        let field = PinField::new;
+        match self {
+            Self::OciRuntime {
+                image_reference,
+                oci_index_sha256,
+                oci_manifest_sha256,
+                ..
+            } => vec![
+                field("image_reference", image_reference, false),
+                field("oci_index_sha256", oci_index_sha256, true),
+                field("oci_manifest_sha256", oci_manifest_sha256, true),
+            ],
+            Self::OciBuilder {
+                image_reference,
+                oci_index_sha256,
+                oci_manifest_sha256,
+                sdk_sha256,
+                ..
+            } => vec![
+                field("image_reference", image_reference, false),
+                field("oci_index_sha256", oci_index_sha256, true),
+                field("oci_manifest_sha256", oci_manifest_sha256, true),
+                field("sdk_sha256", sdk_sha256, true),
+            ],
+            Self::HostedMacos {
+                runner_image_version,
+                sdk_sha256,
+                ..
+            } => vec![
+                field("runner_image_version", runner_image_version, false),
+                field("sdk_sha256", sdk_sha256, true),
+            ],
+        }
+    }
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Recipe {
+    environment_id: String,
+    id: String,
+    qualification: Qualification,
+    script: String,
+    settings: Map<String, Value>,
+    #[serde(deserialize_with = "nullable")]
+    sha256: Option<String>,
+}
+
+fn nullable<'de, D, T>(deserializer: D) -> Result<Option<T>, D::Error>
+where
+    D: Deserializer<'de>,
+    T: Deserialize<'de>,
+{
+    Option::<T>::deserialize(deserializer)
+}
+
+impl ToolsDocument {
+    /// Lists pending qualifications and null pins in document order.
+    pub(super) fn pending_items(&self) -> Vec<String> {
+        let mut items = Vec::new();
+        for environment in &self.environments {
+            note_pending(
+                &mut items,
+                &format!("environment {}", environment.identity().0),
+                environment.qualification(),
+                Some(environment.acquisition()),
+                &environment.pins(),
+            );
+        }
+        for recipe in &self.recipes {
+            let digest = PinField::new("sha256", &recipe.sha256, true);
+            note_pending(
+                &mut items,
+                &format!("recipe {}", recipe.id),
+                recipe.qualification,
+                None,
+                &[digest],
+            );
+        }
+        for tool in &self.tools {
+            let digest = PinField::new("sha256", &tool.sha256, true);
+            note_pending(
+                &mut items,
+                &format!("tool {}", tool.name),
+                tool.qualification,
+                Some(tool.acquisition.as_ref()),
+                &[digest],
+            );
+        }
+        items
+    }
+}
+
+/// Appends pending diagnostics; `acquisition` is `None` when the record has no such field.
+fn note_pending(
+    items: &mut Vec<String>,
+    subject: &str,
+    qualification: Qualification,
+    acquisition: Option<Option<&Value>>,
+    pins: &[PinField<'_>],
+) {
+    if qualification != Qualification::Qualified {
+        items.push(format!("{subject}: qualification pending"));
+    }
+    if acquisition.is_some_and(|value| value.is_none()) {
+        items.push(format!("{subject}: acquisition is null"));
+    }
+    for pin in pins.iter().filter(|pin| pin.value.is_none()) {
+        items.push(format!("{subject}: {} is null", pin.name));
+    }
+}
+
+fn expected_tools() -> BTreeMap<String, (&'static str, Option<&'static str>)> {
+    let mut expected = BTreeMap::new();
+    expected.insert(
+        ATTEST_NAME.to_owned(),
+        (ATTEST_VERSION, Some(ATTEST_REVISION)),
+    );
+    for (tool, version) in PER_HOST_TOOLS {
+        for host in TOOL_HOSTS {
+            expected.insert(format!("{tool}:{host}"), (version, None));
+        }
+    }
+    expected
+}
+
+/// Compares parsed pins, environments and recipes with the compiled contract.
+pub(super) fn check_tools(tools: &ToolsDocument) -> Result<(), Report<ReleaseError>> {
+    if tools.schema_version != SCHEMA_VERSION {
+        return Err(rejected("tools schema_version must be 1"));
+    }
+    let fixed = expected_tools();
+    let mut seen = BTreeSet::new();
+    for tool in &tools.tools {
+        if !seen.insert(tool.name.as_str()) {
+            return Err(rejected(format!("duplicate tool {}", tool.name)));
+        }
+        let (version, revision) = *fixed
+            .get(&tool.name)
+            .ok_or_else(|| rejected(format!("unknown tool {}", tool.name)))?;
+        if tool.version != version || tool.revision.as_deref() != revision {
+            return Err(rejected(format!(
+                "tool {} must pin version {version} and revision {revision:?}",
+                tool.name
+            )));
+        }
+        check_digest(
+            &format!("tool {}", tool.name),
+            "sha256",
+            tool.sha256.as_deref(),
+        )?;
+    }
+    if let Some(missing) = fixed.keys().find(|name| !seen.contains(name.as_str())) {
+        return Err(rejected(format!("missing tool {missing}")));
+    }
+    check_environments(&tools.environments)?;
+    check_recipes(&tools.recipes)
+}
+
+fn check_digest(
+    subject: &str,
+    field: &str,
+    value: Option<&str>,
+) -> Result<(), Report<ReleaseError>> {
+    match value {
+        Some(digest) if !lower_hex(digest, 64) => Err(rejected(format!(
+            "{subject}: {field} must be 64 lowercase hex digits or null"
+        ))),
+        _ => Ok(()),
+    }
+}
+
+fn check_environments(environments: &[Environment]) -> Result<(), Report<ReleaseError>> {
+    let mut seen = BTreeSet::new();
+    for environment in environments {
+        let identity = environment.identity();
+        let id = identity.0;
+        if !seen.insert(id) {
+            return Err(rejected(format!("duplicate environment {id}")));
+        }
+        let fixed = FIXED_ENVIRONMENTS
+            .iter()
+            .find(|fixed| fixed.0 == id)
+            .ok_or_else(|| rejected(format!("unknown environment {id}")))?;
+        if (fixed.1, fixed.2, fixed.3) != (identity.1, identity.2, identity.3) {
+            return Err(rejected(format!(
+                "environment {id} changes its fixed kind, role or platform constant"
+            )));
+        }
+        for pin in environment.pins().iter().filter(|pin| pin.digest) {
+            check_digest(&format!("environment {id}"), pin.name, pin.value)?;
+        }
+    }
+    if let Some(missing) = FIXED_ENVIRONMENTS
+        .iter()
+        .find(|fixed| !seen.contains(fixed.0))
+    {
+        return Err(rejected(format!("missing environment {}", missing.0)));
+    }
+    Ok(())
+}
+
+/// One source-owned recipe identity and the settings it must restate.
+struct FixedRecipe {
+    id: &'static str,
+    environment: &'static str,
+    script: &'static str,
+    settings: Value,
+}
+
+/// Complete effective settings shared by every executable recipe.
+fn artifact_settings() -> Value {
+    json!({
+        "ambient_profiles": AmbientProfile::tracked_json(),
+        "aws_lc_target_selector": true,
+        "aws_lc_use_system": false,
+        "cargo_config": ".cargo/config.toml",
+        "cargo_frozen": true,
+        "cargo_home": "private-prepared",
+        "cargo_locked": true,
+        "cargo_message_format": "json-render-diagnostics",
+        "download_control": "actual-cargo-build-script-required",
+        "fresh_target": true,
+        "network_boundary": "source-owned-os-denial-v1",
+        "normalized_inputs": [
+            "compiler-locale-C",
+            "compiler-timezone-UTC",
+            "source-commit-epoch",
+            "remapped-paths",
+        ],
+        "npm_lifecycle": "reviewed-preparation-only",
+        "release_debug": 1,
+        "release_strip": "none",
+        "rust_toolchain": RUST_VERSION,
+        "sqlite_features": ["bundled"],
+        "sqlite_use_pkg_config": false,
+        "sysroot": "authenticated-sdk-required",
+        "tool_paths": "authenticated-absolute-paths-required",
+        "vite_config_loading": false,
+        "vite_env_loading": false,
+        "vite_mode": "production",
+    })
+}
+
+/// Complete effective settings of the shared JS recipe.
+fn js_settings() -> Value {
+    json!({
+        "compare": "all-tracked-final-module-bytes",
+        "fresh_installations": 2,
+        "fresh_private_npm_caches": true,
+        "fresh_source": "tracked-objects-only",
+        "mandatory_tests": true,
+        "network_boundary": "source-owned-os-denial-v1",
+        "node_version": NODE_VERSION,
+        "npm_audit": false,
+        "npm_fund": false,
+        "npm_include_dev": true,
+        "npm_lifecycle": "reviewed-observed-foreground",
+        "npm_offline": true,
+        "npm_version": NPM_VERSION,
+        "publish": "A-only-after-equality",
+        "tool_paths": "authenticated-absolute-paths-required",
+        "vite_config_loading": false,
+        "vite_env_loading": false,
+        "vite_mode": "production",
+    })
+}
+
+fn expected_recipes() -> Vec<FixedRecipe> {
+    let mut recipes: Vec<_> = FIXED_ARTIFACTS
+        .iter()
+        .map(|fixed| FixedRecipe {
+            id: fixed.name,
+            environment: fixed.recipe_environment,
+            script: ARTIFACT_SCRIPT,
+            settings: artifact_settings(),
+        })
+        .collect();
+    recipes.push(FixedRecipe {
+        id: JS_RECIPE,
+        environment: BUILDER_ENVIRONMENT,
+        script: JS_SCRIPT,
+        settings: js_settings(),
+    });
+    recipes
+}
+
+/// Names the first settings key whose presence or value differs.
+fn first_settings_difference(expected: &Value, actual: &Map<String, Value>) -> Option<String> {
+    let expected = expected.as_object()?;
+    expected
+        .keys()
+        .chain(actual.keys())
+        .find(|key| expected.get(*key) != actual.get(*key))
+        .cloned()
+}
+
+fn check_recipes(recipes: &[Recipe]) -> Result<(), Report<ReleaseError>> {
+    let expected = expected_recipes();
+    let mut seen = BTreeSet::new();
+    for recipe in recipes {
+        let id = recipe.id.as_str();
+        if !seen.insert(id) {
+            return Err(rejected(format!("duplicate recipe {id}")));
+        }
+        let FixedRecipe {
+            environment,
+            script,
+            settings,
+            ..
+        } = expected
+            .iter()
+            .find(|fixed| fixed.id == id)
+            .ok_or_else(|| rejected(format!("unknown recipe {id}")))?;
+        if recipe.environment_id != *environment {
+            return Err(rejected(format!(
+                "recipe {id} environment_id must be {environment}"
+            )));
+        }
+        if recipe.script != *script {
+            return Err(rejected(format!("recipe {id} script must be {script}")));
+        }
+        if let Some(key) = first_settings_difference(settings, &recipe.settings) {
+            return Err(rejected(format!(
+                "recipe {id} settings.{key} differs from the compiled recipe settings"
+            )));
+        }
+        check_digest(&format!("recipe {id}"), "sha256", recipe.sha256.as_deref())?;
+    }
+    if let Some(missing) = expected.iter().find(|fixed| !seen.contains(fixed.id)) {
+        return Err(rejected(format!("missing recipe {}", missing.id)));
+    }
+    Ok(())
+}
diff --git a/crates/trusted-server-release/src/preflight.rs b/crates/trusted-server-release/src/preflight.rs
new file mode 100644
index 0000000000..cf8f907cf7
--- /dev/null
+++ b/crates/trusted-server-release/src/preflight.rs
@@ -0,0 +1,314 @@
+//! Inherited-environment audit and allowlisted child-environment construction.
+//!
+//! The audit runs over the complete inherited snapshot before anything is
+//! cleared, so an empty starting environment cannot hide a rejected channel.
+//! Errors name variables but never print their values, which may be secrets.
+
+use std::collections::BTreeSet;
+use std::ffi::OsString;
+use std::path::{Component, Path, PathBuf};
+
+use error_stack::Report;
+
+use crate::error::ReleaseError;
+use crate::policy;
+use crate::source::{self, CommitId};
+
+const RELEASE_BUILD: &str = "TRUSTED_SERVER__RELEASE_BUILD";
+const REMOVED_PREFIXES: [&str; 2] = ["TRUSTED_SERVER__", "EDGEZERO__"];
+
+/// Exact (uppercase) names that select compilers, flags, loaders, sources or
+/// credentials. Sorted, unique, and never covered by [`REJECTED_PREFIXES`] or
+/// [`NATIVE_SELECTORS`].
+const REJECTED_EXACT: &[&str] = &[
+    "ACTIONS_CACHE_URL",
+    "ACTIONS_ID_TOKEN_REQUEST_TOKEN",
+    "ACTIONS_ID_TOKEN_REQUEST_URL",
+    "ACTIONS_RESULTS_URL",
+    "ACTIONS_RUNTIME_TOKEN",
+    "ACTIONS_RUNTIME_URL",
+    "BASH_ENV",
+    "CARGO",
+    "CLANG_PATH",
+    "CRATE_CC_NO_DEFAULTS",
+    "CROSS_COMPILE",
+    "DEVELOPER_DIR",
+    "ENV",
+    "GH_ENTERPRISE_TOKEN",
+    "GH_TOKEN",
+    "GITHUB_ENTERPRISE_TOKEN",
+    "GITHUB_TOKEN",
+    "LIBCLANG_PATH",
+    "LLVM_CONFIG_PATH",
+    "MACOSX_DEPLOYMENT_TARGET",
+    "NASM",
+    "NODE_AUTH_TOKEN",
+    "NODE_ENV",
+    "NODE_EXTRA_CA_CERTS",
+    "NODE_OPTIONS",
+    "NODE_PATH",
+    "NODE_TLS_REJECT_UNAUTHORIZED",
+    "NPM_TOKEN",
+    "PKG_CONFIG",
+    "PROTOC",
+    "PROTOC_INCLUDE",
+    "RUSTC",
+    "RUSTDOC",
+    "RUSTDOCFLAGS",
+    "RUSTFLAGS",
+    "SDKROOT",
+    "SOURCE_DATE_EPOCH",
+    "SSH_AUTH_SOCK",
+    "TSJS_SKIP_BUILD",
+    "VCPKG_INSTALLATION_ROOT",
+    "VCPKG_ROOT",
+];
+
+/// Uppercase prefixes whose whole family is recipe-selected or forbidden.
+const REJECTED_PREFIXES: &[&str] = &[
+    "AWS_",
+    "BINDGEN_",
+    "CARGO_",
+    "CLOUDFLARE_",
+    "CMAKE",
+    "DYLD_",
+    "FASTLY_",
+    "GIT_",
+    "LD_",
+    "LIBSQLITE3_",
+    "NPM_CONFIG_",
+    "OPENSSL_",
+    "PKG_CONFIG_",
+    "RING_",
+    "RUSTC_",
+    "RUSTDOC_",
+    "RUSTUP_",
+    "SIGSTORE_",
+    "SQLCIPHER_",
+    "SQLITE3_",
+    "SQLITE_",
+    "VCPKGRS_",
+    "VITE_",
+];
+
+/// Native tool selectors; `_<target>`, `-<target>`, `TARGET_` and `HOST_` variants are rejected too.
+const NATIVE_SELECTORS: [&str; 11] = [
+    "AR",
+    "ARFLAGS",
+    "CC",
+    "CFLAGS",
+    "CPPFLAGS",
+    "CXX",
+    "CXXFLAGS",
+    "CXXSTDLIB",
+    "LD",
+    "LDFLAGS",
+    "RANLIB",
+];
+
+/// A hosted setup export accepted only for an exact value whose path resolves to a
+/// mandatory reviewed identity; value-only exceptions are not representable.
+pub(crate) struct ReviewedException {
+    name: &'static str,
+    value: &'static str,
+    path_identity: &'static str,
+}
+
+/// Reviewed hosted setup values. Empty until values and paths are qualified.
+pub(crate) const REVIEWED_SETUP_EXCEPTIONS: [ReviewedException; 0] = [];
+
+/// Proof that the inherited environment snapshot passed the release audit.
+pub(crate) struct AuditedEnvironment {
+    removed: Vec<String>,
+    search_path: Option<String>,
+}
+
+impl AuditedEnvironment {
+    /// Names of inherited operator variables removed rather than passed on.
+    pub(crate) fn removed_names(&self) -> &[String] {
+        &self.removed
+    }
+
+    /// Inherited `PATH`, used only to locate preflight helpers such as Git.
+    pub(crate) fn search_path(&self) -> Option<&str> {
+        self.search_path.as_deref()
+    }
+}
+
+/// Audits an inherited environment snapshot collected before any clearing.
+///
+/// # Errors
+///
+/// Fails when any variable is non-UTF-8, selects a rejected channel, or sets
+/// `TRUSTED_SERVER__RELEASE_BUILD` to a value other than `1`. The error lists
+/// every rejected name and never a value.
+pub(crate) fn audit_environment(
+    snapshot: &[(OsString, OsString)],
+) -> Result<AuditedEnvironment, Report<ReleaseError>> {
+    let mut rejected = BTreeSet::new();
+    let mut removed = BTreeSet::new();
+    let mut search_path = None;
+    for (name, value) in snapshot {
+        let Some(name) = name.to_str() else {
+            rejected.insert(format!("{} (non-UTF-8 name)", name.to_string_lossy()));
+            continue;
+        };
+        let Some(value) = value.to_str() else {
+            rejected.insert(format!("{name} (non-UTF-8 value)"));
+            continue;
+        };
+        if name == RELEASE_BUILD && value != "1" {
+            rejected.insert(format!("{name} (must be exactly 1 when present)"));
+        } else if REMOVED_PREFIXES
+            .iter()
+            .any(|prefix| name.starts_with(prefix))
+        {
+            removed.insert(name.to_owned());
+        } else if REMOVED_PREFIXES
+            .iter()
+            .any(|prefix| name.to_ascii_uppercase().starts_with(prefix))
+        {
+            rejected.insert(format!("{name} (ambiguous operator prefix casing)"));
+        } else if is_rejected(name) && !is_reviewed(name, value) {
+            rejected.insert(name.to_owned());
+        } else if name == "PATH" {
+            search_path = Some(value.to_owned());
+        }
+    }
+    if !rejected.is_empty() {
+        return Err(Report::new(ReleaseError::Environment).attach(format!(
+            "rejected inherited variables: {}",
+            rejected.into_iter().collect::<Vec<_>>().join(", ")
+        )));
+    }
+    Ok(AuditedEnvironment {
+        removed: removed.into_iter().collect(),
+        search_path,
+    })
+}
+
+fn is_rejected(name: &str) -> bool {
+    let upper = name.to_ascii_uppercase();
+    REJECTED_EXACT.contains(&upper.as_str())
+        || REJECTED_PREFIXES
+            .iter()
+            .any(|prefix| upper.starts_with(prefix))
+        || NATIVE_SELECTORS
+            .iter()
+            .any(|selector| is_native_variant(&upper, selector))
+}
+
+fn is_native_variant(upper: &str, selector: &str) -> bool {
+    let base = upper
+        .strip_prefix("TARGET_")
+        .or_else(|| upper.strip_prefix("HOST_"))
+        .unwrap_or(upper);
+    base == selector
+        || upper
+            .strip_prefix(selector)
+            .is_some_and(|suffix| suffix.starts_with(['_', '-']))
+}
+
+impl ReviewedException {
+    /// Accepts only the exact name and value whose path resolves to the reviewed identity.
+    fn matches(&self, name: &str, value: &str) -> bool {
+        self.name == name
+            && self.value == value
+            && std::fs::canonicalize(value).is_ok_and(|path| path == Path::new(self.path_identity))
+    }
+}
+
+fn is_reviewed(name: &str, value: &str) -> bool {
+    REVIEWED_SETUP_EXCEPTIONS
+        .iter()
+        .any(|exception| exception.matches(name, value))
+}
+
+/// Resolves the source root, which is always the current directory.
+///
+/// # Errors
+///
+/// Fails when the current directory cannot be resolved.
+pub(crate) fn source_root() -> Result<PathBuf, Report<ReleaseError>> {
+    std::env::current_dir().map_err(|error| {
+        Report::new(ReleaseError::Source).attach(format!("cannot resolve source root: {error}"))
+    })
+}
+
+fn names_cohort(root: &Path, cohort: &Path) -> bool {
+    !cohort.as_os_str().is_empty()
+        && !cohort
+            .components()
+            .any(|component| matches!(component, Component::ParentDir))
+        && root
+            .join(cohort)
+            .components()
+            .eq(root.join(policy::COHORT_PATH).components())
+}
+
+/// Runs the complete fail-closed preflight over the current-directory source.
+///
+/// The qualified selector always runs, so omitting `--require-qualified`
+/// can never succeed where passing it would fail.
+///
+/// # Errors
+///
+/// Fails on any rejected inherited variable, a cohort path other than the
+/// source-owned one, unauthenticated source, inputs that differ from the
+/// approved commit, or the closed qualified selector.
+pub(crate) fn run_preflight(
+    inherited: &[(OsString, OsString)],
+    cohort: &Path,
+    commit: &CommitId,
+    require_qualified: bool,
+) -> Result<(), Report<ReleaseError>> {
+    let audited = audit_environment(inherited)?;
+    if !audited.removed_names().is_empty() {
+        crate::notice(format_args!(
+            "removed inherited operator variables: {}",
+            audited.removed_names().join(", ")
+        ));
+    }
+    let root = source_root()?;
+    if !names_cohort(&root, cohort) {
+        return Err(Report::new(ReleaseError::Policy).attach(format!(
+            "--cohort must name {} below the current source root",
+            policy::COHORT_PATH
+        )));
+    }
+    let source = source::authenticate(&root, commit, &audited)?;
+    let inputs = policy::load_inputs(&root)?;
+    for (path, sha256) in inputs.input_digests() {
+        if source.tracked_sha256(path) != Some(sha256) {
+            return Err(Report::new(ReleaseError::Source)
+                .attach(format!("{path} does not match the approved commit")));
+        }
+    }
+    crate::notice(format_args!(
+        "source matched locally; git executable and remote eligibility not established \
+         (commit {}, epoch {}, snapshot {}, helper closure {} over {} paths; \
+         git executable identity: Task 8; remote branch-tip ancestry and rulesets: Task 14)",
+        source.commit(),
+        source.epoch(),
+        source.snapshot().fingerprint(),
+        source.closure_digest(),
+        source.closure_paths().len()
+    ));
+    if !require_qualified {
+        crate::notice(format_args!(
+            "qualified selection is required whether or not --require-qualified is passed"
+        ));
+    }
+    let selection = policy::select_qualified(&inputs, &[])?;
+    source.snapshot().verify_unchanged()?;
+    crate::notice(format_args!("{}", selection.summary()));
+    Ok(())
+}
+
+// Recipe execution (Tasks 5 and 7) is the only production consumer of the
+// child-environment builder; until it lands, only tests reference it.
+#[allow(dead_code)]
+pub(crate) mod child;
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/trusted-server-release/src/preflight/child.rs b/crates/trusted-server-release/src/preflight/child.rs
new file mode 100644
index 0000000000..29a0d77786
--- /dev/null
+++ b/crates/trusted-server-release/src/preflight/child.rs
@@ -0,0 +1,157 @@
+//! Allowlisted child-environment construction for recipe execution.
+//!
+//! The child environment is built from scratch: nothing inherited passes
+//! through, and only recipe-selected facts and private locations are set.
+
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+
+use error_stack::Report;
+
+use super::{AuditedEnvironment, RELEASE_BUILD};
+use crate::error::ReleaseError;
+use crate::policy::ReleaseTarget;
+use crate::source::{ApprovedSource, CommitId};
+
+const MACOS_DEPLOYMENT_TARGET: &str = "13.0";
+
+/// A tool directory produced by authenticated acquisition (Task 8).
+pub(crate) struct ToolDirectory(pub(super) PathBuf);
+
+/// Recipe-selected private locations for one child build.
+pub(crate) struct ChildRequest {
+    pub(crate) target: ReleaseTarget,
+    pub(crate) home: PathBuf,
+    pub(crate) cargo_home: PathBuf,
+    pub(crate) tool_directories: Vec<ToolDirectory>,
+}
+
+/// An allowlisted child environment constructed from scratch.
+pub(crate) struct ChildEnvironment {
+    variables: BTreeMap<String, String>,
+    removed: Vec<String>,
+}
+
+impl ChildEnvironment {
+    /// Every variable the child receives; nothing is inherited.
+    pub(crate) fn variables(&self) -> &BTreeMap<String, String> {
+        &self.variables
+    }
+
+    /// Sorted names injected by the recipe, recorded as input facts.
+    pub(crate) fn injected_names(&self) -> Vec<&str> {
+        self.variables.keys().map(String::as_str).collect()
+    }
+
+    /// Inherited operator names removed during the audit.
+    pub(crate) fn removed_names(&self) -> &[String] {
+        &self.removed
+    }
+}
+
+fn absolute_text<'a>(label: &str, path: &'a Path) -> Result<&'a str, Report<ReleaseError>> {
+    path.to_str()
+        .filter(|text| path.is_absolute() && !text.contains([':', '\0']))
+        .ok_or_else(|| {
+            Report::new(ReleaseError::Environment).attach(format!(
+                "{label} must be an absolute UTF-8 path without ':' or NUL"
+            ))
+        })
+}
+
+/// Joins authenticated tool directories into a child `PATH`, if any are given.
+fn tool_path(directories: &[ToolDirectory]) -> Result<Option<String>, Report<ReleaseError>> {
+    if directories.is_empty() {
+        return Ok(None);
+    }
+    let entries = directories
+        .iter()
+        .map(|directory| absolute_text("tool directory", &directory.0))
+        .collect::<Result<Vec<_>, _>>()?;
+    Ok(Some(entries.join(":")))
+}
+
+/// Builds the child environment from explicit approved facts.
+pub(super) fn build_child(
+    audited: &AuditedEnvironment,
+    commit: &CommitId,
+    epoch: u64,
+    request: &ChildRequest,
+) -> Result<ChildEnvironment, Report<ReleaseError>> {
+    let mut variables = BTreeMap::from([
+        ("AWS_LC_SYS_USE_SYSTEM".to_owned(), "0".to_owned()),
+        (
+            format!(
+                "AWS_LC_SYS_USE_SYSTEM_{}",
+                request.target.triple().replace('-', "_")
+            ),
+            "0".to_owned(),
+        ),
+        (
+            "CARGO_HOME".to_owned(),
+            absolute_text("CARGO_HOME", &request.cargo_home)?.to_owned(),
+        ),
+        (
+            "HOME".to_owned(),
+            absolute_text("HOME", &request.home)?.to_owned(),
+        ),
+        ("LC_ALL".to_owned(), "C".to_owned()),
+        ("LIBSQLITE3_SYS_USE_PKG_CONFIG".to_owned(), "0".to_owned()),
+        ("SOURCE_DATE_EPOCH".to_owned(), epoch.to_string()),
+        (
+            "TRUSTED_SERVER__GIT_VERSION".to_owned(),
+            commit.as_str().to_owned(),
+        ),
+        (RELEASE_BUILD.to_owned(), "1".to_owned()),
+        ("TZ".to_owned(), "UTC".to_owned()),
+    ]);
+    if let Some(path) = tool_path(&request.tool_directories)? {
+        variables.insert("PATH".to_owned(), path);
+    }
+    if request.target.is_darwin() {
+        variables.insert(
+            "MACOSX_DEPLOYMENT_TARGET".to_owned(),
+            MACOS_DEPLOYMENT_TARGET.to_owned(),
+        );
+    }
+    Ok(ChildEnvironment {
+        variables,
+        removed: audited.removed.clone(),
+    })
+}
+
+/// Builds the allowlisted child environment for one recipe execution.
+///
+/// This is the production entry point: it requires both the audited
+/// inherited environment and the locally authenticated source, so the
+/// injected commit and committer epoch can only come from authentication.
+///
+/// # Errors
+///
+/// Fails when a private location or tool directory is not an absolute UTF-8
+/// path without `:` or NUL.
+pub(crate) fn child_environment(
+    audited: &AuditedEnvironment,
+    source: &ApprovedSource,
+    request: &ChildRequest,
+) -> Result<ChildEnvironment, Report<ReleaseError>> {
+    build_child(audited, source.commit(), source.epoch(), request)
+}
+
+/// Builds a child environment from explicit facts, for recipe tests only.
+///
+/// Production code must go through [`child_environment`], which takes the
+/// commit and epoch from an [`ApprovedSource`].
+///
+/// # Errors
+///
+/// As [`child_environment`].
+#[cfg(test)]
+pub(crate) fn build_child_for_tests(
+    audited: &AuditedEnvironment,
+    commit: &CommitId,
+    epoch: u64,
+    request: &ChildRequest,
+) -> Result<ChildEnvironment, Report<ReleaseError>> {
+    build_child(audited, commit, epoch, request)
+}
diff --git a/crates/trusted-server-release/src/preflight/tests.rs b/crates/trusted-server-release/src/preflight/tests.rs
new file mode 100644
index 0000000000..89209e5526
--- /dev/null
+++ b/crates/trusted-server-release/src/preflight/tests.rs
@@ -0,0 +1,648 @@
+use std::os::unix::ffi::OsStringExt as _;
+
+use std::collections::BTreeMap;
+
+use super::child::{ChildRequest, ToolDirectory, build_child};
+use super::*;
+use crate::policy::ReleaseTarget;
+
+const COMMIT: &str = "0123456789abcdef0123456789abcdef01234567";
+
+fn commit() -> CommitId {
+    CommitId::parse(COMMIT).expect("should parse fictional commit")
+}
+
+fn snapshot(entries: &[(&str, &str)]) -> Vec<(OsString, OsString)> {
+    entries
+        .iter()
+        .map(|(name, value)| (OsString::from(name), OsString::from(value)))
+        .collect()
+}
+
+fn rejection(entries: &[(&str, &str)]) -> String {
+    let report = audit_environment(&snapshot(entries))
+        .err()
+        .expect("should reject inherited environment");
+    format!("{report:?}")
+}
+
+fn request(target: ReleaseTarget) -> ChildRequest {
+    ChildRequest {
+        target,
+        home: PathBuf::from("/private/release/home"),
+        cargo_home: PathBuf::from("/private/release/cargo-home"),
+        tool_directories: vec![
+            ToolDirectory(PathBuf::from("/private/release/tools/rust/bin")),
+            ToolDirectory(PathBuf::from("/private/release/tools/node/bin")),
+        ],
+    }
+}
+
+#[test]
+fn accepts_benign_environment_and_keeps_search_path() {
+    let audited = audit_environment(&snapshot(&[
+        ("PATH", "/usr/bin:/bin"),
+        ("HOME", "/home/fictional"),
+        ("LANG", "en_US.UTF-8"),
+        ("TERM", "xterm"),
+    ]))
+    .expect("should accept benign variables");
+    assert_eq!(audited.search_path(), Some("/usr/bin:/bin"));
+    assert!(audited.removed_names().is_empty(), "should remove nothing");
+}
+
+#[test]
+fn rejects_tsjs_skip_build_with_empty_value() {
+    let text = rejection(&[("TSJS_SKIP_BUILD", "")]);
+    assert!(text.contains("TSJS_SKIP_BUILD"), "should name skip flag");
+}
+
+#[test]
+fn rejects_tsjs_skip_build_with_zero_value() {
+    let text = rejection(&[("TSJS_SKIP_BUILD", "0")]);
+    assert!(text.contains("TSJS_SKIP_BUILD"), "should name skip flag");
+}
+
+#[test]
+fn rejects_tsjs_skip_build_with_one_value() {
+    let text = rejection(&[("TSJS_SKIP_BUILD", "1")]);
+    assert!(text.contains("TSJS_SKIP_BUILD"), "should name skip flag");
+}
+
+fn assert_each_rejected(class: &str, names: &[&str]) {
+    for name in names {
+        let text = rejection(&[("PATH", "/usr/bin"), (name, "fictional-value")]);
+        assert!(
+            text.contains(name),
+            "should reject {class} variable {name}: {text}"
+        );
+        assert!(
+            !text.contains("fictional-value"),
+            "should never print {class} values"
+        );
+    }
+}
+
+#[test]
+fn rejects_compiler_wrappers() {
+    assert_each_rejected(
+        "wrapper",
+        &[
+            "RUSTC_WRAPPER",
+            "RUSTC_WORKSPACE_WRAPPER",
+            "CARGO_BUILD_RUSTC_WRAPPER",
+            "CARGO_BUILD_RUSTC_WORKSPACE_WRAPPER",
+            "RUSTC",
+            "RUSTDOC",
+        ],
+    );
+}
+
+#[test]
+fn rejects_compiler_and_profile_flags() {
+    assert_each_rejected(
+        "flag",
+        &[
+            "RUSTFLAGS",
+            "RUSTDOCFLAGS",
+            "CARGO_ENCODED_RUSTFLAGS",
+            "CARGO_ENCODED_RUSTDOCFLAGS",
+            "CARGO_BUILD_RUSTFLAGS",
+            "CARGO_TARGET_WASM32_WASIP1_LINKER",
+            "CARGO_TARGET_DIR",
+            "CARGO_PROFILE_RELEASE_DEBUG",
+        ],
+    );
+}
+
+#[test]
+fn rejects_cargo_and_rustup_configuration_layers() {
+    assert_each_rejected(
+        "cargo-config",
+        &[
+            "CARGO",
+            "CARGO_HOME",
+            "CARGO_NET_OFFLINE",
+            "CARGO_MANIFEST_DIR",
+            "RUSTUP_HOME",
+            "RUSTUP_TOOLCHAIN",
+        ],
+    );
+}
+
+#[test]
+fn rejects_node_npm_and_vite_overrides() {
+    assert_each_rejected(
+        "node",
+        &[
+            "NODE_OPTIONS",
+            "NODE_PATH",
+            "npm_config_registry",
+            "NPM_CONFIG_CACHE",
+            "Npm_Config_Ignore_Scripts",
+            "VITE_MODE",
+        ],
+    );
+}
+
+#[test]
+fn rejects_native_build_selectors_and_target_variants() {
+    assert_each_rejected(
+        "native",
+        &[
+            "AWS_LC_SYS_USE_SYSTEM",
+            "AWS_LC_SYS_CMAKE_BUILDER",
+            "AWS_LC_SYS_PREBUILT_NASM_x86_64_unknown_linux_gnu",
+            "AWS_LC_FIPS_SYS_STATIC",
+            "LIBSQLITE3_SYS_USE_PKG_CONFIG",
+            "SQLITE3_LIB_DIR",
+            "CC",
+            "CXX",
+            "AR",
+            "LD",
+            "CFLAGS",
+            "CXXFLAGS",
+            "LDFLAGS",
+            "CPPFLAGS",
+            "CC_x86_64_unknown_linux_gnu",
+            "CFLAGS_aarch64-apple-darwin",
+            "TARGET_CC",
+            "HOST_CFLAGS",
+            "PKG_CONFIG",
+            "PKG_CONFIG_PATH",
+            "BINDGEN_EXTRA_CLANG_ARGS",
+            "SDKROOT",
+            "DEVELOPER_DIR",
+            "MACOSX_DEPLOYMENT_TARGET",
+            "VCPKG_INSTALLATION_ROOT",
+            "VCPKG_ROOT",
+        ],
+    );
+}
+
+#[test]
+fn rejects_sqlite_selectors() {
+    assert_each_rejected(
+        "sqlite",
+        &[
+            "LIBSQLITE3_FLAGS",
+            "SQLITE_MAX_VARIABLE_NUMBER",
+            "SQLCIPHER_LIB_DIR",
+        ],
+    );
+}
+
+#[test]
+fn rejects_ring_and_openssl_selectors() {
+    assert_each_rejected(
+        "crypto",
+        &[
+            "RING_PREGENERATE_ASM",
+            "OPENSSL_DIR",
+            "OPENSSL_STATIC",
+            "OPENSSL_CONF",
+            "OPENSSL_CONF_INCLUDE",
+        ],
+    );
+}
+
+#[test]
+fn rejects_cmake_selectors() {
+    assert_each_rejected(
+        "cmake",
+        &["CMAKE", "CMAKE_TOOLCHAIN_FILE", "CMAKE_GENERATOR"],
+    );
+}
+
+#[test]
+fn rejects_vcpkg_rs_selectors() {
+    assert_each_rejected("vcpkg", &["VCPKGRS_DYNAMIC", "VCPKGRS_TRIPLET"]);
+}
+
+#[test]
+fn rejects_cc_crate_controls() {
+    assert_each_rejected(
+        "cc-crate",
+        &[
+            "CRATE_CC_NO_DEFAULTS",
+            "CC_ENABLE_DEBUG_OUTPUT",
+            "CC_FORCE_DISABLE",
+            "CC_SHELL_ESCAPED_FLAGS",
+        ],
+    );
+}
+
+#[test]
+fn rejects_lowercase_target_suffixed_native_flags() {
+    assert_each_rejected(
+        "target-suffixed",
+        &[
+            "CFLAGS_aarch64_apple_darwin",
+            "CXXFLAGS_x86_64_unknown_linux_gnu",
+            "AWS_LC_SYS_USE_SYSTEM_aarch64_apple_darwin",
+            "AWS_LC_SYS_STATIC_x86_64_apple_darwin",
+        ],
+    );
+}
+
+#[test]
+fn rejects_loader_injection() {
+    assert_each_rejected(
+        "loader",
+        &[
+            "LD_PRELOAD",
+            "LD_LIBRARY_PATH",
+            "LD_AUDIT",
+            "DYLD_INSERT_LIBRARIES",
+            "DYLD_LIBRARY_PATH",
+        ],
+    );
+}
+
+#[test]
+fn rejects_git_channels_and_source_date_epoch() {
+    assert_each_rejected(
+        "git",
+        &[
+            "GIT_DIR",
+            "GIT_CONFIG_PARAMETERS",
+            "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+            "SOURCE_DATE_EPOCH",
+        ],
+    );
+}
+
+#[test]
+fn rejects_credentials_and_signing_material() {
+    assert_each_rejected(
+        "credential",
+        &[
+            "GH_TOKEN",
+            "GITHUB_TOKEN",
+            "ACTIONS_ID_TOKEN_REQUEST_TOKEN",
+            "ACTIONS_ID_TOKEN_REQUEST_URL",
+            "ACTIONS_RUNTIME_TOKEN",
+            "FASTLY_API_TOKEN",
+            "AWS_ACCESS_KEY_ID",
+            "AWS_SECRET_ACCESS_KEY",
+            "AWS_SESSION_TOKEN",
+            "SIGSTORE_ID_TOKEN",
+        ],
+    );
+}
+
+#[test]
+fn rejects_unreviewed_setup_exports_even_when_empty() {
+    assert!(
+        REVIEWED_SETUP_EXCEPTIONS.is_empty(),
+        "should have no reviewed hosted setup values yet"
+    );
+    for (name, value) in [
+        ("RUSTFLAGS", ""),
+        ("VCPKG_INSTALLATION_ROOT", "/usr/local/share/vcpkg"),
+    ] {
+        let text = rejection(&[(name, value)]);
+        assert!(text.contains(name), "should reject unreviewed {name}");
+    }
+}
+
+#[test]
+fn rejects_non_utf8_names_and_values() {
+    let bad_value = vec![(
+        OsString::from("FICTIONAL_SETTING"),
+        OsString::from_vec(vec![0x66, 0xff, 0x6f]),
+    )];
+    let text = format!(
+        "{:?}",
+        audit_environment(&bad_value)
+            .err()
+            .expect("should reject non-UTF-8 value")
+    );
+    assert!(text.contains("FICTIONAL_SETTING"), "should name variable");
+    let bad_name = vec![(
+        OsString::from_vec(vec![0x46, 0xff, 0x4f]),
+        OsString::from("value"),
+    )];
+    assert!(
+        audit_environment(&bad_name).is_err(),
+        "should reject non-UTF-8 name"
+    );
+}
+
+#[test]
+fn rejects_release_build_flag_other_than_one() {
+    for value in ["0", "", "true", "11"] {
+        let text = rejection(&[("TRUSTED_SERVER__RELEASE_BUILD", value)]);
+        assert!(
+            text.contains("TRUSTED_SERVER__RELEASE_BUILD"),
+            "should reject release flag value"
+        );
+    }
+}
+
+#[test]
+fn removes_operator_prefixes_by_full_prefix() {
+    let audited = audit_environment(&snapshot(&[
+        ("TRUSTED_SERVER__RELEASE_BUILD", "1"),
+        ("TRUSTED_SERVER__PUBLISHER__DOMAIN", "publisher.example.com"),
+        ("EDGEZERO__STORES__CONFIG__ID", "fictional"),
+        ("MY_TRUSTED_SERVER__SETTING", "kept-out"),
+        ("TRUSTED_SERVERX", "kept-out"),
+    ]))
+    .expect("should accept removable operator variables");
+    assert_eq!(
+        audited.removed_names(),
+        [
+            "EDGEZERO__STORES__CONFIG__ID",
+            "TRUSTED_SERVER__PUBLISHER__DOMAIN",
+            "TRUSTED_SERVER__RELEASE_BUILD",
+        ],
+        "should record exactly the case-exact prefixed names"
+    );
+}
+
+#[test]
+fn reports_every_rejected_name_without_secret_values() {
+    let text = rejection(&[
+        ("GH_TOKEN", "ghp_fictionalsecretvalue"),
+        ("AWS_SECRET_ACCESS_KEY", "fictional/secret/access/key"),
+        ("RUSTFLAGS", "-C link-arg=fictional-secret-flag"),
+        ("TSJS_SKIP_BUILD", "1"),
+    ]);
+    for name in [
+        "GH_TOKEN",
+        "AWS_SECRET_ACCESS_KEY",
+        "RUSTFLAGS",
+        "TSJS_SKIP_BUILD",
+    ] {
+        assert!(text.contains(name), "should name {name}");
+    }
+    for secret in [
+        "ghp_fictionalsecretvalue",
+        "fictional/secret/access/key",
+        "fictional-secret-flag",
+    ] {
+        assert!(!text.contains(secret), "should never print variable values");
+    }
+}
+
+#[test]
+fn child_environment_contains_exactly_expected_linux_keys() {
+    let audited = audit_environment(&snapshot(&[
+        ("PATH", "/usr/bin"),
+        ("TRUSTED_SERVER__PROXY__SECRET", "fictional"),
+        ("LANG", "en_US.UTF-8"),
+    ]))
+    .expect("should audit benign environment");
+    let child = build_child(
+        &audited,
+        &commit(),
+        1_700_000_000,
+        &request(ReleaseTarget::X86_64UnknownLinuxGnu),
+    )
+    .expect("should build child environment");
+    let expected = BTreeMap::from([
+        ("AWS_LC_SYS_USE_SYSTEM", "0"),
+        ("AWS_LC_SYS_USE_SYSTEM_x86_64_unknown_linux_gnu", "0"),
+        ("CARGO_HOME", "/private/release/cargo-home"),
+        ("HOME", "/private/release/home"),
+        ("LC_ALL", "C"),
+        ("LIBSQLITE3_SYS_USE_PKG_CONFIG", "0"),
+        (
+            "PATH",
+            "/private/release/tools/rust/bin:/private/release/tools/node/bin",
+        ),
+        ("SOURCE_DATE_EPOCH", "1700000000"),
+        ("TRUSTED_SERVER__GIT_VERSION", COMMIT),
+        ("TRUSTED_SERVER__RELEASE_BUILD", "1"),
+        ("TZ", "UTC"),
+    ]);
+    let actual: BTreeMap<&str, &str> = child
+        .variables()
+        .iter()
+        .map(|(name, value)| (name.as_str(), value.as_str()))
+        .collect();
+    assert_eq!(
+        actual, expected,
+        "should construct the allowlist from scratch"
+    );
+    assert_eq!(
+        child.injected_names(),
+        expected.keys().copied().collect::<Vec<_>>(),
+        "should record injected names as input facts"
+    );
+    assert_eq!(
+        child.removed_names(),
+        ["TRUSTED_SERVER__PROXY__SECRET"],
+        "should record removed operator names"
+    );
+}
+
+#[test]
+fn child_environment_sets_macos_floor_only_for_darwin() {
+    let audited = audit_environment(&[]).expect("should audit empty snapshot");
+    for target in [
+        ReleaseTarget::Aarch64AppleDarwin,
+        ReleaseTarget::X86_64AppleDarwin,
+    ] {
+        let child = build_child(&audited, &commit(), 1, &request(target))
+            .expect("should build darwin child");
+        assert_eq!(
+            child
+                .variables()
+                .get("MACOSX_DEPLOYMENT_TARGET")
+                .map(String::as_str),
+            Some("13.0"),
+            "should set loader floor for {target:?}"
+        );
+    }
+    for target in [
+        ReleaseTarget::Wasm32Wasip1,
+        ReleaseTarget::X86_64UnknownLinuxGnu,
+    ] {
+        let child = build_child(&audited, &commit(), 1, &request(target))
+            .expect("should build non-darwin child");
+        assert!(
+            !child.variables().contains_key("MACOSX_DEPLOYMENT_TARGET"),
+            "should not set macOS floor for {target:?}"
+        );
+    }
+}
+
+#[test]
+fn child_environment_rejects_unsafe_paths_and_commits() {
+    let audited = audit_environment(&[]).expect("should audit empty snapshot");
+    let mut relative = request(ReleaseTarget::Wasm32Wasip1);
+    relative.home = PathBuf::from("home");
+    assert!(
+        build_child(&audited, &commit(), 1, &relative).is_err(),
+        "should reject relative HOME"
+    );
+    let mut colon = request(ReleaseTarget::Wasm32Wasip1);
+    colon.tool_directories = vec![ToolDirectory(PathBuf::from("/tools:/usr/bin"))];
+    assert!(
+        build_child(&audited, &commit(), 1, &colon).is_err(),
+        "should reject PATH separator inside a tool directory"
+    );
+    for malformed in ["ABC", "--help", &COMMIT.to_uppercase(), &COMMIT[..39]] {
+        assert!(
+            CommitId::parse(malformed).is_err(),
+            "should reject malformed commit {malformed}"
+        );
+    }
+}
+
+#[test]
+fn child_environment_sets_target_suffixed_aws_lc_selector() {
+    let audited = audit_environment(&[]).expect("should audit empty snapshot");
+    for (target, name) in [
+        (
+            ReleaseTarget::Wasm32Wasip1,
+            "AWS_LC_SYS_USE_SYSTEM_wasm32_wasip1",
+        ),
+        (
+            ReleaseTarget::Aarch64AppleDarwin,
+            "AWS_LC_SYS_USE_SYSTEM_aarch64_apple_darwin",
+        ),
+        (
+            ReleaseTarget::X86_64AppleDarwin,
+            "AWS_LC_SYS_USE_SYSTEM_x86_64_apple_darwin",
+        ),
+    ] {
+        let child = build_child(&audited, &commit(), 1, &request(target))
+            .expect("should build child environment");
+        assert_eq!(
+            child.variables().get(name).map(String::as_str),
+            Some("0"),
+            "should pin the target-suffixed selector for {target:?}"
+        );
+        assert_eq!(
+            child
+                .variables()
+                .keys()
+                .filter(|key| key.starts_with("AWS_LC_SYS_USE_SYSTEM"))
+                .count(),
+            2,
+            "should set only the generic and selected-target selectors"
+        );
+    }
+}
+
+#[test]
+fn rejects_ambiguous_case_operator_prefixes() {
+    for name in [
+        "trusted_server__lowercase",
+        "Trusted_Server__Mixed",
+        "edgezero__stores",
+        "EdgeZero__Stores",
+    ] {
+        let text = rejection(&[(name, "fictional-value")]);
+        assert!(text.contains(name), "should reject ambiguous casing {name}");
+    }
+}
+
+#[test]
+fn rejects_package_registry_and_cloud_credentials() {
+    assert_each_rejected(
+        "registry-credential",
+        &[
+            "NPM_TOKEN",
+            "NODE_AUTH_TOKEN",
+            "AWS_REGION",
+            "AWS_PROFILE",
+            "AWS_CONFIG_FILE",
+            "SSH_AUTH_SOCK",
+            "GH_ENTERPRISE_TOKEN",
+            "GITHUB_ENTERPRISE_TOKEN",
+            "CLOUDFLARE_API_TOKEN",
+            "CLOUDFLARE_ACCOUNT_ID",
+        ],
+    );
+}
+
+#[test]
+fn rejects_hosted_runner_service_endpoints() {
+    assert_each_rejected(
+        "runner-service",
+        &[
+            "ACTIONS_CACHE_URL",
+            "ACTIONS_RESULTS_URL",
+            "ACTIONS_RUNTIME_URL",
+        ],
+    );
+}
+
+#[test]
+fn rejects_shell_startup_injection() {
+    assert_each_rejected("shell", &["BASH_ENV", "ENV"]);
+}
+
+#[test]
+fn rejects_native_toolchain_locators() {
+    assert_each_rejected(
+        "native-locator",
+        &[
+            "CXXSTDLIB",
+            "CXXSTDLIB_x86_64_unknown_linux_gnu",
+            "TARGET_CXXSTDLIB",
+            "CROSS_COMPILE",
+            "LIBCLANG_PATH",
+            "CLANG_PATH",
+            "LLVM_CONFIG_PATH",
+            "PROTOC",
+            "PROTOC_INCLUDE",
+            "NASM",
+        ],
+    );
+}
+
+#[test]
+fn rejects_node_trust_and_mode_overrides() {
+    assert_each_rejected(
+        "node-trust",
+        &[
+            "NODE_EXTRA_CA_CERTS",
+            "NODE_TLS_REJECT_UNAUTHORIZED",
+            "NODE_ENV",
+        ],
+    );
+}
+
+#[test]
+fn reviewed_exceptions_require_a_path_identity() {
+    let exception = ReviewedException {
+        name: "VCPKG_INSTALLATION_ROOT",
+        value: "/fictional/vcpkg",
+        path_identity: "/fictional/vcpkg",
+    };
+    assert!(
+        !exception.matches("VCPKG_INSTALLATION_ROOT", "/fictional/vcpkg"),
+        "should not accept a value whose path identity cannot be resolved"
+    );
+    assert!(
+        !exception.matches("VCPKG_ROOT", "/fictional/vcpkg"),
+        "should not accept a different name"
+    );
+}
+
+#[test]
+fn rejected_exact_names_are_sorted_unique_and_not_covered_elsewhere() {
+    assert!(
+        REJECTED_EXACT.windows(2).all(|pair| pair[0] < pair[1]),
+        "should keep exact names strictly sorted, which also rules out duplicates"
+    );
+    for name in REJECTED_EXACT {
+        assert!(
+            !REJECTED_PREFIXES
+                .iter()
+                .any(|prefix| name.starts_with(prefix)),
+            "{name} is already covered by a rejected prefix"
+        );
+        assert!(
+            !NATIVE_SELECTORS
+                .iter()
+                .any(|selector| is_native_variant(name, selector)),
+            "{name} is already covered by a native selector"
+        );
+    }
+}
diff --git a/crates/trusted-server-release/src/preparation.rs b/crates/trusted-server-release/src/preparation.rs
new file mode 100644
index 0000000000..d926101753
--- /dev/null
+++ b/crates/trusted-server-release/src/preparation.rs
@@ -0,0 +1,682 @@
+//! Fresh, independently owned npm installation state and authenticated observations.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::ffi::OsString;
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::time::{Duration, Instant};
+
+use base64::Engine as _;
+use base64::engine::general_purpose::STANDARD;
+use error_stack::{Report, ResultExt as _};
+use hmac::{Hmac, KeyInit as _, Mac as _};
+use serde_json::{Value, json};
+use sha2::{Digest as _, Sha256};
+
+use crate::boundary::{Boundary, BoundaryRoots, ConfinedCommand, DenialProof, random_bytes};
+#[cfg(test)]
+use crate::documents::hash_bounded_with_check;
+use crate::documents::{Role, parse_json};
+use crate::error::ReleaseError;
+use crate::materials::{LockedMaterials, PreparedNpmOriginals, RootManifestReview};
+use crate::process::{Cancellation, ProcessLimits};
+use crate::source::{ApprovedSource, FreshSource};
+use crate::tool_tree::tool_tree_digest;
+
+pub(super) const LIB: &str = "crates/trusted-server-js/lib";
+const PREFIX: &[u8] = b"TS_RELEASE_NPM_OBSERVATION_V1 ";
+
+pub(super) fn preparation_error(detail: impl std::fmt::Display) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Material).attach(detail.to_string())
+}
+
+/// Authenticated and qualified JS tool selections are supplied by Task 3/8.
+///
+/// None is qualified yet; ordinary CI fixtures use an explicit test constructor.
+#[derive(Clone, Copy)]
+pub(crate) enum QualifiedJsTools {}
+
+/// Fixed Node/npm/guard/probe layout, retained as a measured local candidate.
+pub(crate) struct SelectedJsTools {
+    root: PathBuf,
+}
+
+impl SelectedJsTools {
+    /// Accepts only a qualified selection; production construction stays closed.
+    pub(crate) fn qualified(_root: &Path, qualification: QualifiedJsTools) -> Self {
+        match qualification {}
+    }
+
+    /// Selects ordinary CI tools without asserting release qualification.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for absent or unsupported candidate tool paths.
+    #[cfg(test)]
+    pub(crate) fn for_tests(root: &Path) -> Result<Self, Report<ReleaseError>> {
+        let root = fs::canonicalize(root).map_err(preparation_error)?;
+        for relative in [
+            "bin/node",
+            "lib/node_modules/npm/bin/npm-cli.js",
+            "guard.node",
+            "probe",
+        ] {
+            hash_bounded_with_check(&root.join(relative), 512 * 1024 * 1024, &|| Ok(()))?;
+        }
+        Ok(Self { root })
+    }
+
+    pub(super) fn node(&self) -> PathBuf {
+        self.root.join("bin/node")
+    }
+    fn npm(&self) -> PathBuf {
+        self.root.join("lib/node_modules/npm/bin/npm-cli.js")
+    }
+    fn guard(&self) -> PathBuf {
+        self.root.join("guard.node")
+    }
+
+    fn digest(&self, attempt: &JsAttempt) -> Result<String, Report<ReleaseError>> {
+        tool_tree_digest(&self.root, &|| attempt.check())
+    }
+}
+
+/// One shared bounded preparation attempt, independent of inherited environment.
+#[derive(Clone)]
+pub(crate) struct JsAttempt {
+    pub(super) deadline: Instant,
+    pub(super) cancellation: Cancellation,
+}
+
+impl JsAttempt {
+    /// Creates a bounded attempt using an explicitly selected deadline and cancellation.
+    pub(crate) fn new(deadline: Instant, cancellation: Cancellation) -> Self {
+        Self {
+            deadline,
+            cancellation,
+        }
+    }
+    pub(super) fn check(&self) -> Result<(), Report<ReleaseError>> {
+        if self.cancellation.is_cancelled() || Instant::now() >= self.deadline {
+            return Err(preparation_error("JS preparation cancelled or timed out"));
+        }
+        Ok(())
+    }
+}
+
+/// One side has its own source, installation, cache, home, temporary and output roots.
+pub(super) struct Side {
+    pub(super) source: FreshSource,
+    pub(super) state: tempfile::TempDir,
+    metadata: tempfile::TempDir,
+    pub(super) expected_tests: BTreeSet<String>,
+}
+
+impl Side {
+    fn new(
+        source: FreshSource,
+        module_ids: &[String],
+        attempt: &JsAttempt,
+    ) -> Result<Self, Report<ReleaseError>> {
+        let state = tempfile::tempdir().map_err(preparation_error)?;
+        let metadata = tempfile::tempdir().map_err(preparation_error)?;
+        for relative in ["cache", "home", "tmp", "output", "output/bundles"] {
+            fs::create_dir(state.path().join(relative)).map_err(preparation_error)?;
+        }
+        let context =
+            json!({"schema_version":1,"source_commit":source.commit(),"module_ids":module_ids});
+        fs::write(
+            metadata.path().join("source-context.json"),
+            serde_json::to_vec(&context).map_err(preparation_error)?,
+        )
+        .map_err(preparation_error)?;
+        let expected_tests = discover_tests(&source.root().join(LIB), attempt)?;
+        Ok(Self {
+            source,
+            state,
+            metadata,
+            expected_tests,
+        })
+    }
+    pub(super) fn output(&self) -> PathBuf {
+        self.state.path().join("output")
+    }
+    pub(super) fn library(&self) -> PathBuf {
+        self.source.root().join(LIB)
+    }
+    pub(super) fn verify_source(&self) -> Result<(), Report<ReleaseError>> {
+        self.source
+            .verify_unchanged(&["crates/trusted-server-js/lib/node_modules"])
+    }
+}
+
+fn discover_tests(
+    root: &Path,
+    attempt: &JsAttempt,
+) -> Result<BTreeSet<String>, Report<ReleaseError>> {
+    let mut pending = vec![root.join("test")];
+    let mut tests = BTreeSet::new();
+    while let Some(directory) = pending.pop() {
+        for entry in fs::read_dir(directory).map_err(preparation_error)? {
+            attempt.check()?;
+            let entry = entry.map_err(preparation_error)?;
+            let metadata = fs::symlink_metadata(entry.path()).map_err(preparation_error)?;
+            if metadata.is_dir() {
+                pending.push(entry.path());
+            } else if metadata.is_file() {
+                let path = entry.path();
+                let name = path
+                    .file_name()
+                    .and_then(|name| name.to_str())
+                    .ok_or_else(|| preparation_error("test path is not UTF-8"))?;
+                if [
+                    ".test.ts",
+                    ".test.mjs",
+                    ".test.js",
+                    ".spec.ts",
+                    ".spec.mjs",
+                    ".spec.js",
+                ]
+                .iter()
+                .any(|suffix| name.ends_with(suffix))
+                {
+                    tests.insert(
+                        path.strip_prefix(root)
+                            .map_err(preparation_error)?
+                            .to_str()
+                            .ok_or_else(|| preparation_error("test path is not UTF-8"))?
+                            .to_owned(),
+                    );
+                }
+            } else {
+                return Err(preparation_error(
+                    "test registration contains an unsafe file type",
+                ));
+            }
+        }
+    }
+    if tests.is_empty() || !tests.iter().any(|path| path.ends_with("types.test.ts")) {
+        return Err(preparation_error(
+            "full JS and registered type-check suites are required",
+        ));
+    }
+    Ok(tests)
+}
+
+/// Fresh two-side state, without any installation or completion authority yet.
+pub(crate) struct PreparedJsBuild<'a> {
+    pub(super) source: &'a ApprovedSource,
+    pub(super) originals: &'a PreparedNpmOriginals,
+    pub(super) tools: SelectedJsTools,
+    pub(super) tools_digest: String,
+    pub(super) module_ids: Vec<String>,
+    pub(super) sides: [Side; 2],
+    pub(super) attempt: JsAttempt,
+    declarations: BTreeMap<(String, String), String>,
+    _root_review: RootManifestReview,
+}
+
+/// Private measured installation data, constructed only after HMAC and joins.
+pub(super) struct ObservedInstall {
+    preparation: Value,
+    pub(super) raw: Vec<u8>,
+}
+
+impl<'a> PreparedJsBuild<'a> {
+    /// Closes every independent source, installation and metadata root, even after a failure.
+    ///
+    /// # Errors
+    ///
+    /// Returns all observed cleanup failures; expiration never prevents cleanup.
+    pub(super) fn cleanup(self) -> Result<(), Report<ReleaseError>> {
+        let mut failure = None::<Report<ReleaseError>>;
+        for side in self.sides {
+            for result in [
+                side.source.close(),
+                side.state.close().map_err(preparation_error),
+                side.metadata.close().map_err(preparation_error),
+            ] {
+                if let Err(error) = result {
+                    failure = Some(match failure.take() {
+                        Some(previous) => {
+                            previous.attach(format!("another private JS cleanup failed: {error:?}"))
+                        }
+                        None => error.attach("private JS resource cleanup failed"),
+                    });
+                }
+            }
+        }
+        match failure {
+            Some(error) => Err(error),
+            None => Ok(()),
+        }
+    }
+    /// Creates both independent source/state trees from approved tracked bytes.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for changed/unjoined inputs, root hooks or failed private state.
+    pub(crate) fn new(
+        source: &'a ApprovedSource,
+        locked: &LockedMaterials,
+        originals: &'a PreparedNpmOriginals,
+        tools: SelectedJsTools,
+        attempt: JsAttempt,
+    ) -> Result<Self, Report<ReleaseError>> {
+        attempt.check()?;
+        let root_review = locked.review_root(source)?;
+        let lock = source.read_tracked(
+            "crates/trusted-server-js/lib/package-lock.json",
+            Role::Metadata,
+        )?;
+        if originals.source_binding()
+            != (
+                source.commit().as_str(),
+                hex::encode(Sha256::digest(lock)).as_str(),
+            )
+        {
+            return Err(preparation_error(
+                "npm originals are bound to different approved source or lockfile",
+            ));
+        }
+        originals.verify_unchanged()?;
+        let first = source.materialize(attempt.deadline, &attempt.cancellation)?;
+        let module_ids = first.module_ids();
+        if module_ids.is_empty() || !module_ids.iter().any(|id| id == "core") {
+            return Err(preparation_error(
+                "approved source lists no full JS module set",
+            ));
+        }
+        let sides = [
+            Side::new(first, &module_ids, &attempt)?,
+            Side::new(
+                source.materialize(attempt.deadline, &attempt.cancellation)?,
+                &module_ids,
+                &attempt,
+            )?,
+        ];
+        let tools_digest = tools.digest(&attempt)?;
+        let declarations = originals.declared_hooks();
+        Ok(Self {
+            source,
+            originals,
+            tools,
+            tools_digest,
+            module_ids,
+            sides,
+            attempt,
+            declarations,
+            _root_review: root_review,
+        })
+    }
+
+    /// Returns exactly one side's roots; the other side is never mounted.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for an unknown side or unsafe/overlapping roots.
+    pub(crate) fn boundary_roots(
+        &self,
+        index: usize,
+    ) -> Result<BoundaryRoots, Report<ReleaseError>> {
+        let side = self
+            .sides
+            .get(index)
+            .ok_or_else(|| preparation_error("unknown JS comparison side"))?;
+        BoundaryRoots::new(
+            &[
+                self.originals.root().to_owned(),
+                side.metadata.path().to_owned(),
+            ],
+            std::slice::from_ref(&self.tools.root),
+            &[side.source.root().to_owned(), side.state.path().to_owned()],
+        )
+    }
+
+    pub(super) fn check(&self) -> Result<(), Report<ReleaseError>> {
+        self.attempt.check()?;
+        self.originals.verify_unchanged()?;
+        if self.tools.digest(&self.attempt)? != self.tools_digest {
+            return Err(preparation_error("selected JS tools changed"));
+        }
+        Ok(())
+    }
+
+    pub(super) fn command(
+        &self,
+        index: usize,
+        boundary: &Boundary,
+    ) -> Result<ConfinedCommand, Report<ReleaseError>> {
+        self.command_with_npm_path(index, boundary, true)
+    }
+
+    pub(super) fn command_with_npm_path(
+        &self,
+        index: usize,
+        boundary: &Boundary,
+        include_npm: bool,
+    ) -> Result<ConfinedCommand, Report<ReleaseError>> {
+        self.check()?;
+        let side = &self.sides[index];
+        let remaining = self
+            .attempt
+            .deadline
+            .checked_duration_since(Instant::now())
+            .ok_or_else(|| preparation_error("JS deadline expired"))?;
+        let bin = boundary
+            .execution_path(&self.tools.node())?
+            .parent()
+            .ok_or_else(|| preparation_error("selected Node has no parent"))?
+            .to_owned();
+        let path = if include_npm {
+            format!("{}:/usr/bin:/bin", bin.display())
+        } else {
+            "/usr/bin:/bin".to_owned()
+        };
+        ConfinedCommand::new(
+            &self.tools.node(),
+            &side.library(),
+            ProcessLimits {
+                wall: remaining.min(Duration::from_secs(1200)),
+                stdout_max: 16 * 1024 * 1024,
+                stderr_max: 16 * 1024 * 1024,
+            },
+        )?
+        .environment("PATH", path)?
+        .environment(
+            "HOME",
+            boundary.execution_path(&side.state.path().join("home"))?,
+        )?
+        .environment(
+            "TMPDIR",
+            boundary.execution_path(&side.state.path().join("tmp"))?,
+        )?
+        .environment("LANG", "C.UTF-8")?
+        .environment("LC_ALL", "C.UTF-8")?
+        .environment("TZ", "UTC")?
+        .environment("TRUSTED_SERVER__RELEASE_BUILD", "1")?
+        .environment("TRUSTED_SERVER__GIT_VERSION", self.source.commit().as_str())?
+        .environment("TRUSTED_SERVER__RELEASE_JS_TESTS", "1")
+        .and_then(|command| {
+            command.environment(
+                "TRUSTED_SERVER__RELEASE_JS_SOURCE_CONTEXT",
+                boundary.execution_path(&side.metadata.path().join("source-context.json"))?,
+            )
+        })
+        .map(|command| command.cancellation(self.attempt.cancellation.clone()))
+    }
+
+    pub(super) fn run_command(
+        &self,
+        index: usize,
+        boundary: &Boundary,
+        proof: &DenialProof,
+        arguments: Vec<OsString>,
+    ) -> Result<Vec<u8>, Report<ReleaseError>> {
+        let command = self.command(index, boundary)?.arguments(arguments);
+        let output = boundary.run_confined(&command, proof)?.require_success()?;
+        self.sides[index].verify_source()?;
+        self.check()?;
+        Ok(output)
+    }
+
+    pub(super) fn install(
+        &self,
+        index: usize,
+        boundary: &Boundary,
+        proof: &DenialProof,
+    ) -> Result<ObservedInstall, Report<ReleaseError>> {
+        if !boundary.matches_roots(&self.boundary_roots(index)?)
+            || !boundary.has_owned_descendant_cleanup()
+        {
+            return Err(preparation_error(
+                "JS installation requires exact side roots and owned descendant cleanup",
+            ));
+        }
+        let side = &self.sides[index];
+        let npm = boundary.execution_path(&self.tools.npm())?;
+        let cache = boundary.execution_path(&side.state.path().join("cache"))?;
+        let versions =
+            self.run_command(index, boundary, proof, vec![OsString::from("--version")])?;
+        if versions != b"v24.20.0\n" {
+            return Err(preparation_error(
+                "selected Node version differs from approved pin",
+            ));
+        }
+        let version = self.run_command(
+            index,
+            boundary,
+            proof,
+            vec![npm.as_os_str().to_owned(), OsString::from("--version")],
+        )?;
+        if version != b"11.19.0\n" {
+            return Err(preparation_error(
+                "selected npm version differs from approved pin",
+            ));
+        }
+        for archives in self.originals.archive_paths().chunks(32) {
+            let mut arguments = vec![
+                npm.as_os_str().to_owned(),
+                OsString::from("cache"),
+                OsString::from("add"),
+            ];
+            for archive in archives {
+                arguments.push(boundary.execution_path(archive)?.into_os_string());
+            }
+            arguments.extend(
+                [
+                    "--offline",
+                    "--ignore-scripts",
+                    "--no-audit",
+                    "--no-fund",
+                    "--progress=false",
+                    "--userconfig=/dev/null",
+                ]
+                .map(OsString::from),
+            );
+            arguments.push(OsString::from(format!(
+                "--globalconfig={}/release-disabled-global.npmrc",
+                cache.display()
+            )));
+            arguments.extend([OsString::from("--cache"), cache.as_os_str().to_owned()]);
+            self.run_command(index, boundary, proof, arguments)?;
+        }
+        let key = random_bytes::<32>().change_context(ReleaseError::Material)?;
+        let nonce = random_bytes::<32>().change_context(ReleaseError::Material)?;
+        let guard = boundary.execution_path(&self.tools.guard())?;
+        let request = json!({"schema_version":1,"key":hex::encode(key),"nonce":hex::encode(nonce),"source_commit":self.source.commit().as_str(),"repo_root":boundary.execution_path(side.source.root())?,"cache":cache,"guard_path":guard,"native_esbuild":self.originals.native_esbuild(std::env::consts::ARCH)?});
+        let command = self
+            .command(index, boundary)?
+            .arguments([
+                boundary
+                    .execution_path(&side.source.root().join("scripts/release/observe-npm.mjs"))?
+                    .into_os_string(),
+                OsString::from("--guard"),
+                guard.into_os_string(),
+            ])
+            .stdin_bytes(serde_json::to_vec(&request).map_err(preparation_error)?);
+        let output = boundary.run_confined(&command, proof)?.require_success()?;
+        let observation = authenticate_observation(&output, &key, &request, &self.declarations)?;
+        fs::write(
+            side.metadata.path().join("preparation.json"),
+            serde_json::to_vec(&observation.preparation).map_err(preparation_error)?,
+        )
+        .map_err(preparation_error)?;
+        side.verify_source()?;
+        self.check()?;
+        Ok(observation)
+    }
+
+    pub(super) fn collector_arguments(
+        &self,
+        index: usize,
+        boundary: &Boundary,
+    ) -> Result<Vec<OsString>, Report<ReleaseError>> {
+        let side = &self.sides[index];
+        Ok(vec![
+            boundary
+                .execution_path(&side.source.root().join("scripts/release/collect-js.mjs"))?
+                .into_os_string(),
+            OsString::from("--out-dir"),
+            boundary
+                .execution_path(&side.output().join("bundles"))?
+                .into_os_string(),
+            OsString::from("--inventory"),
+            boundary
+                .execution_path(&side.output().join("tsjs-inventory.json"))?
+                .into_os_string(),
+            OsString::from("--preparation"),
+            boundary
+                .execution_path(&side.metadata.path().join("preparation.json"))?
+                .into_os_string(),
+            OsString::from("--source-context"),
+            boundary
+                .execution_path(&side.metadata.path().join("source-context.json"))?
+                .into_os_string(),
+        ])
+    }
+}
+
+fn authenticate_observation(
+    output: &[u8],
+    key: &[u8; 32],
+    request: &Value,
+    declarations: &BTreeMap<(String, String), String>,
+) -> Result<ObservedInstall, Report<ReleaseError>> {
+    let mut accepted = None;
+    for line in output.split(|byte| *byte == b'\n') {
+        let Some(encoded) = line.strip_prefix(PREFIX) else {
+            continue;
+        };
+        let Some(space) = encoded.iter().position(|byte| *byte == b' ') else {
+            continue;
+        };
+        let Ok(bytes) = STANDARD.decode(&encoded[..space]) else {
+            continue;
+        };
+        let Ok(signature) = hex::decode(&encoded[space + 1..]) else {
+            continue;
+        };
+        let mut mac = Hmac::<Sha256>::new_from_slice(key).map_err(preparation_error)?;
+        mac.update(&bytes);
+        if mac.verify_slice(&signature).is_err() {
+            continue;
+        }
+        if accepted.is_some() {
+            return Err(preparation_error("multiple authenticated npm observations"));
+        }
+        accepted = Some((parse_json(&bytes, Role::Metadata)?, bytes));
+    }
+    let (observation, raw) =
+        accepted.ok_or_else(|| preparation_error("no authenticated npm lifecycle observation"))?;
+    let object = observation
+        .as_object()
+        .ok_or_else(|| preparation_error("npm observation is not an object"))?;
+    let expected_keys = BTreeSet::from([
+        "schema_version",
+        "nonce",
+        "source_commit",
+        "repo_root",
+        "cache",
+        "guard_path",
+        "native_esbuild",
+        "normalizations",
+        "success",
+        "npm_exit_code",
+        "events",
+        "preparation",
+    ]);
+    if object.keys().map(String::as_str).collect::<BTreeSet<_>>() != expected_keys
+        || observation["success"] != true
+        || observation["npm_exit_code"] != 0
+    {
+        return Err(preparation_error(
+            "npm observation did not prove complete successful execution",
+        ));
+    }
+    for field in [
+        "schema_version",
+        "nonce",
+        "source_commit",
+        "repo_root",
+        "cache",
+        "guard_path",
+        "native_esbuild",
+    ] {
+        if observation.get(field) != request.get(field) {
+            return Err(preparation_error(
+                "npm observation belongs to another private request",
+            ));
+        }
+    }
+    let events = observation["events"]
+        .as_array()
+        .ok_or_else(|| preparation_error("npm observation has no event array"))?;
+    let mut states = BTreeMap::<(String, String), u8>::new();
+    for event in events {
+        let text = |name: &str| {
+            event
+                .get(name)
+                .and_then(Value::as_str)
+                .ok_or_else(|| preparation_error("lifecycle event lacks a required string"))
+        };
+        let identity = (text("lock_path")?.to_owned(), text("event")?.to_owned());
+        if declarations.get(&identity).map(String::as_str) != Some(text("script_sha256")?) {
+            return Err(preparation_error(
+                "observed hook differs from authenticated declaration",
+            ));
+        }
+        let state = states.entry(identity).or_default();
+        match (text("stage")?, *state) {
+            ("start", 0) => *state = 1,
+            ("success", 1) if event["exit_code"] == 0 && event["signal"].is_null() => *state = 2,
+            _ => {
+                return Err(preparation_error(
+                    "hook failed, repeated or lacks successful completion",
+                ));
+            }
+        }
+    }
+    if states.len() != declarations.len() || states.values().any(|state| *state != 2) {
+        return Err(preparation_error(
+            "not every reviewed hook executed successfully",
+        ));
+    }
+    if !observation["preparation"].is_object() || !observation["normalizations"].is_array() {
+        return Err(preparation_error(
+            "npm observation lacks measured preparation",
+        ));
+    }
+    let normalizations = observation["normalizations"]
+        .as_array()
+        .ok_or_else(|| preparation_error("normalizations must be an array"))?;
+    if normalizations.len() > 1 {
+        return Err(preparation_error(
+            "native tool was normalized more than once",
+        ));
+    }
+    for normalization in normalizations {
+        let native = &request["native_esbuild"];
+        let lock_path = native["lock_path"]
+            .as_str()
+            .ok_or_else(|| preparation_error("native expectation lacks locked package identity"))?;
+        let expected = json!({
+            "kind":"esbuild-hardlink-copy-v1",
+            "path":"node_modules/esbuild/bin/esbuild",
+            "native_path":format!("{lock_path}/bin/esbuild"),
+            "sha256":native["sha256"],"size":native["size"],"mode":native["mode"],
+        });
+        if *normalization != expected {
+            return Err(preparation_error(
+                "native normalization differs from independently authenticated original",
+            ));
+        }
+    }
+    Ok(ObservedInstall {
+        preparation: observation["preparation"].clone(),
+        raw,
+    })
+}
+
+#[cfg(test)]
+pub(crate) mod tests;
diff --git a/crates/trusted-server-release/src/preparation/tests.rs b/crates/trusted-server-release/src/preparation/tests.rs
new file mode 100644
index 0000000000..cd63f3de1d
--- /dev/null
+++ b/crates/trusted-server-release/src/preparation/tests.rs
@@ -0,0 +1,118 @@
+use super::*;
+
+fn request() -> Value {
+    json!({"schema_version":1,"nonce":"a".repeat(64),"source_commit":"b".repeat(40),"repo_root":"/example/source","cache":"/example/cache","guard_path":"/example/tools/guard.node","native_esbuild":{"lock_path":"node_modules/@esbuild/linux-x64","sha256":"c".repeat(64),"size":1,"mode":493}})
+}
+fn summary() -> Value {
+    let mut value = request();
+    value["success"] = json!(true);
+    value["npm_exit_code"] = json!(0);
+    value["events"] = json!([]);
+    value["normalizations"] = json!([]);
+    value["preparation"] = json!({"schema_version":1});
+    value
+}
+fn seal(value: &Value, key: &[u8; 32]) -> Vec<u8> {
+    let bytes = serde_json::to_vec(value).expect("should encode fixture observation");
+    let mut mac =
+        Hmac::<Sha256>::new_from_slice(key).expect("should initialize fixture authenticator");
+    mac.update(&bytes);
+    format!(
+        "{}{} {}\n",
+        std::str::from_utf8(PREFIX).expect("should decode fixed prefix"),
+        STANDARD.encode(bytes),
+        hex::encode(mac.finalize().into_bytes())
+    )
+    .into_bytes()
+}
+#[test]
+fn unauthenticated_child_output_cannot_construct_an_install_observation() {
+    let key = random_bytes::<32>().expect("should read an authentication key");
+    let mut forged_key = key;
+    forged_key[0] ^= 1;
+    assert!(
+        authenticate_observation(
+            &seal(&summary(), &forged_key),
+            &key,
+            &request(),
+            &BTreeMap::new()
+        )
+        .is_err(),
+        "should reject a child-forged observation"
+    );
+}
+#[test]
+fn observation_requires_one_successful_private_request() {
+    let key = random_bytes::<32>().expect("should read an authentication key");
+    authenticate_observation(&seal(&summary(), &key), &key, &request(), &BTreeMap::new())
+        .expect("should accept an authenticated protocol fixture");
+    for field in [
+        "nonce",
+        "source_commit",
+        "repo_root",
+        "cache",
+        "guard_path",
+        "native_esbuild",
+        "schema_version",
+        "success",
+        "npm_exit_code",
+    ] {
+        let mut changed = summary();
+        changed[field] = Value::Null;
+        assert!(
+            authenticate_observation(&seal(&changed, &key), &key, &request(), &BTreeMap::new())
+                .is_err(),
+            "should reject an altered binding or failed observation"
+        );
+    }
+    let mut duplicate = seal(&summary(), &key);
+    duplicate.extend(seal(&summary(), &key));
+    assert!(
+        authenticate_observation(&duplicate, &key, &request(), &BTreeMap::new()).is_err(),
+        "should reject repeated authenticated completion"
+    );
+}
+#[test]
+fn hook_start_does_not_substitute_for_successful_terminal_execution() {
+    let key = random_bytes::<32>().expect("should read an authentication key");
+    let digest = "d".repeat(64);
+    let declarations = BTreeMap::from([(
+        ("node_modules/example".to_owned(), "postinstall".to_owned()),
+        digest.clone(),
+    )]);
+    let start = json!({"lock_path":"node_modules/example","event":"postinstall","script_sha256":digest,"stage":"start","changes":[]});
+    let mut success = start.clone();
+    success["stage"] = json!("success");
+    success["exit_code"] = json!(0);
+    success["signal"] = Value::Null;
+    let mut value = summary();
+    value["events"] = json!([start.clone(), success.clone()]);
+    authenticate_observation(&seal(&value, &key), &key, &request(), &declarations)
+        .expect("should join start and successful completion");
+    for events in [
+        json!([]),
+        json!([start.clone()]),
+        json!([success]),
+        json!([start.clone(), start]),
+    ] {
+        value["events"] = events;
+        assert!(
+            authenticate_observation(&seal(&value, &key), &key, &request(), &declarations).is_err(),
+            "should reject missing, repeated or out-of-order hook execution"
+        );
+    }
+}
+
+#[cfg(target_os = "linux")]
+pub(crate) mod full;
+
+#[test]
+fn normalization_receipt_cannot_assert_another_native_tool_identity() {
+    let key = random_bytes::<32>().expect("should read an authentication key");
+    let mut value = summary();
+    value["normalizations"] = json!([{"kind":"esbuild-hardlink-copy-v1","path":"node_modules/esbuild/bin/esbuild","native_path":"node_modules/@esbuild/linux-x64/bin/esbuild","sha256":"f".repeat(64),"size":1,"mode":493}]);
+    assert!(
+        authenticate_observation(&seal(&value, &key), &key, &request(), &BTreeMap::new()).is_err(),
+        "should bind normalization to independently authenticated native bytes"
+    );
+}
diff --git a/crates/trusted-server-release/src/preparation/tests/full.rs b/crates/trusted-server-release/src/preparation/tests/full.rs
new file mode 100644
index 0000000000..1a7786a944
--- /dev/null
+++ b/crates/trusted-server-release/src/preparation/tests/full.rs
@@ -0,0 +1,283 @@
+//! Explicit real Linux fixture; never selected by a normal focused unit run.
+
+use super::*;
+use crate::boundary::{DockerSettings, ImageSelection, ProbeProgram};
+use crate::documents::read_bounded;
+use crate::javascript::JsBuildCompleted;
+use crate::preflight::{AuditedEnvironment, audit_environment};
+use crate::source::{CommitId, authenticate};
+
+fn host_limits() -> ProcessLimits {
+    ProcessLimits {
+        wall: Duration::from_secs(300),
+        stdout_max: 1024 * 1024,
+        stderr_max: 1024 * 1024,
+    }
+}
+
+/// One real two-build JS fixture run and the authenticated source it built.
+///
+/// Ordinary CI evidence only: the tools, image and fixture acquisition are
+/// unqualified, so nothing here is release qualification.
+pub(crate) struct JsFixtureRun {
+    /// The explicitly supplied fixture root.
+    pub(crate) fixture: PathBuf,
+    /// The audited minimal environment the source was authenticated under.
+    pub(crate) audited: AuditedEnvironment,
+    /// The locally authenticated fixture source.
+    pub(crate) source: ApprovedSource,
+    /// The locked materials derived from that source.
+    pub(crate) locked: LockedMaterials,
+    /// The completed JS handoff of build A.
+    pub(crate) completed: JsBuildCompleted,
+    /// The ordinary CI measurement of both JS builds.
+    pub(crate) measurement: Value,
+}
+
+/// Runs two fresh offline JS builds from the fixture named by
+/// `TS_RELEASE_JS_FIXTURE_ROOT` and returns the retained A handoff.
+///
+/// # Panics
+///
+/// Panics when the fixture is missing or any preparation, boundary or build
+/// step fails; this is an explicit CI fixture, not a production path.
+pub(crate) fn run_two_fresh_js_builds() -> JsFixtureRun {
+    let fixture = std::env::var_os("TS_RELEASE_JS_FIXTURE_ROOT")
+        .map(PathBuf::from)
+        .expect("should explicitly supply original-only fixture root");
+    let fixture = fs::canonicalize(fixture).expect("should resolve fixture root");
+    let context = read_bounded(&fixture.join("fixture.json"), Role::Metadata)
+        .expect("should read fixture context");
+    let context = parse_json(&context.bytes, Role::Metadata).expect("should parse fixture context");
+    let commit = CommitId::parse(
+        context["source_commit"]
+            .as_str()
+            .expect("should retain source identity"),
+    )
+    .expect("should parse independently selected source identity");
+    let audited = audit_environment(&[(OsString::from("PATH"), OsString::from("/usr/bin:/bin"))])
+        .expect("should audit minimal source environment");
+    let source = authenticate(&fixture.join("source"), &commit, &audited)
+        .expect("should authenticate fixture tracked source");
+    let locked =
+        LockedMaterials::from_source(&source).expect("should derive approved locked npm materials");
+    let (completed, measurement) = two_fresh_js_builds(&fixture, &context, &source, &locked);
+    JsFixtureRun {
+        fixture,
+        audited,
+        source,
+        locked,
+        completed,
+        measurement,
+    }
+}
+
+/// Prepares, proves and runs both JS builds, returning the handoff and measurement.
+fn two_fresh_js_builds(
+    fixture: &Path,
+    context: &Value,
+    source: &ApprovedSource,
+    locked: &LockedMaterials,
+) -> (JsBuildCompleted, Value) {
+    let cancellation = Cancellation::default();
+    let deadline = Instant::now() + Duration::from_secs(3600);
+    let originals = locked
+        .prepare_npm_originals(&fixture.join("originals"), deadline, &cancellation)
+        .expect("should authenticate every original archive and review declarations");
+    let tools = SelectedJsTools::for_tests(&fixture.join("tools"))
+        .expect("should measure ordinary CI candidate tools");
+    let prepared = PreparedJsBuild::new(
+        source,
+        locked,
+        &originals,
+        tools,
+        JsAttempt::new(deadline, cancellation),
+    )
+    .expect("should own two independent fresh installations");
+    let host = tempfile::tempdir().expect("should create disjoint boundary host state");
+    let image = ImageSelection::Test {
+        id: context["image_id"]
+            .as_str()
+            .expect("should select the already-built ordinary CI fixture image")
+            .to_owned(),
+    };
+    // These IDs only select the existing unprivileged CI worker account.
+    let user = unsafe { (libc::getuid(), libc::getgid()) };
+    let settings = DockerSettings {
+        client: PathBuf::from("/usr/bin/docker"),
+        cpus: 1,
+        memory_bytes: 4 * 1024 * 1024 * 1024,
+        pids_limit: 512,
+        tmpfs_bytes: 256 * 1024 * 1024,
+        user,
+        stop_timeout_seconds: 5,
+        host_limits: host_limits(),
+    };
+    let first_roots = prepared
+        .boundary_roots(0)
+        .expect("should select only A roots");
+    let second_roots = prepared
+        .boundary_roots(1)
+        .expect("should select only B roots");
+    let first = Boundary::linux_container(
+        first_roots.clone(),
+        settings.clone(),
+        image.clone(),
+        host.path(),
+    )
+    .expect("should configure A owned PID/network boundary");
+    let second = Boundary::linux_container(second_roots.clone(), settings, image, host.path())
+        .expect("should configure B disjoint boundary");
+    for (own, other) in [(&first_roots, &second_roots), (&second_roots, &first_roots)] {
+        let mut shared = 0;
+        for (_, _, root) in other.entries() {
+            if own.entries().any(|(_, _, own_root)| own_root == root) {
+                shared += 1;
+                assert!(
+                    !own.writable().iter().any(|path| path == root),
+                    "should share only read-only roots between A and B"
+                );
+            } else {
+                assert!(
+                    own.entries()
+                        .all(|(_, _, own_root)| !own_root.starts_with(root)
+                            && !root.starts_with(own_root)),
+                    "should never expose the other side's private source, installation or metadata root"
+                );
+            }
+        }
+        assert_eq!(
+            shared, 2,
+            "should share exactly the read-only originals and selected tool roots"
+        );
+    }
+    assert!(
+        first.matches_roots(&first_roots) && second.matches_roots(&second_roots),
+        "should bind each boundary to exactly its own selected roots"
+    );
+    assert!(
+        !first.matches_roots(&second_roots) && !second.matches_roots(&first_roots),
+        "should refuse either side's commands inside the other side's boundary"
+    );
+    let probe = ProbeProgram::from_staged_release_binary(&fixture.join("tools/probe"))
+        .expect("should select staged native producer probe");
+    let limits = ProcessLimits {
+        wall: Duration::from_secs(60),
+        stdout_max: 4096,
+        stderr_max: 4096,
+    };
+    let first_proof = first
+        .establish_denial(&probe, limits)
+        .expect("should establish real A positive and denied socket controls");
+    let second_proof = second
+        .establish_denial(&probe, limits)
+        .expect("should establish independent real B controls");
+    let owned_roots: Vec<_> = prepared
+        .sides
+        .iter()
+        .flat_map(|side| {
+            [
+                side.source.root().to_owned(),
+                side.state.path().to_owned(),
+                side.metadata.path().to_owned(),
+            ]
+        })
+        .collect();
+    let module_count = prepared.module_ids.len();
+    let completed=prepared.run([&first,&second],[&first_proof,&second_proof]).expect("should complete both actual fresh offline installations, lifecycle observations, negative tool controls, full suites and final-byte equality");
+    assert!(
+        owned_roots.iter().all(|root| !root.exists()),
+        "should close all six private source, state and metadata roots of both builds before completion"
+    );
+    assert_eq!(
+        completed.source_commit(),
+        source.commit().as_str(),
+        "should bind actual approved source"
+    );
+    assert!(
+        completed.test_counts().iter().all(|count| *count > 0),
+        "should execute nonzero full registered suites on both sides"
+    );
+    assert_eq!(
+        completed.tools_sha256().len(),
+        64,
+        "should bind measured complete tool tree"
+    );
+    assert_eq!(
+        completed.settings_sha256().len(),
+        64,
+        "should bind fixed execution settings"
+    );
+    assert_eq!(
+        completed.inventory_sha256().len(),
+        64,
+        "should retain original A inventory digest"
+    );
+    completed
+        .rehash_for_handoff()
+        .expect("should rejoin retained A bytes before downstream handoff");
+    let contributors = completed
+        .retained_contributions()
+        .expect("should export actual collector origins after private-root cleanup");
+    assert_eq!(
+        contributors.inventory_sha256(),
+        completed.inventory_sha256(),
+        "should preserve the original collector inventory identity"
+    );
+    assert_eq!(
+        contributors.modules().len(),
+        module_count,
+        "should export every actual final module with its conservative origins"
+    );
+    let measurement = json!({
+        "schema_version": 1,
+        "kind": "ordinary-ci-two-fresh-js-builds",
+        "source_commit": completed.source_commit(),
+        "test_counts": completed.test_counts(),
+        "module_count": module_count,
+        "tools_sha256": completed.tools_sha256(),
+        "settings_sha256": completed.settings_sha256(),
+        "inventory_sha256": completed.inventory_sha256(),
+        "private_roots_removed": owned_roots.len(),
+        "release_qualification": false,
+    });
+    (completed, measurement)
+}
+
+/// Runs the two fresh JS builds and exports the retained handoff and its
+/// measurement into the fresh directory named by
+/// `TS_RELEASE_JS_HANDOFF_EXPORT`, for the macOS candidate jobs to adopt.
+///
+/// The export is an unauthenticated ordinary CI artifact; adoption labels it
+/// so, and nothing here is release qualification.
+#[test]
+#[ignore = "requires explicit original-only fixture, an export destination and Linux Docker; run separately in producer CI"]
+fn export_js_handoff_for_candidates() {
+    let destination = std::env::var_os("TS_RELEASE_JS_HANDOFF_EXPORT")
+        .map(PathBuf::from)
+        .expect("should explicitly supply the JS handoff export destination");
+    let run = run_two_fresh_js_builds();
+    run.completed
+        .export_ordinary_ci_handoff_for_tests(&run.measurement, &destination)
+        .expect("should export the rehashed handoff and its measurement");
+    let (handoff, measurement) =
+        JsBuildCompleted::read_exported_ordinary_ci_handoff_for_tests(&destination)
+            .expect("should read back exactly the exported handoff and measurement");
+    JsBuildCompleted::adopt_ordinary_ci_handoff_for_tests(&run.source, &handoff, &measurement)
+        .expect("should adopt the export as the macOS jobs will");
+    println!(
+        "{}",
+        serde_json::to_string_pretty(&run.measurement).expect("should encode the JS measurement")
+    );
+}
+
+#[test]
+#[ignore = "requires explicit original-only fixture and Linux Docker; run separately in producer CI"]
+fn real_two_fresh_js_builds() {
+    let run = run_two_fresh_js_builds();
+    fs::write(
+        run.fixture.join("js-execution-measurement.json"),
+        serde_json::to_vec_pretty(&run.measurement).expect("should encode actual CI measurement"),
+    )
+    .expect("should retain actual CI measurement after successful handoff");
+}
diff --git a/crates/trusted-server-release/src/process.rs b/crates/trusted-server-release/src/process.rs
new file mode 100644
index 0000000000..f5c7bfb69d
--- /dev/null
+++ b/crates/trusted-server-release/src/process.rs
@@ -0,0 +1,651 @@
+//! Bounded child-process execution.
+//!
+//! Every child runs from an absolute program path with a fixed argument
+//! vector, an explicit working directory and an explicit environment applied
+//! after clearing the inherited one. Each child leads a new process group.
+//!
+//! # Group kill and reaping
+//!
+//! The supervisor observes the leader's exit with
+//! `waitid(WEXITED | WNOHANG | WNOWAIT)`, which leaves the leader as an
+//! unreaped zombie. While that zombie pins the process-group ID, the group is
+//! sent `SIGKILL` — after a normal exit as well as on deadline, cancellation
+//! or output cap — so the signal cannot reach a recycled group. Only then is
+//! the leader reaped (polling, bounded by the kill grace, never a blocking
+//! wait), and `killpg` is repeated until it reports `ESRCH`.
+//!
+//! A residual pgid-reuse window remains after reaping: if every member is
+//! already gone and the ID is recycled before the confirming `killpg`, that
+//! call could reach the new group. Every original member has already been
+//! sent `SIGKILL` while the ID was pinned, so this window affects only the
+//! confirmation, not the kill.
+//!
+//! Pipes are drained concurrently under byte caps and every wait is bounded,
+//! so a descendant that leaves the group (`setsid`, job control) while still
+//! holding the output pipes is reported as
+//! [`ProcessFailure::DescendantEscaped`] instead of hanging the producer.
+//!
+//! # Residuals delegated to the Task 7 OS boundary
+//!
+//! This module does **not** contain a descendant that calls `setsid()` and
+//! closes its stdio (a daemon): it leaves no group membership or pipe for the
+//! supervisor to observe, and the run reports only the leader's outcome. The
+//! Task 7 boundary must provide that containment — on Linux a container
+//! private PID namespace with an init process (`docker run --init`), whose
+//! teardown kills every namespace member; on macOS the sandbox profile.
+//! macOS has no subreaper, and this module deliberately does not change
+//! process-wide state such as `PR_SET_CHILD_SUBREAPER`.
+//!
+//! # Platform notes
+//!
+//! - On Linux, signalling a zombie succeeds, so `killpg` keeps returning `0`
+//!   until init reaps reparented zombie descendants. Containers therefore need
+//!   a reaping init (`--init`); without one, runs fail with
+//!   [`ProcessFailure::GroupSurvived`] instead of passing silently.
+//!   Process-group members cannot be enumerated portably, so the supervisor
+//!   does not scan `/proc` to treat a zombie-only group as gone; it relies on
+//!   that reaping init. The Linux test fixtures read `/proc/<pid>/stat` only
+//!   to treat an already-killed `Z`-state fixture pid as dead.
+//! - XNU's `killpg` reports `EPERM` while a group holds only zombies, so
+//!   `EPERM` is retried within the kill grace and recorded with its real errno
+//!   only if it persists.
+//! - A persistent genuine `EPERM` and a group that survives `SIGKILL` need
+//!   privileges or kernel states tests cannot arrange; those paths are
+//!   unit-tested through their decision functions only.
+//! - Process and group IDs `<= 1` are never signalled: `0`, `-1` and `1`
+//!   would address the supervisor's own group, every process, or init.
+//!
+//! # Environment
+//!
+//! The environment denylist is a backstop, not the policy: the Task 7
+//! boundary and preparation callers move to per-tool environment allowlists.
+//! Compiler and tool selection (`RUSTFLAGS`, `CARGO_ENCODED_RUSTFLAGS`,
+//! `CARGO_BUILD_RUSTC`, `CARGO_BUILD_RUSTDOC`, `CARGO_BUILD_RUSTFLAGS` and
+//! the wrappers) is denied here; recipes may set compiler flags only through a
+//! future reviewed API.
+//!
+//! Configuration redirectors need the same pinning. `HOME`, `CARGO_HOME` and
+//! `XDG_CONFIG_HOME` are accepted here but choose where tools read
+//! configuration; `RUSTFLAGS`, `CARGO_ENCODED_RUSTFLAGS`, `CARGO_BUILD_RUSTC`
+//! and `CARGO_BUILD_RUSTDOC` select compiler flags and tools and are denied
+//! here until that reviewed API exists. Callers' per-tool allowlists (Task 7
+//! boundary and preparation) must pin every such redirector to authenticated
+//! private paths.
+//!
+//! A timeout is the [`ProcessOutcome::TimedOut`] outcome; errnos are recorded
+//! only from the operating system and never synthesized.
+
+mod environment;
+mod pipes;
+mod redact;
+mod supervise;
+
+use std::collections::BTreeMap;
+use std::ffi::{OsStr, OsString};
+use std::fmt;
+use std::os::unix::ffi::OsStrExt as _;
+use std::os::unix::process::{CommandExt as _, ExitStatusExt as _};
+use std::path::{Path, PathBuf};
+use std::process::{Child, Command, ExitStatus, Stdio};
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::mpsc::Receiver;
+use std::time::{Duration, Instant};
+
+use error_stack::Report;
+
+use self::environment::{EnvironmentValue, is_credential};
+use self::pipes::{DrainedOutput, Pipes};
+use self::redact::{REDACTED, redact, redact_cut_tail, redacted_text};
+use self::supervise::{KILL_GRACE, Watch, observe, reap_within, settle};
+use crate::error::ReleaseError;
+
+/// Maximum stderr bytes shown in a failure excerpt (display bound only).
+const STDERR_EXCERPT_BYTES: usize = 4 * 1024;
+
+/// Required per-child limits; there are deliberately no defaults.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) struct ProcessLimits {
+    /// Wall-clock deadline measured from spawn.
+    pub(crate) wall: Duration,
+    /// Maximum captured stdout bytes; exceeding it kills the group.
+    pub(crate) stdout_max: u64,
+    /// Maximum captured stderr bytes; exceeding it kills the group.
+    pub(crate) stderr_max: u64,
+}
+
+/// A cancellation flag shared between the caller and running children.
+#[derive(Clone, Debug, Default)]
+pub(crate) struct Cancellation(Arc<AtomicBool>);
+
+impl Cancellation {
+    /// Requests cancellation of every child observing this flag.
+    pub(crate) fn cancel(&self) {
+        self.0.store(true, Ordering::SeqCst);
+    }
+
+    /// Returns whether cancellation was requested.
+    #[must_use]
+    pub(crate) fn is_cancelled(&self) -> bool {
+        self.0.load(Ordering::SeqCst)
+    }
+}
+
+/// A captured child output stream.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, derive_more::Display)]
+pub(crate) enum Stream {
+    #[display("stdout")]
+    Stdout,
+    #[display("stderr")]
+    Stderr,
+}
+
+/// How a supervised child run ended.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, derive_more::Display)]
+pub(crate) enum ProcessOutcome {
+    /// The leader exited normally with `code`.
+    #[display("exited with status {code}")]
+    Exited { code: i32 },
+    /// The leader was terminated by `signal`.
+    #[display("was terminated by signal {signal}")]
+    Signaled { signal: i32 },
+    /// The wall-clock deadline expired and the group was killed.
+    #[display("exceeded its wall-clock deadline")]
+    TimedOut,
+    /// Cancellation was requested and the group was killed (or never started).
+    #[display("was cancelled")]
+    Cancelled,
+    /// A stream exceeded its byte cap and the group was killed.
+    #[display("exceeded the {stream} byte cap")]
+    OutputLimit { stream: Stream },
+}
+
+/// Typed classification attached to every [`ReleaseError::Process`] report.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, derive_more::Display)]
+pub(crate) enum ProcessFailure {
+    /// The command description was rejected before spawning.
+    #[display("invalid bounded command")]
+    InvalidCommand,
+    /// The operating system refused to start the child.
+    #[display("spawn failed (errno {errno:?})")]
+    Spawn { errno: Option<i32> },
+    /// Observing or reaping the leader failed.
+    #[display("wait failed (errno {errno:?})")]
+    Wait { errno: Option<i32> },
+    /// Signalling the process group failed with something other than `ESRCH`.
+    #[display("process-group signal failed (errno {errno:?})")]
+    Signal { errno: Option<i32> },
+    /// The leader or group still existed after `SIGKILL` and the kill grace.
+    #[display("process group survived SIGKILL past the grace period")]
+    GroupSurvived,
+    /// A descendant left the group and still holds the child pipes.
+    #[display("a descendant escaped the process group while holding its pipes")]
+    DescendantEscaped,
+    /// Reading or writing a child pipe failed.
+    #[display("child pipe failed (errno {errno:?})")]
+    Pipe { errno: Option<i32> },
+    /// The child ran but did not exit with status zero.
+    #[display("child did not succeed")]
+    Unsuccessful,
+}
+
+/// A file-mode creation mask a child runs under, restricted to permission bits.
+///
+/// Rendered as three octal digits such as `022` or `027`.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, derive_more::Display)]
+#[display("{_0:03o}")]
+pub(crate) struct Umask(u16);
+
+impl Umask {
+    /// The largest valid mask, `0o777`.
+    const MAX: u32 = 0o777;
+
+    /// Accepts a numeric mask of at most `0o777`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Process`] with [`ProcessFailure::InvalidCommand`]
+    /// for any value above `0o777`.
+    pub(crate) fn new(mask: u32) -> Result<Self, Report<ReleaseError>> {
+        match u16::try_from(mask) {
+            Ok(mask) if u32::from(mask) <= Self::MAX => Ok(Self(mask)),
+            _ => Err(invalid(format!("umask {mask:#o} is not within 0..=0o777"))),
+        }
+    }
+
+    /// Returns the numeric mask.
+    #[must_use]
+    pub(crate) fn mask(self) -> u32 {
+        u32::from(self.0)
+    }
+}
+
+/// A fully specified child command executed under [`ProcessLimits`].
+pub(crate) struct BoundedCommand {
+    program: PathBuf,
+    arguments: Vec<OsString>,
+    working_directory: PathBuf,
+    environment: BTreeMap<OsString, EnvironmentValue>,
+    stdin: Option<Vec<u8>>,
+    limits: ProcessLimits,
+    umask: Option<Umask>,
+    cancellation: Option<Cancellation>,
+}
+
+fn process_error(failure: ProcessFailure, message: impl fmt::Display) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Process)
+        .attach(failure)
+        .attach(message.to_string())
+}
+
+fn invalid(message: impl fmt::Display) -> Report<ReleaseError> {
+    process_error(ProcessFailure::InvalidCommand, message)
+}
+
+impl BoundedCommand {
+    /// Describes a child running `program` in `working_directory`.
+    ///
+    /// The command starts with no arguments, an empty environment and a null
+    /// stdin.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Process`] with [`ProcessFailure::InvalidCommand`]
+    /// when `program` or `working_directory` is not absolute.
+    pub(crate) fn new(
+        program: &Path,
+        working_directory: &Path,
+        limits: ProcessLimits,
+    ) -> Result<Self, Report<ReleaseError>> {
+        if !program.is_absolute() {
+            return Err(invalid("program path is not absolute"));
+        }
+        if !working_directory.is_absolute() {
+            return Err(invalid("working directory is not absolute"));
+        }
+        Ok(Self {
+            program: program.to_path_buf(),
+            arguments: Vec::new(),
+            working_directory: working_directory.to_path_buf(),
+            environment: BTreeMap::new(),
+            stdin: None,
+            limits,
+            cancellation: None,
+            umask: None,
+        })
+    }
+
+    /// Appends fixed arguments to the argument vector.
+    #[must_use]
+    pub(crate) fn arguments<I>(mut self, arguments: I) -> Self
+    where
+        I: IntoIterator<Item = OsString>,
+    {
+        self.arguments.extend(arguments);
+        self
+    }
+
+    /// Adds a non-secret environment variable.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ProcessFailure::InvalidCommand`] for an empty or malformed
+    /// name, a value containing NUL, a duplicate name, a code or configuration
+    /// injection variable (`LD_*`, `DYLD_*`, `NODE_OPTIONS`, `npm_config_*`,
+    /// Git configuration and interpreter search paths), or a known credential
+    /// name, which only [`Self::secret_environment`] may carry.
+    pub(crate) fn environment(
+        self,
+        name: impl AsRef<OsStr>,
+        value: impl AsRef<OsStr>,
+    ) -> Result<Self, Report<ReleaseError>> {
+        if is_credential(name.as_ref()) {
+            return Err(invalid(format!(
+                "credential variable {:?} must be classified as secret",
+                name.as_ref()
+            )));
+        }
+        self.insert_environment(name.as_ref(), value.as_ref(), false)
+    }
+
+    /// Adds an environment variable whose value is redacted from all
+    /// diagnostics, including captured stderr excerpts.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ProcessFailure::InvalidCommand`] for the same reasons as
+    /// [`Self::environment`] except the credential rule, or for an empty
+    /// secret value.
+    pub(crate) fn secret_environment(
+        self,
+        name: impl AsRef<OsStr>,
+        value: impl AsRef<OsStr>,
+    ) -> Result<Self, Report<ReleaseError>> {
+        if value.as_ref().is_empty() {
+            return Err(invalid(format!(
+                "secret environment variable {:?} is empty",
+                name.as_ref()
+            )));
+        }
+        self.insert_environment(name.as_ref(), value.as_ref(), true)
+    }
+
+    /// Supplies fixed in-memory bytes on stdin instead of `/dev/null`.
+    #[must_use]
+    pub(crate) fn stdin_bytes(mut self, bytes: Vec<u8>) -> Self {
+        self.stdin = Some(bytes);
+        self
+    }
+
+    /// Observes `cancellation`; setting it kills and reaps the child group,
+    /// and a flag set before [`Self::run`] prevents spawning at all.
+    #[must_use]
+    pub(crate) fn cancellation(mut self, cancellation: Cancellation) -> Self {
+        self.cancellation = Some(cancellation);
+        self
+    }
+
+    /// Sets the child's umask before it executes; the parent's is untouched.
+    #[must_use]
+    pub(crate) fn umask(mut self, umask: Umask) -> Self {
+        self.umask = Some(umask);
+        self
+    }
+
+    fn secrets(&self) -> Vec<Vec<u8>> {
+        self.environment
+            .values()
+            .filter(|entry| entry.secret)
+            .map(|entry| entry.value.as_bytes().to_vec())
+            .collect()
+    }
+
+    fn is_cancelled(&self) -> bool {
+        self.cancellation
+            .as_ref()
+            .is_some_and(Cancellation::is_cancelled)
+    }
+
+    fn command(&self) -> Command {
+        let mut command = Command::new(&self.program);
+        command
+            .args(&self.arguments)
+            .current_dir(&self.working_directory)
+            .env_clear()
+            .envs(
+                self.environment
+                    .iter()
+                    .map(|(name, entry)| (name, &entry.value)),
+            )
+            .stdin(if self.stdin.is_some() {
+                Stdio::piped()
+            } else {
+                Stdio::null()
+            })
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .process_group(0);
+        if let Some(umask) = self.umask {
+            let mode = libc::mode_t::from(umask.0);
+            // SAFETY: the closure runs in the forked child before exec and
+            // only calls `umask`, which is async-signal-safe, touches no
+            // memory and cannot fail; it captures one `Copy` integer.
+            unsafe {
+                command.pre_exec(move || {
+                    libc::umask(mode);
+                    Ok(())
+                });
+            }
+        }
+        command
+    }
+
+    fn result(
+        &self,
+        outcome: ProcessOutcome,
+        output: DrainedOutput,
+        started: Instant,
+    ) -> ProcessResult {
+        ProcessResult {
+            program: self.program.clone(),
+            outcome,
+            stdout: output.stdout,
+            stderr: output.stderr,
+            stderr_truncated: output.stderr_truncated,
+            elapsed: started.elapsed(),
+            secrets: self.secrets(),
+        }
+    }
+
+    /// Spawns the child and returns it with its usable process-group ID.
+    fn spawn_group(&self) -> Result<(Child, libc::pid_t), Report<ReleaseError>> {
+        let mut child = self.command().spawn().map_err(|source| {
+            process_error(
+                ProcessFailure::Spawn {
+                    errno: source.raw_os_error(),
+                },
+                format!("cannot spawn child: {source}"),
+            )
+        })?;
+        if let Some(process_group) = libc::pid_t::try_from(child.id())
+            .ok()
+            .filter(|pid| *pid > 1)
+        {
+            return Ok((child, process_group));
+        }
+        // The ID is unusable for killpg, so only the leader can be stopped.
+        let mut report = process_error(
+            ProcessFailure::Spawn { errno: None },
+            "child process ID is unusable as a process group",
+        );
+        if let Err(source) = child.kill() {
+            report = report.attach(format!("cannot kill the child: {source}"));
+        }
+        match reap_within(&mut child, KILL_GRACE) {
+            Ok(Some(_)) => {}
+            Ok(None) => report = report.attach("child stayed unreaped after the kill grace"),
+            Err(source) => report = report.attach(format!("cannot reap the child: {source}")),
+        }
+        Err(report)
+    }
+
+    /// Runs the child to an outcome under the configured limits.
+    ///
+    /// Deadlines, cancellation and output caps are outcomes, not errors: the
+    /// group is killed while the leader pins its ID, the leader is reaped and
+    /// the group confirmed gone before returning. After a normal leader exit
+    /// the group is killed as well so no same-group descendant outlives the
+    /// run.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Process`] carrying a [`ProcessFailure`] when the
+    /// child cannot be spawned (with the real errno), the group cannot be
+    /// signalled, reaped or does not vanish within the kill grace, a pipe
+    /// fails, or a descendant escaped the group while holding the child
+    /// pipes.
+    pub(crate) fn run(&self) -> Result<ProcessResult, Report<ReleaseError>> {
+        let started = Instant::now();
+        if self.is_cancelled() {
+            return Ok(self.result(ProcessOutcome::Cancelled, DrainedOutput::default(), started));
+        }
+        let deadline = started + self.limits.wall;
+        let (mut child, process_group) = self.spawn_group()?;
+        let Some((pipes, overflow)) = Pipes::start(&mut child, self.stdin.clone(), &self.limits)
+        else {
+            settle(&mut child, process_group)?;
+            return Err(process_error(
+                ProcessFailure::Pipe { errno: None },
+                "child pipes are unavailable",
+            ));
+        };
+        let watch = Watch {
+            overflow: &overflow,
+            deadline,
+            cancellation: self.cancellation.as_ref(),
+        };
+        let stop = observe(&mut child, process_group, &watch)?;
+        let status = settle(&mut child, process_group)?;
+        let drained = pipes.join()?;
+        let outcome = final_outcome(stop, &overflow, &drained, status)?;
+        Ok(self.result(outcome, drained, started))
+    }
+}
+
+/// Chooses the reported outcome once the group is gone and pipes are drained.
+///
+/// A stop condition wins; otherwise a leader that died of `SIGPIPE` after a
+/// capped drain closed its pipe still reports the cap, not its own exit.
+fn final_outcome(
+    stop: Option<ProcessOutcome>,
+    overflow: &Receiver<Stream>,
+    drained: &DrainedOutput,
+    status: ExitStatus,
+) -> Result<ProcessOutcome, Report<ReleaseError>> {
+    if let Some(outcome) = stop {
+        return Ok(outcome);
+    }
+    match overflow.try_recv().ok().or(drained.overflowed) {
+        Some(stream) => Ok(ProcessOutcome::OutputLimit { stream }),
+        None => status_outcome(status),
+    }
+}
+
+impl fmt::Debug for BoundedCommand {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let secrets = self.secrets();
+        let text = |bytes: &[u8]| redacted_text(bytes, &secrets);
+        let arguments: Vec<String> = self
+            .arguments
+            .iter()
+            .map(|argument| text(argument.as_bytes()))
+            .collect();
+        let environment: BTreeMap<String, String> = self
+            .environment
+            .iter()
+            .map(|(name, entry)| {
+                let value = if entry.secret {
+                    String::from_utf8_lossy(REDACTED).into_owned()
+                } else {
+                    text(entry.value.as_bytes())
+                };
+                (text(name.as_bytes()), value)
+            })
+            .collect();
+        formatter
+            .debug_struct("BoundedCommand")
+            .field("program", &text(self.program.as_os_str().as_bytes()))
+            .field("arguments", &arguments)
+            .field(
+                "working_directory",
+                &text(self.working_directory.as_os_str().as_bytes()),
+            )
+            .field("environment", &environment)
+            .field("stdin_bytes", &self.stdin.as_ref().map(Vec::len))
+            .field("limits", &self.limits)
+            .field("cancellable", &self.cancellation.is_some())
+            .finish()
+    }
+}
+
+/// The bounded result of one supervised child run.
+pub(crate) struct ProcessResult {
+    program: PathBuf,
+    outcome: ProcessOutcome,
+    stdout: Vec<u8>,
+    stderr: Vec<u8>,
+    /// Whether the stderr drain stopped at its cap, whatever the reported outcome.
+    stderr_truncated: bool,
+    elapsed: Duration,
+    secrets: Vec<Vec<u8>>,
+}
+
+impl ProcessResult {
+    /// Returns how the run ended.
+    #[must_use]
+    pub(crate) fn outcome(&self) -> ProcessOutcome {
+        self.outcome
+    }
+
+    /// Returns captured stdout, at most the configured cap.
+    #[must_use]
+    pub(crate) fn stdout(&self) -> &[u8] {
+        &self.stdout
+    }
+
+    /// Returns captured stderr, at most the configured cap.
+    #[must_use]
+    pub(crate) fn stderr(&self) -> &[u8] {
+        &self.stderr
+    }
+
+    /// Returns wall-clock time from spawn to a confirmed-gone group.
+    #[must_use]
+    pub(crate) fn elapsed(&self) -> Duration {
+        self.elapsed
+    }
+
+    /// Returns stdout only when the child exited with status zero.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Process`] with [`ProcessFailure::Unsuccessful`]
+    /// for any other outcome, carrying a bounded, lossy stderr tail with every
+    /// secret environment value redacted, including a secret prefix cut off by
+    /// the stderr cap.
+    pub(crate) fn require_success(self) -> Result<Vec<u8>, Report<ReleaseError>> {
+        if self.outcome == (ProcessOutcome::Exited { code: 0 }) {
+            return Ok(self.stdout);
+        }
+        let redacted = redact(&self.stderr, &self.secrets);
+        // Only a stderr cut by its cap can end inside a secret; the cut is
+        // tracked per stream because another stream may have overflowed first.
+        let redacted = if self.stderr_truncated {
+            redact_cut_tail(redacted, &self.secrets)
+        } else {
+            redacted
+        };
+        let start = redacted.len().saturating_sub(STDERR_EXCERPT_BYTES);
+        let excerpt = String::from_utf8_lossy(redacted.get(start..).unwrap_or_default());
+        Err(process_error(
+            ProcessFailure::Unsuccessful,
+            format!(
+                "{} {}; stderr tail ({} of {} bytes): {excerpt}",
+                redacted_text(self.program.as_os_str().as_bytes(), &self.secrets),
+                self.outcome,
+                redacted.len() - start,
+                redacted.len()
+            ),
+        ))
+    }
+}
+
+impl fmt::Debug for ProcessResult {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("ProcessResult")
+            .field(
+                "program",
+                &redacted_text(self.program.as_os_str().as_bytes(), &self.secrets),
+            )
+            .field("outcome", &self.outcome)
+            .field("stdout_bytes", &self.stdout.len())
+            .field("stderr_bytes", &self.stderr.len())
+            .field("elapsed", &self.elapsed)
+            .finish_non_exhaustive()
+    }
+}
+
+fn status_outcome(status: ExitStatus) -> Result<ProcessOutcome, Report<ReleaseError>> {
+    match (status.code(), status.signal()) {
+        (Some(code), _) => Ok(ProcessOutcome::Exited { code }),
+        (None, Some(signal)) => Ok(ProcessOutcome::Signaled { signal }),
+        (None, None) => Err(process_error(
+            ProcessFailure::Wait { errno: None },
+            format!("unrecognized child status {status:?}"),
+        )),
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/trusted-server-release/src/process/environment.rs b/crates/trusted-server-release/src/process/environment.rs
new file mode 100644
index 0000000000..4783ad4d27
--- /dev/null
+++ b/crates/trusted-server-release/src/process/environment.rs
@@ -0,0 +1,227 @@
+//! Environment validation for [`BoundedCommand`].
+//!
+//! The denylists are a backstop; the Task 7 boundary and preparation callers
+//! supply per-tool allowlists.
+
+use std::ffi::{OsStr, OsString};
+use std::os::unix::ffi::OsStrExt as _;
+
+use error_stack::Report;
+
+use super::{BoundedCommand, invalid};
+use crate::error::ReleaseError;
+
+/// Uppercased name prefixes that inject code or configuration into children.
+const INJECTION_PREFIXES: [&str; 5] = [
+    "DYLD_",
+    "GIT_CONFIG_KEY_",
+    "GIT_CONFIG_VALUE_",
+    "LD_",
+    "NPM_CONFIG_",
+];
+/// Uppercased `CARGO_TARGET_<triple>_<suffix>` suffixes that select tools.
+const CARGO_TARGET_TOOL_SUFFIXES: [&str; 2] = ["_LINKER", "_RUNNER"];
+/// Uppercased exact names that inject code or configuration into children.
+const INJECTION_EXACT: [&str; 42] = [
+    "BASH_ENV",
+    "CARGO_BUILD_RUSTC",
+    "CARGO_BUILD_RUSTDOC",
+    "CARGO_BUILD_RUSTFLAGS",
+    "CARGO_BUILD_RUSTC_WORKSPACE_WRAPPER",
+    "CARGO_BUILD_RUSTC_WRAPPER",
+    "CARGO_ENCODED_RUSTFLAGS",
+    "EDITOR",
+    "ENV",
+    "GCONV_PATH",
+    "GIT_ASKPASS",
+    "GIT_CONFIG",
+    "GIT_CONFIG_COUNT",
+    "GIT_CONFIG_GLOBAL",
+    "GIT_CONFIG_PARAMETERS",
+    "GIT_CONFIG_SYSTEM",
+    "GIT_EDITOR",
+    "GIT_EXEC_PATH",
+    "GIT_EXTERNAL_DIFF",
+    "GIT_PAGER",
+    "GIT_PROXY_COMMAND",
+    "GIT_SSH",
+    "GIT_SSH_COMMAND",
+    "GIT_TEMPLATE_DIR",
+    "JAVA_TOOL_OPTIONS",
+    "NODE_OPTIONS",
+    "NODE_PATH",
+    "PAGER",
+    "PERL5LIB",
+    "PERL5OPT",
+    "PYTHONPATH",
+    "PYTHONSTARTUP",
+    "RUBYLIB",
+    "RUBYOPT",
+    "RUSTC",
+    "RUSTC_WORKSPACE_WRAPPER",
+    "RUSTC_WRAPPER",
+    "RUSTDOC",
+    "RUSTFLAGS",
+    "SSH_ASKPASS",
+    "VISUAL",
+    "_JAVA_OPTIONS",
+];
+/// Uppercased credential name prefixes accepted only as secrets.
+const CREDENTIAL_PREFIXES: [&str; 2] = ["AWS_", "FASTLY_"];
+/// Uppercased `aws-lc-sys` system-library switch, also per target as
+/// `<name>_<triple>`. It shares the `AWS_` prefix but carries no credential.
+const BUILD_SWITCH: &str = "AWS_LC_SYS_USE_SYSTEM";
+/// Uppercased `CARGO_REGISTRIES_<name>_TOKEN` registry credential affixes.
+const CARGO_REGISTRIES_TOKEN: (&str, &str) = ("CARGO_REGISTRIES_", "_TOKEN");
+/// Uppercased credential names accepted only as secrets.
+const CREDENTIAL_EXACT: [&str; 8] = [
+    "ACTIONS_ID_TOKEN_REQUEST_TOKEN",
+    "ACTIONS_RUNTIME_TOKEN",
+    "CARGO_REGISTRY_TOKEN",
+    "GH_TOKEN",
+    "GITHUB_TOKEN",
+    "NODE_AUTH_TOKEN",
+    "NPM_TOKEN",
+    "SIGSTORE_ID_TOKEN",
+];
+
+/// One explicit child environment entry.
+#[derive(Clone)]
+pub(super) struct EnvironmentValue {
+    pub(super) value: OsString,
+    pub(super) secret: bool,
+}
+
+fn upper_name(name: &OsStr) -> String {
+    name.to_string_lossy().to_ascii_uppercase()
+}
+
+fn is_injection(name: &OsStr) -> bool {
+    let upper = upper_name(name);
+    let cargo_target_tool = upper.starts_with("CARGO_TARGET_")
+        && CARGO_TARGET_TOOL_SUFFIXES
+            .iter()
+            .any(|suffix| upper.ends_with(suffix));
+    cargo_target_tool
+        || INJECTION_PREFIXES
+            .iter()
+            .any(|prefix| upper.starts_with(prefix))
+        || INJECTION_EXACT.contains(&upper.as_str())
+}
+
+pub(super) fn is_credential(name: &OsStr) -> bool {
+    let upper = upper_name(name);
+    let (registries, token) = CARGO_REGISTRIES_TOKEN;
+    let registry_token = upper.starts_with(registries) && upper.ends_with(token);
+    let build_switch = upper == BUILD_SWITCH
+        || upper
+            .strip_prefix(BUILD_SWITCH)
+            .and_then(|suffix| suffix.strip_prefix('_'))
+            .is_some_and(|triple| {
+                !triple.is_empty()
+                    && triple
+                        .bytes()
+                        .all(|byte| byte.is_ascii_alphanumeric() || byte == b'_')
+            });
+    registry_token
+        || (!build_switch
+            && upper != "AWS_LC_SYS_CMAKE_BUILDER"
+            && upper != "AWS_LC_SYS_CMAKE_BUILDER_X86_64_UNKNOWN_LINUX_GNU"
+            && CREDENTIAL_PREFIXES
+                .iter()
+                .any(|prefix| upper.starts_with(prefix)))
+        || CREDENTIAL_EXACT.contains(&upper.as_str())
+}
+
+/// Exact names an orchestrator may set explicitly through
+/// [`BoundedCommand::tool_selector_environment`] despite the injection denylist.
+const TOOL_SELECTORS: [&str; 1] = ["RUSTC"];
+
+impl BoundedCommand {
+    pub(super) fn insert_environment(
+        self,
+        name: &OsStr,
+        value: &OsStr,
+        secret: bool,
+    ) -> Result<Self, Report<ReleaseError>> {
+        self.insert_checked(name, value, secret, false)
+    }
+
+    /// Adds one explicitly selected tool path, such as the compiler.
+    ///
+    /// The generic [`Self::environment`] keeps rejecting every tool selector,
+    /// because an inherited or attacker-chosen `RUSTC` swaps the compiler.
+    /// This method accepts only the names in [`TOOL_SELECTORS`], only with an
+    /// absolute path, and only once.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Process`] for any other name, a relative or
+    /// empty value, or a repeated name.
+    pub(crate) fn tool_selector_environment(
+        self,
+        name: impl AsRef<OsStr>,
+        value: impl AsRef<OsStr>,
+    ) -> Result<Self, Report<ReleaseError>> {
+        let (name, value) = (name.as_ref(), value.as_ref());
+        let selectable = TOOL_SELECTORS
+            .iter()
+            .any(|selector| name == OsStr::new(selector));
+        if !selectable || !value.as_bytes().starts_with(b"/") {
+            return Err(invalid(format!(
+                "{name:?} is not an explicitly selectable tool with an absolute path"
+            )));
+        }
+        self.insert_checked(name, value, false, true)
+    }
+
+    fn insert_checked(
+        mut self,
+        name: &OsStr,
+        value: &OsStr,
+        secret: bool,
+        tool_selector: bool,
+    ) -> Result<Self, Report<ReleaseError>> {
+        let name_bytes = name.as_bytes();
+        if name_bytes.is_empty() || name_bytes.contains(&b'=') || name_bytes.contains(&0) {
+            return Err(invalid(format!(
+                "environment variable name {name:?} is malformed"
+            )));
+        }
+        if value.as_bytes().contains(&0) {
+            return Err(invalid(format!(
+                "environment variable {name:?} value contains NUL"
+            )));
+        }
+        if !tool_selector && is_injection(name) {
+            return Err(invalid(format!(
+                "environment variable {name:?} injects code or configuration"
+            )));
+        }
+        if matches!(
+            upper_name(name).as_str(),
+            "AWS_LC_SYS_CMAKE_BUILDER" | "AWS_LC_SYS_CMAKE_BUILDER_X86_64_UNKNOWN_LINUX_GNU"
+        ) && value != OsStr::new("0")
+        {
+            return Err(invalid(
+                "only the reviewed AWS-LC cc backend switch is permitted",
+            ));
+        }
+        if self.environment.contains_key(name) {
+            return Err(invalid(format!(
+                "environment variable {name:?} is set twice"
+            )));
+        }
+        self.environment.insert(
+            name.to_os_string(),
+            EnvironmentValue {
+                value: value.to_os_string(),
+                secret,
+            },
+        );
+        Ok(self)
+    }
+}
+
+#[cfg(test)]
+mod selector_tests;
diff --git a/crates/trusted-server-release/src/process/environment/selector_tests.rs b/crates/trusted-server-release/src/process/environment/selector_tests.rs
new file mode 100644
index 0000000000..6f7c025bac
--- /dev/null
+++ b/crates/trusted-server-release/src/process/environment/selector_tests.rs
@@ -0,0 +1,74 @@
+//! Pure tests of the explicit tool-selector allowance; no process is started.
+
+use std::ffi::{OsStr, OsString};
+use std::path::Path;
+use std::time::Duration;
+
+use super::*;
+use crate::process::ProcessLimits;
+
+fn fresh() -> BoundedCommand {
+    BoundedCommand::new(
+        Path::new("/example/tool"),
+        Path::new("/example"),
+        ProcessLimits {
+            wall: Duration::from_secs(1),
+            stdout_max: 1024,
+            stderr_max: 1024,
+        },
+    )
+    .expect("should describe a command")
+}
+
+#[test]
+fn generic_environment_still_rejects_every_tool_selector() {
+    for name in [
+        "RUSTC",
+        "RUSTC_WRAPPER",
+        "RUSTFLAGS",
+        "RUSTDOC",
+        "CARGO_BUILD_RUSTC",
+    ] {
+        assert!(
+            fresh().environment(name, "/example/rustc").is_err(),
+            "should keep rejecting {name} through the generic environment"
+        );
+    }
+}
+
+#[test]
+fn only_rustc_with_an_absolute_path_is_a_selectable_tool() {
+    let selected = fresh()
+        .tool_selector_environment("RUSTC", "/example/bin/rustc")
+        .expect("should accept an explicit absolute RUSTC");
+    assert_eq!(
+        selected
+            .environment
+            .get(OsStr::new("RUSTC"))
+            .map(|entry| entry.value.clone()),
+        Some(OsString::from("/example/bin/rustc")),
+        "should carry the selected compiler"
+    );
+    for (name, value) in [
+        ("RUSTC_WRAPPER", "/example/wrapper"),
+        ("RUSTFLAGS", "/example/flags"),
+        ("RUSTDOC", "/example/rustdoc"),
+        ("CARGO_BUILD_RUSTC", "/example/rustc"),
+        ("LD_PRELOAD", "/example/lib.so"),
+        ("rustc", "/example/rustc"),
+        ("RUSTC", "relative/rustc"),
+        ("RUSTC", ""),
+    ] {
+        assert!(
+            fresh().tool_selector_environment(name, value).is_err(),
+            "should reject {name}={value:?} as a tool selector"
+        );
+    }
+    assert!(
+        fresh()
+            .tool_selector_environment("RUSTC", "/example/bin/rustc")
+            .and_then(|command| command.tool_selector_environment("RUSTC", "/example/other"))
+            .is_err(),
+        "should reject setting RUSTC twice"
+    );
+}
diff --git a/crates/trusted-server-release/src/process/pipes.rs b/crates/trusted-server-release/src/process/pipes.rs
new file mode 100644
index 0000000000..7d2df2e256
--- /dev/null
+++ b/crates/trusted-server-release/src/process/pipes.rs
@@ -0,0 +1,159 @@
+//! Bounded concurrent draining of child pipes.
+
+use std::io::{self, Read, Write as _};
+use std::process::Child;
+use std::sync::mpsc::{self, Receiver, Sender};
+use std::thread::{self, JoinHandle};
+use std::time::Instant;
+
+use error_stack::Report;
+
+use super::supervise::{KILL_GRACE, POLL_INTERVAL};
+use super::{ProcessFailure, ProcessLimits, Stream, process_error};
+use crate::error::ReleaseError;
+
+/// Pipe read size for the drain threads.
+const READ_CHUNK: usize = 64 * 1024;
+
+/// Bytes read from one stream before EOF or the cap.
+struct Drained {
+    bytes: Vec<u8>,
+    overflowed: bool,
+}
+
+/// Captured output of both streams after every pipe thread finished.
+#[derive(Default)]
+pub(super) struct DrainedOutput {
+    pub(super) stdout: Vec<u8>,
+    pub(super) stderr: Vec<u8>,
+    pub(super) overflowed: Option<Stream>,
+    pub(super) stderr_truncated: bool,
+}
+
+/// Drain and stdin-writer threads attached to one child.
+pub(super) struct Pipes {
+    stdout: JoinHandle<io::Result<Drained>>,
+    stderr: JoinHandle<io::Result<Drained>>,
+    stdin: Option<JoinHandle<io::Result<()>>>,
+}
+
+impl Pipes {
+    pub(super) fn start(
+        child: &mut Child,
+        stdin_bytes: Option<Vec<u8>>,
+        limits: &ProcessLimits,
+    ) -> Option<(Self, Receiver<Stream>)> {
+        let stdout = child.stdout.take()?;
+        let stderr = child.stderr.take()?;
+        let stdin = match stdin_bytes {
+            Some(bytes) => Some((child.stdin.take()?, bytes)),
+            None => None,
+        };
+        let (sender, overflow) = mpsc::channel();
+        let pipes = Self {
+            stdout: drain(stdout, Stream::Stdout, limits.stdout_max, sender.clone()),
+            stderr: drain(stderr, Stream::Stderr, limits.stderr_max, sender),
+            stdin: stdin.map(|(mut pipe, bytes)| {
+                thread::spawn(move || match pipe.write_all(&bytes) {
+                    // A child that stops reading early is not a pipe failure.
+                    Err(source) if source.kind() == io::ErrorKind::BrokenPipe => Ok(()),
+                    other => other,
+                })
+            }),
+        };
+        Some((pipes, overflow))
+    }
+
+    fn finished(&self) -> bool {
+        self.stdout.is_finished()
+            && self.stderr.is_finished()
+            && self.stdin.as_ref().is_none_or(JoinHandle::is_finished)
+    }
+
+    /// Joins every pipe thread within [`KILL_GRACE`].
+    ///
+    /// Threads still blocked after the grace stay detached: they hold only a
+    /// pipe end that the escaped descendant keeps open.
+    pub(super) fn join(self) -> Result<DrainedOutput, Report<ReleaseError>> {
+        let until = Instant::now() + KILL_GRACE;
+        while !self.finished() {
+            if Instant::now() >= until {
+                return Err(process_error(
+                    ProcessFailure::DescendantEscaped,
+                    "child pipes stayed open after the process group was gone; \
+                     output is rejected",
+                ));
+            }
+            thread::sleep(POLL_INTERVAL);
+        }
+        if let Some(stdin) = self.stdin {
+            joined(stdin)?;
+        }
+        let stdout = joined(self.stdout)?;
+        let stderr = joined(self.stderr)?;
+        let overflowed = if stdout.overflowed {
+            Some(Stream::Stdout)
+        } else if stderr.overflowed {
+            Some(Stream::Stderr)
+        } else {
+            None
+        };
+        Ok(DrainedOutput {
+            stdout: stdout.bytes,
+            stderr: stderr.bytes,
+            overflowed,
+            stderr_truncated: stderr.overflowed,
+        })
+    }
+}
+
+fn joined<T>(handle: JoinHandle<io::Result<T>>) -> Result<T, Report<ReleaseError>> {
+    handle
+        .join()
+        .map_err(|_| process_error(ProcessFailure::Pipe { errno: None }, "pipe thread panicked"))?
+        .map_err(|source| {
+            process_error(
+                ProcessFailure::Pipe {
+                    errno: source.raw_os_error(),
+                },
+                format!("child pipe failed: {source}"),
+            )
+        })
+}
+
+fn drain<R: Read + Send + 'static>(
+    mut reader: R,
+    stream: Stream,
+    limit: u64,
+    overflow: Sender<Stream>,
+) -> JoinHandle<io::Result<Drained>> {
+    thread::spawn(move || {
+        let mut bytes = Vec::new();
+        let mut buffer = vec![0; READ_CHUNK];
+        loop {
+            let count = match reader.read(&mut buffer) {
+                Ok(count) => count,
+                Err(source) if source.kind() == io::ErrorKind::Interrupted => continue,
+                Err(source) => return Err(source),
+            };
+            if count == 0 {
+                return Ok(Drained {
+                    bytes,
+                    overflowed: false,
+                });
+            }
+            let captured = u64::try_from(bytes.len()).unwrap_or(u64::MAX);
+            let remaining = usize::try_from(limit.saturating_sub(captured)).unwrap_or(usize::MAX);
+            if count > remaining {
+                bytes.extend_from_slice(buffer.get(..remaining).unwrap_or_default());
+                // Dropping the reader closes the pipe; the supervisor kills the group.
+                let _ = overflow.send(stream);
+                return Ok(Drained {
+                    bytes,
+                    overflowed: true,
+                });
+            }
+            bytes.extend_from_slice(buffer.get(..count).unwrap_or_default());
+        }
+    })
+}
diff --git a/crates/trusted-server-release/src/process/redact.rs b/crates/trusted-server-release/src/process/redact.rs
new file mode 100644
index 0000000000..c14b3fe07c
--- /dev/null
+++ b/crates/trusted-server-release/src/process/redact.rs
@@ -0,0 +1,63 @@
+//! Secret redaction for diagnostics.
+
+/// Replacement text for secret values in diagnostics.
+pub(super) const REDACTED: &[u8] = b"[REDACTED]";
+
+/// Replaces the union of every secret occurrence with one marker per span.
+///
+/// Matches are found on the original bytes and merged before replacement, so
+/// overlapping or adjacent secrets cannot leave fragments behind.
+pub(super) fn redact(bytes: &[u8], secrets: &[Vec<u8>]) -> Vec<u8> {
+    let mut ranges: Vec<(usize, usize)> = secrets
+        .iter()
+        .filter(|secret| !secret.is_empty())
+        .flat_map(|secret| {
+            bytes
+                .windows(secret.len())
+                .enumerate()
+                .filter(move |(_, window)| window == secret)
+                .map(move |(start, _)| (start, start + secret.len()))
+        })
+        .collect();
+    ranges.sort_unstable();
+    let mut merged: Vec<(usize, usize)> = Vec::with_capacity(ranges.len());
+    for (start, end) in ranges {
+        match merged.last_mut() {
+            Some(last) if start <= last.1 => last.1 = last.1.max(end),
+            _ => merged.push((start, end)),
+        }
+    }
+    let mut output = Vec::with_capacity(bytes.len());
+    let mut cursor = 0;
+    for (start, end) in merged {
+        output.extend_from_slice(bytes.get(cursor..start).unwrap_or_default());
+        output.extend_from_slice(REDACTED);
+        cursor = end;
+    }
+    output.extend_from_slice(bytes.get(cursor..).unwrap_or_default());
+    output
+}
+
+/// Replaces a trailing proper prefix of any secret, as left by a byte cap
+/// that cut the stream inside the secret.
+pub(super) fn redact_cut_tail(mut bytes: Vec<u8>, secrets: &[Vec<u8>]) -> Vec<u8> {
+    let cut = secrets
+        .iter()
+        .flat_map(|secret| {
+            (1..secret.len()).filter(|&length| {
+                secret
+                    .get(..length)
+                    .is_some_and(|prefix| bytes.ends_with(prefix))
+            })
+        })
+        .max();
+    if let Some(length) = cut {
+        bytes.truncate(bytes.len() - length);
+        bytes.extend_from_slice(REDACTED);
+    }
+    bytes
+}
+
+pub(super) fn redacted_text(bytes: &[u8], secrets: &[Vec<u8>]) -> String {
+    String::from_utf8_lossy(&redact(bytes, secrets)).into_owned()
+}
diff --git a/crates/trusted-server-release/src/process/supervise.rs b/crates/trusted-server-release/src/process/supervise.rs
new file mode 100644
index 0000000000..c356bfdca1
--- /dev/null
+++ b/crates/trusted-server-release/src/process/supervise.rs
@@ -0,0 +1,233 @@
+//! Leader observation, process-group kill and bounded reaping.
+
+use std::io;
+use std::process::{Child, ExitStatus};
+use std::sync::mpsc::{Receiver, RecvTimeoutError};
+use std::thread;
+use std::time::{Duration, Instant};
+
+use error_stack::Report;
+
+use super::{Cancellation, ProcessFailure, ProcessOutcome, Stream, process_error};
+use crate::error::ReleaseError;
+
+/// Bounded wait for reaping, group disappearance and pipe closure after a kill.
+///
+/// This is a supervisor liveness bound, not a release policy value: a killed
+/// group closes its pipes promptly, so anything still holding them after this
+/// grace has escaped the group.
+pub(super) const KILL_GRACE: Duration = Duration::from_secs(2);
+/// Supervisor polling interval for leader status, deadlines and cancellation.
+pub(super) const POLL_INTERVAL: Duration = Duration::from_millis(10);
+
+/// Stop conditions observed while the leader runs.
+pub(super) struct Watch<'a> {
+    pub(super) overflow: &'a Receiver<Stream>,
+    pub(super) deadline: Instant,
+    pub(super) cancellation: Option<&'a Cancellation>,
+}
+
+/// Returns whether the leader has exited, leaving it unreaped.
+///
+/// `WNOWAIT` keeps the zombie, so the process-group ID stays pinned until
+/// [`settle`] has signalled the group.
+fn leader_exited(pid: libc::pid_t) -> io::Result<bool> {
+    let id = libc::id_t::try_from(pid)
+        .ok()
+        .filter(|_| pid > 1)
+        .ok_or_else(|| io::Error::new(io::ErrorKind::InvalidInput, "unusable child pid"))?;
+    // SAFETY: `siginfo_t` is plain integer and pointer data; all-zero is a
+    // valid value and lets `si_pid == 0` signal "no state change".
+    let mut info: libc::siginfo_t = unsafe { core::mem::zeroed() };
+    // SAFETY: `info` is a valid, writable `siginfo_t` for the call's duration.
+    let result = unsafe {
+        libc::waitid(
+            libc::P_PID,
+            id,
+            &raw mut info,
+            libc::WEXITED | libc::WNOHANG | libc::WNOWAIT,
+        )
+    };
+    if result != 0 {
+        let source = io::Error::last_os_error();
+        if source.kind() == io::ErrorKind::Interrupted {
+            return Ok(false);
+        }
+        return Err(source);
+    }
+    // SAFETY: `waitid` filled `info` (or left it zeroed under `WNOHANG`).
+    Ok(unsafe { info.si_pid() } != 0)
+}
+
+/// Polls until the leader exits (`None`) or a stop condition fires.
+fn wait_for_leader(pid: libc::pid_t, watch: &Watch<'_>) -> io::Result<Option<ProcessOutcome>> {
+    loop {
+        if let Ok(stream) = watch.overflow.try_recv() {
+            return Ok(Some(ProcessOutcome::OutputLimit { stream }));
+        }
+        if leader_exited(pid)? {
+            return Ok(None);
+        }
+        if watch.cancellation.is_some_and(Cancellation::is_cancelled) {
+            return Ok(Some(ProcessOutcome::Cancelled));
+        }
+        if Instant::now() >= watch.deadline {
+            return Ok(Some(ProcessOutcome::TimedOut));
+        }
+        match watch.overflow.recv_timeout(POLL_INTERVAL) {
+            Ok(stream) => return Ok(Some(ProcessOutcome::OutputLimit { stream })),
+            Err(RecvTimeoutError::Timeout) => {}
+            Err(RecvTimeoutError::Disconnected) => thread::sleep(POLL_INTERVAL),
+        }
+    }
+}
+
+pub(super) fn signal_group(process_group: libc::pid_t) -> io::Result<()> {
+    // 0, -1 and 1 would address this supervisor's group, every process or
+    // init; refuse them without inventing an errno.
+    if process_group <= 1 {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidInput,
+            "refusing to signal a non-child process group",
+        ));
+    }
+    // SAFETY: `killpg` only reads its two integer arguments; it touches no
+    // memory owned by this process.
+    let result = unsafe { libc::killpg(process_group, libc::SIGKILL) };
+    if result == 0 {
+        Ok(())
+    } else {
+        Err(io::Error::last_os_error())
+    }
+}
+
+fn signal_failure(source: &io::Error) -> Report<ReleaseError> {
+    process_error(
+        ProcessFailure::Signal {
+            errno: source.raw_os_error(),
+        },
+        format!("killpg failed: {source}"),
+    )
+}
+
+/// Returns whether `source` may be XNU's transient refusal to signal a group
+/// that holds only zombies.
+fn is_transient_refusal(source: &io::Error) -> bool {
+    source.raw_os_error() == Some(libc::EPERM)
+}
+
+/// Polls for the leader's exit status for at most `grace`; never blocks.
+///
+/// Returns `Ok(None)` when the leader is still unreaped after the grace.
+pub(super) fn reap_within(child: &mut Child, grace: Duration) -> io::Result<Option<ExitStatus>> {
+    let until = Instant::now() + grace;
+    loop {
+        if let Some(status) = child.try_wait()? {
+            return Ok(Some(status));
+        }
+        if Instant::now() >= until {
+            return Ok(None);
+        }
+        thread::sleep(POLL_INTERVAL);
+    }
+}
+
+/// Classifies a leader that stayed unreaped after `SIGKILL` and the grace,
+/// keeping the real errno of a refused group signal.
+pub(super) fn unreaped_failure(refusal: Option<&io::Error>) -> ProcessFailure {
+    match refusal {
+        Some(source) => ProcessFailure::Signal {
+            errno: source.raw_os_error(),
+        },
+        None => ProcessFailure::GroupSurvived,
+    }
+}
+
+/// Kills the group while the unreaped leader pins its ID, reaps the leader
+/// within the grace, then confirms the group is gone.
+pub(super) fn settle(
+    child: &mut Child,
+    process_group: libc::pid_t,
+) -> Result<ExitStatus, Report<ReleaseError>> {
+    let refusal = signal_group(process_group)
+        .err()
+        .filter(|source| source.raw_os_error() != Some(libc::ESRCH));
+    // A refused group signal may be XNU's zombie-only EPERM; signal the
+    // leader directly as well so a live leader still dies. A failure here
+    // matters only if the leader then stays unreaped, where it is reported.
+    let direct = refusal.as_ref().and_then(|_| child.kill().err());
+    let status = reap_within(child, KILL_GRACE).map_err(|source| {
+        process_error(
+            ProcessFailure::Wait {
+                errno: source.raw_os_error(),
+            },
+            format!("cannot reap child: {source}"),
+        )
+    })?;
+    let Some(status) = status else {
+        let message = match &refusal {
+            Some(source) => format!("child stayed unreaped after killpg failed: {source}"),
+            None => "child stayed unreaped after SIGKILL".to_owned(),
+        };
+        let report = process_error(unreaped_failure(refusal.as_ref()), message);
+        return Err(match direct {
+            Some(source) => report.attach(format!("direct leader kill also failed: {source}")),
+            None => report,
+        });
+    };
+    kill_group_until_gone(process_group)?;
+    Ok(status)
+}
+
+/// Sends `SIGKILL` to the group until `killpg` reports `ESRCH`.
+///
+/// This runs after the leader is reaped, so the group ID is no longer pinned:
+/// if every member is already gone and the ID is recycled before a call
+/// here, that call could reach the new group. Every original member was
+/// already sent `SIGKILL` by [`settle`] while the ID was pinned, so the window
+/// affects only this confirmation.
+fn kill_group_until_gone(process_group: libc::pid_t) -> Result<(), Report<ReleaseError>> {
+    let until = Instant::now() + KILL_GRACE;
+    loop {
+        let expired = Instant::now() >= until;
+        match signal_group(process_group) {
+            Err(source) if source.raw_os_error() == Some(libc::ESRCH) => return Ok(()),
+            Err(source) if expired || !is_transient_refusal(&source) => {
+                return Err(signal_failure(&source));
+            }
+            Ok(()) if expired => {
+                return Err(process_error(
+                    ProcessFailure::GroupSurvived,
+                    format!("process group {process_group} survived SIGKILL"),
+                ));
+            }
+            Ok(()) | Err(_) => thread::sleep(POLL_INTERVAL),
+        }
+    }
+}
+
+/// Waits for the leader's exit or a stop condition.
+///
+/// When observation itself fails, the group is still settled before the
+/// error is returned, and a cleanup failure is attached to it.
+pub(super) fn observe(
+    child: &mut Child,
+    process_group: libc::pid_t,
+    watch: &Watch<'_>,
+) -> Result<Option<ProcessOutcome>, Report<ReleaseError>> {
+    match wait_for_leader(process_group, watch) {
+        Ok(stop) => Ok(stop),
+        Err(source) => {
+            let report = process_error(
+                ProcessFailure::Wait {
+                    errno: source.raw_os_error(),
+                },
+                format!("cannot observe child: {source}"),
+            );
+            Err(match settle(child, process_group) {
+                Ok(_) => report,
+                Err(cleanup) => report.attach(format!("cleanup also failed: {cleanup:?}")),
+            })
+        }
+    }
+}
diff --git a/crates/trusted-server-release/src/process/tests.rs b/crates/trusted-server-release/src/process/tests.rs
new file mode 100644
index 0000000000..70fd1d5a4f
--- /dev/null
+++ b/crates/trusted-server-release/src/process/tests.rs
@@ -0,0 +1,56 @@
+//! Process supervision tests.
+//!
+//! Fixtures are host-independent: instead of ambient shells or coreutils,
+//! each child re-executes this test binary in a hidden helper mode selected
+//! by [`HELPER_SELECTOR`] (see [`helper_entry`] and [`fixture`]). The helper
+//! implements every process shape with std and libc only.
+//!
+//! The helper fails closed: a selector without the exact helper filter and a
+//! matching per-run nonce fails the test run instead of acting or skipping.
+//!
+//! Genuine `EPERM` group-signal refusals and a group that survives
+//! `SIGKILL` need privileges or kernel states a test cannot arrange, so those
+//! paths are covered only by unit tests of [`reap_within`] and
+//! [`unreaped_failure`], not end to end.
+
+mod fixture;
+mod outcomes;
+mod redaction;
+mod supervision;
+mod variables;
+
+use std::io;
+use std::process::Command as StdCommand;
+use std::thread;
+
+use self::fixture::{
+    CUT_KEPT, CUT_PADDING, CUT_SECRET, HELPER_NONCE, HELPER_PIDS, HELPER_SELECTOR,
+    HELPER_SETUP_FAILED, HELPER_TEST, LARGE_STDERR, OVERLAP_FIRST, OVERLAP_SECOND, SECRET, SLACK,
+    TIMEOUT_WALL, authorized_mode, failure, force_kill, harness_arguments, helper, helper_selector,
+    is_alive, is_dead_soon, limits, payload, read_pid, run_helper, supervision_bound, test_binary,
+    unauthorized_helper_run, workspace,
+};
+use super::supervise::{signal_group, unreaped_failure};
+use super::*;
+
+/// Hidden re-exec entry point; returns immediately in normal test runs.
+///
+/// A selector present without the fixture's exact filter and nonce fails the
+/// run rather than silently acting or passing.
+#[test]
+fn helper_entry() {
+    let Some(selector) = std::env::var_os(HELPER_SELECTOR) else {
+        return;
+    };
+    let nonce = std::env::var(HELPER_NONCE).ok();
+    let arguments: Vec<String> = std::env::args().collect();
+    let mode = authorized_mode(&selector.to_string_lossy(), nonce.as_deref(), &arguments);
+    assert!(
+        mode.is_some(),
+        "should run helper mode only from a fixture-launched exact helper invocation"
+    );
+    let code = mode.map_or(HELPER_SETUP_FAILED, |mode| run_helper(&mode));
+    // SAFETY: `_exit` ends the helper without returning to the harness, so no
+    // harness summary is appended to the captured output.
+    unsafe { libc::_exit(code) }
+}
diff --git a/crates/trusted-server-release/src/process/tests/fixture.rs b/crates/trusted-server-release/src/process/tests/fixture.rs
new file mode 100644
index 0000000000..55b00011d6
--- /dev/null
+++ b/crates/trusted-server-release/src/process/tests/fixture.rs
@@ -0,0 +1,509 @@
+//! Host-independent child fixtures and test-side utilities.
+//!
+//! Helper modes run inside a re-executed test binary (see
+//! [`super::helper_entry`]) using std and libc only. Forked helper children
+//! call only async-signal-safe functions.
+
+use std::io::Read as _;
+use std::process::Command as StdCommand;
+use std::sync::atomic::AtomicU64;
+use std::thread;
+
+use tempfile::TempDir;
+
+use super::*;
+
+/// Environment selector `<mode>:<nonce>`; absent in normal test runs.
+pub(super) const HELPER_SELECTOR: &str = "TS_RELEASE_PROCESS_HELPER";
+/// Environment variable carrying the nonce the selector must match.
+pub(super) const HELPER_NONCE: &str = "TS_RELEASE_PROCESS_NONCE";
+/// Exact libtest name of [`super::helper_entry`].
+pub(super) const HELPER_TEST: &str = "process::tests::helper_entry";
+/// Exit status of a helper whose fork, pipe or pid-file setup failed.
+pub(super) const HELPER_SETUP_FAILED: i32 = 90;
+/// Exit status of an unknown helper mode.
+const HELPER_UNKNOWN_MODE: i32 = 97;
+/// Environment variable naming the directory where helpers record pids.
+pub(super) const HELPER_PIDS: &str = "TS_RELEASE_PROCESS_PIDS";
+/// How long sleeping helpers wait; every supervision bound must stay below it.
+pub(super) const HELPER_SLEEP: Duration = Duration::from_secs(30);
+/// Marks the start of helper stdout after the test harness preamble.
+pub(super) const SENTINEL: &[u8] = b"\x1eTS-PROCESS-HELPER\x1e";
+pub(super) const SECRET: &str = "fixture-secret-value-0451";
+pub(super) const CUT_SECRET: &str = "Qz7-secret-Wq9";
+pub(super) const CUT_PADDING: usize = 100;
+pub(super) const CUT_KEPT: usize = 6;
+pub(super) const OVERLAP_FIRST: &str = "Kq1Vv8Mm";
+pub(super) const OVERLAP_SECOND: &str = "Vv8MmJx3";
+const OVERLAP_TEXT: &str = "Kq1Vv8MmJx3";
+/// Stderr written before any stdout; far above a pipe buffer.
+pub(super) const LARGE_STDERR: usize = 1024 * 1024 + 17;
+/// Headroom for harness startup and scheduling in wall-time assertions.
+pub(super) const SLACK: Duration = Duration::from_secs(10);
+/// Wall deadline for timeout tests; long enough for helpers to record pids.
+pub(super) const TIMEOUT_WALL: Duration = Duration::from_secs(2);
+
+// ---------------------------------------------------------------------------
+// Helper authorization and modes (run inside the re-executed child)
+// ---------------------------------------------------------------------------
+
+/// Returns the helper mode when the selector, nonce and argv all match a
+/// fixture-launched helper run.
+pub(super) fn authorized_mode(
+    selector: &str,
+    nonce: Option<&str>,
+    arguments: &[String],
+) -> Option<String> {
+    let (mode, selector_nonce) = selector.rsplit_once(':')?;
+    let exact = arguments.iter().any(|argument| argument == "--exact");
+    let filtered = arguments.iter().any(|argument| argument == HELPER_TEST);
+    let matched = nonce.is_some_and(|nonce| !nonce.is_empty() && nonce == selector_nonce);
+    (exact && filtered && matched).then(|| mode.to_owned())
+}
+
+/// Runs helper `mode` and returns its exit status.
+pub(super) fn run_helper(mode: &str) -> i32 {
+    output_mode(mode)
+        .or_else(|| group_mode(mode))
+        .or_else(|| secret_mode(mode))
+        .unwrap_or(HELPER_UNKNOWN_MODE)
+}
+
+/// Modes that only write fixed output and exit.
+fn output_mode(mode: &str) -> Option<i32> {
+    match mode {
+        "print" => {
+            write_stream(1, &[SENTINEL, b"out\nline"].concat());
+            write_stream(2, b"err text");
+            Some(0)
+        }
+        "stderr-then-stdout" => {
+            write_stream(2, &[b'e'; LARGE_STDERR]);
+            write_stream(1, &[SENTINEL, b"small"].concat());
+            Some(0)
+        }
+        "bulk-stderr" => {
+            write_stream(2, &b"abcdefghij".repeat(2000));
+            write_stream(2, b"TAIL");
+            Some(1)
+        }
+        "env" => {
+            let mut lines: Vec<Vec<u8>> = std::env::vars_os()
+                .map(|(name, value)| [name.as_bytes(), b"=", value.as_bytes(), b"\n"].concat())
+                .collect();
+            lines.sort();
+            write_stream(1, &[SENTINEL, &lines.concat()].concat());
+            Some(0)
+        }
+        "cat" => {
+            let mut input = Vec::new();
+            let _ = std::io::stdin().read_to_end(&mut input);
+            write_stream(1, &[SENTINEL, &input, b"|done"].concat());
+            Some(0)
+        }
+        other => other
+            .strip_prefix("exit:")
+            .and_then(|code| code.parse().ok())
+            .inspect(|_| write_stream(2, b"diagnostic detail")),
+    }
+}
+
+/// Modes that shape the process group: sleepers, descendants, floods,
+/// escapes and signals. Pids are recorded before anything else happens.
+fn group_mode(mode: &str) -> Option<i32> {
+    match mode {
+        "raise" => {
+            // SAFETY: raising SIGTERM with its default disposition ends the helper.
+            unsafe {
+                libc::raise(libc::SIGTERM);
+            }
+            Some(0)
+        }
+        "sleep" => {
+            record_pid("leader.pid", own_pid());
+            thread::sleep(HELPER_SLEEP);
+            Some(0)
+        }
+        "linger" => {
+            record_pid("grandchild.pid", fork_paused());
+            Some(0)
+        }
+        "group-sleep" => {
+            record_pid("leader.pid", own_pid());
+            record_pid("grandchild.pid", fork_paused());
+            thread::sleep(HELPER_SLEEP);
+            Some(0)
+        }
+        "flood-both" => {
+            record_pid("grandchild.pid", fork_flood(2));
+            Some(flood(1))
+        }
+        "flood-stderr" => Some(flood(2)),
+        "escape" => {
+            record_pid("escaped.pid", fork_escaped(false));
+            Some(0)
+        }
+        "daemon" => {
+            record_pid("escaped.pid", fork_escaped(true));
+            Some(0)
+        }
+        _ => None,
+    }
+}
+
+/// Modes that echo secret-classified environment values.
+fn secret_mode(mode: &str) -> Option<i32> {
+    match mode {
+        "secret" => {
+            let secret = read_secret();
+            write_stream(2, &[b"leak:", secret.as_slice(), b":"].concat());
+            write_stream(1, &secret);
+            Some(3)
+        }
+        "secret-cut" => {
+            write_stream(
+                2,
+                &[&b"x".repeat(CUT_PADDING), read_secret().as_slice()].concat(),
+            );
+            Some(1)
+        }
+        "overlap" => {
+            write_stream(2, OVERLAP_TEXT.as_bytes());
+            Some(1)
+        }
+        _ => None,
+    }
+}
+
+fn read_secret() -> Vec<u8> {
+    std::env::var_os("TOKEN")
+        .map(|value| value.as_bytes().to_vec())
+        .unwrap_or_default()
+}
+
+fn write_stream(fd: libc::c_int, bytes: &[u8]) {
+    let mut rest = bytes;
+    while !rest.is_empty() {
+        // SAFETY: `rest` is a valid initialized buffer of `rest.len()` bytes.
+        let written = unsafe { libc::write(fd, rest.as_ptr().cast(), rest.len()) };
+        let Ok(written) = usize::try_from(written) else {
+            return;
+        };
+        rest = rest.get(written..).unwrap_or_default();
+    }
+}
+
+/// Writes to `fd` until the write fails, then returns exit status zero.
+fn flood(fd: libc::c_int) -> i32 {
+    let chunk = [b'o'; 4096];
+    loop {
+        // SAFETY: `chunk` is a valid initialized buffer.
+        if unsafe { libc::write(fd, chunk.as_ptr().cast(), chunk.len()) } < 0 {
+            return 0;
+        }
+    }
+}
+
+fn setup_failed() -> ! {
+    // SAFETY: `_exit` is async-signal-safe and ends the helper immediately.
+    unsafe { libc::_exit(HELPER_SETUP_FAILED) }
+}
+
+/// Records `pid`; a pid that could address a process group or every process
+/// (`<= 1`) or an unwritable pid file ends the helper instead.
+fn record_pid(name: &str, pid: libc::pid_t) {
+    if pid <= 1 {
+        setup_failed();
+    }
+    let Some(directory) = std::env::var_os(HELPER_PIDS) else {
+        setup_failed();
+    };
+    if std::fs::write(Path::new(&directory).join(name), pid.to_string()).is_err() {
+        setup_failed();
+    }
+}
+
+fn own_pid() -> libc::pid_t {
+    // SAFETY: `getpid` has no preconditions.
+    unsafe { libc::getpid() }
+}
+
+fn pause_forever() -> ! {
+    loop {
+        // SAFETY: `pause` is async-signal-safe and has no preconditions.
+        unsafe {
+            libc::pause();
+        }
+    }
+}
+
+/// Forks a same-group child that waits until killed.
+fn fork_paused() -> libc::pid_t {
+    // SAFETY: the forked child only calls the async-signal-safe `pause`.
+    let pid = unsafe { libc::fork() };
+    if pid == 0 {
+        pause_forever();
+    }
+    if pid < 0 {
+        setup_failed();
+    }
+    pid
+}
+
+/// Forks a same-group child that floods `fd` until the write fails.
+///
+/// Each 4 KiB write is followed by a 1 ms pause so the flood stays far below
+/// a 64 MiB cap even when the leader is descheduled under parallel tests.
+fn fork_flood(fd: libc::c_int) -> libc::pid_t {
+    // SAFETY: the forked child only calls async-signal-safe `write`,
+    // `nanosleep` and `_exit`.
+    let pid = unsafe { libc::fork() };
+    if pid == 0 {
+        let chunk = [b'e'; 4096];
+        let pause = libc::timespec {
+            tv_sec: 0,
+            tv_nsec: 1_000_000,
+        };
+        loop {
+            // SAFETY: `chunk` and `pause` are valid for the calls' duration.
+            unsafe {
+                if libc::write(fd, chunk.as_ptr().cast(), chunk.len()) < 0 {
+                    libc::_exit(0);
+                }
+                libc::nanosleep(&raw const pause, core::ptr::null_mut());
+            }
+        }
+    }
+    if pid < 0 {
+        setup_failed();
+    }
+    pid
+}
+
+/// Waits for the one-byte readiness signal, retrying `EINTR`.
+fn await_ready(read_end: libc::c_int) {
+    let mut byte = [0_u8; 1];
+    loop {
+        // SAFETY: `read_end` comes from `pipe` and `byte` is writable.
+        let count = unsafe { libc::read(read_end, byte.as_mut_ptr().cast(), 1) };
+        if count == 1 {
+            return;
+        }
+        if count < 0 && std::io::Error::last_os_error().kind() == std::io::ErrorKind::Interrupted {
+            continue;
+        }
+        setup_failed();
+    }
+}
+
+/// Forks a child that calls `setsid()` (leaving the process group) and
+/// optionally closes its stdio, then reports readiness and waits forever.
+fn fork_escaped(close_stdio: bool) -> libc::pid_t {
+    let mut ready = [0 as libc::c_int; 2];
+    // SAFETY: `ready` provides space for the two pipe descriptors.
+    if unsafe { libc::pipe(ready.as_mut_ptr()) } != 0 {
+        setup_failed();
+    }
+    let [read_end, write_end] = ready;
+    // SAFETY: the forked child only calls async-signal-safe functions.
+    let pid = unsafe { libc::fork() };
+    if pid == 0 {
+        // SAFETY: setsid/close/write are async-signal-safe; descriptors are valid.
+        unsafe {
+            libc::setsid();
+            if close_stdio {
+                libc::close(0);
+                libc::close(1);
+                libc::close(2);
+            }
+            libc::write(write_end, b"r".as_ptr().cast(), 1);
+            libc::close(write_end);
+        }
+        pause_forever();
+    }
+    if pid < 0 {
+        setup_failed();
+    }
+    // SAFETY: `write_end` comes from `pipe` above and is no longer needed here.
+    unsafe {
+        libc::close(write_end);
+    }
+    await_ready(read_end);
+    // SAFETY: `read_end` comes from `pipe` above.
+    unsafe {
+        libc::close(read_end);
+    }
+    pid
+}
+
+// ---------------------------------------------------------------------------
+// Test-side utilities (run in the supervising test)
+// ---------------------------------------------------------------------------
+
+pub(super) fn limits(wall: Duration) -> ProcessLimits {
+    ProcessLimits {
+        wall,
+        stdout_max: 1024 * 1024,
+        stderr_max: 1024 * 1024,
+    }
+}
+
+/// Upper bound for a supervised run: its wall deadline, the reap, group and
+/// pipe graces, plus [`SLACK`] for harness startup.
+pub(super) fn supervision_bound(wall: Duration) -> Duration {
+    let bound = wall + KILL_GRACE * 3 + SLACK;
+    assert!(
+        bound < HELPER_SLEEP,
+        "should keep supervision bounds below the helper sleep"
+    );
+    bound
+}
+
+pub(super) fn workspace() -> TempDir {
+    tempfile::tempdir().expect("should create a private test workspace")
+}
+
+pub(super) fn test_binary() -> PathBuf {
+    std::env::current_exe().expect("should locate the test binary")
+}
+
+pub(super) fn harness_arguments() -> Vec<OsString> {
+    ["--exact", HELPER_TEST, "--nocapture", "--test-threads=1"]
+        .into_iter()
+        .map(OsString::from)
+        .collect()
+}
+
+/// Returns a fresh per-launch nonce and the matching `<mode>:<nonce>` selector.
+pub(super) fn helper_selector(mode: &str) -> (String, String) {
+    static COUNTER: AtomicU64 = AtomicU64::new(0);
+    let sequence = COUNTER.fetch_add(1, Ordering::SeqCst);
+    let nanos = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|elapsed| elapsed.as_nanos())
+        .unwrap_or_default();
+    let nonce = format!("{}-{sequence}-{nanos}", std::process::id());
+    let selector = format!("{mode}:{nonce}");
+    (nonce, selector)
+}
+
+/// Builds a bounded re-exec of this test binary in helper `mode`.
+pub(super) fn helper(
+    workspace: &TempDir,
+    mode: &str,
+    process_limits: ProcessLimits,
+) -> BoundedCommand {
+    let (nonce, selector) = helper_selector(mode);
+    BoundedCommand::new(&test_binary(), workspace.path(), process_limits)
+        .expect("should accept an absolute program")
+        .arguments(harness_arguments())
+        .environment(HELPER_SELECTOR, selector)
+        .expect("should accept the helper selector")
+        .environment(HELPER_NONCE, nonce)
+        .expect("should accept the helper nonce")
+        .environment(HELPER_PIDS, workspace.path())
+        .expect("should accept the helper pid directory")
+}
+
+/// Runs this test binary with a helper selector but `arguments` and `nonce`
+/// that a fixture would not use; returns whether the run succeeded.
+pub(super) fn unauthorized_helper_run(arguments: &[&str], nonce: Option<&str>) -> bool {
+    let dir = workspace();
+    let mut command = StdCommand::new(test_binary());
+    command
+        .args(arguments)
+        .env_clear()
+        .env(HELPER_SELECTOR, "print:fixture-nonce")
+        .env(HELPER_PIDS, dir.path())
+        .stdout(Stdio::null())
+        .stderr(Stdio::null());
+    if let Some(nonce) = nonce {
+        command.env(HELPER_NONCE, nonce);
+    }
+    command
+        .status()
+        .expect("should run the test binary")
+        .success()
+}
+
+/// Returns helper stdout after the harness preamble.
+pub(super) fn payload(stdout: &[u8]) -> &[u8] {
+    stdout
+        .windows(SENTINEL.len())
+        .position(|window| window == SENTINEL)
+        .and_then(|start| stdout.get(start + SENTINEL.len()..))
+        .unwrap_or_default()
+}
+
+/// Refuses pids that would address a process group or every process.
+fn assert_single_process(pid: libc::pid_t) {
+    assert!(
+        pid > 1,
+        "should only signal a single fixture pid, got {pid}"
+    );
+}
+
+pub(super) fn read_pid(path: &Path) -> libc::pid_t {
+    let deadline = Instant::now() + SLACK;
+    loop {
+        let text = std::fs::read_to_string(path).unwrap_or_default();
+        if let Ok(pid) = text.trim().parse::<libc::pid_t>() {
+            assert_single_process(pid);
+            return pid;
+        }
+        assert!(
+            Instant::now() < deadline,
+            "should observe a pid written to {}",
+            path.display()
+        );
+        thread::sleep(Duration::from_millis(10));
+    }
+}
+
+/// Returns whether Linux reports `pid` as a zombie (`Z` in `/proc/<pid>/stat`).
+///
+/// Elsewhere there is no `/proc`, the read fails and this returns `false`.
+fn is_zombie(pid: libc::pid_t) -> bool {
+    std::fs::read_to_string(format!("/proc/{pid}/stat"))
+        .ok()
+        .and_then(|stat| {
+            stat.rfind(')')
+                .and_then(|end| stat.get(end + 1..))
+                .map(|rest| rest.trim_start().starts_with('Z'))
+        })
+        .unwrap_or(false)
+}
+
+/// Returns whether `pid` is a live (non-zombie) process.
+pub(super) fn is_alive(pid: libc::pid_t) -> bool {
+    assert_single_process(pid);
+    // SAFETY: `kill` with signal 0 only performs a permission and existence check.
+    let result = unsafe { libc::kill(pid, 0) };
+    let exists = result == 0 || std::io::Error::last_os_error().raw_os_error() != Some(libc::ESRCH);
+    exists && !is_zombie(pid)
+}
+
+/// Waits briefly for an already-killed, reparented pid to disappear.
+pub(super) fn is_dead_soon(pid: libc::pid_t) -> bool {
+    assert_single_process(pid);
+    let deadline = Instant::now() + KILL_GRACE;
+    while is_alive(pid) {
+        if Instant::now() >= deadline {
+            return false;
+        }
+        thread::sleep(Duration::from_millis(10));
+    }
+    true
+}
+
+pub(super) fn force_kill(pid: libc::pid_t) {
+    assert_single_process(pid);
+    // SAFETY: `kill` only reads its integer arguments; `pid` is one fixture process.
+    unsafe {
+        libc::kill(pid, libc::SIGKILL);
+    }
+}
+
+pub(super) fn failure(report: &Report<ReleaseError>) -> Option<&ProcessFailure> {
+    report.downcast_ref::<ProcessFailure>()
+}
diff --git a/crates/trusted-server-release/src/process/tests/outcomes.rs b/crates/trusted-server-release/src/process/tests/outcomes.rs
new file mode 100644
index 0000000000..5a38ccba27
--- /dev/null
+++ b/crates/trusted-server-release/src/process/tests/outcomes.rs
@@ -0,0 +1,237 @@
+//! Outcome classification, output capture, stdin and helper authorization.
+
+use super::*;
+
+#[test]
+fn success_captures_stdout_and_stderr_exactly() {
+    let dir = workspace();
+
+    let result = helper(&dir, "print", limits(SLACK))
+        .run()
+        .expect("should run a successful child");
+
+    assert_eq!(
+        result.outcome(),
+        ProcessOutcome::Exited { code: 0 },
+        "should exit zero"
+    );
+    assert_eq!(
+        payload(result.stdout()),
+        b"out\nline",
+        "should capture stdout exactly"
+    );
+    assert_eq!(
+        result.stderr(),
+        b"err text",
+        "should capture stderr exactly"
+    );
+    assert!(
+        result.elapsed() < SLACK,
+        "should report a bounded elapsed time"
+    );
+    let stdout = result.require_success().expect("should accept exit zero");
+    assert_eq!(payload(&stdout), b"out\nline", "should return stdout");
+}
+
+#[test]
+fn nonzero_exit_reports_code_and_bounded_stderr() {
+    let dir = workspace();
+
+    let result = helper(&dir, "exit:7", limits(SLACK))
+        .run()
+        .expect("should run a failing child");
+
+    assert_eq!(
+        result.outcome(),
+        ProcessOutcome::Exited { code: 7 },
+        "should report the exit code"
+    );
+    let report = result
+        .require_success()
+        .expect_err("should reject a nonzero exit");
+    let text = format!("{report:?}");
+    assert!(
+        text.contains("diagnostic detail"),
+        "should include the stderr excerpt: {text}"
+    );
+    assert!(
+        matches!(failure(&report), Some(ProcessFailure::Unsuccessful)),
+        "should classify the failure as unsuccessful"
+    );
+}
+
+#[test]
+fn stderr_excerpt_is_bounded() {
+    let dir = workspace();
+
+    let report = helper(&dir, "bulk-stderr", limits(SLACK))
+        .run()
+        .expect("should run a failing child")
+        .require_success()
+        .expect_err("should reject a nonzero exit");
+    let text = format!("{report:?}");
+
+    assert!(text.contains("TAIL"), "should keep the stderr tail: {text}");
+    assert!(
+        text.len() < 20_000 / 2,
+        "should bound the excerpt well below the captured stderr"
+    );
+}
+
+#[test]
+fn large_stderr_before_stdout_drains_concurrently() {
+    let dir = workspace();
+    let process_limits = ProcessLimits {
+        wall: SLACK,
+        stdout_max: 1024 * 1024,
+        stderr_max: 4 * 1024 * 1024,
+    };
+
+    let result = helper(&dir, "stderr-then-stdout", process_limits)
+        .run()
+        .expect("should run a child that fills stderr first");
+
+    assert_eq!(
+        result.outcome(),
+        ProcessOutcome::Exited { code: 0 },
+        "should exit zero without blocking on a full stderr pipe"
+    );
+    assert_eq!(
+        result.stderr().len(),
+        LARGE_STDERR,
+        "should capture every stderr byte"
+    );
+    assert_eq!(payload(result.stdout()), b"small", "should capture stdout");
+}
+
+#[test]
+fn signaled_child_reports_signal() {
+    let dir = workspace();
+
+    let result = helper(&dir, "raise", limits(SLACK))
+        .run()
+        .expect("should run a signaled child");
+
+    assert_eq!(
+        result.outcome(),
+        ProcessOutcome::Signaled {
+            signal: libc::SIGTERM
+        },
+        "should report the terminating signal"
+    );
+    assert!(
+        result.require_success().is_err(),
+        "should reject a signaled child"
+    );
+}
+
+#[test]
+fn nonexistent_program_reports_real_errno() {
+    let dir = workspace();
+    let missing = PathBuf::from("/nonexistent-trusted-server-release/fixture-tool");
+    let command = BoundedCommand::new(&missing, dir.path(), limits(SLACK))
+        .expect("should accept an absolute program");
+
+    let report = command.run().expect_err("should fail to spawn");
+
+    assert!(
+        matches!(
+            failure(&report),
+            Some(ProcessFailure::Spawn {
+                errno: Some(libc::ENOENT)
+            })
+        ),
+        "should record ENOENT: {report:?}"
+    );
+    assert!(
+        format!("{report:?}").contains(&format!("os error {}", libc::ENOENT)),
+        "should carry the operating system error text"
+    );
+}
+
+#[test]
+fn bounded_stdin_reaches_child() {
+    let dir = workspace();
+    let command = helper(&dir, "cat", limits(SLACK)).stdin_bytes(b"from stdin".to_vec());
+
+    let stdout = command
+        .run()
+        .expect("should run the cat helper")
+        .require_success()
+        .expect("should exit zero");
+
+    assert_eq!(
+        payload(&stdout),
+        b"from stdin|done",
+        "should deliver stdin bytes"
+    );
+}
+
+#[test]
+fn default_stdin_is_null() {
+    let dir = workspace();
+
+    let stdout = helper(&dir, "cat", limits(SLACK))
+        .run()
+        .expect("should run the cat helper")
+        .require_success()
+        .expect("should exit zero");
+
+    assert_eq!(
+        payload(&stdout),
+        b"|done",
+        "should read EOF from null stdin"
+    );
+}
+
+#[test]
+fn helper_selector_without_fixture_invocation_fails_the_run() {
+    assert!(
+        !unauthorized_helper_run(&[HELPER_TEST, "--test-threads=1"], Some("fixture-nonce")),
+        "should fail a non-exact filter run that carries a selector"
+    );
+    assert!(
+        !unauthorized_helper_run(
+            &["--exact", HELPER_TEST, "--test-threads=1"],
+            Some("other-nonce")
+        ),
+        "should fail an exact run whose nonce does not match"
+    );
+    assert!(
+        !unauthorized_helper_run(&["--exact", HELPER_TEST, "--test-threads=1"], None),
+        "should fail an exact run without a nonce"
+    );
+}
+
+#[test]
+fn helper_authorization_requires_exact_filter_and_nonce() {
+    let fixture: Vec<String> = ["binary", "--exact", HELPER_TEST]
+        .into_iter()
+        .map(str::to_owned)
+        .collect();
+    let loose: Vec<String> = ["binary", HELPER_TEST]
+        .into_iter()
+        .map(str::to_owned)
+        .collect();
+
+    assert_eq!(
+        authorized_mode("print:n1", Some("n1"), &fixture),
+        Some("print".to_owned()),
+        "should authorize a fixture invocation"
+    );
+    assert_eq!(
+        authorized_mode("print", Some("n1"), &fixture),
+        None,
+        "should reject a selector without a nonce"
+    );
+    assert_eq!(
+        authorized_mode("print:n1", Some(""), &fixture),
+        None,
+        "should reject an empty nonce"
+    );
+    assert_eq!(
+        authorized_mode("print:n1", Some("n1"), &loose),
+        None,
+        "should reject a non-exact filter"
+    );
+}
diff --git a/crates/trusted-server-release/src/process/tests/redaction.rs b/crates/trusted-server-release/src/process/tests/redaction.rs
new file mode 100644
index 0000000000..287b516b61
--- /dev/null
+++ b/crates/trusted-server-release/src/process/tests/redaction.rs
@@ -0,0 +1,171 @@
+//! Secret redaction in Debug output and failure excerpts.
+
+use super::*;
+
+#[test]
+fn secret_values_never_appear_in_debug_or_error_text() {
+    let dir = workspace();
+    let command = helper(&dir, "secret", limits(SLACK))
+        .secret_environment("TOKEN", SECRET)
+        .expect("should accept a secret variable");
+
+    let command_text = format!("{command:?}");
+    let result = command.run().expect("should run the child");
+    let result_text = format!("{result:?}");
+    let report = result
+        .require_success()
+        .expect_err("should reject a nonzero exit");
+    let report_text = format!("{report:?}");
+
+    assert!(
+        command_text.contains("TOKEN"),
+        "should still name the secret variable"
+    );
+    for text in [&command_text, &result_text, &report_text] {
+        assert!(!text.contains(SECRET), "should redact the secret value");
+    }
+    assert!(
+        report_text.contains("leak:[REDACTED]:"),
+        "should mark the redacted stderr span: {report_text}"
+    );
+}
+
+#[test]
+fn secret_cut_at_stderr_cap_is_redacted() {
+    let dir = workspace();
+    let process_limits = ProcessLimits {
+        wall: SLACK,
+        stdout_max: 1024,
+        stderr_max: u64::try_from(CUT_PADDING + CUT_KEPT).expect("should fit in u64"),
+    };
+    let command = helper(&dir, "secret-cut", process_limits)
+        .secret_environment("TOKEN", CUT_SECRET)
+        .expect("should accept a secret variable");
+
+    let result = command.run().expect("should run the child");
+    assert_eq!(
+        result.outcome(),
+        ProcessOutcome::OutputLimit {
+            stream: Stream::Stderr
+        },
+        "should cut stderr at its cap"
+    );
+    let report = result
+        .require_success()
+        .expect_err("should reject a capped run");
+    let text = format!("{report:?}");
+
+    let kept = CUT_SECRET
+        .get(..CUT_KEPT)
+        .expect("should slice the fixture");
+    assert!(
+        !text.contains(kept),
+        "should redact a secret prefix cut by the cap: {text}"
+    );
+    assert!(text.contains("[REDACTED]"), "should mark the cut: {text}");
+}
+
+#[test]
+fn cut_tail_redaction_follows_actual_stderr_truncation() {
+    let secrets = vec![CUT_SECRET.as_bytes().to_vec()];
+    let result = |outcome, stderr_truncated| ProcessResult {
+        program: PathBuf::from("/fixture/tool"),
+        outcome,
+        stdout: Vec::new(),
+        stderr: b"exit 1: Q".to_vec(),
+        stderr_truncated,
+        elapsed: Duration::ZERO,
+        secrets: secrets.clone(),
+    };
+    let text = |result: ProcessResult| {
+        format!(
+            "{:?}",
+            result
+                .require_success()
+                .expect_err("should reject an unsuccessful run")
+        )
+    };
+
+    let complete = text(result(ProcessOutcome::Exited { code: 1 }, false));
+    let stderr_capped = text(result(
+        ProcessOutcome::OutputLimit {
+            stream: Stream::Stderr,
+        },
+        true,
+    ));
+    // Stdout overflowed first, but stderr was also cut mid-secret.
+    let both_capped = text(result(
+        ProcessOutcome::OutputLimit {
+            stream: Stream::Stdout,
+        },
+        true,
+    ));
+    let stdout_only = text(result(
+        ProcessOutcome::OutputLimit {
+            stream: Stream::Stdout,
+        },
+        false,
+    ));
+
+    for untouched in [&complete, &stdout_only] {
+        assert!(
+            untouched.contains("exit 1: Q") && !untouched.contains("[REDACTED]"),
+            "should leave untruncated stderr untouched: {untouched}"
+        );
+    }
+    for redacted in [&stderr_capped, &both_capped] {
+        assert!(
+            redacted.contains("exit 1: [REDACTED]"),
+            "should redact a possible secret prefix at a stderr cut: {redacted}"
+        );
+    }
+}
+
+#[test]
+fn overlapping_secrets_are_fully_redacted() {
+    let dir = workspace();
+    let command = helper(&dir, "overlap", limits(SLACK))
+        .secret_environment("FIRST", OVERLAP_FIRST)
+        .expect("should accept a secret variable")
+        .secret_environment("SECOND", OVERLAP_SECOND)
+        .expect("should accept a secret variable");
+
+    let report = command
+        .run()
+        .expect("should run the child")
+        .require_success()
+        .expect_err("should reject a nonzero exit");
+    let text = format!("{report:?}");
+
+    for fragment in ["Kq1", "Vv8", "Jx3"] {
+        assert!(
+            !text.contains(fragment),
+            "should redact every byte of overlapping secrets: {text}"
+        );
+    }
+}
+
+#[test]
+fn redaction_merges_overlapping_ranges() {
+    let secrets = vec![b"abcXYZ".to_vec(), b"XYZdef".to_vec()];
+
+    assert_eq!(
+        redact(b"<abcXYZdef>", &secrets),
+        b"<[REDACTED]>".to_vec(),
+        "should replace the merged span once"
+    );
+}
+
+#[test]
+fn debug_redacts_program_and_working_directory() {
+    let program = PathBuf::from(format!("/fixture/{SECRET}/tool"));
+    let working_directory = PathBuf::from(format!("/fixture/{SECRET}"));
+    let command = BoundedCommand::new(&program, &working_directory, limits(SLACK))
+        .expect("should accept absolute paths")
+        .secret_environment("TOKEN", SECRET)
+        .expect("should accept a secret variable");
+
+    let text = format!("{command:?}");
+
+    assert!(!text.contains(SECRET), "should redact paths");
+}
diff --git a/crates/trusted-server-release/src/process/tests/supervision.rs b/crates/trusted-server-release/src/process/tests/supervision.rs
new file mode 100644
index 0000000000..a6c6657694
--- /dev/null
+++ b/crates/trusted-server-release/src/process/tests/supervision.rs
@@ -0,0 +1,298 @@
+//! Group kill, reaping, deadlines, cancellation, caps and escapes.
+
+use super::*;
+
+#[test]
+fn timeout_kills_and_reaps_leader() {
+    let dir = workspace();
+    let started = Instant::now();
+
+    let result = helper(&dir, "sleep", limits(TIMEOUT_WALL))
+        .run()
+        .expect("should supervise a timed-out child");
+
+    assert_eq!(
+        result.outcome(),
+        ProcessOutcome::TimedOut,
+        "should report a timeout outcome rather than an errno"
+    );
+    assert!(
+        started.elapsed() < supervision_bound(TIMEOUT_WALL),
+        "should stop within the wall deadline plus the kill graces"
+    );
+    let leader = read_pid(&dir.path().join("leader.pid"));
+    assert!(!is_alive(leader), "should reap the leader");
+    let report = result
+        .require_success()
+        .expect_err("should reject a timeout");
+    assert_eq!(
+        failure(&report),
+        Some(&ProcessFailure::Unsuccessful),
+        "should classify a timeout as an errno-free unsuccessful outcome"
+    );
+}
+
+#[test]
+fn normal_exit_kills_lingering_group_descendant() {
+    let dir = workspace();
+
+    let result = helper(&dir, "linger", limits(SLACK))
+        .run()
+        .expect("should run a child with a descendant");
+
+    assert_eq!(
+        result.outcome(),
+        ProcessOutcome::Exited { code: 0 },
+        "should report the leader exit"
+    );
+    let grandchild = read_pid(&dir.path().join("grandchild.pid"));
+    assert!(
+        is_dead_soon(grandchild),
+        "should kill the same-group grandchild"
+    );
+}
+
+#[test]
+fn timeout_kills_leader_and_grandchild() {
+    let dir = workspace();
+
+    let result = helper(&dir, "group-sleep", limits(TIMEOUT_WALL))
+        .run()
+        .expect("should supervise a timed-out group");
+
+    assert_eq!(
+        result.outcome(),
+        ProcessOutcome::TimedOut,
+        "should report a timeout"
+    );
+    assert!(
+        !is_alive(read_pid(&dir.path().join("leader.pid"))),
+        "should reap the leader"
+    );
+    assert!(
+        is_dead_soon(read_pid(&dir.path().join("grandchild.pid"))),
+        "should kill the grandchild"
+    );
+}
+
+#[test]
+fn stdout_cap_with_stderr_flood_does_not_deadlock() {
+    let dir = workspace();
+    let process_limits = ProcessLimits {
+        wall: SLACK * 3,
+        stdout_max: 64 * 1024,
+        stderr_max: 64 * 1024 * 1024,
+    };
+    let started = Instant::now();
+
+    let result = helper(&dir, "flood-both", process_limits)
+        .run()
+        .expect("should supervise a flooding child");
+
+    assert_eq!(
+        result.outcome(),
+        ProcessOutcome::OutputLimit {
+            stream: Stream::Stdout
+        },
+        "should report the stdout cap"
+    );
+    assert!(
+        result.stdout().len() <= 64 * 1024,
+        "should keep stdout within its cap"
+    );
+    assert!(
+        started.elapsed() < supervision_bound(Duration::ZERO),
+        "should stop at the cap, well before the wall deadline"
+    );
+    assert!(
+        is_dead_soon(read_pid(&dir.path().join("grandchild.pid"))),
+        "should kill the flooding grandchild"
+    );
+}
+
+#[test]
+fn stderr_cap_reports_stderr() {
+    let dir = workspace();
+    let process_limits = ProcessLimits {
+        wall: SLACK,
+        stdout_max: 1024 * 1024,
+        stderr_max: 4096,
+    };
+
+    let result = helper(&dir, "flood-stderr", process_limits)
+        .run()
+        .expect("should supervise a flooding child");
+
+    assert_eq!(
+        result.outcome(),
+        ProcessOutcome::OutputLimit {
+            stream: Stream::Stderr
+        },
+        "should report the stderr cap"
+    );
+    assert!(
+        result.stderr().len() <= 4096,
+        "should keep stderr within its cap"
+    );
+}
+
+#[test]
+fn cancellation_from_another_thread_stops_group() {
+    let dir = workspace();
+    let cancellation = Cancellation::default();
+    let command = helper(&dir, "group-sleep", limits(SLACK * 3)).cancellation(cancellation.clone());
+    let grandchild_file = dir.path().join("grandchild.pid");
+    let canceller = thread::spawn(move || {
+        let grandchild = read_pid(&grandchild_file);
+        cancellation.cancel();
+        grandchild
+    });
+    let started = Instant::now();
+
+    let result = command.run().expect("should supervise a cancelled child");
+    let grandchild = canceller.join().expect("should join the cancelling thread");
+
+    assert_eq!(
+        result.outcome(),
+        ProcessOutcome::Cancelled,
+        "should report cancellation"
+    );
+    assert!(
+        started.elapsed() < supervision_bound(Duration::ZERO),
+        "should stop promptly after cancellation"
+    );
+    assert!(
+        is_dead_soon(grandchild),
+        "should kill the grandchild on cancellation"
+    );
+}
+
+#[test]
+fn cancellation_before_spawn_starts_nothing() {
+    let dir = workspace();
+    let cancellation = Cancellation::default();
+    cancellation.cancel();
+
+    let result = helper(&dir, "sleep", limits(SLACK))
+        .cancellation(cancellation)
+        .run()
+        .expect("should report a pre-cancelled run");
+
+    assert_eq!(
+        result.outcome(),
+        ProcessOutcome::Cancelled,
+        "should report cancellation"
+    );
+    assert!(
+        !dir.path().join("leader.pid").exists(),
+        "should not spawn a child after cancellation"
+    );
+}
+
+#[test]
+fn escaped_descendant_holding_pipes_is_reported() {
+    let dir = workspace();
+    let started = Instant::now();
+
+    let report = helper(&dir, "escape", limits(SLACK))
+        .run()
+        .expect_err("should reject output held by an escaped descendant");
+    let elapsed = started.elapsed();
+    let escaped = read_pid(&dir.path().join("escaped.pid"));
+    force_kill(escaped);
+
+    assert!(
+        matches!(failure(&report), Some(ProcessFailure::DescendantEscaped)),
+        "should classify the escape: {report:?}"
+    );
+    assert!(
+        elapsed < supervision_bound(Duration::ZERO),
+        "should give up within the bounded drain grace"
+    );
+}
+
+/// Documents a residual this module cannot close: a `setsid()` daemon with
+/// closed stdio leaves no observable trace for the supervisor. The Task 7 OS
+/// boundary (container PID namespace, macOS sandbox) must contain it.
+#[test]
+fn closed_stdio_daemon_escape_is_not_detected_here() {
+    let dir = workspace();
+
+    let result = helper(&dir, "daemon", limits(SLACK))
+        .run()
+        .expect("should not observe a daemon that closed its stdio");
+    let daemon = read_pid(&dir.path().join("escaped.pid"));
+    let survived = is_alive(daemon);
+    force_kill(daemon);
+
+    assert_eq!(
+        result.outcome(),
+        ProcessOutcome::Exited { code: 0 },
+        "should report only the leader exit"
+    );
+    assert!(
+        survived,
+        "should leave the escaped daemon to the OS boundary (documented residual)"
+    );
+}
+
+#[test]
+fn reaping_is_bounded_and_never_blocks() {
+    let dir = workspace();
+    let (nonce, selector) = helper_selector("sleep");
+    let mut child = StdCommand::new(test_binary())
+        .args(harness_arguments())
+        .env_clear()
+        .env(HELPER_SELECTOR, selector)
+        .env(HELPER_NONCE, nonce)
+        .env(HELPER_PIDS, dir.path())
+        .stdout(Stdio::null())
+        .stderr(Stdio::null())
+        .spawn()
+        .expect("should spawn an unsignalled helper");
+    let started = Instant::now();
+
+    let reaped = reap_within(&mut child, Duration::from_millis(200));
+    let elapsed = started.elapsed();
+    let _ = child.kill();
+    let _ = child.wait();
+
+    assert!(
+        matches!(reaped, Ok(None)),
+        "should report an unreaped leader instead of waiting"
+    );
+    assert!(
+        elapsed < KILL_GRACE,
+        "should return after the bounded grace"
+    );
+}
+
+#[test]
+fn unreaped_leader_failure_keeps_real_errno() {
+    let refused = io::Error::from_raw_os_error(libc::EPERM);
+
+    assert_eq!(
+        unreaped_failure(Some(&refused)),
+        ProcessFailure::Signal {
+            errno: Some(libc::EPERM)
+        },
+        "should carry the real killpg errno"
+    );
+    assert_eq!(
+        unreaped_failure(None),
+        ProcessFailure::GroupSurvived,
+        "should report survival when signalling succeeded"
+    );
+}
+
+#[test]
+fn group_signal_refuses_init_and_broadcast_ids() {
+    // Only pgid 1 is probed: 0 and -1 would address this runner or every process.
+    let refused = signal_group(1).expect_err("should refuse process group 1");
+
+    assert_eq!(
+        refused.raw_os_error(),
+        None,
+        "should refuse before calling killpg, without a synthesized errno"
+    );
+}
diff --git a/crates/trusted-server-release/src/process/tests/variables.rs b/crates/trusted-server-release/src/process/tests/variables.rs
new file mode 100644
index 0000000000..6b38da4b50
--- /dev/null
+++ b/crates/trusted-server-release/src/process/tests/variables.rs
@@ -0,0 +1,231 @@
+//! Command and environment validation.
+
+use super::*;
+
+/// Names that inject code or configuration; rejected even as secrets.
+const INJECTION_NAMES: [&str; 54] = [
+    "LD_PRELOAD",
+    "LD_LIBRARY_PATH",
+    "LD_AUDIT",
+    "LD_ANYTHING",
+    "DYLD_INSERT_LIBRARIES",
+    "dyld_insert_libraries",
+    "NODE_OPTIONS",
+    "BASH_ENV",
+    "ENV",
+    "GCONV_PATH",
+    "GIT_CONFIG_PARAMETERS",
+    "GIT_CONFIG_COUNT",
+    "GIT_CONFIG_KEY_0",
+    "GIT_CONFIG_VALUE_0",
+    "GIT_EXEC_PATH",
+    "GIT_SSH_COMMAND",
+    "GIT_SSH",
+    "npm_config_registry",
+    "NPM_CONFIG_REGISTRY",
+    "PYTHONPATH",
+    "PYTHONSTARTUP",
+    "PERL5OPT",
+    "PERL5LIB",
+    "RUBYOPT",
+    "RUBYLIB",
+    "GIT_CONFIG_GLOBAL",
+    "GIT_CONFIG_SYSTEM",
+    "GIT_CONFIG",
+    "GIT_ASKPASS",
+    "SSH_ASKPASS",
+    "GIT_PROXY_COMMAND",
+    "GIT_EXTERNAL_DIFF",
+    "GIT_EDITOR",
+    "EDITOR",
+    "VISUAL",
+    "GIT_PAGER",
+    "PAGER",
+    "GIT_TEMPLATE_DIR",
+    "RUSTC_WRAPPER",
+    "RUSTC_WORKSPACE_WRAPPER",
+    "CARGO_BUILD_RUSTC_WRAPPER",
+    "CARGO_BUILD_RUSTC_WORKSPACE_WRAPPER",
+    "CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUNNER",
+    "CARGO_TARGET_AARCH64_APPLE_DARWIN_LINKER",
+    "RUSTC",
+    "RUSTDOC",
+    "RUSTFLAGS",
+    "CARGO_ENCODED_RUSTFLAGS",
+    "CARGO_BUILD_RUSTC",
+    "CARGO_BUILD_RUSTDOC",
+    "CARGO_BUILD_RUSTFLAGS",
+    "NODE_PATH",
+    "JAVA_TOOL_OPTIONS",
+    "_JAVA_OPTIONS",
+];
+
+/// Credential names accepted only through `secret_environment`.
+const CREDENTIAL_NAMES: [&str; 12] = [
+    "GH_TOKEN",
+    "GITHUB_TOKEN",
+    "NPM_TOKEN",
+    "NODE_AUTH_TOKEN",
+    "ACTIONS_ID_TOKEN_REQUEST_TOKEN",
+    "ACTIONS_RUNTIME_TOKEN",
+    "AWS_SECRET_ACCESS_KEY",
+    "FASTLY_API_TOKEN",
+    "github_token",
+    "CARGO_REGISTRY_TOKEN",
+    "CARGO_REGISTRIES_EXAMPLE_TOKEN",
+    "SIGSTORE_ID_TOKEN",
+];
+
+#[test]
+fn relative_program_is_rejected() {
+    let dir = workspace();
+
+    let report = BoundedCommand::new(Path::new("helper"), dir.path(), limits(SLACK))
+        .expect_err("should reject a relative program path");
+
+    assert!(
+        matches!(failure(&report), Some(ProcessFailure::InvalidCommand)),
+        "should classify an invalid command"
+    );
+}
+
+#[test]
+fn relative_working_directory_is_rejected() {
+    let report = BoundedCommand::new(&test_binary(), Path::new("relative"), limits(SLACK))
+        .expect_err("should reject a relative working directory");
+
+    assert!(
+        matches!(failure(&report), Some(ProcessFailure::InvalidCommand)),
+        "should classify an invalid command"
+    );
+}
+
+#[test]
+fn environment_is_exactly_the_explicit_map() {
+    let dir = workspace();
+    let command = helper(&dir, "env", limits(SLACK))
+        .environment("ALPHA", "1")
+        .expect("should accept a plain variable")
+        .environment("BETA", "two words")
+        .expect("should accept a plain variable");
+
+    let stdout = command
+        .run()
+        .expect("should run the env helper")
+        .require_success()
+        .expect("should exit zero");
+
+    let text = String::from_utf8(payload(&stdout).to_vec()).expect("should print UTF-8");
+    let names: Vec<&str> = text
+        .lines()
+        .filter_map(|line| line.split_once('=').map(|(name, _)| name))
+        .collect();
+    assert_eq!(
+        names,
+        vec!["ALPHA", "BETA", HELPER_SELECTOR, HELPER_NONCE, HELPER_PIDS],
+        "should pass exactly the explicit environment"
+    );
+    assert!(
+        text.contains("ALPHA=1\nBETA=two words\n"),
+        "should pass explicit values: {text}"
+    );
+}
+
+#[test]
+fn injection_variables_are_rejected() {
+    let dir = workspace();
+    for name in INJECTION_NAMES {
+        let plain = BoundedCommand::new(&test_binary(), dir.path(), limits(SLACK))
+            .expect("should accept an absolute program")
+            .environment(name, "/tmp/fixture.so")
+            .expect_err("should reject an injection variable");
+        assert!(
+            matches!(failure(&plain), Some(ProcessFailure::InvalidCommand)),
+            "should classify {name} as an invalid command"
+        );
+        assert!(
+            !format!("{plain:?}").contains("/tmp/fixture.so"),
+            "should not echo the rejected value"
+        );
+        let secret = BoundedCommand::new(&test_binary(), dir.path(), limits(SLACK))
+            .expect("should accept an absolute program")
+            .secret_environment(name, "/tmp/fixture.so");
+        assert!(
+            secret.is_err(),
+            "should reject {name} as a secret variable too"
+        );
+    }
+}
+
+#[test]
+fn credentials_require_secret_classification() {
+    let dir = workspace();
+    for name in CREDENTIAL_NAMES {
+        let plain = BoundedCommand::new(&test_binary(), dir.path(), limits(SLACK))
+            .expect("should accept an absolute program")
+            .environment(name, "credential");
+        assert!(
+            plain.is_err(),
+            "should refuse {name} through the plain environment"
+        );
+        let secret = BoundedCommand::new(&test_binary(), dir.path(), limits(SLACK))
+            .expect("should accept an absolute program")
+            .secret_environment(name, "credential");
+        assert!(secret.is_ok(), "should accept {name} as a secret variable");
+    }
+}
+
+#[test]
+fn malformed_environment_names_are_rejected() {
+    let dir = workspace();
+    for name in ["", "A=B", "NUL\0NAME"] {
+        let command = BoundedCommand::new(&test_binary(), dir.path(), limits(SLACK))
+            .expect("should accept an absolute program");
+        assert!(
+            command.environment(name, "value").is_err(),
+            "should reject environment name {name:?}"
+        );
+    }
+}
+
+#[test]
+fn harmless_names_are_accepted() {
+    let dir = workspace();
+    for name in ["CARGO_TARGET_DIR", "CARGO_HOME", "LANG", "HOME", "TZ"] {
+        let command = BoundedCommand::new(&test_binary(), dir.path(), limits(SLACK))
+            .expect("should accept an absolute program");
+        assert!(
+            command.environment(name, "value").is_ok(),
+            "should accept {name}"
+        );
+    }
+}
+
+#[test]
+fn aws_lc_sys_build_switches_are_plain_variables() {
+    let dir = workspace();
+    for name in [
+        "AWS_LC_SYS_USE_SYSTEM",
+        "AWS_LC_SYS_USE_SYSTEM_aarch64_apple_darwin",
+    ] {
+        let plain = BoundedCommand::new(&test_binary(), dir.path(), limits(SLACK))
+            .expect("should accept an absolute program")
+            .environment(name, "0");
+        assert!(plain.is_ok(), "should accept {name} as a plain variable");
+    }
+    for name in [
+        "AWS_SECRET_ACCESS_KEY",
+        "AWS_LC_SYS_OTHER",
+        "AWS_LC_SYS_USE_SYSTEM_",
+        "AWS_LC_SYS_USE_SYSTEMX",
+        "AWS_LC_SYS_USE_SYSTEM_x86-64",
+    ] {
+        let credential = BoundedCommand::new(&test_binary(), dir.path(), limits(SLACK))
+            .expect("should accept an absolute program")
+            .environment(name, "fictional");
+        assert!(
+            credential.is_err(),
+            "should still refuse {name} as a plain variable"
+        );
+    }
+}
diff --git a/crates/trusted-server-release/src/publication.rs b/crates/trusted-server-release/src/publication.rs
new file mode 100644
index 0000000000..3ac1ac602d
--- /dev/null
+++ b/crates/trusted-server-release/src/publication.rs
@@ -0,0 +1,57 @@
+//! Sole-owner immutable release publication state machine.
+//!
+//! Publication remains closed. This module has no HTTP adapter, workflow,
+//! token acquisition or command: it drives an abstract [`api::ReleaseApi`] so
+//! every draft, upload, publish, reconciliation and incident path is exercised
+//! against an in-process fake.
+//!
+//! The owner is tag scoped and never cancelled
+//! ([`model::ConcurrencyPolicy`]). It creates or resumes exactly one matching
+//! draft, uploads only absent assets, re-downloads and validates the exact
+//! asset set, publishes, then requires `immutable == true` and a release
+//! statement whose membership equals the intended set. Published releases and
+//! tags are never overwritten. A lost mutation response is followed by a
+//! read-only reconciliation before any other mutation. A confirmed mutable
+//! release fails publication and is removed only under
+//! [`role::CleanupAuthority`]; an immutable or unknown-state release is never
+//! deleted.
+//!
+//! # Explicit recovery gap
+//!
+//! The owner never repairs a draft. A lost upload response can leave a
+//! partial or altered asset; reconciliation then refuses with "explicit
+//! recovery is required", as it does for a conflicting draft, extra asset,
+//! multiple drafts or a tag at another commit. No automated recovery exists:
+//! the release runbook must cover inspecting the unpublished draft, deleting
+//! the offending draft asset or draft by hand under maintainer authority, and
+//! rerunning publication.
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256};
+
+use crate::error::ReleaseError;
+
+pub(crate) mod api;
+pub(crate) mod incident;
+pub(crate) mod model;
+mod owner;
+pub(crate) mod role;
+#[cfg(test)]
+mod tests;
+
+#[cfg_attr(
+    not(test),
+    expect(
+        unused_imports,
+        reason = "publication remains closed: only the fake-API tests call it"
+    )
+)]
+pub(crate) use owner::publish;
+
+fn rejected(message: impl Into<String>) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Publication).attach(message.into())
+}
+
+fn sha256_hex(bytes: &[u8]) -> String {
+    hex::encode(Sha256::digest(bytes))
+}
diff --git a/crates/trusted-server-release/src/publication/api.rs b/crates/trusted-server-release/src/publication/api.rs
new file mode 100644
index 0000000000..d0e68d2dff
--- /dev/null
+++ b/crates/trusted-server-release/src/publication/api.rs
@@ -0,0 +1,179 @@
+//! The abstract releases API the publication owner drives.
+
+use super::model::ReleaseTag;
+use super::role::{CleanupAuthority, ContentsWrite};
+use crate::source::CommitId;
+
+/// A GitHub release numeric ID.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
+pub(crate) struct ReleaseId(pub(crate) u64);
+
+/// One asset as reported by the releases API (not trusted for bytes).
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct ObservedAsset {
+    /// Asset numeric ID; a replaced asset gets a new ID.
+    pub(crate) id: u64,
+    /// Asset name.
+    pub(crate) name: String,
+    /// Reported size in bytes.
+    pub(crate) size: u64,
+    /// Reported lowercase hex SHA-256, when the API provides one.
+    pub(crate) sha256: Option<String>,
+}
+
+/// A release as reported by the releases API.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct ObservedRelease {
+    /// Release ID.
+    pub(crate) id: ReleaseId,
+    /// Release tag name.
+    pub(crate) tag: String,
+    /// Target commit.
+    pub(crate) target_commit: String,
+    /// Whether the release is still a draft.
+    pub(crate) draft: bool,
+    /// Reported immutability; `None` when absent or unreadable.
+    pub(crate) immutable: Option<bool>,
+    /// Attached assets.
+    pub(crate) assets: Vec<ObservedAsset>,
+}
+
+/// One signed subject of the GitHub release statement.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct StatementSubject {
+    /// Asset name.
+    pub(crate) name: String,
+    /// Lowercase hex SHA-256.
+    pub(crate) sha256: String,
+}
+
+/// The verified GitHub release statement for a tag.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct ReleaseStatement {
+    /// Signed tag.
+    pub(crate) tag: String,
+    /// Signed target commit.
+    pub(crate) commit: String,
+    /// Signed asset membership.
+    pub(crate) subjects: Vec<StatementSubject>,
+}
+
+/// A releases API failure.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum ApiFailure {
+    /// The API answered with a definite rejection status.
+    Rejected {
+        /// HTTP status.
+        status: u16,
+    },
+    /// The outcome is unknown (lost response, timeout or unreadable state).
+    Indeterminate,
+}
+
+/// The releases API operations available to the publication owner.
+///
+/// Every call requires [`ContentsWrite`]; deletion additionally requires
+/// [`CleanupAuthority`]. No real adapter exists while publication is closed.
+pub(crate) trait ReleaseApi {
+    /// Lists every release (draft or published) for `tag`.
+    ///
+    /// # Errors
+    ///
+    /// Returns an [`ApiFailure`] when the listing is rejected or unknown.
+    fn releases_for_tag(
+        &mut self,
+        authority: &ContentsWrite,
+        tag: &ReleaseTag,
+    ) -> Result<Vec<ObservedRelease>, ApiFailure>;
+
+    /// Reads one release; `None` when it does not exist.
+    ///
+    /// # Errors
+    ///
+    /// Returns an [`ApiFailure`] when the read is rejected or unknown.
+    fn release(
+        &mut self,
+        authority: &ContentsWrite,
+        id: ReleaseId,
+    ) -> Result<Option<ObservedRelease>, ApiFailure>;
+
+    /// Reads the commit the git tag `tag` points at; `None` when no tag exists.
+    ///
+    /// # Errors
+    ///
+    /// Returns an [`ApiFailure`] when the read is rejected or unknown.
+    fn tag_ref(
+        &mut self,
+        authority: &ContentsWrite,
+        tag: &ReleaseTag,
+    ) -> Result<Option<CommitId>, ApiFailure>;
+
+    /// Creates a draft for `tag` targeting `commit`.
+    ///
+    /// # Errors
+    ///
+    /// Returns an [`ApiFailure`] when creation is rejected or unknown.
+    fn create_draft(
+        &mut self,
+        authority: &ContentsWrite,
+        tag: &ReleaseTag,
+        commit: &CommitId,
+    ) -> Result<ReleaseId, ApiFailure>;
+
+    /// Uploads a new asset to a draft; never replaces an existing asset.
+    ///
+    /// # Errors
+    ///
+    /// Returns an [`ApiFailure`] when the upload is rejected or unknown.
+    fn upload_asset(
+        &mut self,
+        authority: &ContentsWrite,
+        id: ReleaseId,
+        name: &str,
+        bytes: &[u8],
+    ) -> Result<(), ApiFailure>;
+
+    /// Downloads at most `limit + 1` bytes of an asset.
+    ///
+    /// # Errors
+    ///
+    /// Returns an [`ApiFailure`] when the download is rejected or unknown.
+    fn download_asset(
+        &mut self,
+        authority: &ContentsWrite,
+        id: ReleaseId,
+        name: &str,
+        limit: u64,
+    ) -> Result<Vec<u8>, ApiFailure>;
+
+    /// Publishes a draft.
+    ///
+    /// # Errors
+    ///
+    /// Returns an [`ApiFailure`] when publication is rejected or unknown.
+    fn publish_draft(&mut self, authority: &ContentsWrite, id: ReleaseId)
+    -> Result<(), ApiFailure>;
+
+    /// Reads and verifies the GitHub release statement for `tag`.
+    ///
+    /// # Errors
+    ///
+    /// Returns an [`ApiFailure`] when the statement is absent or unverifiable.
+    fn release_statement(
+        &mut self,
+        authority: &ContentsWrite,
+        tag: &ReleaseTag,
+    ) -> Result<ReleaseStatement, ApiFailure>;
+
+    /// Deletes a release confirmed still mutable.
+    ///
+    /// # Errors
+    ///
+    /// Returns an [`ApiFailure`] when deletion is rejected or unknown.
+    fn delete_mutable_release(
+        &mut self,
+        authority: &ContentsWrite,
+        cleanup: &CleanupAuthority,
+        id: ReleaseId,
+    ) -> Result<(), ApiFailure>;
+}
diff --git a/crates/trusted-server-release/src/publication/incident.rs b/crates/trusted-server-release/src/publication/incident.rs
new file mode 100644
index 0000000000..4fd07a9220
--- /dev/null
+++ b/crates/trusted-server-release/src/publication/incident.rs
@@ -0,0 +1,130 @@
+//! Publication results: success, refusal and release incidents.
+
+use error_stack::Report;
+
+use super::api::{ApiFailure, ReleaseId};
+use super::model::SourceApproval;
+use crate::error::ReleaseError;
+
+/// The kind of release incident raised after a publish attempt.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum IncidentKind {
+    /// The published release was confirmed mutable.
+    MutablePublication,
+    /// The post-publish state could not be determined; reconciliation is read-only.
+    UnknownState,
+    /// The immutable release's statement or assets differ from the intended set.
+    MembershipMismatch,
+    /// The release statement could not be verified.
+    UnverifiedStatement,
+}
+
+/// The outcome of still-mutable release cleanup recorded in an incident.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum CleanupOutcome {
+    /// No cleanup applies to this incident kind.
+    NotAttempted,
+    /// The release-write role does not authorize cleanup.
+    NotAuthorized,
+    /// The still-mutable release was removed (or confirmed absent).
+    Removed,
+    /// Deletion was rejected with this status.
+    Denied {
+        /// HTTP status.
+        status: u16,
+    },
+    /// The deletion outcome could not be determined.
+    Indeterminate,
+    /// The release is immutable and is never deleted.
+    RetainedImmutable,
+    /// The state could not be reconfirmed before deletion, so it was retained.
+    RetainedStateUnknown,
+}
+
+/// A release incident record.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct Incident {
+    pub(super) tag: String,
+    pub(super) release: Option<ReleaseId>,
+    pub(super) kind: IncidentKind,
+    pub(super) cleanup: CleanupOutcome,
+    pub(super) api_failure: Option<ApiFailure>,
+}
+
+impl Incident {
+    /// The release tag.
+    pub(crate) fn tag(&self) -> &str {
+        &self.tag
+    }
+
+    /// The release concerned, when known.
+    pub(crate) fn release(&self) -> Option<ReleaseId> {
+        self.release
+    }
+
+    /// What went wrong.
+    pub(crate) fn kind(&self) -> IncidentKind {
+        self.kind
+    }
+
+    /// The cleanup outcome.
+    pub(crate) fn cleanup(&self) -> CleanupOutcome {
+        self.cleanup
+    }
+
+    /// The releases API failure behind this incident, when one was observed.
+    pub(crate) fn api_failure(&self) -> Option<ApiFailure> {
+        self.api_failure
+    }
+}
+
+/// A failed publication with its optional incident.
+#[derive(Debug)]
+pub(crate) struct PublicationFailure {
+    pub(super) report: Report<ReleaseError>,
+    pub(super) incident: Option<Incident>,
+}
+
+impl PublicationFailure {
+    pub(super) fn refused(report: Report<ReleaseError>) -> Self {
+        Self {
+            report,
+            incident: None,
+        }
+    }
+
+    /// The failure report.
+    pub(crate) fn report(&self) -> &Report<ReleaseError> {
+        &self.report
+    }
+
+    /// The release incident, when the failure follows a publish attempt.
+    pub(crate) fn incident(&self) -> Option<&Incident> {
+        self.incident.as_ref()
+    }
+}
+
+/// A release published, confirmed immutable and membership-verified.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct PublishedRelease {
+    pub(super) id: ReleaseId,
+    pub(super) tag: String,
+    pub(super) approval: SourceApproval,
+}
+
+impl PublishedRelease {
+    /// The release ID.
+    pub(crate) fn id(&self) -> ReleaseId {
+        self.id
+    }
+
+    /// The release tag.
+    pub(crate) fn tag(&self) -> &str {
+        &self.tag
+    }
+
+    /// The source approval the release was published under.
+    pub(crate) fn approval(&self) -> &SourceApproval {
+        &self.approval
+    }
+}
diff --git a/crates/trusted-server-release/src/publication/model.rs b/crates/trusted-server-release/src/publication/model.rs
new file mode 100644
index 0000000000..a4806bbb14
--- /dev/null
+++ b/crates/trusted-server-release/src/publication/model.rs
@@ -0,0 +1,345 @@
+//! Validated publication inputs: tag, source approval and the exact asset set.
+
+use std::collections::BTreeMap;
+
+use error_stack::Report;
+
+use super::{rejected, sha256_hex};
+use crate::documents::Role;
+use crate::error::ReleaseError;
+use crate::source::CommitId;
+
+const ASSET_NAME_LIMIT: usize = 128;
+const TAG_LIMIT: usize = 128;
+/// Release-wide assets named by the spec's distribution section.
+const RELEASE_WIDE_ASSETS: usize = 4;
+/// The release-index v1 schema's `artifacts` array has exactly four items.
+const INDEX_ARTIFACTS: usize = 4;
+/// Each executable plus its six companion documents.
+const ASSETS_PER_ARTIFACT: usize = 7;
+
+fn numeric_identifier(value: &str) -> bool {
+    !value.is_empty()
+        && value.bytes().all(|byte| byte.is_ascii_digit())
+        && (value == "0" || !value.starts_with('0'))
+}
+
+fn dotted_identifiers(value: &str) -> bool {
+    value.split('.').all(|part| {
+        !part.is_empty()
+            && part
+                .bytes()
+                .all(|byte| byte.is_ascii_alphanumeric() || byte == b'-')
+    })
+}
+
+/// A strict `v`-prefixed semantic-version release tag.
+#[derive(Clone, Debug, PartialEq, Eq, derive_more::Display)]
+pub(crate) struct ReleaseTag(String);
+
+impl ReleaseTag {
+    /// Parses a `vMAJOR.MINOR.PATCH[-prerelease][+build]` tag without normalization.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Publication`] for any other shape, leading zeros
+    /// or empty identifiers.
+    pub(crate) fn parse(value: &str) -> Result<Self, Report<ReleaseError>> {
+        let invalid = || {
+            rejected(format!(
+                "release tag `{value}` is not a strict v-SemVer tag"
+            ))
+        };
+        if value.len() > TAG_LIMIT {
+            return Err(invalid());
+        }
+        let version = value.strip_prefix('v').ok_or_else(invalid)?;
+        let (version, build) = match version.split_once('+') {
+            Some((version, build)) => (version, Some(build)),
+            None => (version, None),
+        };
+        let (core, prerelease) = match version.split_once('-') {
+            Some((core, prerelease)) => (core, Some(prerelease)),
+            None => (version, None),
+        };
+        let core_valid = core.split('.').count() == 3 && core.split('.').all(numeric_identifier);
+        let prerelease_valid = prerelease.is_none_or(|value| {
+            dotted_identifiers(value)
+                && value.split('.').all(|part| {
+                    !part.bytes().all(|byte| byte.is_ascii_digit()) || numeric_identifier(part)
+                })
+        });
+        let build_valid = build.is_none_or(dotted_identifiers);
+        if !(core_valid && prerelease_valid && build_valid) {
+            return Err(invalid());
+        }
+        Ok(Self(value.to_owned()))
+    }
+
+    /// The tag text.
+    pub(crate) fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+/// How the tagged source commit was approved for release.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) enum SourceApproval {
+    /// Ancestor of the approved `main` tip.
+    Main,
+    /// Ancestor of an explicitly reviewed exact `rc/YYYYMM` branch tip.
+    ReviewedRc {
+        /// The reviewed `rc/YYYYMM` branch name.
+        branch: String,
+    },
+}
+
+impl SourceApproval {
+    /// Records a reviewed exact `rc/YYYYMM` branch approval.
+    ///
+    /// Approval kind never changes publication permissions; the same
+    /// contents-write-only [`super::role::PublicationRole`] applies.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Publication`] unless `branch` is exactly
+    /// `rc/YYYYMM` with a month from 01 to 12.
+    pub(crate) fn reviewed_rc(branch: &str) -> Result<Self, Report<ReleaseError>> {
+        let valid = branch.strip_prefix("rc/").is_some_and(|stamp| {
+            stamp.len() == 6
+                && stamp.bytes().all(|byte| byte.is_ascii_digit())
+                && matches!(stamp[4..].parse::<u8>(), Ok(1..=12))
+        });
+        if !valid {
+            return Err(rejected(format!(
+                "release-candidate branch `{branch}` is not an exact rc/YYYYMM branch"
+            )));
+        }
+        Ok(Self::ReviewedRc {
+            branch: branch.to_owned(),
+        })
+    }
+}
+
+/// One asset the publication owner intends to attach.
+#[derive(Clone, Debug)]
+pub(crate) struct IntendedAsset {
+    name: String,
+    sha256: String,
+    bytes: Vec<u8>,
+}
+
+impl IntendedAsset {
+    /// Records an asset's exact bytes under a portable release asset name.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Publication`] for an empty, overlong, hidden or
+    /// non-portable name.
+    pub(crate) fn new(name: &str, bytes: Vec<u8>) -> Result<Self, Report<ReleaseError>> {
+        let portable = !name.is_empty()
+            && name.len() <= ASSET_NAME_LIMIT
+            && !name.starts_with('.')
+            && name
+                .bytes()
+                .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'-'));
+        if !portable {
+            return Err(rejected(format!(
+                "release asset name `{name}` is not a portable asset name"
+            )));
+        }
+        Ok(Self {
+            name: name.to_owned(),
+            sha256: sha256_hex(&bytes),
+            bytes,
+        })
+    }
+
+    /// The asset name.
+    pub(crate) fn name(&self) -> &str {
+        &self.name
+    }
+
+    /// Lowercase hex SHA-256 of the exact bytes.
+    pub(crate) fn sha256(&self) -> &str {
+        &self.sha256
+    }
+
+    /// The exact bytes.
+    pub(crate) fn bytes(&self) -> &[u8] {
+        &self.bytes
+    }
+
+    /// The exact size in bytes.
+    pub(crate) fn size(&self) -> u64 {
+        u64::try_from(self.bytes.len()).unwrap_or(u64::MAX)
+    }
+}
+
+/// Count and byte bounds on an intended asset set.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) struct AssetBounds {
+    count: usize,
+    asset_bytes: u64,
+    total_bytes: u64,
+}
+
+impl AssetBounds {
+    pub(super) fn new(count: usize, asset_bytes: u64, total_bytes: u64) -> Self {
+        Self {
+            count,
+            asset_bytes,
+            total_bytes,
+        }
+    }
+
+    /// Bounds for one official release, derived from existing contracts.
+    ///
+    /// - Count: the spec's release-wide assets (index, index provenance
+    ///   bundle, JS inventory, `SHA256SUMS`) plus, for each of the index
+    ///   schema's exactly four artifacts, the executable and its six
+    ///   companions — 32 in total.
+    /// - Per asset: the largest published role limit,
+    ///   [`Role::Executable`].
+    /// - Total: four executables at that limit plus every other asset at the
+    ///   largest companion role limit,
+    ///   [`Role::Companion`].
+    pub(crate) fn release() -> Self {
+        let count = RELEASE_WIDE_ASSETS + INDEX_ARTIFACTS * ASSETS_PER_ARTIFACT;
+        let executable = Role::Executable.limit();
+        let companion = Role::Companion.limit();
+        let total = executable
+            .saturating_mul(INDEX_ARTIFACTS as u64)
+            .saturating_add(companion.saturating_mul((count - INDEX_ARTIFACTS) as u64));
+        Self::new(count, executable, total)
+    }
+
+    /// Maximum asset count.
+    pub(crate) fn count(&self) -> usize {
+        self.count
+    }
+
+    /// Maximum bytes per asset.
+    pub(crate) fn asset_bytes(&self) -> u64 {
+        self.asset_bytes
+    }
+}
+
+/// The complete release the sole owner publishes for one tag.
+#[derive(Clone, Debug)]
+pub(crate) struct IntendedRelease {
+    tag: ReleaseTag,
+    commit: CommitId,
+    approval: SourceApproval,
+    assets: BTreeMap<String, IntendedAsset>,
+}
+
+impl IntendedRelease {
+    /// Binds the exact asset set to its tag and approved source commit.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Publication`] for an empty set, duplicate names
+    /// or a set outside [`AssetBounds::release`].
+    pub(crate) fn new(
+        tag: ReleaseTag,
+        commit: CommitId,
+        approval: SourceApproval,
+        assets: Vec<IntendedAsset>,
+    ) -> Result<Self, Report<ReleaseError>> {
+        Self::new_bounded(tag, commit, approval, assets, &AssetBounds::release())
+    }
+
+    pub(super) fn new_bounded(
+        tag: ReleaseTag,
+        commit: CommitId,
+        approval: SourceApproval,
+        assets: Vec<IntendedAsset>,
+        bounds: &AssetBounds,
+    ) -> Result<Self, Report<ReleaseError>> {
+        if assets.is_empty() {
+            return Err(rejected("release asset set must not be empty"));
+        }
+        if assets.len() > bounds.count {
+            return Err(rejected(format!(
+                "release asset set has {} assets; at most {} are allowed",
+                assets.len(),
+                bounds.count
+            )));
+        }
+        let mut total: u64 = 0;
+        for asset in &assets {
+            if asset.size() > bounds.asset_bytes {
+                return Err(rejected(format!(
+                    "release asset `{}` exceeds the {}-byte asset bound",
+                    asset.name, bounds.asset_bytes
+                )));
+            }
+            total = total.saturating_add(asset.size());
+        }
+        if total > bounds.total_bytes {
+            return Err(rejected(format!(
+                "release asset set exceeds the {}-byte total bound",
+                bounds.total_bytes
+            )));
+        }
+        let mut by_name = BTreeMap::new();
+        for asset in assets {
+            let name = asset.name.clone();
+            if by_name.insert(name.clone(), asset).is_some() {
+                return Err(rejected(format!("release asset `{name}` is duplicated")));
+            }
+        }
+        Ok(Self {
+            tag,
+            commit,
+            approval,
+            assets: by_name,
+        })
+    }
+
+    /// The release tag.
+    pub(crate) fn tag(&self) -> &ReleaseTag {
+        &self.tag
+    }
+
+    /// The approved source commit.
+    pub(crate) fn commit(&self) -> &CommitId {
+        &self.commit
+    }
+
+    /// The source approval.
+    pub(crate) fn approval(&self) -> &SourceApproval {
+        &self.approval
+    }
+
+    /// The exact asset set keyed by name.
+    pub(crate) fn assets(&self) -> &BTreeMap<String, IntendedAsset> {
+        &self.assets
+    }
+}
+
+/// Tag-scoped serialization of publication runs.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct ConcurrencyPolicy {
+    group: String,
+}
+
+impl ConcurrencyPolicy {
+    /// The concurrency group serializing every publication run of `tag`.
+    pub(crate) fn for_tag(tag: &ReleaseTag) -> Self {
+        Self {
+            group: format!("release-publication-{}", tag.as_str()),
+        }
+    }
+
+    /// The tag-scoped group name.
+    pub(crate) fn group(&self) -> &str {
+        &self.group
+    }
+
+    /// A publishing run is never cancelled by a newer run.
+    pub(crate) fn cancel_in_progress(&self) -> bool {
+        false
+    }
+}
diff --git a/crates/trusted-server-release/src/publication/owner.rs b/crates/trusted-server-release/src/publication/owner.rs
new file mode 100644
index 0000000000..683a996bcf
--- /dev/null
+++ b/crates/trusted-server-release/src/publication/owner.rs
@@ -0,0 +1,512 @@
+//! The sole-owner publication run for one tag.
+
+use std::collections::BTreeSet;
+
+use error_stack::Report;
+
+use super::api::{ApiFailure, ObservedRelease, ReleaseApi, ReleaseId, ReleaseStatement};
+use super::incident::{
+    CleanupOutcome, Incident, IncidentKind, PublicationFailure, PublishedRelease,
+};
+use super::model::IntendedRelease;
+use super::role::PublicationRole;
+use super::{rejected, sha256_hex};
+use crate::error::ReleaseError;
+
+/// Publishes `release` as its tag's sole immutable-release owner.
+///
+/// The git tag must be absent or already point at the intended commit, both
+/// when the draft is located and again immediately before publishing. The
+/// draft is re-read immediately before publishing and must still equal the
+/// validated asset set (asset IDs, names, sizes and digests).
+///
+/// # Errors
+///
+/// Returns a [`PublicationFailure`] whenever publication is not completed and
+/// verified. Failures after a publish attempt carry an [`Incident`].
+pub(crate) fn publish<A: ReleaseApi>(
+    api: &mut A,
+    role: &PublicationRole,
+    release: &IntendedRelease,
+) -> Result<PublishedRelease, PublicationFailure> {
+    let mut owner = Owner { api, role, release };
+    let id = owner.locate_draft().map_err(PublicationFailure::refused)?;
+    owner
+        .upload_absent(id)
+        .and_then(|()| owner.verify_exact_set(id))
+        .and_then(|validated| owner.recheck_before_publish(&validated))
+        .map_err(PublicationFailure::refused)?;
+    owner.publish_draft(id)?;
+    owner.final_check(id)
+}
+
+fn api_error(action: &str, failure: ApiFailure) -> Report<ReleaseError> {
+    match failure {
+        ApiFailure::Rejected { status } => rejected(format!(
+            "releases API rejected {action} with status {status}"
+        )),
+        ApiFailure::Indeterminate => {
+            rejected(format!("releases API outcome of {action} is unknown"))
+        }
+    }
+}
+
+/// The single in-flight publication run for one tag.
+struct Owner<'run, A> {
+    api: &'run mut A,
+    role: &'run PublicationRole,
+    release: &'run IntendedRelease,
+}
+
+impl<A: ReleaseApi> Owner<'_, A> {
+    fn incident(
+        &self,
+        id: ReleaseId,
+        kind: IncidentKind,
+        cleanup: CleanupOutcome,
+        failure: Option<ApiFailure>,
+        message: &str,
+    ) -> PublicationFailure {
+        PublicationFailure {
+            report: rejected(format!(
+                "release `{}` publication failed: {message}; cleanup outcome {cleanup:?}; API failure {failure:?}",
+                self.release.tag()
+            )),
+            incident: Some(Incident {
+                tag: self.release.tag().as_str().to_owned(),
+                release: Some(id),
+                kind,
+                cleanup,
+                api_failure: failure,
+            }),
+        }
+    }
+
+    fn list_for_tag(&mut self) -> Result<Vec<ObservedRelease>, Report<ReleaseError>> {
+        self.api
+            .releases_for_tag(self.role.contents(), self.release.tag())
+            .map_err(|failure| api_error("listing releases for the tag", failure))
+    }
+
+    /// Requires the git tag to be absent or to point at the intended commit.
+    fn check_tag_ref(&mut self) -> Result<(), Report<ReleaseError>> {
+        let target = self
+            .api
+            .tag_ref(self.role.contents(), self.release.tag())
+            .map_err(|failure| api_error("reading the tag reference", failure))?;
+        match target {
+            Some(commit) if commit != *self.release.commit() => Err(rejected(format!(
+                "tag `{}` already points at `{commit}`, not the intended `{}`; tags are never retagged",
+                self.release.tag(),
+                self.release.commit()
+            ))),
+            Some(_) | None => Ok(()),
+        }
+    }
+
+    fn check_draft_source(&self, draft: &ObservedRelease) -> Result<(), Report<ReleaseError>> {
+        if draft.tag != self.release.tag().as_str()
+            || draft.target_commit != self.release.commit().as_str()
+        {
+            return Err(rejected(format!(
+                "conflicting draft {:?} targets `{}` at `{}`; explicit recovery is required",
+                draft.id, draft.tag, draft.target_commit
+            )));
+        }
+        if let Some(extra) = draft
+            .assets
+            .iter()
+            .find(|asset| !self.release.assets().contains_key(&asset.name))
+        {
+            return Err(rejected(format!(
+                "draft asset `{}` is outside the intended set; explicit recovery is required",
+                extra.name
+            )));
+        }
+        Ok(())
+    }
+
+    fn select_existing(
+        &self,
+        releases: &[ObservedRelease],
+    ) -> Result<Option<ReleaseId>, Report<ReleaseError>> {
+        if releases.iter().any(|release| !release.draft) {
+            return Err(rejected(format!(
+                "tag `{}` already has a published release; published releases and tags are never overwritten",
+                self.release.tag()
+            )));
+        }
+        match releases {
+            [] => Ok(None),
+            [draft] => {
+                self.check_draft_source(draft)?;
+                Ok(Some(draft.id))
+            }
+            _ => Err(rejected(format!(
+                "tag `{}` has multiple drafts; explicit recovery is required",
+                self.release.tag()
+            ))),
+        }
+    }
+
+    fn locate_draft(&mut self) -> Result<ReleaseId, Report<ReleaseError>> {
+        self.check_tag_ref()?;
+        let releases = self.list_for_tag()?;
+        if let Some(id) = self.select_existing(&releases)? {
+            return Ok(id);
+        }
+        match self.api.create_draft(
+            self.role.contents(),
+            self.release.tag(),
+            self.release.commit(),
+        ) {
+            Ok(id) => Ok(id),
+            Err(ApiFailure::Indeterminate | ApiFailure::Rejected { status: 409 | 422 }) => {
+                // A lost response or a racing run: reconcile read-only before any mutation.
+                let releases = self.list_for_tag()?;
+                self.select_existing(&releases)?.ok_or_else(|| {
+                    rejected(
+                        "draft creation outcome is unknown and reconciliation found no draft; rerun publication",
+                    )
+                })
+            }
+            Err(failure) => Err(api_error("draft creation", failure)),
+        }
+    }
+
+    fn read_draft(&mut self, id: ReleaseId) -> Result<ObservedRelease, Report<ReleaseError>> {
+        let observed = self
+            .api
+            .release(self.role.contents(), id)
+            .map_err(|failure| api_error("reading the draft", failure))?
+            .ok_or_else(|| rejected(format!("draft {id:?} disappeared during publication")))?;
+        if !observed.draft {
+            return Err(rejected(format!(
+                "release {id:?} was published outside this owner before validation"
+            )));
+        }
+        self.check_draft_source(&observed)?;
+        Ok(observed)
+    }
+
+    fn check_downloaded(&mut self, id: ReleaseId, name: &str) -> Result<(), Report<ReleaseError>> {
+        let release = self.release;
+        let intended = release
+            .assets()
+            .get(name)
+            .ok_or_else(|| rejected(format!("asset `{name}` is outside the intended set")))?;
+        let bytes = self
+            .api
+            .download_asset(self.role.contents(), id, name, intended.size())
+            .map_err(|failure| api_error("asset re-download", failure))?;
+        if u64::try_from(bytes.len()).map_or(true, |length| length > intended.size()) {
+            return Err(rejected(format!(
+                "downloaded asset `{name}` exceeds its intended size of {} bytes",
+                intended.size()
+            )));
+        }
+        if bytes != intended.bytes() || sha256_hex(&bytes) != intended.sha256() {
+            return Err(rejected(format!(
+                "draft asset `{name}` bytes differ from the intended asset; explicit recovery is required"
+            )));
+        }
+        Ok(())
+    }
+
+    fn upload_absent(&mut self, id: ReleaseId) -> Result<(), Report<ReleaseError>> {
+        let observed = self.read_draft(id)?;
+        let present: BTreeSet<String> = observed
+            .assets
+            .into_iter()
+            .map(|asset| asset.name)
+            .collect();
+        for name in &present {
+            self.check_downloaded(id, name)?;
+        }
+        let release = self.release;
+        for asset in release.assets().values() {
+            if present.contains(asset.name()) {
+                continue;
+            }
+            match self
+                .api
+                .upload_asset(self.role.contents(), id, asset.name(), asset.bytes())
+            {
+                Ok(()) => {}
+                Err(ApiFailure::Indeterminate) => self.reconcile_upload(id, asset.name())?,
+                Err(failure) => return Err(api_error("asset upload", failure)),
+            }
+        }
+        Ok(())
+    }
+
+    fn reconcile_upload(&mut self, id: ReleaseId, name: &str) -> Result<(), Report<ReleaseError>> {
+        let observed = self.read_draft(id)?;
+        if !observed.assets.iter().any(|asset| asset.name == name) {
+            return Err(rejected(format!(
+                "upload outcome of `{name}` is unknown and the asset is absent after reconciliation; rerun to resume the draft"
+            )));
+        }
+        self.check_downloaded(id, name)
+    }
+
+    /// Validates the exact asset set and returns the validated draft snapshot.
+    fn verify_exact_set(&mut self, id: ReleaseId) -> Result<ObservedRelease, Report<ReleaseError>> {
+        let observed = self.read_draft(id)?;
+        let release = self.release;
+        let names: BTreeSet<&str> = observed
+            .assets
+            .iter()
+            .map(|asset| asset.name.as_str())
+            .collect();
+        if names.len() != observed.assets.len() {
+            return Err(rejected("draft lists a duplicated asset name"));
+        }
+        if let Some(missing) = release
+            .assets()
+            .keys()
+            .find(|name| !names.contains(name.as_str()))
+        {
+            return Err(rejected(format!(
+                "draft asset `{missing}` is missing after upload"
+            )));
+        }
+        if !self.assets_match(&observed) {
+            return Err(rejected(
+                "draft asset size or digest differs from the intended asset; explicit recovery is required",
+            ));
+        }
+        for name in release.assets().keys() {
+            self.check_downloaded(id, name)?;
+        }
+        Ok(observed)
+    }
+
+    /// Re-checks the tag and the draft read-only immediately before publishing.
+    fn recheck_before_publish(
+        &mut self,
+        validated: &ObservedRelease,
+    ) -> Result<(), Report<ReleaseError>> {
+        self.check_tag_ref()?;
+        let current = self.read_draft(validated.id)?;
+        let mut expected = validated.assets.clone();
+        let mut observed = current.assets;
+        expected.sort_by_key(|asset| asset.id);
+        observed.sort_by_key(|asset| asset.id);
+        if observed != expected {
+            return Err(rejected(format!(
+                "draft {:?} assets changed after validation; publication is refused and the draft kept",
+                validated.id
+            )));
+        }
+        Ok(())
+    }
+
+    fn publish_draft(&mut self, id: ReleaseId) -> Result<(), PublicationFailure> {
+        match self.api.publish_draft(self.role.contents(), id) {
+            Ok(()) => Ok(()),
+            Err(failure @ ApiFailure::Rejected { .. }) => Err(PublicationFailure::refused(
+                api_error("publishing the draft", failure),
+            )),
+            // A lost publish response: reconcile read-only before any other mutation.
+            Err(ApiFailure::Indeterminate) => match self.api.release(self.role.contents(), id) {
+                Ok(Some(observed)) if !observed.draft => Ok(()),
+                Ok(Some(_)) => Err(PublicationFailure::refused(rejected(
+                    "publish response was lost and reconciliation shows the draft still unpublished; rerun publication",
+                ))),
+                Ok(None) => Err(self.incident(
+                    id,
+                    IncidentKind::UnknownState,
+                    CleanupOutcome::NotAttempted,
+                    Some(ApiFailure::Indeterminate),
+                    "publish response was lost and reconciliation finds no release",
+                )),
+                Err(failure) => Err(self.incident(
+                    id,
+                    IncidentKind::UnknownState,
+                    CleanupOutcome::NotAttempted,
+                    Some(failure),
+                    "publish response was lost and reconciliation cannot determine the release state",
+                )),
+            },
+        }
+    }
+
+    fn final_check(&mut self, id: ReleaseId) -> Result<PublishedRelease, PublicationFailure> {
+        let observed = match self.api.release(self.role.contents(), id) {
+            Ok(Some(observed)) if !observed.draft => observed,
+            Ok(Some(_)) => {
+                return Err(self.incident(
+                    id,
+                    IncidentKind::UnknownState,
+                    CleanupOutcome::NotAttempted,
+                    None,
+                    "release is still reported as a draft after publish; reconciliation is read-only",
+                ));
+            }
+            Ok(None) => {
+                return Err(self.incident(
+                    id,
+                    IncidentKind::UnknownState,
+                    CleanupOutcome::NotAttempted,
+                    None,
+                    "published release is missing; reconciliation is read-only",
+                ));
+            }
+            Err(failure) => {
+                return Err(self.incident(
+                    id,
+                    IncidentKind::UnknownState,
+                    CleanupOutcome::NotAttempted,
+                    Some(failure),
+                    "published release state is unreadable; reconciliation is read-only",
+                ));
+            }
+        };
+        match observed.immutable {
+            Some(true) => self.verify_membership(&observed),
+            Some(false) => {
+                let (cleanup, failure) = self.cleanup_mutable(id);
+                Err(self.incident(
+                    id,
+                    IncidentKind::MutablePublication,
+                    cleanup,
+                    failure,
+                    "published release is confirmed mutable",
+                ))
+            }
+            None => Err(self.incident(
+                id,
+                IncidentKind::UnknownState,
+                CleanupOutcome::NotAttempted,
+                None,
+                "published release immutability is unknown; reconciliation is read-only",
+            )),
+        }
+    }
+
+    /// Removes a confirmed still-mutable release when the role authorizes it.
+    ///
+    /// The release is re-read immediately before deletion. The remaining
+    /// window between that read and the delete is benign: GitHub applies
+    /// immutability only at publication, so a published mutable release
+    /// cannot later become immutable, and the API itself refuses to delete an
+    /// immutable release.
+    ///
+    /// Deleting a release leaves its git tag in place. A rerun is not blocked
+    /// by that tag: [`Owner::check_tag_ref`] accepts a tag that already points
+    /// at the intended commit, and no published release remains to refuse.
+    /// A tag at any other commit still requires explicit recovery.
+    fn cleanup_mutable(&mut self, id: ReleaseId) -> (CleanupOutcome, Option<ApiFailure>) {
+        let role = self.role;
+        let Some(cleanup) = role.cleanup() else {
+            return (CleanupOutcome::NotAuthorized, None);
+        };
+        let authority = role.contents();
+        match self.api.release(authority, id) {
+            Ok(Some(observed)) if observed.immutable == Some(false) => {}
+            Ok(Some(observed)) if observed.immutable == Some(true) => {
+                return (CleanupOutcome::RetainedImmutable, None);
+            }
+            Ok(None) => return (CleanupOutcome::Removed, None),
+            Ok(Some(_)) => return (CleanupOutcome::RetainedStateUnknown, None),
+            Err(failure) => return (CleanupOutcome::RetainedStateUnknown, Some(failure)),
+        }
+        match self.api.delete_mutable_release(authority, cleanup, id) {
+            Ok(()) => (CleanupOutcome::Removed, None),
+            Err(failure @ ApiFailure::Rejected { status }) => {
+                (CleanupOutcome::Denied { status }, Some(failure))
+            }
+            Err(ApiFailure::Indeterminate) => match self.api.release(authority, id) {
+                Ok(None) => (CleanupOutcome::Removed, Some(ApiFailure::Indeterminate)),
+                Ok(Some(_)) => (
+                    CleanupOutcome::Indeterminate,
+                    Some(ApiFailure::Indeterminate),
+                ),
+                Err(failure) => (CleanupOutcome::Indeterminate, Some(failure)),
+            },
+        }
+    }
+
+    fn statement_matches(&self, statement: &ReleaseStatement) -> bool {
+        let intended: BTreeSet<(&str, &str)> = self
+            .release
+            .assets()
+            .values()
+            .map(|asset| (asset.name(), asset.sha256()))
+            .collect();
+        let signed: BTreeSet<(&str, &str)> = statement
+            .subjects
+            .iter()
+            .map(|subject| (subject.name.as_str(), subject.sha256.as_str()))
+            .collect();
+        statement.tag == self.release.tag().as_str()
+            && statement.commit == self.release.commit().as_str()
+            && signed.len() == statement.subjects.len()
+            && signed == intended
+    }
+
+    fn assets_match(&self, observed: &ObservedRelease) -> bool {
+        observed.assets.len() == self.release.assets().len()
+            && observed.assets.iter().all(|asset| {
+                self.release
+                    .assets()
+                    .get(&asset.name)
+                    .is_some_and(|intended| {
+                        asset.size == intended.size()
+                            && asset
+                                .sha256
+                                .as_ref()
+                                .is_none_or(|digest| digest == intended.sha256())
+                    })
+            })
+    }
+
+    fn release_identity_matches(&self, observed: &ObservedRelease) -> bool {
+        !observed.draft
+            && observed.tag == self.release.tag().as_str()
+            && observed.target_commit == self.release.commit().as_str()
+    }
+
+    fn verify_membership(
+        &mut self,
+        observed: &ObservedRelease,
+    ) -> Result<PublishedRelease, PublicationFailure> {
+        let id = observed.id;
+        let mismatch = |owner: &Self| {
+            owner.incident(
+                id,
+                IncidentKind::MembershipMismatch,
+                CleanupOutcome::RetainedImmutable,
+                None,
+                "immutable release identity, statement or assets differ from the intended set; an advisory and new version are required",
+            )
+        };
+        if !(self.release_identity_matches(observed) && self.assets_match(observed)) {
+            return Err(mismatch(self));
+        }
+        let verified = match self
+            .api
+            .release_statement(self.role.contents(), self.release.tag())
+        {
+            Ok(statement) => statement,
+            Err(failure) => {
+                return Err(self.incident(
+                    id,
+                    IncidentKind::UnverifiedStatement,
+                    CleanupOutcome::RetainedImmutable,
+                    Some(failure),
+                    "immutable release statement could not be verified",
+                ));
+            }
+        };
+        if !self.statement_matches(&verified) {
+            return Err(mismatch(self));
+        }
+        Ok(PublishedRelease {
+            id,
+            tag: self.release.tag().as_str().to_owned(),
+            approval: self.release.approval().clone(),
+        })
+    }
+}
diff --git a/crates/trusted-server-release/src/publication/role.rs b/crates/trusted-server-release/src/publication/role.rs
new file mode 100644
index 0000000000..68584aee27
--- /dev/null
+++ b/crates/trusted-server-release/src/publication/role.rs
@@ -0,0 +1,107 @@
+//! The contents-write-only publication role and its credential markers.
+
+use std::collections::BTreeSet;
+
+use error_stack::Report;
+
+use super::rejected;
+use crate::error::ReleaseError;
+
+/// A workflow job permission or credential that might reach publication.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
+pub(crate) enum JobPermission {
+    /// `contents: read`.
+    ContentsRead,
+    /// `contents: write`.
+    ContentsWrite,
+    /// `actions: read`.
+    ActionsRead,
+    /// `checks: read`.
+    ChecksRead,
+    /// `id-token: write` (OIDC).
+    IdTokenWrite,
+    /// `attestations: write`.
+    AttestationsWrite,
+    /// Any deployment-provider credential.
+    ProviderCredential,
+    /// Any repository-settings token.
+    RepositorySettings,
+}
+
+/// Whether the workflow's release-write role authorizes mutable cleanup.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum CleanupGrant {
+    /// Removing a confirmed still-mutable release is authorized.
+    Authorized,
+    /// No cleanup is authorized; a mutable release is retained for the incident.
+    NotAuthorized,
+}
+
+/// Proof that the caller holds `contents: write` and nothing broader.
+///
+/// Only [`PublicationRole::from_job`] constructs it, and every
+/// [`super::api::ReleaseApi`] call requires it. No OIDC, attestation, provider or
+/// settings credential type exists in the publication API surface.
+#[derive(Debug)]
+pub(crate) struct ContentsWrite(());
+
+/// Proof that the release-write role authorizes still-mutable cleanup.
+///
+/// Only [`PublicationRole::from_job`] constructs it.
+#[derive(Debug)]
+pub(crate) struct CleanupAuthority(());
+
+/// The contents-write-only publication role.
+#[derive(Debug)]
+pub(crate) struct PublicationRole {
+    contents: ContentsWrite,
+    cleanup: Option<CleanupAuthority>,
+}
+
+impl PublicationRole {
+    /// Validates the job's granted permissions for publication.
+    ///
+    /// The same role applies to approved `main` and reviewed RC commits.
+    ///
+    /// `granted` is caller-attested: this pure model cannot observe the job.
+    /// A real adapter MUST derive it from the parsed, reviewed workflow
+    /// `permissions` block and the job's actual credential inputs, never from
+    /// an operator-supplied list.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Publication`] unless `granted` is exactly
+    /// `contents: write`, optionally with the implied `contents: read`.
+    pub(crate) fn from_job(
+        granted: &[JobPermission],
+        cleanup: CleanupGrant,
+    ) -> Result<Self, Report<ReleaseError>> {
+        let granted: BTreeSet<JobPermission> = granted.iter().copied().collect();
+        let allowed = BTreeSet::from([JobPermission::ContentsRead, JobPermission::ContentsWrite]);
+        if !granted.contains(&JobPermission::ContentsWrite) {
+            return Err(rejected("publication requires contents: write"));
+        }
+        if let Some(extra) = granted.difference(&allowed).next() {
+            return Err(rejected(format!(
+                "publication role must hold contents: write only; {extra:?} is forbidden"
+            )));
+        }
+        Ok(Self {
+            contents: ContentsWrite(()),
+            cleanup: match cleanup {
+                CleanupGrant::Authorized => Some(CleanupAuthority(())),
+                CleanupGrant::NotAuthorized => None,
+            },
+        })
+    }
+
+    /// The contents-write marker every API call requires.
+    pub(crate) fn contents(&self) -> &ContentsWrite {
+        &self.contents
+    }
+
+    /// The cleanup authority, when the release-write role grants it.
+    pub(crate) fn cleanup(&self) -> Option<&CleanupAuthority> {
+        self.cleanup.as_ref()
+    }
+}
diff --git a/crates/trusted-server-release/src/publication/tests.rs b/crates/trusted-server-release/src/publication/tests.rs
new file mode 100644
index 0000000000..04d94c86ff
--- /dev/null
+++ b/crates/trusted-server-release/src/publication/tests.rs
@@ -0,0 +1,26 @@
+use super::api::{
+    ApiFailure, ObservedAsset, ObservedRelease, ReleaseApi, ReleaseId, ReleaseStatement,
+    StatementSubject,
+};
+use super::incident::{
+    CleanupOutcome, Incident, IncidentKind, PublicationFailure, PublishedRelease,
+};
+use super::model::{
+    AssetBounds, ConcurrencyPolicy, IntendedAsset, IntendedRelease, ReleaseTag, SourceApproval,
+};
+use super::role::{CleanupAuthority, CleanupGrant, ContentsWrite, JobPermission, PublicationRole};
+use super::{publish, sha256_hex};
+use crate::error::ReleaseError;
+use crate::source::CommitId;
+
+mod drafts;
+mod fake;
+mod final_state;
+mod inputs;
+mod reconciliation;
+
+use fake::{
+    COMMIT, Call, FIRST_RELEASE_ID, FakeApi, Fault, OTHER_COMMIT, Operation, assert_message,
+    assets, commit, correct_statement, draft_with, failure, incident, intended_with, published,
+    role, run, tag,
+};
diff --git a/crates/trusted-server-release/src/publication/tests/drafts.rs b/crates/trusted-server-release/src/publication/tests/drafts.rs
new file mode 100644
index 0000000000..b6b0ee5aea
--- /dev/null
+++ b/crates/trusted-server-release/src/publication/tests/drafts.rs
@@ -0,0 +1,272 @@
+//! Draft location, resume, asset validation and tag-ref guards.
+
+use super::*;
+
+#[test]
+fn publishes_fresh_release_after_exact_redownload_and_immutable_membership() {
+    let mut api = FakeApi::new();
+
+    let release = run(&mut api, CleanupGrant::Authorized).expect("should publish");
+
+    assert_eq!(
+        release.id(),
+        ReleaseId(FIRST_RELEASE_ID),
+        "should publish the created draft"
+    );
+    assert_eq!(release.tag(), "v1.2.3", "should publish the intended tag");
+    let publish_index = api.position(&Call::Publish);
+    for (name, _) in assets() {
+        let download = api.position(&Call::Download(name.to_owned()));
+        assert!(
+            download < publish_index,
+            "should validate {name} before publishing"
+        );
+    }
+    assert_eq!(
+        api.calls.last(),
+        Some(&Call::Statement),
+        "should end with release statement verification"
+    );
+    assert_eq!(api.count(&Call::Delete), 0, "should never delete");
+}
+
+#[test]
+fn resumes_matching_partial_draft_without_reuploading_present_assets() {
+    let mut api = FakeApi::new();
+    let present = assets()[..1].to_vec();
+    api.seed(draft_with(COMMIT, &present));
+
+    run(&mut api, CleanupGrant::NotAuthorized).expect("should resume and publish");
+
+    assert_eq!(
+        api.count(&Call::Create),
+        0,
+        "should resume rather than create"
+    );
+    assert_eq!(
+        api.count(&Call::Upload(present[0].0.to_owned())),
+        0,
+        "should not overwrite a matching present asset"
+    );
+    assert_eq!(
+        api.count(&Call::Upload("example-server.wasm".to_owned())),
+        1,
+        "should upload missing"
+    );
+}
+
+#[test]
+fn refuses_draft_with_conflicting_source_commit() {
+    let mut api = FakeApi::new();
+    api.seed(draft_with(OTHER_COMMIT, &[]));
+
+    let failure = failure(run(&mut api, CleanupGrant::Authorized));
+
+    assert_message(&failure, "conflicting draft");
+    assert!(
+        api.mutations().is_empty(),
+        "should not mutate a conflicting draft"
+    );
+}
+
+#[test]
+fn refuses_draft_with_unexpected_or_altered_asset() {
+    let mut extra = FakeApi::new();
+    extra.seed(draft_with(COMMIT, &[("example-unexpected.txt", b"extra")]));
+    let failure_extra = failure(run(&mut extra, CleanupGrant::Authorized));
+    assert_message(&failure_extra, "outside the intended set");
+    assert!(
+        extra.mutations().is_empty(),
+        "should not mutate a draft with extra assets"
+    );
+
+    let mut altered = FakeApi::new();
+    altered.seed(draft_with(
+        COMMIT,
+        &[("example-server.wasm", b"\0asm\x01\0\0\0altered")],
+    ));
+    let failure_altered = failure(run(&mut altered, CleanupGrant::Authorized));
+    assert_message(&failure_altered, "explicit recovery");
+    assert!(
+        altered.mutations().is_empty(),
+        "should not overwrite or publish altered bytes"
+    );
+}
+
+#[test]
+fn refuses_publication_when_an_upload_goes_missing() {
+    let mut api = FakeApi::new();
+    api.fault(Operation::Upload, Fault::Dropped);
+
+    let failure = failure(run(&mut api, CleanupGrant::Authorized));
+
+    assert_message(&failure, "missing");
+    assert_eq!(
+        api.count(&Call::Publish),
+        0,
+        "should not publish an incomplete set"
+    );
+}
+
+#[test]
+fn refuses_publication_when_redownloaded_bytes_are_altered() {
+    let mut api = FakeApi::new();
+    api.fault(Operation::Upload, Fault::Corrupted);
+
+    let failure = failure(run(&mut api, CleanupGrant::Authorized));
+
+    assert_message(&failure, "explicit recovery");
+    assert_eq!(
+        api.count(&Call::Publish),
+        0,
+        "should not publish altered bytes"
+    );
+}
+
+#[test]
+fn refuses_oversized_download_before_comparing_bytes() {
+    let mut api = FakeApi::new();
+    api.seed(draft_with(COMMIT, &assets()[..1]));
+    api.fault(Operation::Download, Fault::Oversized);
+
+    let failure = failure(run(&mut api, CleanupGrant::Authorized));
+
+    assert_message(&failure, "exceeds its intended size");
+    assert!(
+        api.mutations().is_empty(),
+        "should not upload or publish after an oversized read"
+    );
+}
+
+#[test]
+fn refuses_already_published_tag_without_mutation() {
+    for immutable in [Some(true), Some(false), None] {
+        let mut api = FakeApi::new();
+        api.seed(published(immutable));
+
+        let failure = failure(run(&mut api, CleanupGrant::Authorized));
+
+        assert_message(&failure, "already has a published release");
+        assert!(
+            api.mutations().is_empty(),
+            "should never overwrite or delete a published tag"
+        );
+    }
+}
+
+#[test]
+fn concurrent_rerun_resumes_draft_created_by_racing_run() {
+    let mut api = FakeApi::new();
+    api.fault(Operation::Create, Fault::Raced(422));
+
+    run(&mut api, CleanupGrant::NotAuthorized).expect("should resume the raced draft");
+
+    assert_eq!(
+        api.count(&Call::Create),
+        1,
+        "should not retry draft creation"
+    );
+    assert_eq!(api.releases.len(), 1, "should leave exactly one release");
+}
+
+#[test]
+fn concurrent_rerun_refuses_multiple_drafts_and_published_successor() {
+    let mut drafts = FakeApi::new();
+    drafts.seed(draft_with(COMMIT, &[]));
+    drafts.seed(draft_with(COMMIT, &[]));
+    let failure_drafts = failure(run(&mut drafts, CleanupGrant::Authorized));
+    assert_message(&failure_drafts, "multiple drafts");
+    assert!(
+        drafts.mutations().is_empty(),
+        "should not pick one of several drafts"
+    );
+
+    let mut sequential = FakeApi::new();
+    run(&mut sequential, CleanupGrant::Authorized).expect("should publish the first run");
+    let before = sequential.mutations().len();
+    let failure_rerun = failure(run(&mut sequential, CleanupGrant::Authorized));
+    assert_message(&failure_rerun, "already has a published release");
+    assert_eq!(
+        sequential.mutations().len(),
+        before,
+        "should not mutate on rerun"
+    );
+}
+
+#[test]
+fn bare_tag_at_another_commit_is_refused_before_creating_a_draft() {
+    let mut api = FakeApi::new();
+    api.tags
+        .insert("v1.2.3".to_owned(), OTHER_COMMIT.to_owned());
+
+    let failure = failure(run(&mut api, CleanupGrant::Authorized));
+
+    assert_message(&failure, "already points at");
+    assert!(api.mutations().is_empty(), "should not create a draft");
+}
+
+#[test]
+fn bare_tag_at_the_intended_commit_is_allowed() {
+    let mut api = FakeApi::new();
+    api.tags.insert("v1.2.3".to_owned(), COMMIT.to_owned());
+
+    run(&mut api, CleanupGrant::Authorized).expect("should publish onto the matching tag");
+}
+
+#[test]
+fn unreadable_tag_ref_is_refused_without_mutation() {
+    let mut api = FakeApi::new();
+    api.fault(Operation::TagRef, Fault::Unreachable);
+
+    let failure = failure(run(&mut api, CleanupGrant::Authorized));
+
+    assert_message(&failure, "tag reference");
+    assert!(api.mutations().is_empty(), "should not mutate");
+}
+
+#[test]
+fn tag_moved_to_another_commit_before_publish_is_refused() {
+    let mut api = FakeApi::new();
+    api.tag_ref_hook = Some((2, |api| {
+        api.tags
+            .insert("v1.2.3".to_owned(), OTHER_COMMIT.to_owned());
+    }));
+
+    let failure = failure(run(&mut api, CleanupGrant::Authorized));
+
+    assert_message(&failure, "already points at");
+    assert_eq!(api.count(&Call::Publish), 0, "should not publish");
+    assert!(
+        failure.incident().is_none(),
+        "should keep the draft quietly"
+    );
+    assert!(
+        api.releases.values().all(|release| release.draft),
+        "should keep the draft"
+    );
+}
+
+#[test]
+fn draft_changed_after_validation_is_refused_before_publish() {
+    let mut api = FakeApi::new();
+    api.tag_ref_hook = Some((2, |api| api.reupload_with_new_id("example-server.wasm")));
+
+    let failure = failure(run(&mut api, CleanupGrant::Authorized));
+
+    assert_message(&failure, "changed after validation");
+    assert_eq!(api.count(&Call::Publish), 0, "should not publish");
+    assert!(
+        api.releases.values().all(|release| release.draft),
+        "should keep the draft"
+    );
+    let tag_ref = api
+        .calls
+        .iter()
+        .rposition(|call| *call == Call::TagRef)
+        .expect("should check the tag ref");
+    assert_eq!(
+        api.calls.get(tag_ref + 1),
+        Some(&Call::Get),
+        "should re-read the draft immediately before publishing"
+    );
+}
diff --git a/crates/trusted-server-release/src/publication/tests/fake.rs b/crates/trusted-server-release/src/publication/tests/fake.rs
new file mode 100644
index 0000000000..78d2a50feb
--- /dev/null
+++ b/crates/trusted-server-release/src/publication/tests/fake.rs
@@ -0,0 +1,531 @@
+//! In-process stand-in for the GitHub releases API; no network.
+
+use std::collections::{BTreeMap, VecDeque};
+
+use super::*;
+
+pub(super) const COMMIT: &str = "1111111111111111111111111111111111111111";
+pub(super) const OTHER_COMMIT: &str = "2222222222222222222222222222222222222222";
+pub(super) const FIRST_RELEASE_ID: u64 = 99999;
+const FIRST_ASSET_ID: u64 = 99999;
+
+/// One recorded call against the fake releases API.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(super) enum Call {
+    List,
+    Get,
+    TagRef,
+    Create,
+    Upload(String),
+    Download(String),
+    Publish,
+    Statement,
+    Delete,
+}
+
+impl Call {
+    fn mutates(&self) -> bool {
+        matches!(
+            self,
+            Self::Create | Self::Upload(_) | Self::Publish | Self::Delete
+        )
+    }
+}
+
+/// A scripted fault for the next call of one operation.
+#[derive(Clone, Copy, Debug)]
+pub(super) enum Fault {
+    /// The effect is applied but the response is lost.
+    Lost,
+    /// No effect is applied and the response is lost.
+    Unreachable,
+    /// The effect is applied and the API reports this status (racing writer).
+    Raced(u16),
+    /// No effect is applied and the API reports this status.
+    Status(u16),
+    /// The upload reports success but stores nothing.
+    Dropped,
+    /// The upload reports success but stores altered bytes.
+    Corrupted,
+    /// The download returns more bytes than the intended size.
+    Oversized,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
+pub(super) enum Operation {
+    List,
+    Get,
+    TagRef,
+    Create,
+    Upload,
+    Download,
+    Publish,
+    Statement,
+    Delete,
+}
+
+#[derive(Clone, Debug)]
+pub(super) struct FakeRelease {
+    pub(super) tag: String,
+    pub(super) commit: String,
+    pub(super) draft: bool,
+    pub(super) immutable: Option<bool>,
+    pub(super) assets: BTreeMap<String, (u64, Vec<u8>)>,
+}
+
+/// A hook run before answering the given 1-based `tag_ref` call.
+pub(super) type TagRefHook = (usize, fn(&mut FakeApi));
+
+pub(super) struct FakeApi {
+    pub(super) releases: BTreeMap<u64, FakeRelease>,
+    pub(super) tags: BTreeMap<String, String>,
+    pub(super) calls: Vec<Call>,
+    pub(super) immutable_after_publish: Option<bool>,
+    pub(super) statement: Option<ReleaseStatement>,
+    pub(super) reads_after_publish_unknown: bool,
+    /// Runs before answering the given 1-based `tag_ref` call.
+    pub(super) tag_ref_hook: Option<TagRefHook>,
+    /// Alters the release after a successful publish.
+    pub(super) after_publish: Option<fn(&mut FakeRelease)>,
+    next_id: u64,
+    next_asset_id: u64,
+    tag_ref_calls: usize,
+    faults: BTreeMap<Operation, VecDeque<Fault>>,
+}
+
+impl FakeApi {
+    pub(super) fn new() -> Self {
+        Self {
+            releases: BTreeMap::new(),
+            tags: BTreeMap::new(),
+            calls: Vec::new(),
+            immutable_after_publish: Some(true),
+            statement: None,
+            reads_after_publish_unknown: false,
+            tag_ref_hook: None,
+            after_publish: None,
+            next_id: FIRST_RELEASE_ID,
+            next_asset_id: FIRST_ASSET_ID,
+            tag_ref_calls: 0,
+            faults: BTreeMap::new(),
+        }
+    }
+
+    pub(super) fn fault(&mut self, operation: Operation, fault: Fault) {
+        self.faults.entry(operation).or_default().push_back(fault);
+    }
+
+    fn peek_fault(&self, operation: Operation) -> Option<Fault> {
+        self.faults
+            .get(&operation)
+            .and_then(|queue| queue.front().copied())
+    }
+
+    fn next_fault(&mut self, operation: Operation) -> Option<Fault> {
+        self.faults.get_mut(&operation)?.pop_front()
+    }
+
+    fn asset_id(&mut self) -> u64 {
+        let id = self.next_asset_id;
+        self.next_asset_id += 1;
+        id
+    }
+
+    pub(super) fn seed(&mut self, release: FakeRelease) -> u64 {
+        let id = self.next_id;
+        self.next_id += 1;
+        self.releases.insert(id, release);
+        id
+    }
+
+    /// Replaces the stored asset `name` of every release with a fresh asset ID.
+    pub(super) fn reupload_with_new_id(&mut self, name: &str) {
+        let fresh = self.asset_id();
+        for release in self.releases.values_mut() {
+            if let Some(asset) = release.assets.get_mut(name) {
+                asset.0 = fresh;
+            }
+        }
+    }
+
+    fn observed(&self, id: u64) -> Option<ObservedRelease> {
+        let release = self.releases.get(&id)?;
+        Some(ObservedRelease {
+            id: ReleaseId(id),
+            tag: release.tag.clone(),
+            target_commit: release.commit.clone(),
+            draft: release.draft,
+            immutable: if release.draft {
+                Some(false)
+            } else {
+                release.immutable
+            },
+            assets: release
+                .assets
+                .iter()
+                .map(|(name, (asset_id, bytes))| ObservedAsset {
+                    id: *asset_id,
+                    name: name.clone(),
+                    size: bytes.len() as u64,
+                    sha256: Some(sha256_hex(bytes)),
+                })
+                .collect(),
+        })
+    }
+
+    pub(super) fn mutations(&self) -> Vec<Call> {
+        self.calls
+            .iter()
+            .filter(|call| call.mutates())
+            .cloned()
+            .collect()
+    }
+
+    pub(super) fn count(&self, wanted: &Call) -> usize {
+        self.calls.iter().filter(|call| *call == wanted).count()
+    }
+
+    pub(super) fn position(&self, wanted: &Call) -> usize {
+        self.calls
+            .iter()
+            .position(|call| call == wanted)
+            .expect("should record the call")
+    }
+
+    /// Applies or withholds an effect according to the scripted fault.
+    fn respond<T>(
+        &mut self,
+        operation: Operation,
+        effect: impl FnOnce(&mut Self) -> Result<T, ApiFailure>,
+    ) -> Result<T, ApiFailure> {
+        match self.next_fault(operation) {
+            None | Some(Fault::Dropped | Fault::Corrupted | Fault::Oversized) => effect(self),
+            Some(Fault::Lost) => {
+                let _ = effect(self);
+                Err(ApiFailure::Indeterminate)
+            }
+            Some(Fault::Raced(status)) => {
+                let _ = effect(self);
+                Err(ApiFailure::Rejected { status })
+            }
+            Some(Fault::Unreachable) => Err(ApiFailure::Indeterminate),
+            Some(Fault::Status(status)) => Err(ApiFailure::Rejected { status }),
+        }
+    }
+}
+
+impl ReleaseApi for FakeApi {
+    fn releases_for_tag(
+        &mut self,
+        _authority: &ContentsWrite,
+        tag: &ReleaseTag,
+    ) -> Result<Vec<ObservedRelease>, ApiFailure> {
+        self.calls.push(Call::List);
+        self.respond(Operation::List, |api| {
+            Ok(api
+                .releases
+                .iter()
+                .filter(|(_, release)| release.tag == tag.as_str())
+                .filter_map(|(id, _)| api.observed(*id))
+                .collect())
+        })
+    }
+
+    fn release(
+        &mut self,
+        _authority: &ContentsWrite,
+        id: ReleaseId,
+    ) -> Result<Option<ObservedRelease>, ApiFailure> {
+        self.calls.push(Call::Get);
+        let unknown = self.reads_after_publish_unknown
+            && self
+                .releases
+                .get(&id.0)
+                .is_some_and(|release| !release.draft);
+        self.respond(Operation::Get, |api| {
+            if unknown {
+                return Err(ApiFailure::Indeterminate);
+            }
+            Ok(api.observed(id.0))
+        })
+    }
+
+    fn tag_ref(
+        &mut self,
+        _authority: &ContentsWrite,
+        tag: &ReleaseTag,
+    ) -> Result<Option<CommitId>, ApiFailure> {
+        self.calls.push(Call::TagRef);
+        self.tag_ref_calls += 1;
+        if let Some((call, hook)) = self.tag_ref_hook
+            && call == self.tag_ref_calls
+        {
+            hook(self);
+        }
+        self.respond(Operation::TagRef, |api| {
+            Ok(api
+                .tags
+                .get(tag.as_str())
+                .map(|commit| CommitId::parse(commit).expect("should hold a valid fake commit")))
+        })
+    }
+
+    fn create_draft(
+        &mut self,
+        _authority: &ContentsWrite,
+        tag: &ReleaseTag,
+        commit: &CommitId,
+    ) -> Result<ReleaseId, ApiFailure> {
+        self.calls.push(Call::Create);
+        let release = FakeRelease {
+            tag: tag.as_str().to_owned(),
+            commit: commit.as_str().to_owned(),
+            draft: true,
+            immutable: None,
+            assets: BTreeMap::new(),
+        };
+        self.respond(Operation::Create, |api| Ok(ReleaseId(api.seed(release))))
+    }
+
+    fn upload_asset(
+        &mut self,
+        _authority: &ContentsWrite,
+        id: ReleaseId,
+        name: &str,
+        bytes: &[u8],
+    ) -> Result<(), ApiFailure> {
+        self.calls.push(Call::Upload(name.to_owned()));
+        let fault = self.peek_fault(Operation::Upload);
+        self.respond(Operation::Upload, |api| {
+            let asset_id = api.asset_id();
+            let release = api
+                .releases
+                .get_mut(&id.0)
+                .ok_or(ApiFailure::Rejected { status: 404 })?;
+            if !release.draft || release.assets.contains_key(name) {
+                return Err(ApiFailure::Rejected { status: 422 });
+            }
+            match fault {
+                Some(Fault::Dropped) => {}
+                Some(Fault::Corrupted) => {
+                    let mut altered = bytes.to_vec();
+                    altered.push(b'!');
+                    release.assets.insert(name.to_owned(), (asset_id, altered));
+                }
+                _ => {
+                    release
+                        .assets
+                        .insert(name.to_owned(), (asset_id, bytes.to_vec()));
+                }
+            }
+            Ok(())
+        })
+    }
+
+    fn download_asset(
+        &mut self,
+        _authority: &ContentsWrite,
+        id: ReleaseId,
+        name: &str,
+        limit: u64,
+    ) -> Result<Vec<u8>, ApiFailure> {
+        self.calls.push(Call::Download(name.to_owned()));
+        let oversized = matches!(self.peek_fault(Operation::Download), Some(Fault::Oversized));
+        self.respond(Operation::Download, |api| {
+            let (_, stored) = api
+                .releases
+                .get(&id.0)
+                .and_then(|release| release.assets.get(name))
+                .ok_or(ApiFailure::Rejected { status: 404 })?;
+            let mut bytes = stored.clone();
+            if oversized {
+                bytes.extend_from_slice(b"oversized");
+            }
+            let bounded = bytes
+                .len()
+                .min(usize::try_from(limit + 1).unwrap_or(usize::MAX));
+            bytes.truncate(bounded);
+            Ok(bytes)
+        })
+    }
+
+    fn publish_draft(
+        &mut self,
+        _authority: &ContentsWrite,
+        id: ReleaseId,
+    ) -> Result<(), ApiFailure> {
+        self.calls.push(Call::Publish);
+        let immutable = self.immutable_after_publish;
+        let after_publish = self.after_publish;
+        self.respond(Operation::Publish, |api| {
+            let release = api
+                .releases
+                .get_mut(&id.0)
+                .ok_or(ApiFailure::Rejected { status: 404 })?;
+            if !release.draft {
+                return Err(ApiFailure::Rejected { status: 422 });
+            }
+            release.draft = false;
+            release.immutable = immutable;
+            let (tag, commit) = (release.tag.clone(), release.commit.clone());
+            if let Some(alter) = after_publish {
+                alter(release);
+            }
+            api.tags.entry(tag).or_insert(commit);
+            Ok(())
+        })
+    }
+
+    fn release_statement(
+        &mut self,
+        _authority: &ContentsWrite,
+        tag: &ReleaseTag,
+    ) -> Result<ReleaseStatement, ApiFailure> {
+        self.calls.push(Call::Statement);
+        let configured = self.statement.clone();
+        self.respond(Operation::Statement, |api| {
+            if let Some(statement) = configured {
+                return Ok(statement);
+            }
+            let (_, release) = api
+                .releases
+                .iter()
+                .find(|(_, release)| release.tag == tag.as_str() && !release.draft)
+                .ok_or(ApiFailure::Rejected { status: 404 })?;
+            Ok(ReleaseStatement {
+                tag: release.tag.clone(),
+                commit: release.commit.clone(),
+                subjects: release
+                    .assets
+                    .iter()
+                    .map(|(name, (_, bytes))| StatementSubject {
+                        name: name.clone(),
+                        sha256: sha256_hex(bytes),
+                    })
+                    .collect(),
+            })
+        })
+    }
+
+    fn delete_mutable_release(
+        &mut self,
+        _authority: &ContentsWrite,
+        _cleanup: &CleanupAuthority,
+        id: ReleaseId,
+    ) -> Result<(), ApiFailure> {
+        self.calls.push(Call::Delete);
+        self.respond(Operation::Delete, |api| {
+            let release = api
+                .releases
+                .get(&id.0)
+                .ok_or(ApiFailure::Rejected { status: 404 })?;
+            if release.immutable == Some(true) {
+                return Err(ApiFailure::Rejected { status: 422 });
+            }
+            api.releases.remove(&id.0);
+            Ok(())
+        })
+    }
+}
+
+pub(super) fn tag() -> ReleaseTag {
+    ReleaseTag::parse("v1.2.3").expect("should parse example tag")
+}
+
+pub(super) fn commit(value: &str) -> CommitId {
+    CommitId::parse(value).expect("should parse example commit")
+}
+
+pub(super) fn assets() -> Vec<(&'static str, &'static [u8])> {
+    vec![
+        ("example-release-index.json", b"{\"example\":true}"),
+        ("example-server.wasm", b"\0asm\x01\0\0\0example"),
+        ("ts-example-target", b"example executable bytes"),
+    ]
+}
+
+pub(super) fn intended_with(approval: SourceApproval) -> IntendedRelease {
+    let assets = assets()
+        .into_iter()
+        .map(|(name, bytes)| IntendedAsset::new(name, bytes.to_vec()).expect("should accept asset"))
+        .collect::<Vec<_>>();
+    IntendedRelease::new(tag(), commit(COMMIT), approval, assets)
+        .expect("should accept intended release")
+}
+
+pub(super) fn intended() -> IntendedRelease {
+    intended_with(SourceApproval::Main)
+}
+
+pub(super) fn correct_statement() -> ReleaseStatement {
+    ReleaseStatement {
+        tag: "v1.2.3".to_owned(),
+        commit: COMMIT.to_owned(),
+        subjects: assets()
+            .into_iter()
+            .map(|(name, bytes)| StatementSubject {
+                name: name.to_owned(),
+                sha256: sha256_hex(bytes),
+            })
+            .collect(),
+    }
+}
+
+pub(super) fn role(cleanup: CleanupGrant) -> PublicationRole {
+    PublicationRole::from_job(&[JobPermission::ContentsWrite], cleanup)
+        .expect("should accept contents-write-only role")
+}
+
+pub(super) fn draft_with(commit_value: &str, present: &[(&str, &[u8])]) -> FakeRelease {
+    FakeRelease {
+        tag: "v1.2.3".to_owned(),
+        commit: commit_value.to_owned(),
+        draft: true,
+        immutable: None,
+        assets: present
+            .iter()
+            .zip(FIRST_ASSET_ID + 1000..)
+            .map(|((name, bytes), asset_id)| ((*name).to_owned(), (asset_id, bytes.to_vec())))
+            .collect(),
+    }
+}
+
+pub(super) fn published(immutable: Option<bool>) -> FakeRelease {
+    let mut release = draft_with(COMMIT, &assets());
+    release.draft = false;
+    release.immutable = immutable;
+    release
+}
+
+pub(super) fn run(
+    api: &mut FakeApi,
+    cleanup: CleanupGrant,
+) -> Result<PublishedRelease, PublicationFailure> {
+    publish(api, &role(cleanup), &intended())
+}
+
+pub(super) fn failure(result: Result<PublishedRelease, PublicationFailure>) -> PublicationFailure {
+    match result {
+        Ok(_) => panic!("should fail publication"),
+        Err(failure) => failure,
+    }
+}
+
+pub(super) fn assert_message(failure: &PublicationFailure, needle: &str) {
+    let rendered = format!("{:?}", failure.report());
+    assert!(
+        matches!(
+            failure.report().current_context(),
+            ReleaseError::Publication
+        ),
+        "should report a publication error"
+    );
+    assert!(
+        rendered.contains(needle),
+        "should mention `{needle}` in {rendered}"
+    );
+}
+
+pub(super) fn incident(failure: &PublicationFailure) -> &Incident {
+    failure.incident().expect("should raise a release incident")
+}
diff --git a/crates/trusted-server-release/src/publication/tests/final_state.rs b/crates/trusted-server-release/src/publication/tests/final_state.rs
new file mode 100644
index 0000000000..2f48d982d3
--- /dev/null
+++ b/crates/trusted-server-release/src/publication/tests/final_state.rs
@@ -0,0 +1,304 @@
+//! Post-publish immutability, membership, cleanup and RC permission cases.
+
+use super::*;
+
+#[test]
+fn confirmed_mutable_release_is_removed_when_cleanup_is_authorized() {
+    let mut api = FakeApi::new();
+    api.immutable_after_publish = Some(false);
+
+    let failure = failure(run(&mut api, CleanupGrant::Authorized));
+
+    let record = incident(&failure);
+    assert_eq!(
+        record.kind(),
+        IncidentKind::MutablePublication,
+        "should record mutable release"
+    );
+    assert_eq!(
+        record.cleanup(),
+        CleanupOutcome::Removed,
+        "should record removal"
+    );
+    assert_eq!(record.tag(), "v1.2.3", "should name the tag");
+    assert_eq!(
+        record.release(),
+        Some(ReleaseId(FIRST_RELEASE_ID)),
+        "should name the release"
+    );
+    assert!(
+        api.releases.is_empty(),
+        "should remove the still-mutable release"
+    );
+    let delete = api.position(&Call::Delete);
+    assert_eq!(
+        api.calls[delete - 1],
+        Call::Get,
+        "should reconfirm mutability before deletion"
+    );
+}
+
+#[test]
+fn confirmed_mutable_release_cleanup_failures_are_recorded() {
+    let mut denied = FakeApi::new();
+    denied.immutable_after_publish = Some(false);
+    denied.fault(Operation::Delete, Fault::Status(403));
+    let failure_denied = failure(run(&mut denied, CleanupGrant::Authorized));
+    assert_eq!(
+        incident(&failure_denied).cleanup(),
+        CleanupOutcome::Denied { status: 403 },
+        "should record the denied cleanup"
+    );
+
+    let mut lost = FakeApi::new();
+    lost.immutable_after_publish = Some(false);
+    lost.fault(Operation::Delete, Fault::Lost);
+    let failure_lost = failure(run(&mut lost, CleanupGrant::Authorized));
+    assert_eq!(
+        incident(&failure_lost).cleanup(),
+        CleanupOutcome::Removed,
+        "should reconcile a lost delete response read-only"
+    );
+    assert_eq!(lost.count(&Call::Delete), 1, "should not retry deletion");
+
+    let mut unreachable = FakeApi::new();
+    unreachable.immutable_after_publish = Some(false);
+    unreachable.fault(Operation::Delete, Fault::Unreachable);
+    let failure_unreachable = failure(run(&mut unreachable, CleanupGrant::Authorized));
+    assert_eq!(
+        incident(&failure_unreachable).cleanup(),
+        CleanupOutcome::Indeterminate,
+        "should record an indeterminate cleanup"
+    );
+    assert_eq!(
+        incident(&failure_unreachable).api_failure(),
+        Some(ApiFailure::Indeterminate),
+        "should carry the cleanup failure"
+    );
+}
+
+#[test]
+fn unknown_final_state_raises_incident_without_deletion() {
+    let mut unknown_flag = FakeApi::new();
+    unknown_flag.immutable_after_publish = None;
+    let failure_flag = failure(run(&mut unknown_flag, CleanupGrant::Authorized));
+    assert_eq!(
+        incident(&failure_flag).kind(),
+        IncidentKind::UnknownState,
+        "should flag unknown"
+    );
+    assert_eq!(
+        unknown_flag.count(&Call::Delete),
+        0,
+        "should not delete on unknown state"
+    );
+
+    let mut unreadable = FakeApi::new();
+    unreadable.reads_after_publish_unknown = true;
+    let failure_read = failure(run(&mut unreadable, CleanupGrant::Authorized));
+    assert_eq!(
+        incident(&failure_read).kind(),
+        IncidentKind::UnknownState,
+        "should flag unknown"
+    );
+    assert_eq!(
+        incident(&failure_read).cleanup(),
+        CleanupOutcome::NotAttempted,
+        "should not attempt cleanup"
+    );
+    assert_eq!(
+        unreadable.count(&Call::Delete),
+        0,
+        "should not delete on unreadable state"
+    );
+
+    let mut still_draft = FakeApi::new();
+    still_draft.after_publish = Some(|release| release.draft = true);
+    let failure_draft = failure(run(&mut still_draft, CleanupGrant::Authorized));
+    assert_eq!(
+        incident(&failure_draft).kind(),
+        IncidentKind::UnknownState,
+        "should flag a release still reported as draft"
+    );
+    assert_eq!(
+        still_draft.count(&Call::Delete),
+        0,
+        "should not delete a release reported as draft after publish"
+    );
+}
+
+#[test]
+fn immutable_release_with_wrong_statement_is_never_deleted() {
+    let mut api = FakeApi::new();
+    api.statement = Some(ReleaseStatement {
+        tag: "v1.2.3".to_owned(),
+        commit: OTHER_COMMIT.to_owned(),
+        subjects: Vec::new(),
+    });
+
+    let failure_statement = failure(run(&mut api, CleanupGrant::Authorized));
+
+    let record = incident(&failure_statement);
+    assert_eq!(
+        record.kind(),
+        IncidentKind::MembershipMismatch,
+        "should flag membership"
+    );
+    assert_eq!(
+        record.cleanup(),
+        CleanupOutcome::RetainedImmutable,
+        "should retain"
+    );
+    assert_eq!(
+        api.count(&Call::Delete),
+        0,
+        "should never delete an immutable release"
+    );
+
+    let mut missing_subject = FakeApi::new();
+    let mut statement = correct_statement();
+    statement.subjects.pop();
+    missing_subject.statement = Some(statement);
+    let failure_subject = failure(run(&mut missing_subject, CleanupGrant::Authorized));
+    assert_eq!(
+        incident(&failure_subject).kind(),
+        IncidentKind::MembershipMismatch,
+        "should flag a missing statement subject"
+    );
+}
+
+#[test]
+fn immutable_release_with_wrong_observed_tag_or_commit_is_never_deleted() {
+    let alterations: [fn(&mut fake::FakeRelease); 2] = [
+        |release| release.tag = "v9.9.9".to_owned(),
+        |release| release.commit = OTHER_COMMIT.to_owned(),
+    ];
+    for alter in alterations {
+        let mut api = FakeApi::new();
+        api.statement = Some(correct_statement());
+        api.after_publish = Some(alter);
+
+        let failure = failure(run(&mut api, CleanupGrant::Authorized));
+
+        let record = incident(&failure);
+        assert_eq!(
+            record.kind(),
+            IncidentKind::MembershipMismatch,
+            "should flag the observed release identity"
+        );
+        assert_eq!(
+            record.cleanup(),
+            CleanupOutcome::RetainedImmutable,
+            "should retain"
+        );
+        assert_eq!(
+            api.count(&Call::Delete),
+            0,
+            "should never delete an immutable release"
+        );
+    }
+}
+
+#[test]
+fn unverifiable_statement_raises_incident_without_deletion() {
+    let mut api = FakeApi::new();
+    api.fault(Operation::Statement, Fault::Unreachable);
+
+    let failure = failure(run(&mut api, CleanupGrant::Authorized));
+
+    let record = incident(&failure);
+    assert_eq!(
+        record.kind(),
+        IncidentKind::UnverifiedStatement,
+        "should flag unverified"
+    );
+    assert_eq!(
+        record.cleanup(),
+        CleanupOutcome::RetainedImmutable,
+        "should retain"
+    );
+    assert_eq!(
+        record.api_failure(),
+        Some(ApiFailure::Indeterminate),
+        "should carry the statement failure"
+    );
+    assert_eq!(
+        api.count(&Call::Delete),
+        0,
+        "should never delete an immutable release"
+    );
+}
+
+#[test]
+fn approved_rc_commit_uses_the_same_contents_write_only_role() {
+    let approval = SourceApproval::reviewed_rc("rc/202610").expect("should accept RC branch");
+    let rc = intended_with(approval.clone());
+    let widened = [JobPermission::ContentsWrite, JobPermission::IdTokenWrite];
+    assert!(
+        PublicationRole::from_job(&widened, CleanupGrant::Authorized).is_err(),
+        "should not widen the role for an RC commit"
+    );
+    let mut api = FakeApi::new();
+
+    let release = publish(&mut api, &role(CleanupGrant::NotAuthorized), &rc)
+        .expect("should publish an approved RC commit");
+
+    assert_eq!(
+        release.approval(),
+        &approval,
+        "should record the RC approval"
+    );
+}
+
+#[test]
+fn approved_rc_permission_differences_fail_closed() {
+    let approval = SourceApproval::reviewed_rc("rc/202610").expect("should accept RC branch");
+    let rc = intended_with(approval);
+
+    let mut denied = FakeApi::new();
+    denied.fault(Operation::Publish, Fault::Status(403));
+    let failure_denied = failure(publish(&mut denied, &role(CleanupGrant::Authorized), &rc));
+    assert_message(&failure_denied, "403");
+    assert!(
+        failure_denied.incident().is_none(),
+        "should leave the draft without incident"
+    );
+    assert_eq!(
+        denied.count(&Call::Delete),
+        0,
+        "should not delete after a denied publish"
+    );
+    assert!(
+        denied.releases.values().all(|release| release.draft),
+        "should keep the draft"
+    );
+
+    let mut mutable = FakeApi::new();
+    mutable.immutable_after_publish = Some(false);
+    let failure_mutable = failure(publish(
+        &mut mutable,
+        &role(CleanupGrant::NotAuthorized),
+        &rc,
+    ));
+    let record = incident(&failure_mutable);
+    assert_eq!(
+        record.kind(),
+        IncidentKind::MutablePublication,
+        "should flag mutable release"
+    );
+    assert_eq!(
+        record.cleanup(),
+        CleanupOutcome::NotAuthorized,
+        "should record missing authority"
+    );
+    assert_eq!(
+        mutable.count(&Call::Delete),
+        0,
+        "should not delete without authority"
+    );
+    assert_eq!(
+        mutable.releases.len(),
+        1,
+        "should retain the release for the incident"
+    );
+}
diff --git a/crates/trusted-server-release/src/publication/tests/inputs.rs b/crates/trusted-server-release/src/publication/tests/inputs.rs
new file mode 100644
index 0000000000..311168fa56
--- /dev/null
+++ b/crates/trusted-server-release/src/publication/tests/inputs.rs
@@ -0,0 +1,174 @@
+//! Input validation, bounds, role and concurrency policy.
+
+use super::*;
+
+#[test]
+fn concurrency_group_is_tag_scoped_without_cancellation() {
+    let policy = ConcurrencyPolicy::for_tag(&tag());
+    let other = ConcurrencyPolicy::for_tag(&ReleaseTag::parse("v1.2.4").expect("should parse tag"));
+
+    assert_eq!(
+        policy.group(),
+        "release-publication-v1.2.3",
+        "should scope the group to the tag"
+    );
+    assert_ne!(
+        policy.group(),
+        other.group(),
+        "should not share groups across tags"
+    );
+    assert!(
+        !policy.cancel_in_progress(),
+        "should never cancel a publishing run"
+    );
+}
+
+#[test]
+fn rejects_invalid_tags_assets_and_rc_branches() {
+    for value in [
+        "1.2.3",
+        "v1.2",
+        "v01.2.3",
+        "v1.2.3-",
+        "v1.2.3+",
+        "v1.2.3 ",
+        "refs/tags/v1.2.3",
+    ] {
+        assert!(
+            ReleaseTag::parse(value).is_err(),
+            "should reject tag {value:?}"
+        );
+    }
+    for value in ["v1.2.3", "v1.2.3-rc.1", "v1.2.3-rc.1+build.5"] {
+        assert!(
+            ReleaseTag::parse(value).is_ok(),
+            "should accept tag {value:?}"
+        );
+    }
+    for name in ["", ".hidden", "dir/asset", "asset name"] {
+        assert!(
+            IntendedAsset::new(name, vec![1]).is_err(),
+            "should reject asset name {name:?}"
+        );
+    }
+    let duplicate = vec![
+        IntendedAsset::new("example-server.wasm", vec![1]).expect("should accept asset"),
+        IntendedAsset::new("example-server.wasm", vec![2]).expect("should accept asset"),
+    ];
+    assert!(
+        IntendedRelease::new(tag(), commit(COMMIT), SourceApproval::Main, duplicate).is_err(),
+        "should reject duplicate asset names"
+    );
+    assert!(
+        IntendedRelease::new(tag(), commit(COMMIT), SourceApproval::Main, Vec::new()).is_err(),
+        "should reject an empty asset set"
+    );
+    for branch in ["rc/2026", "rc/202613", "release/202610", "rc/202610-extra"] {
+        assert!(
+            SourceApproval::reviewed_rc(branch).is_err(),
+            "should reject RC branch {branch:?}"
+        );
+    }
+}
+
+fn numbered_assets(count: usize, size: usize) -> Vec<IntendedAsset> {
+    (0..count)
+        .map(|index| {
+            IntendedAsset::new(&format!("example-asset-{index}"), vec![b'x'; size])
+                .expect("should accept asset")
+        })
+        .collect()
+}
+
+#[test]
+fn release_bounds_derive_from_the_index_asset_set_and_role_limits() {
+    let bounds = AssetBounds::release();
+
+    assert_eq!(
+        bounds.count(),
+        32,
+        "should allow four release-wide assets plus seven per index artifact"
+    );
+    assert_eq!(
+        bounds.asset_bytes(),
+        crate::documents::Role::Executable.limit(),
+        "should cap each asset at the executable role limit"
+    );
+    assert!(
+        IntendedRelease::new(
+            tag(),
+            commit(COMMIT),
+            SourceApproval::Main,
+            numbered_assets(33, 1)
+        )
+        .is_err(),
+        "should reject more assets than the index asset set"
+    );
+    assert!(
+        IntendedRelease::new(
+            tag(),
+            commit(COMMIT),
+            SourceApproval::Main,
+            numbered_assets(32, 1)
+        )
+        .is_ok(),
+        "should accept the full index asset set"
+    );
+}
+
+#[test]
+fn rejects_oversized_asset_and_total_under_bounds() {
+    let bounds = AssetBounds::new(4, 8, 12);
+    let build = |assets| {
+        IntendedRelease::new_bounded(tag(), commit(COMMIT), SourceApproval::Main, assets, &bounds)
+    };
+
+    assert!(
+        build(numbered_assets(1, 9)).is_err(),
+        "should reject an asset over the per-asset bound"
+    );
+    assert!(
+        build(numbered_assets(2, 7)).is_err(),
+        "should reject a set over the total bound"
+    );
+    assert!(
+        build(numbered_assets(5, 1)).is_err(),
+        "should reject a set over the count bound"
+    );
+    assert!(
+        build(numbered_assets(2, 6)).is_ok(),
+        "should accept a set within every bound"
+    );
+}
+
+#[test]
+fn role_accepts_only_contents_write() {
+    for granted in [
+        vec![JobPermission::ContentsWrite],
+        vec![JobPermission::ContentsRead, JobPermission::ContentsWrite],
+    ] {
+        assert!(
+            PublicationRole::from_job(&granted, CleanupGrant::NotAuthorized).is_ok(),
+            "should accept {granted:?}"
+        );
+    }
+    for extra in [
+        JobPermission::IdTokenWrite,
+        JobPermission::AttestationsWrite,
+        JobPermission::ActionsRead,
+        JobPermission::ChecksRead,
+        JobPermission::ProviderCredential,
+        JobPermission::RepositorySettings,
+    ] {
+        let granted = [JobPermission::ContentsWrite, extra];
+        assert!(
+            PublicationRole::from_job(&granted, CleanupGrant::Authorized).is_err(),
+            "should reject publication role carrying {extra:?}"
+        );
+    }
+    assert!(
+        PublicationRole::from_job(&[JobPermission::ContentsRead], CleanupGrant::NotAuthorized)
+            .is_err(),
+        "should require contents write"
+    );
+}
diff --git a/crates/trusted-server-release/src/publication/tests/reconciliation.rs b/crates/trusted-server-release/src/publication/tests/reconciliation.rs
new file mode 100644
index 0000000000..f5afcf1f5c
--- /dev/null
+++ b/crates/trusted-server-release/src/publication/tests/reconciliation.rs
@@ -0,0 +1,117 @@
+//! Lost responses reconcile read-only before any other mutation.
+
+use super::*;
+
+#[test]
+fn lost_create_response_reconciles_read_only_before_continuing() {
+    let mut applied = FakeApi::new();
+    applied.fault(Operation::Create, Fault::Lost);
+    run(&mut applied, CleanupGrant::NotAuthorized).expect("should resume the created draft");
+    let create = applied.position(&Call::Create);
+    assert_eq!(
+        applied.calls.get(create + 1),
+        Some(&Call::List),
+        "should reconcile next"
+    );
+    assert_eq!(
+        applied.count(&Call::Create),
+        1,
+        "should not blindly recreate"
+    );
+
+    let mut absent = FakeApi::new();
+    absent.fault(Operation::Create, Fault::Unreachable);
+    let failure = failure(run(&mut absent, CleanupGrant::NotAuthorized));
+    assert_message(&failure, "reconciliation found no draft");
+    assert_eq!(
+        absent.mutations(),
+        vec![Call::Create],
+        "should stop after reconciliation"
+    );
+}
+
+#[test]
+fn lost_upload_response_reconciles_before_another_mutation() {
+    let mut applied = FakeApi::new();
+    applied.fault(Operation::Upload, Fault::Lost);
+    run(&mut applied, CleanupGrant::NotAuthorized).expect("should accept reconciled upload");
+    let first = assets()[0].0.to_owned();
+    assert_eq!(
+        applied.count(&Call::Upload(first)),
+        1,
+        "should not re-upload a reconciled asset"
+    );
+
+    let mut absent = FakeApi::new();
+    absent.fault(Operation::Upload, Fault::Unreachable);
+    let failure = failure(run(&mut absent, CleanupGrant::NotAuthorized));
+    assert_message(&failure, "absent after reconciliation");
+    assert_eq!(absent.count(&Call::Publish), 0, "should not publish");
+
+    absent.calls.clear();
+    run(&mut absent, CleanupGrant::NotAuthorized)
+        .expect("should resume the partial draft on rerun");
+    assert_eq!(
+        absent.count(&Call::Create),
+        0,
+        "should resume the existing draft"
+    );
+}
+
+#[test]
+fn lost_publish_response_reconciles_published_release() {
+    let mut api = FakeApi::new();
+    api.fault(Operation::Publish, Fault::Lost);
+
+    run(&mut api, CleanupGrant::NotAuthorized).expect("should accept reconciled publication");
+
+    assert_eq!(api.count(&Call::Publish), 1, "should not republish");
+}
+
+#[test]
+fn lost_publish_response_with_draft_still_unpublished_fails_without_retry() {
+    let mut api = FakeApi::new();
+    api.fault(Operation::Publish, Fault::Unreachable);
+
+    let failure = failure(run(&mut api, CleanupGrant::Authorized));
+
+    assert_message(&failure, "still unpublished");
+    assert_eq!(
+        api.count(&Call::Publish),
+        1,
+        "should not retry publish blindly"
+    );
+    assert!(
+        failure.incident().is_none(),
+        "should leave a resumable draft, not an incident"
+    );
+}
+
+#[test]
+fn lost_publish_response_with_unknown_state_raises_incident_without_deletion() {
+    let mut api = FakeApi::new();
+    api.fault(Operation::Publish, Fault::Lost);
+    api.reads_after_publish_unknown = true;
+
+    let failure = failure(run(&mut api, CleanupGrant::Authorized));
+
+    let record = incident(&failure);
+    assert_eq!(
+        record.kind(),
+        IncidentKind::UnknownState,
+        "should record unknown state"
+    );
+    assert_eq!(
+        record.cleanup(),
+        CleanupOutcome::NotAttempted,
+        "should not attempt cleanup"
+    );
+    assert_eq!(
+        record.api_failure(),
+        Some(ApiFailure::Indeterminate),
+        "should carry the reconciliation failure"
+    );
+    assert_message(&failure, "Indeterminate");
+    assert_eq!(api.count(&Call::Delete), 0, "should never delete blindly");
+    assert_eq!(api.count(&Call::Publish), 1, "should not mutate again");
+}
diff --git a/crates/trusted-server-release/src/recipe.rs b/crates/trusted-server-release/src/recipe.rs
new file mode 100644
index 0000000000..d26e7cd6fa
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe.rs
@@ -0,0 +1,818 @@
+//! Closed recipe layer for one reproducible Cargo build.
+//!
+//! The recipe validates and binds every input a Cargo execution needs, derives
+//! the exact plan in the build's own path namespace, runs it confined, and
+//! parses and copies the result of a successful run. Only the test-only
+//! ordinary CI tool selection reaches the run, so every completed build is
+//! unqualified candidate evidence; production execution stays closed until a
+//! toolchain, boundary and image are qualified.
+//!
+//! # Roots
+//!
+//! The checkout, the retained JS handoff and the prepared vendor materials are
+//! mounted read-only. The tools are read-only. Two roots are writable: the
+//! fresh `cargo_state` root (Cargo home, `HOME` and `TMPDIR`) and the Cargo
+//! target directory. The output directory is not mounted at all: the host
+//! copies the executable into it after the run.
+
+use std::path::{Path, PathBuf};
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256};
+
+use crate::boundary::BoundaryRoots;
+use crate::composition::origin::WorkspaceOrigins;
+use crate::documents::Role as DocumentRole;
+use crate::error::ReleaseError;
+use crate::javascript::JsBuildCompleted;
+use crate::javascript::RetainedJsModule;
+use crate::materials::PreparedCargoMaterials;
+#[cfg(test)]
+use crate::policy::ReleaseTarget;
+use crate::policy::{FIXED_ARTIFACTS, FixedArtifact};
+use crate::preflight::AuditedEnvironment;
+use crate::preflight::child::{ChildEnvironment, ChildRequest, child_environment};
+use crate::source::{ApprovedSource, CommitId, FreshSource};
+use fresh::{
+    absent_in_real_parent, disjoint, empty_directory, normal_absolute, prepared_materials,
+    real_directory, real_file,
+};
+
+mod ambient;
+mod apple;
+mod artifact;
+mod cargo_home;
+mod cargo_output;
+mod compare;
+mod completed;
+mod execute;
+pub(crate) mod fastly_tools;
+mod final_paths;
+mod fresh;
+pub(crate) mod gnu;
+mod identity;
+mod native;
+mod paths;
+mod plan;
+mod remap;
+mod runtime;
+mod sources;
+mod startup;
+mod tools;
+
+pub(crate) use ambient::{
+    AmbientClaim, AmbientProfile, CheckedAmbient, Dimension, ObservedAmbient,
+};
+#[allow(
+    unused_imports,
+    reason = "the qualified Apple selection has no production caller yet"
+)]
+pub(crate) use apple::{
+    AppleDeveloperTools, AppleToolEvidence, AppleToolFacts, QualifiedAppleTools,
+};
+pub(crate) use artifact::copy_artifact;
+pub(crate) use cargo_output::successful_messages as observed_cargo_messages;
+pub(crate) use compare::FastlyEqualityChecked;
+pub(crate) use completed::RecipeCompleted;
+pub(crate) use identity::{ExactInvocationDigest, RecipeDefinitionIdentity};
+pub(crate) use paths::ExecutionPaths;
+pub(crate) use plan::CargoPlan;
+pub(crate) use runtime::FastlyRuntimeAccepted;
+pub(crate) use startup::NativeStartupAccepted;
+#[allow(
+    unused_imports,
+    reason = "the qualified selection has no production caller yet"
+)]
+pub(crate) use tools::{
+    Authority, QualifiedRustTools, RustToolEvidence, SelectedRustTools, ToolSelection,
+};
+
+#[cfg(test)]
+use execute::RunOutput;
+use execute::retained_tree_digest;
+use plan::{PlanInputs, check_child_state, plan_for};
+
+/// The only released feature variant of every asset.
+const DEFAULT_VARIANT: &str = "default";
+
+/// Builds a recipe error carrying `message`.
+pub(crate) fn recipe_error(message: impl std::fmt::Display) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Recipe).attach(message.to_string())
+}
+
+/// One source-owned asset identity, reachable only through the fixed table.
+#[derive(Clone, Copy)]
+pub(crate) struct AssetId {
+    artifact: &'static FixedArtifact,
+}
+
+impl std::fmt::Debug for AssetId {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_tuple("AssetId")
+            .field(&self.artifact.name)
+            .finish()
+    }
+}
+
+impl PartialEq for AssetId {
+    fn eq(&self, other: &Self) -> bool {
+        self.artifact.name == other.artifact.name
+    }
+}
+
+impl Eq for AssetId {}
+
+impl AssetId {
+    /// Resolves an asset name against the compiled fixed table.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] for any name not in the table.
+    pub(crate) fn parse(name: &str) -> Result<Self, Report<ReleaseError>> {
+        FIXED_ARTIFACTS
+            .iter()
+            .find(|artifact| artifact.name == name)
+            .map(|artifact| Self { artifact })
+            .ok_or_else(|| recipe_error(format!("unknown asset id {name:?}")))
+    }
+
+    /// Returns the fixed table row; JSON can never supply its fields.
+    pub(crate) fn artifact(&self) -> &'static FixedArtifact {
+        self.artifact
+    }
+
+    /// Resolves a Cargo denial fixture member by package name, for tests only.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] for any package not in the test rows.
+    #[cfg(test)]
+    pub(crate) fn denial_fixture(package: &str) -> Result<Self, Report<ReleaseError>> {
+        crate::policy::DENIAL_FIXTURE_ARTIFACTS
+            .iter()
+            .find(|artifact| artifact.package == package)
+            .map(|artifact| Self { artifact })
+            .ok_or_else(|| recipe_error(format!("unknown denial fixture member {package:?}")))
+    }
+
+    /// Resolves a Cargo denial fixture member built for a Darwin `target`,
+    /// for tests only.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] for any package or target not in the
+    /// Darwin test rows.
+    #[cfg(test)]
+    pub(crate) fn darwin_denial_fixture(
+        package: &str,
+        target: ReleaseTarget,
+    ) -> Result<Self, Report<ReleaseError>> {
+        crate::policy::DARWIN_DENIAL_FIXTURE_ARTIFACTS
+            .iter()
+            .find(|artifact| artifact.package == package && artifact.target == target)
+            .map(|artifact| Self { artifact })
+            .ok_or_else(|| {
+                recipe_error(format!(
+                    "unknown Darwin denial fixture member {package:?} for {}",
+                    target.triple()
+                ))
+            })
+    }
+}
+
+/// Which independent build of the pair a recipe belongs to.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum Role {
+    /// The canonical build whose output is proposed for publication.
+    Canonical,
+    /// The independent reproduction under varied ambient conditions, which
+    /// must match the canonical build.
+    Reproduction,
+}
+
+impl Role {
+    /// Parses exactly `A` or `B`, the external spelling of the two roles.
+    ///
+    /// The spec (R-REPEAT, "Build A" and "Build B") and the closed
+    /// `build.sh --role A|B` interface of the implementation plan (Task 9)
+    /// name the roles `A` and `B`, as do the tracked `ambient_profiles` keys
+    /// of `release-tools.json`. This and [`Self::spec_label`] are the only
+    /// places that spelling maps to [`Self::Canonical`] and
+    /// [`Self::Reproduction`].
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] for any other text.
+    pub(crate) fn parse(text: &str) -> Result<Self, Report<ReleaseError>> {
+        match text {
+            "A" => Ok(Self::Canonical),
+            "B" => Ok(Self::Reproduction),
+            _ => Err(recipe_error(format!(
+                "unknown role {text:?}; expected A or B"
+            ))),
+        }
+    }
+
+    /// Returns the external spelling [`Self::parse`] accepts for this role.
+    pub(crate) fn spec_label(self) -> &'static str {
+        match self {
+            Self::Canonical => "A",
+            Self::Reproduction => "B",
+        }
+    }
+}
+
+/// Requires the default feature variant.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Recipe`] for any other variant name.
+pub(crate) fn check_variant(variant: &str) -> Result<(), Report<ReleaseError>> {
+    if variant != DEFAULT_VARIANT {
+        return Err(recipe_error(format!(
+            "variant {variant:?} is rejected; only the default feature set is released"
+        )));
+    }
+    Ok(())
+}
+
+/// Unvalidated textual request fields, exactly as an operator supplied them.
+pub(crate) struct RecipeInput<'a> {
+    /// Asset name, resolved only against the compiled fixed table.
+    pub(crate) asset: &'a str,
+    /// Feature variant; only `default` is accepted.
+    pub(crate) variant: &'a str,
+    /// `A` (canonical) or `B` (reproduction); see [`Role::parse`].
+    pub(crate) role: &'a str,
+    /// Approved 40-digit source commit.
+    pub(crate) commit: &'a str,
+    /// Retained directory of the final JS bundles.
+    pub(crate) js_dir: &'a Path,
+    /// Retained JS inventory file beside the bundle directory.
+    pub(crate) js_inventory: &'a Path,
+    /// Prepared materials root holding exactly the vendor directory.
+    pub(crate) materials: &'a Path,
+    /// Fresh empty directory for Cargo home, `HOME` and `TMPDIR`.
+    pub(crate) cargo_state: &'a Path,
+    /// Fresh empty directory receiving the built artifact; never mounted.
+    pub(crate) output: &'a Path,
+    /// Cargo target directory; must not exist yet.
+    pub(crate) target_dir: &'a Path,
+}
+
+/// Checks the lexical form, freshness and disjointness of every request path.
+fn check_roots(input: &RecipeInput<'_>) -> Result<(), Report<ReleaseError>> {
+    let paths = [
+        ("JS bundle directory", input.js_dir),
+        ("JS inventory", input.js_inventory),
+        ("materials root", input.materials),
+        ("cargo state root", input.cargo_state),
+        ("output root", input.output),
+        ("target directory", input.target_dir),
+    ];
+    for (label, path) in paths {
+        normal_absolute(label, path)?;
+    }
+    real_directory(paths[0].0, input.js_dir)?;
+    real_file(paths[1].0, input.js_inventory)?;
+    let retained = input
+        .js_dir
+        .parent()
+        .ok_or_else(|| recipe_error("JS bundle directory has no retained parent"))?;
+    if input.js_inventory.parent() != Some(retained) {
+        return Err(recipe_error(
+            "JS inventory must sit beside the JS bundle directory in the retained root",
+        ));
+    }
+    prepared_materials(paths[2].0, input.materials)?;
+    empty_directory(paths[3].0, input.cargo_state)?;
+    empty_directory(paths[4].0, input.output)?;
+    absent_in_real_parent(paths[5].0, input.target_dir)?;
+    disjoint(&[
+        ("retained JS root", retained),
+        paths[2],
+        paths[3],
+        paths[4],
+        paths[5],
+    ])?;
+    Ok(())
+}
+
+/// A validated recipe request with fresh, disjoint roots.
+#[derive(Debug)]
+pub(crate) struct RecipeRequest {
+    asset: AssetId,
+    role: Role,
+    commit: CommitId,
+    js_dir: PathBuf,
+    js_inventory: PathBuf,
+    materials: PathBuf,
+    cargo_state: PathBuf,
+    output: PathBuf,
+    target_dir: PathBuf,
+}
+
+impl RecipeRequest {
+    /// Parses and validates one request against the compiled cohort and disk.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] for an unknown asset or role, a
+    /// non-default variant, a malformed commit, non-normal or aliased paths, a
+    /// materials root that is not exactly a prepared vendor directory, a
+    /// reused state, output or target root, or overlapping roots.
+    pub(crate) fn parse(input: &RecipeInput<'_>) -> Result<Self, Report<ReleaseError>> {
+        check_variant(input.variant)?;
+        let asset = AssetId::parse(input.asset)?;
+        Self::with_asset(asset, input)
+    }
+
+    /// Parses a request for an already resolved test-only asset; the asset
+    /// text of `input` is ignored.
+    ///
+    /// # Errors
+    ///
+    /// As [`Self::parse`], except for the asset name.
+    #[cfg(test)]
+    pub(crate) fn parse_for_asset(
+        asset: AssetId,
+        input: &RecipeInput<'_>,
+    ) -> Result<Self, Report<ReleaseError>> {
+        check_variant(input.variant)?;
+        Self::with_asset(asset, input)
+    }
+
+    /// Validates every field but the asset, which the caller resolved.
+    fn with_asset(asset: AssetId, input: &RecipeInput<'_>) -> Result<Self, Report<ReleaseError>> {
+        let role = Role::parse(input.role)?;
+        let commit = CommitId::parse(input.commit)?;
+        check_roots(input)?;
+        Ok(Self {
+            asset,
+            role,
+            commit,
+            js_dir: input.js_dir.to_owned(),
+            js_inventory: input.js_inventory.to_owned(),
+            materials: input.materials.to_owned(),
+            cargo_state: input.cargo_state.to_owned(),
+            output: input.output.to_owned(),
+            target_dir: input.target_dir.to_owned(),
+        })
+    }
+
+    pub(super) fn asset(&self) -> AssetId {
+        self.asset
+    }
+
+    pub(super) fn js_dir(&self) -> &Path {
+        &self.js_dir
+    }
+
+    pub(super) fn js_inventory(&self) -> &Path {
+        &self.js_inventory
+    }
+
+    pub(super) fn target_dir(&self) -> &Path {
+        &self.target_dir
+    }
+
+    /// Private `HOME` below the writable cargo state root.
+    pub(super) fn home(&self) -> PathBuf {
+        self.cargo_state.join("home")
+    }
+
+    /// Private Cargo home below the writable cargo state root.
+    pub(super) fn cargo_home(&self) -> PathBuf {
+        self.cargo_state.join("cargo-home")
+    }
+
+    /// Private `TMPDIR` below the writable cargo state root.
+    pub(super) fn tmpdir(&self) -> PathBuf {
+        self.cargo_state.join("tmp")
+    }
+}
+
+/// Derives the private locations a child build receives from the request.
+fn child_request(request: &RecipeRequest) -> ChildRequest {
+    ChildRequest {
+        target: request.asset.artifact().target,
+        home: request.home(),
+        cargo_home: request.cargo_home(),
+        tool_directories: Vec::new(),
+    }
+}
+
+/// JS handoff digests an attestation binds.
+#[derive(Debug)]
+struct JsFacts {
+    inventory_sha256: String,
+    settings_sha256: String,
+    tools_sha256: String,
+    modules: Vec<RetainedJsModule>,
+    contributions: Option<crate::javascript::contributions::RetainedContributions>,
+}
+
+/// Source authority of one recipe; bypass exists only in explicit test fixtures.
+enum WorkspaceSelection {
+    Approved(Box<ApprovedWorkspace>),
+    #[cfg(test)]
+    Fixture,
+}
+
+struct ApprovedWorkspace {
+    origins: WorkspaceOrigins,
+    definition: RecipeDefinitionIdentity,
+}
+
+/// Everything [`PreparedRecipe::bind`] cross-checks before a recipe may run.
+struct BindInputs<'a> {
+    commit: &'a CommitId,
+    workspace: WorkspaceSelection,
+    child: ChildEnvironment,
+    completed: &'a JsBuildCompleted,
+    tools: SelectedRustTools,
+    materials: PreparedCargoMaterials,
+    ambient: CheckedAmbient,
+    request: RecipeRequest,
+}
+
+/// A recipe whose source, JS handoff, tools, materials, ambient and roots are bound.
+pub(crate) struct PreparedRecipe {
+    request: RecipeRequest,
+    tools: SelectedRustTools,
+    tools_digest: String,
+    materials: PreparedCargoMaterials,
+    ambient: CheckedAmbient,
+    child: ChildEnvironment,
+    retained_root: PathBuf,
+    retained_digest: String,
+    js: JsFacts,
+    workspace: WorkspaceSelection,
+}
+
+impl PreparedRecipe {
+    /// Binds the locally authenticated source and a fresh private checkout.
+    ///
+    /// The commit and committer epoch reach the child environment only
+    /// through [`child_environment`], which requires the authenticated source.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] when the fresh checkout is not the
+    /// approved commit or not the ambient checkout root, the prepared
+    /// materials were derived from another `Cargo.lock`, the tracked Cargo
+    /// configuration sets `build.rustflags`, which the path remap would
+    /// supersede, a legacy extensionless `.cargo/config` is tracked or on
+    /// disk at the checkout root, or as [`Self::bind`].
+    #[allow(
+        clippy::too_many_arguments,
+        reason = "each argument is a distinct authority"
+    )]
+    pub(crate) fn new(
+        source: &ApprovedSource,
+        fresh: &FreshSource,
+        audited: &AuditedEnvironment,
+        completed: &JsBuildCompleted,
+        tools: SelectedRustTools,
+        materials: PreparedCargoMaterials,
+        ambient: CheckedAmbient,
+        request: RecipeRequest,
+    ) -> Result<Self, Report<ReleaseError>> {
+        if fresh.commit() != source.commit().as_str() {
+            return Err(recipe_error("fresh checkout is not the approved commit"));
+        }
+        if fresh.root() != ambient.checkout_root() {
+            return Err(recipe_error(
+                "fresh checkout is not the ambient checkout root",
+            ));
+        }
+        let lock = source
+            .read_tracked("Cargo.lock", DocumentRole::Metadata)
+            .map_err(|error| error.change_context(ReleaseError::Recipe))?;
+        if hex::encode(Sha256::digest(&lock)) != materials.cargo_lock_sha256() {
+            return Err(recipe_error(
+                "prepared materials were derived from another Cargo.lock",
+            ));
+        }
+        let config = source
+            .read_tracked(remap::CARGO_CONFIG, DocumentRole::Metadata)
+            .map_err(|error| error.change_context(ReleaseError::Recipe))?;
+        remap::check_cargo_config(&config)?;
+        remap::check_no_extensionless_config(
+            fresh.root(),
+            source.tracked_sha256(remap::LEGACY_CARGO_CONFIG).is_some(),
+        )?;
+        let child = child_environment(audited, source, &child_request(&request))?;
+        let workspace = ApprovedWorkspace {
+            origins: WorkspaceOrigins::bind(source, fresh)?,
+            definition: RecipeDefinitionIdentity::from_source(source, request.asset)?,
+        };
+        Self::bind(BindInputs {
+            commit: source.commit(),
+            workspace: WorkspaceSelection::Approved(Box::new(workspace)),
+            child,
+            completed,
+            tools,
+            materials,
+            ambient,
+            request,
+        })
+    }
+
+    /// Cross-checks every input and creates the fresh target and state directories.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] when the request, JS handoff, child
+    /// environment or materials name another commit, the JS handoff no longer
+    /// rehashes or is not the requested directory, the materials are not the
+    /// requested root or changed, the tools were selected for another target,
+    /// the ambient role differs, a root is no longer fresh, the checkout,
+    /// tools, retained JS, materials, state, target and Apple developer roots
+    /// overlap, Apple developer tools are missing for a Darwin asset, given
+    /// for another, carry another authority or no longer rehash, or a Darwin
+    /// tool root and target directory do not share one parent.
+    fn bind(inputs: BindInputs<'_>) -> Result<Self, Report<ReleaseError>> {
+        check_commits(&inputs)?;
+        check_parts(&inputs)?;
+        let BindInputs {
+            workspace,
+            child,
+            completed,
+            tools,
+            materials,
+            ambient,
+            request,
+            ..
+        } = inputs;
+        let retained_root = resolve_js_handoff(completed, &request)?;
+        check_fresh_and_disjoint(&request, &ambient, &tools, &materials, &retained_root)?;
+        check_recipe_owned_parent(&request, &tools)?;
+        let tools_digest = tools.digest()?;
+        let retained_digest = retained_tree_digest(&retained_root)?;
+        let contributions = match &workspace {
+            WorkspaceSelection::Approved(_) => Some(completed.retained_contributions()?),
+            #[cfg(test)]
+            WorkspaceSelection::Fixture => None,
+        };
+        create_private_roots(&request)?;
+        Ok(Self {
+            js: JsFacts {
+                inventory_sha256: completed.inventory_sha256().to_owned(),
+                settings_sha256: completed.settings_sha256().to_owned(),
+                tools_sha256: completed.tools_sha256().to_owned(),
+                modules: completed.retained_modules()?,
+                contributions,
+            },
+            request,
+            tools,
+            tools_digest,
+            materials,
+            ambient,
+            child,
+            retained_root,
+            retained_digest,
+            workspace,
+        })
+    }
+
+    /// Derives the exact Cargo invocation in the namespace `paths` describes.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] when any path variable, the tool
+    /// directory or the vendor directory is outside the roots `paths` knows.
+    pub(crate) fn plan(
+        &self,
+        paths: &dyn ExecutionPaths,
+    ) -> Result<CargoPlan, Report<ReleaseError>> {
+        plan_for(&PlanInputs {
+            request: &self.request,
+            tools: &self.tools,
+            ambient: &self.ambient,
+            child: &self.child,
+            materials: &self.materials,
+            paths,
+        })
+    }
+
+    /// Returns the boundary roles this recipe requires.
+    ///
+    /// The checkout, retained JS and prepared materials are read-only. Cargo
+    /// home, `HOME`, `TMPDIR` and the target directory are the only writable
+    /// roots, and the output directory is not mounted. A Darwin build adds
+    /// its detached SDK as a scanned immutable root and the Apple developer
+    /// directory as its only read-and-execute system root. Explicit lexical
+    /// test fixtures have no detached SDK root.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] for missing or overlapping roots.
+    pub(crate) fn boundary_roots(&self) -> Result<BoundaryRoots, Report<ReleaseError>> {
+        let mut immutable = vec![
+            self.ambient.checkout_root().to_owned(),
+            self.retained_root.clone(),
+            self.request.materials.clone(),
+        ];
+        if let Some(sdk) = self
+            .tools
+            .apple()
+            .and_then(AppleDeveloperTools::owned_sdk_root)
+        {
+            immutable.push(sdk.to_owned());
+        }
+        let roots = BoundaryRoots::new(
+            &immutable,
+            std::slice::from_ref(&self.tools.root().to_owned()),
+            &[
+                self.request.cargo_state.clone(),
+                self.request.target_dir.clone(),
+            ],
+        )?;
+        match self.tools.apple() {
+            Some(apple) => roots.with_system(&[apple.developer_dir().to_owned()]),
+            None => Ok(roots),
+        }
+    }
+}
+
+/// Child variable carrying the authenticated source commit.
+const SOURCE_COMMIT_VARIABLE: &str = "TRUSTED_SERVER__GIT_VERSION";
+
+/// Requires the request, JS handoff, child environment and materials to name
+/// the approved commit.
+fn check_commits(inputs: &BindInputs<'_>) -> Result<(), Report<ReleaseError>> {
+    let commit = inputs.commit;
+    if inputs.request.commit != *commit {
+        return Err(recipe_error("request names another source commit"));
+    }
+    if inputs.completed.source_commit() != commit.as_str() {
+        return Err(recipe_error(
+            "JS handoff was built from another source commit",
+        ));
+    }
+    let child_commit = inputs
+        .child
+        .variables()
+        .get(SOURCE_COMMIT_VARIABLE)
+        .map(String::as_str);
+    if child_commit != Some(commit.as_str()) {
+        return Err(recipe_error(
+            "child environment names another source commit",
+        ));
+    }
+    if inputs.materials.source_commit() != commit.as_str() {
+        return Err(recipe_error(
+            "prepared materials were derived from another source commit",
+        ));
+    }
+    Ok(())
+}
+
+/// Requires the materials, tools, ambient role and child state to match the request.
+fn check_parts(inputs: &BindInputs<'_>) -> Result<(), Report<ReleaseError>> {
+    let request = &inputs.request;
+    if inputs.materials.root().as_os_str() != request.materials.as_os_str() {
+        return Err(recipe_error("request does not name the prepared materials"));
+    }
+    inputs.materials.rehash().map_err(|error| {
+        error
+            .change_context(ReleaseError::Recipe)
+            .attach("prepared materials no longer rehash")
+    })?;
+    if inputs.tools.target() != request.asset.artifact().target {
+        return Err(recipe_error(
+            "Rust tools were selected for another target than the asset",
+        ));
+    }
+    if inputs.ambient.role() != request.role {
+        return Err(recipe_error("ambient role differs from the request role"));
+    }
+    check_apple_tools(request, &inputs.tools)?;
+    check_child_state(request, &inputs.child)
+}
+
+/// Requires Apple developer tools for exactly the Darwin targets, carrying
+/// the Rust tools' authority and still matching their record.
+fn check_apple_tools(
+    request: &RecipeRequest,
+    tools: &SelectedRustTools,
+) -> Result<(), Report<ReleaseError>> {
+    let darwin = request.asset.artifact().target.is_darwin();
+    let apple = match (darwin, tools.apple()) {
+        (false, None) => return Ok(()),
+        (false, Some(_)) => {
+            return Err(recipe_error(
+                "only Darwin assets take Apple developer tools",
+            ));
+        }
+        (true, None) => {
+            return Err(recipe_error("Darwin assets require Apple developer tools"));
+        }
+        (true, Some(apple)) => apple,
+    };
+    if apple.authority() != tools.authority() {
+        return Err(recipe_error(
+            "Apple developer tools and Rust tools carry different authority",
+        ));
+    }
+    apple.verify()
+}
+
+/// Requires a Darwin build's Rust tool root and target directory to be
+/// direct children of one recipe-owned parent.
+///
+/// The linker strips that parent from every debug-map object path
+/// (`-oso_prefix`), so the standard library objects and the build's own
+/// objects both become relative.
+fn check_recipe_owned_parent(
+    request: &RecipeRequest,
+    tools: &SelectedRustTools,
+) -> Result<(), Report<ReleaseError>> {
+    if tools.apple().is_none() {
+        return Ok(());
+    }
+    let target_parent = request
+        .target_dir
+        .parent()
+        .ok_or_else(|| recipe_error("Darwin target directory has no parent"))?;
+    let target_parent = std::fs::canonicalize(target_parent).map_err(|error| {
+        recipe_error(format!(
+            "cannot resolve the Darwin target directory's parent: {error}"
+        ))
+    })?;
+    if tools.root().parent() != Some(target_parent.as_path()) {
+        return Err(recipe_error(
+            "Darwin Rust tool root and target directory must be direct children of one \
+             recipe-owned parent",
+        ));
+    }
+    Ok(())
+}
+
+/// Rehashes the JS handoff and requires the request to name its directories.
+fn resolve_js_handoff(
+    completed: &JsBuildCompleted,
+    request: &RecipeRequest,
+) -> Result<PathBuf, Report<ReleaseError>> {
+    let retained = completed.rehash_for_handoff().map_err(|error| {
+        error
+            .change_context(ReleaseError::Recipe)
+            .attach("JS handoff no longer rehashes")
+    })?;
+    let retained_root = std::fs::canonicalize(retained)
+        .map_err(|error| recipe_error(format!("cannot resolve JS handoff: {error}")))?;
+    if request.js_dir != retained_root.join("bundles")
+        || request.js_inventory != retained_root.join("tsjs-inventory.json")
+    {
+        return Err(recipe_error("request does not name the JS handoff"));
+    }
+    Ok(retained_root)
+}
+
+/// Creates the fresh target directory and the private cargo state directories.
+fn create_private_roots(request: &RecipeRequest) -> Result<(), Report<ReleaseError>> {
+    std::fs::create_dir(&request.target_dir)
+        .map_err(|error| recipe_error(format!("cannot create fresh target: {error}")))?;
+    for state in [request.home(), request.cargo_home(), request.tmpdir()] {
+        std::fs::create_dir(&state)
+            .map_err(|error| recipe_error(format!("cannot create cargo state: {error}")))?;
+    }
+    Ok(())
+}
+
+/// Re-checks root freshness and disjointness immediately before the target is created.
+fn check_fresh_and_disjoint(
+    request: &RecipeRequest,
+    ambient: &CheckedAmbient,
+    tools: &SelectedRustTools,
+    materials: &PreparedCargoMaterials,
+    retained_root: &Path,
+) -> Result<(), Report<ReleaseError>> {
+    prepared_materials("materials root", &request.materials)?;
+    empty_directory("cargo state root", &request.cargo_state)?;
+    empty_directory("output root", &request.output)?;
+    absent_in_real_parent("target directory", &request.target_dir)?;
+    let checkout = std::fs::canonicalize(ambient.checkout_root())
+        .map_err(|error| recipe_error(format!("cannot resolve checkout root: {error}")))?;
+    let mut roots = vec![
+        ("checkout root", checkout.as_path()),
+        ("Rust tools root", tools.root()),
+        ("retained JS root", retained_root),
+        ("materials root", materials.root()),
+        ("cargo state root", request.cargo_state.as_path()),
+        ("output root", request.output.as_path()),
+        ("target directory", request.target_dir.as_path()),
+    ];
+    if let Some(apple) = tools.apple() {
+        roots.push(("Apple developer directory", apple.developer_dir()));
+        if let Some(sdk) = apple.owned_sdk_root() {
+            roots.push(("owned Apple SDK", sdk));
+        }
+    }
+    disjoint(&roots)
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/trusted-server-release/src/recipe/ambient.rs b/crates/trusted-server-release/src/recipe/ambient.rs
new file mode 100644
index 0000000000..217f40729d
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/ambient.rs
@@ -0,0 +1,459 @@
+//! Ambient build conditions: compiled profiles, observations and the
+//! canonical/reproduction pairing.
+
+use std::collections::BTreeSet;
+use std::path::{Path, PathBuf};
+
+use error_stack::Report;
+use serde_json::{Value, json};
+
+use super::fresh::{disjoint, normal_absolute};
+use super::{Role, recipe_error};
+use crate::boundary::Umask;
+use crate::error::ReleaseError;
+
+/// Locale every compiler child sees, whatever the host reports.
+const NORMALIZED_LOCALE: &str = "C";
+/// Timezone every compiler child sees, whatever the host reports.
+const NORMALIZED_TIMEZONE: &str = "UTC";
+
+/// A qualified alternate reproduction profile; none exists, so the production
+/// reproduction build stays closed.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum QualifiedAlternate {}
+
+/// One compiled ambient profile an independent build must run under.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct AmbientProfile {
+    checkout_root: &'static str,
+    execution_user: &'static str,
+    jobs: u32,
+    locale: &'static str,
+    timezone: &'static str,
+    umask: u32,
+}
+
+impl AmbientProfile {
+    /// Profile of the canonical build; its symbolic user and root are
+    /// qualification-selected.
+    pub(crate) const CANONICAL: Self = Self {
+        checkout_root: "external-release-A",
+        execution_user: "qualification-selected",
+        jobs: 4,
+        locale: NORMALIZED_LOCALE,
+        timezone: NORMALIZED_TIMEZONE,
+        umask: 0o022,
+    };
+
+    /// Placeholder of the reproduction build; its alternates await qualification.
+    pub(crate) const REPRODUCTION_PENDING: Self = Self {
+        checkout_root: "external-release-B",
+        execution_user: "qualified-alternate-or-unsupported",
+        jobs: 2,
+        locale: "qualification-selected-alternate",
+        timezone: "qualification-selected-alternate",
+        umask: 0o027,
+    };
+
+    /// Selects the production profile of `role`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Unqualified`] for the reproduction build: its
+    /// alternate locale, timezone and user have not been qualified.
+    pub(crate) fn for_role(role: Role) -> Result<Self, Report<ReleaseError>> {
+        match role {
+            Role::Canonical => Ok(Self::CANONICAL),
+            Role::Reproduction => Err(Report::new(ReleaseError::Unqualified)
+                .attach("reproduction build alternate ambient profile is not qualified")),
+        }
+    }
+
+    /// Accepts only a qualified alternate; production construction stays closed.
+    pub(crate) fn alternate(qualification: QualifiedAlternate) -> Self {
+        match qualification {}
+    }
+
+    /// Selects a fictional alternate for tests without asserting qualification.
+    #[cfg(test)]
+    pub(crate) fn alternate_for_tests() -> Self {
+        Self::alternate_with_host_for_tests("en_US.UTF-8", "Pacific/Auckland")
+    }
+
+    /// As [`Self::alternate_for_tests`], with an explicit host locale and timezone.
+    #[cfg(test)]
+    pub(crate) fn alternate_with_host_for_tests(
+        locale: &'static str,
+        timezone: &'static str,
+    ) -> Self {
+        Self {
+            locale,
+            timezone,
+            execution_user: "qualification-selected",
+            ..Self::REPRODUCTION_PENDING
+        }
+    }
+
+    /// The compiled profiles `release-tools.json` tracks, by role.
+    fn tracked() -> [(Role, Self); 2] {
+        [
+            (Role::Canonical, Self::CANONICAL),
+            (Role::Reproduction, Self::REPRODUCTION_PENDING),
+        ]
+    }
+
+    /// Renders the `ambient_profiles` map exactly as `release-tools.json`
+    /// states it, keyed by each role's [`Role::spec_label`].
+    pub(crate) fn tracked_json() -> Value {
+        Value::Object(
+            Self::tracked()
+                .into_iter()
+                .map(|(role, profile)| (role.spec_label().to_owned(), profile.to_json()))
+                .collect(),
+        )
+    }
+
+    /// Renders the profile exactly as `release-tools.json` states it.
+    pub(crate) fn to_json(&self) -> Value {
+        json!({
+            "checkout_root": self.checkout_root,
+            "execution_user": self.execution_user,
+            "jobs": self.jobs,
+            "locale": self.locale,
+            "timezone": self.timezone,
+            "umask": format!("{:03o}", self.umask),
+        })
+    }
+}
+
+/// Fails when tracked `ambient_profiles` settings differ from the compiled profiles.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Recipe`] naming the profile that drifted.
+pub(crate) fn check_profile_drift(settings: &Value) -> Result<(), Report<ReleaseError>> {
+    for (role, compiled) in AmbientProfile::tracked() {
+        let name = role.spec_label();
+        if settings["ambient_profiles"][name] != compiled.to_json() {
+            return Err(recipe_error(format!(
+                "tracked ambient profile {name} differs from the compiled profile"
+            )));
+        }
+    }
+    Ok(())
+}
+
+/// One independently varied or normalized build condition.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, derive_more::Display)]
+pub(crate) enum Dimension {
+    /// Process umask.
+    Umask,
+    /// Cargo job count.
+    Jobs,
+    /// Checkout root path.
+    CheckoutRoot,
+    /// Build start time.
+    StartTime,
+    /// Host and compiler locale.
+    Locale,
+    /// Host and compiler timezone.
+    Timezone,
+    /// Executing user.
+    ExecutionUser,
+}
+
+impl Dimension {
+    /// Every dimension a pair must account for.
+    pub(crate) const ALL: [Self; 7] = [
+        Self::Umask,
+        Self::Jobs,
+        Self::CheckoutRoot,
+        Self::StartTime,
+        Self::Locale,
+        Self::Timezone,
+        Self::ExecutionUser,
+    ];
+}
+
+/// How one dimension is reported in the canonical/reproduction pair.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Treatment {
+    Varied,
+    Normalized,
+    Unsupported,
+}
+
+/// Conditions an observer reported for one build; carries no authority itself.
+#[derive(Clone, Debug)]
+pub(crate) struct ObservedAmbient {
+    /// Process umask of the build, as a numeric mode.
+    pub(crate) umask: u32,
+    /// Cargo job count of the build.
+    pub(crate) jobs: u32,
+    /// Locale of the host session.
+    pub(crate) host_locale: String,
+    /// Timezone of the host session.
+    pub(crate) host_timezone: String,
+    /// Locale the compiler child saw.
+    pub(crate) child_locale: String,
+    /// Timezone the compiler child saw.
+    pub(crate) child_timezone: String,
+    /// Numeric id of the executing user.
+    pub(crate) execution_uid: u32,
+    /// Absolute checkout root of the build.
+    pub(crate) checkout_root: PathBuf,
+    /// Unix start time of the build in seconds.
+    pub(crate) started_at_seconds: u64,
+}
+
+/// Observed conditions that match the compiled profile of one role.
+#[derive(Clone, Debug)]
+pub(crate) struct CheckedAmbient {
+    role: Role,
+    profile: AmbientProfile,
+    observed: ObservedAmbient,
+}
+
+impl CheckedAmbient {
+    /// Checks `observed` against the profile compiled for `role`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] when the profile does not belong to
+    /// the role, or the observed umask, jobs, host locale or timezone differ
+    /// from it, the compiler child is not normalized, or the checkout root is
+    /// not an absolute normal path.
+    pub(crate) fn check(
+        role: Role,
+        profile: &AmbientProfile,
+        observed: ObservedAmbient,
+    ) -> Result<Self, Report<ReleaseError>> {
+        check_profile_role(role, profile)?;
+        same("umask", &observed.umask, &profile.umask)?;
+        same("jobs", &observed.jobs, &profile.jobs)?;
+        same(
+            "host locale",
+            &observed.host_locale.as_str(),
+            &profile.locale,
+        )?;
+        same(
+            "host timezone",
+            &observed.host_timezone.as_str(),
+            &profile.timezone,
+        )?;
+        same(
+            "child locale",
+            &observed.child_locale.as_str(),
+            &NORMALIZED_LOCALE,
+        )?;
+        same(
+            "child timezone",
+            &observed.child_timezone.as_str(),
+            &NORMALIZED_TIMEZONE,
+        )?;
+        normal_absolute("checkout root", &observed.checkout_root)?;
+        Ok(Self {
+            role,
+            profile: profile.clone(),
+            observed,
+        })
+    }
+
+    /// Returns the checked role.
+    pub(crate) fn role(&self) -> Role {
+        self.role
+    }
+
+    /// Returns the Cargo job count the profile fixes.
+    pub(crate) fn jobs(&self) -> u32 {
+        self.profile.jobs
+    }
+
+    /// Returns the umask the profile fixes.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Process`] when the compiled mask is not a
+    /// valid permission mask.
+    pub(crate) fn umask(&self) -> Result<Umask, Report<ReleaseError>> {
+        Umask::new(self.profile.umask)
+    }
+
+    /// Returns the checkout root this build runs in.
+    pub(crate) fn checkout_root(&self) -> &Path {
+        &self.observed.checkout_root
+    }
+
+    /// Returns the observed conditions that matched the profile.
+    pub(crate) fn observed(&self) -> &ObservedAmbient {
+        &self.observed
+    }
+}
+
+/// Requires an observed value to equal the profile's value.
+fn same<T: PartialEq + std::fmt::Debug>(
+    name: &str,
+    observed: &T,
+    expected: &T,
+) -> Result<(), Report<ReleaseError>> {
+    if observed == expected {
+        return Ok(());
+    }
+    Err(recipe_error(format!(
+        "observed {name} {observed:?} differs from profile {expected:?}"
+    )))
+}
+
+/// Requires the profile to be the runnable one compiled for `role`.
+fn check_profile_role(role: Role, profile: &AmbientProfile) -> Result<(), Report<ReleaseError>> {
+    let belongs = match role {
+        Role::Canonical => *profile == AmbientProfile::CANONICAL,
+        Role::Reproduction => {
+            *profile != AmbientProfile::REPRODUCTION_PENDING
+                && profile.umask != AmbientProfile::CANONICAL.umask
+                && profile.jobs != AmbientProfile::CANONICAL.jobs
+                && profile.locale != AmbientProfile::CANONICAL.locale
+                && profile.timezone != AmbientProfile::CANONICAL.timezone
+        }
+    };
+    if belongs {
+        return Ok(());
+    }
+    Err(recipe_error(format!(
+        "ambient profile is not a runnable profile for role {role:?}"
+    )))
+}
+
+/// A claimed placement of every dimension, as an attestation would state it.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct AmbientClaim {
+    pub(crate) varied: BTreeSet<Dimension>,
+    pub(crate) normalized: BTreeSet<Dimension>,
+    pub(crate) unsupported: BTreeSet<Dimension>,
+}
+
+impl AmbientClaim {
+    /// Returns the only honest placement of the seven dimensions.
+    pub(crate) fn standard() -> Self {
+        let place = |treatment| {
+            Dimension::ALL
+                .into_iter()
+                .filter(|dimension| expected_treatment(*dimension) == treatment)
+                .collect()
+        };
+        Self {
+            varied: place(Treatment::Varied),
+            normalized: place(Treatment::Normalized),
+            unsupported: place(Treatment::Unsupported),
+        }
+    }
+
+    fn placements(&self, dimension: Dimension) -> Vec<Treatment> {
+        [
+            (&self.varied, Treatment::Varied),
+            (&self.normalized, Treatment::Normalized),
+            (&self.unsupported, Treatment::Unsupported),
+        ]
+        .into_iter()
+        .filter(|(set, _)| set.contains(&dimension))
+        .map(|(_, treatment)| treatment)
+        .collect()
+    }
+}
+
+fn expected_treatment(dimension: Dimension) -> Treatment {
+    match dimension {
+        Dimension::Umask | Dimension::Jobs | Dimension::CheckoutRoot | Dimension::StartTime => {
+            Treatment::Varied
+        }
+        Dimension::Locale | Dimension::Timezone => Treatment::Normalized,
+        Dimension::ExecutionUser => Treatment::Unsupported,
+    }
+}
+
+/// Requires every dimension that must vary to vary, and the user to match.
+fn check_variation(
+    canonical: &ObservedAmbient,
+    reproduction: &ObservedAmbient,
+) -> Result<(), Report<ReleaseError>> {
+    for (dimension, differs) in [
+        (Dimension::Umask, canonical.umask != reproduction.umask),
+        (Dimension::Jobs, canonical.jobs != reproduction.jobs),
+        (
+            Dimension::StartTime,
+            canonical.started_at_seconds != reproduction.started_at_seconds,
+        ),
+    ] {
+        if !differs {
+            return Err(recipe_error(format!(
+                "{dimension} is identical across the canonical and reproduction builds"
+            )));
+        }
+    }
+    disjoint(&[
+        ("canonical checkout root", canonical.checkout_root.as_path()),
+        (
+            "reproduction checkout root",
+            reproduction.checkout_root.as_path(),
+        ),
+    ])?;
+    if canonical.execution_uid != reproduction.execution_uid {
+        return Err(recipe_error(
+            "execution user differs but no alternate user is qualified",
+        ));
+    }
+    Ok(())
+}
+
+/// Requires the claim to place every dimension exactly once, as expected.
+fn check_claim(claim: &AmbientClaim) -> Result<(), Report<ReleaseError>> {
+    for dimension in Dimension::ALL {
+        let placements = claim.placements(dimension);
+        if placements.is_empty() {
+            return Err(recipe_error(format!("claim omits {dimension}")));
+        }
+        if placements != [expected_treatment(dimension)] {
+            return Err(recipe_error(format!("claim misreports {dimension}")));
+        }
+    }
+    Ok(())
+}
+
+/// A verified canonical/reproduction ambient pairing.
+#[derive(Clone, Debug)]
+pub(crate) struct AmbientRecord {
+    claim: AmbientClaim,
+}
+
+impl AmbientRecord {
+    /// Verifies that the canonical and reproduction builds varied exactly
+    /// what the claim states.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] when the roles are not canonical then
+    /// reproduction, a varied dimension did not vary, checkout roots overlap,
+    /// the execution user differs without qualification, or the claim omits
+    /// or misplaces a dimension.
+    pub(crate) fn pair(
+        canonical: &CheckedAmbient,
+        reproduction: &CheckedAmbient,
+        claim: &AmbientClaim,
+    ) -> Result<Self, Report<ReleaseError>> {
+        if canonical.role != Role::Canonical || reproduction.role != Role::Reproduction {
+            return Err(recipe_error(
+                "ambient pair must be the canonical then the reproduction build",
+            ));
+        }
+        check_variation(&canonical.observed, &reproduction.observed)?;
+        check_claim(claim)?;
+        Ok(Self {
+            claim: claim.clone(),
+        })
+    }
+
+    /// Returns the verified placement of every dimension.
+    pub(crate) fn claim(&self) -> &AmbientClaim {
+        &self.claim
+    }
+}
diff --git a/crates/trusted-server-release/src/recipe/apple.rs b/crates/trusted-server-release/src/recipe/apple.rs
new file mode 100644
index 0000000000..a43460437f
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/apple.rs
@@ -0,0 +1,747 @@
+//! The Apple developer tools a Darwin recipe compiles and links C with.
+//!
+//! The developer directory is a host system root: the macOS boundary allows
+//! only reading and executing below it and never scans it. Its identity is
+//! therefore this explicit record: the developer directory, the selected SDK,
+//! `clang`, `ar` and `ld` selected directly from the default toolchain (never
+//! through `xcrun` or the `/usr/bin` shims), the Xcode and SDK versions, and
+//! the SHA-256 of the three tools and of `SDKSettings.json`. The record is
+//! rehashed at binding and immediately before and after the confined run.
+//!
+//! # Identity scope
+//!
+//! Ordinary CI selection independently copies the selected SDK into an owned,
+//! bounded tree and binds its digest into this record. Headers, `.tbd` stubs,
+//! frameworks, modes and internal aliases in that selected copy are rehashed
+//! before and after execution and at evidence sealing. Explicit lexical test
+//! fixtures retain only the four-file record and never claim SDK coverage.
+//!
+//! Ordinary CI selection also measures, in place below the selected `clang`'s
+//! toolchain, tree digests of the helper directory, the entire selected
+//! `usr/lib` directory and the single versioned clang resource directory,
+//! plus the SHA-256 of `libLTO.dylib` and
+//! optional `libtapi.dylib`, and rechecks them at every verification point.
+//! Which helpers clang actually ran, the dependency/load closure, libraries
+//! outside the selected measured directories, host runtime and original
+//! acquisition remain unresolved. The developer directory still permits broad
+//! read/execute access; neither receipt proves every compiler input came from
+//! the measured trees.
+//!
+//! Only the test-only ordinary CI selection constructs a record; the
+//! qualified selection is uninhabited until Task 8 qualifies a toolchain.
+
+use std::fs::File;
+use std::io::Read as _;
+use std::os::unix::fs::OpenOptionsExt as _;
+use std::path::{Component, Path, PathBuf};
+use std::sync::Arc;
+#[cfg(test)]
+use std::time::Instant;
+
+use error_stack::Report;
+use serde::Serialize;
+use serde_json::{Value, json};
+use sha2::{Digest as _, Sha256};
+
+use super::artifact::EXECUTABLE_LIMIT;
+use super::fresh::{normal_absolute, real_directory};
+use super::recipe_error;
+use super::tools::Authority;
+use crate::documents::{Role, canonical_json};
+use crate::error::ReleaseError;
+use crate::inspect::MacosVersion;
+#[cfg(test)]
+use crate::process::Cancellation;
+use sdk::{OwnedSdk, SdkReceipt};
+use toolchain::{MeasuredToolchain, ToolchainReceipt};
+
+mod sdk;
+mod toolchain;
+
+/// Fixed prefix the C path remap gives the developer directory.
+pub(crate) const REMAPPED_DEVELOPER: &str = "/apple-developer";
+/// Fixed prefix for a separately owned SDK snapshot.
+pub(crate) const REMAPPED_SDK: &str = "/apple-sdk";
+/// Default toolchain binary directory below the developer directory.
+const TOOLCHAIN_BIN: &str = "Toolchains/XcodeDefault.xctoolchain/usr/bin";
+/// macOS SDK alias below the developer directory.
+const MACOS_SDK: &str = "Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk";
+/// SDK settings file whose `Version` is the measured SDK version.
+const SDK_SETTINGS: &str = "SDKSettings.json";
+/// Largest SDK settings or version file read.
+const SETTINGS_LIMIT: u64 = 1024 * 1024;
+/// Longest accepted Xcode version text.
+const MAX_XCODE_VERSION: usize = 32;
+/// File read size while hashing a tool.
+const HASH_CHUNK: usize = 64 * 1024;
+
+/// Apple developer tools that passed Task 8 qualification.
+///
+/// None have, so this type is uninhabited and production selection stays closed.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum QualifiedAppleTools {}
+
+/// How the developer tools were selected.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum AppleSelection {
+    /// A qualified production selection.
+    Qualified(QualifiedAppleTools),
+    /// An ordinary CI Xcode; test builds only.
+    #[cfg(test)]
+    OrdinaryCi,
+}
+
+/// Explicit facts describing one Apple developer directory.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct AppleToolFacts {
+    /// Canonical developer directory, the only system root.
+    pub(crate) developer_dir: PathBuf,
+    /// Canonical macOS SDK root below the developer directory.
+    pub(crate) sdk_root: PathBuf,
+    /// The C compiler and linker driver.
+    pub(crate) clang: PathBuf,
+    /// The archiver.
+    pub(crate) ar: PathBuf,
+    /// The linker `clang` runs from its own directory.
+    pub(crate) ld: PathBuf,
+    /// Measured Xcode version, such as `16.4`.
+    pub(crate) xcode_version: String,
+    /// Measured SDK version from `SDKSettings.json`.
+    pub(crate) sdk_version: MacosVersion,
+    /// SHA-256 of `clang`.
+    pub(crate) clang_sha256: String,
+    /// SHA-256 of `ar`.
+    pub(crate) ar_sha256: String,
+    /// SHA-256 of `ld`.
+    pub(crate) ld_sha256: String,
+    /// SHA-256 of the SDK's `SDKSettings.json`.
+    pub(crate) sdk_settings_sha256: String,
+}
+
+/// A checked Apple developer tool record bound to its selection.
+#[derive(Clone, Debug)]
+pub(crate) struct AppleDeveloperTools {
+    facts: AppleToolFacts,
+    selection: AppleSelection,
+    sdk: Option<Arc<OwnedSdk>>,
+    toolchain: Option<MeasuredToolchain>,
+}
+
+/// Candidate identity of the explicitly measured Apple files.
+///
+/// The exclusions describe input classes with unresolved coverage. A detached
+/// SDK receipt is present only for a measured owned snapshot, and a
+/// toolchain receipt only for a measured in-place toolchain.
+#[derive(Debug, Serialize)]
+pub(crate) struct AppleToolEvidence {
+    identity_sha256: String,
+    xcode_version: String,
+    sdk_version: String,
+    tools: [AppleFileEvidence; 3],
+    sdk_settings: AppleFileEvidence,
+    sdk_tree: Option<SdkReceipt>,
+    toolchain: Option<ToolchainReceipt>,
+    coverage_exclusions: Vec<&'static str>,
+    origin: &'static str,
+    qualification: &'static str,
+}
+
+#[derive(Debug, Serialize)]
+struct AppleFileEvidence {
+    role: &'static str,
+    path: PathBuf,
+    sha256: String,
+}
+
+impl AppleToolEvidence {
+    /// Borrows measured tool roles and raw-file digests, excluding private paths.
+    pub(crate) fn tool_files(&self) -> impl Iterator<Item = (&str, &str)> {
+        self.tools
+            .iter()
+            .map(|file| (file.role, file.sha256.as_str()))
+    }
+    /// Returns the SDK settings raw-file digest.
+    pub(crate) fn sdk_settings_sha256(&self) -> &str {
+        &self.sdk_settings.sha256
+    }
+    /// Returns the detached SDK's structured-tree digest, when measured.
+    pub(crate) fn sdk_tree_sha256(&self) -> Option<&str> {
+        self.sdk_tree.as_ref().map(SdkReceipt::tree_sha256)
+    }
+    /// Returns the in-place `libLTO.dylib` raw-file digest, when measured.
+    pub(crate) fn liblto_sha256(&self) -> Option<&str> {
+        self.toolchain.as_ref().map(ToolchainReceipt::liblto_sha256)
+    }
+    /// Returns the in-place `libtapi.dylib` raw-file digest, when present and measured.
+    pub(crate) fn libtapi_sha256(&self) -> Option<&str> {
+        self.toolchain
+            .as_ref()
+            .and_then(ToolchainReceipt::libtapi_sha256)
+    }
+    /// Returns the clang resource directory's structured-tree digest, when measured.
+    pub(crate) fn clang_resource_tree_sha256(&self) -> Option<&str> {
+        self.toolchain
+            .as_ref()
+            .map(ToolchainReceipt::clang_resource_tree_sha256)
+    }
+    /// Returns the toolchain helper directory's structured-tree digest, when measured.
+    pub(crate) fn helper_tree_sha256(&self) -> Option<&str> {
+        self.toolchain
+            .as_ref()
+            .map(ToolchainReceipt::helper_tree_sha256)
+    }
+    /// Returns the selected toolchain library directory's structured-tree digest, when measured.
+    pub(crate) fn library_tree_sha256(&self) -> Option<&str> {
+        self.toolchain
+            .as_ref()
+            .map(ToolchainReceipt::library_tree_sha256)
+    }
+    /// Returns the SDK version used to check the accepted executable.
+    pub(crate) fn sdk_version(&self) -> &str {
+        &self.sdk_version
+    }
+    /// Returns the reviewed input classes with unresolved coverage.
+    pub(crate) fn coverage_exclusions(&self) -> &[&'static str] {
+        &self.coverage_exclusions
+    }
+}
+
+fn lower_hex_digest(text: &str) -> bool {
+    text.len() == 64
+        && text
+            .bytes()
+            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+}
+
+/// Requires absolute normal text that can travel unquoted in `CFLAGS`, a
+/// `-Wl,` list, a `PATH`-like value and a Cargo configuration string.
+fn plain_path(label: &str, path: &Path) -> Result<(), Report<ReleaseError>> {
+    normal_absolute(label, path)?;
+    let plain = path.to_str().is_some_and(|text| {
+        !text.contains([',', ':', '"', '\\', '='])
+            && !text.chars().any(|c| c.is_whitespace() || c.is_control())
+    });
+    if !plain {
+        return Err(recipe_error(format!(
+            "{label} holds whitespace, a separator or a quote"
+        )));
+    }
+    Ok(())
+}
+
+/// Requires `path` strictly below `developer_dir` through normal components.
+fn below_developer(
+    label: &str,
+    path: &Path,
+    developer_dir: &Path,
+) -> Result<(), Report<ReleaseError>> {
+    let below = path.strip_prefix(developer_dir).is_ok_and(|relative| {
+        relative.components().next().is_some()
+            && relative
+                .components()
+                .all(|component| matches!(component, Component::Normal(_)))
+    });
+    if !below {
+        return Err(recipe_error(format!(
+            "{label} is not inside the Apple developer directory"
+        )));
+    }
+    Ok(())
+}
+
+/// Checks the facts lexically; nothing on disk is read.
+fn check_facts(facts: &AppleToolFacts) -> Result<(), Report<ReleaseError>> {
+    plain_path("Apple developer directory", &facts.developer_dir)?;
+    let tools = [
+        ("clang", &facts.clang),
+        ("ar", &facts.ar),
+        ("ld", &facts.ld),
+    ];
+    for (label, path) in [("Apple SDK root", &facts.sdk_root)]
+        .into_iter()
+        .chain(tools)
+    {
+        plain_path(label, path)?;
+        below_developer(label, path, &facts.developer_dir)?;
+    }
+    let directory = facts.clang.parent();
+    for (name, path) in tools {
+        if path.file_name().and_then(|file| file.to_str()) != Some(name)
+            || path.parent() != directory
+        {
+            return Err(recipe_error(format!(
+                "Apple {name} must be named {name} beside clang in one toolchain directory"
+            )));
+        }
+    }
+    let version_ok = !facts.xcode_version.is_empty()
+        && facts.xcode_version.len() <= MAX_XCODE_VERSION
+        && facts
+            .xcode_version
+            .bytes()
+            .all(|byte| byte.is_ascii_digit() || byte == b'.');
+    if !version_ok {
+        return Err(recipe_error("Xcode version is not dotted decimal text"));
+    }
+    let digests = [
+        &facts.clang_sha256,
+        &facts.ar_sha256,
+        &facts.ld_sha256,
+        &facts.sdk_settings_sha256,
+    ];
+    if !digests.iter().all(|digest| lower_hex_digest(digest)) {
+        return Err(recipe_error(
+            "Apple tool digests must be 64 lowercase hex digits",
+        ));
+    }
+    Ok(())
+}
+
+/// Hashes a regular file opened without following links, within `limit`.
+fn hash_regular(label: &str, path: &Path, limit: u64) -> Result<String, Report<ReleaseError>> {
+    let io = |error: std::io::Error| recipe_error(format!("{label} cannot be hashed: {error}"));
+    let mut file = File::options()
+        .read(true)
+        .custom_flags(libc::O_NOFOLLOW)
+        .open(path)
+        .map_err(io)?;
+    let metadata = file.metadata().map_err(io)?;
+    if !metadata.is_file() || metadata.len() > limit {
+        return Err(recipe_error(format!(
+            "{label} is not a regular file within its size limit"
+        )));
+    }
+    let mut hasher = Sha256::new();
+    let mut buffer = vec![0_u8; HASH_CHUNK];
+    let mut total = 0_u64;
+    loop {
+        let read = file.read(&mut buffer).map_err(io)?;
+        let Some(chunk) = buffer.get(..read).filter(|chunk| !chunk.is_empty()) else {
+            return Ok(hex::encode(hasher.finalize()));
+        };
+        total += chunk.len() as u64;
+        if total > limit {
+            return Err(recipe_error(format!("{label} grew past its size limit")));
+        }
+        hasher.update(chunk);
+    }
+}
+
+impl AppleDeveloperTools {
+    /// Exports typed candidate facts after rechecking the measured Apple files.
+    ///
+    /// # Errors
+    ///
+    /// Rejects changed tools or SDK settings, or invalid relative component paths.
+    pub(crate) fn candidate_measurement(&self) -> Result<AppleToolEvidence, Report<ReleaseError>> {
+        self.verify()?;
+        let file = |role, path: &Path, sha256: &str| {
+            Ok::<_, Report<ReleaseError>>(AppleFileEvidence {
+                role,
+                path: path
+                    .strip_prefix(&self.facts.developer_dir)
+                    .map_err(|error| {
+                        recipe_error(format!(
+                            "Apple component escapes developer directory: {error}"
+                        ))
+                    })?
+                    .to_owned(),
+                sha256: sha256.to_owned(),
+            })
+        };
+        Ok(AppleToolEvidence {
+            identity_sha256: self.identity_sha256()?,
+            xcode_version: self.facts.xcode_version.clone(),
+            sdk_version: self.facts.sdk_version.to_string(),
+            tools: [
+                file("compiler", &self.facts.clang, &self.facts.clang_sha256)?,
+                file("archiver", &self.facts.ar, &self.facts.ar_sha256)?,
+                file("linker", &self.facts.ld, &self.facts.ld_sha256)?,
+            ],
+            sdk_settings: if self.sdk.is_some() {
+                AppleFileEvidence {
+                    role: "sdk_settings",
+                    path: PathBuf::from(SDK_SETTINGS),
+                    sha256: self.facts.sdk_settings_sha256.clone(),
+                }
+            } else {
+                file(
+                    "sdk_settings",
+                    &self.facts.sdk_root.join(SDK_SETTINGS),
+                    &self.facts.sdk_settings_sha256,
+                )?
+            },
+            sdk_tree: self.sdk.as_ref().map(|sdk| sdk.receipt().clone()),
+            toolchain: self
+                .toolchain
+                .as_ref()
+                .map(|toolchain| toolchain.receipt().clone()),
+            coverage_exclusions: self.coverage_exclusions(),
+            origin: "candidate_measurement",
+            qualification: "unqualified",
+        })
+    }
+
+    /// Names the reviewed input classes with unresolved coverage.
+    ///
+    /// The dependency/load closure and libraries outside selected measured
+    /// directories remain unresolved, so the list is never empty.
+    fn coverage_exclusions(&self) -> Vec<&'static str> {
+        let mut exclusions = Vec::new();
+        if self.sdk.is_none() {
+            exclusions.extend(["sdk_headers", "sdk_stubs", "sdk_frameworks"]);
+        }
+        if self.toolchain.is_none() {
+            exclusions.extend(["tool_helpers", "liblto", "clang_resource_directory"]);
+        }
+        exclusions.push("toolchain_libraries");
+        exclusions
+    }
+
+    /// Accepts only a qualified selection; production construction stays closed.
+    pub(crate) fn qualified(_facts: AppleToolFacts, qualification: QualifiedAppleTools) -> Self {
+        match qualification {}
+    }
+
+    /// Records explicit facts as an ordinary CI selection without reading disk.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] when a path is not absolute normal
+    /// plain text, the SDK root or a tool is not strictly inside the
+    /// developer directory, `clang`, `ar` and `ld` are not so named in one
+    /// directory, the Xcode version is not dotted decimal, or a digest is not
+    /// 64 lowercase hex digits.
+    #[cfg(test)]
+    pub(crate) fn from_facts_for_tests(
+        facts: AppleToolFacts,
+    ) -> Result<Self, Report<ReleaseError>> {
+        check_facts(&facts)?;
+        Ok(Self {
+            facts,
+            selection: AppleSelection::OrdinaryCi,
+            sdk: None,
+            toolchain: None,
+        })
+    }
+
+    /// Measures the selected toolchain's helpers, entire `usr/lib`, `libLTO`,
+    /// optional `libtapi` and clang resources in place and binds them into this record.
+    ///
+    /// # Errors
+    ///
+    /// Rejects changed recorded files, or as the toolchain measurement:
+    /// ambiguous resource versions, a missing `libLTO`, unsafe entries,
+    /// exhausted limits, cancellation or expiration.
+    #[cfg(test)]
+    pub(crate) fn with_measured_toolchain_for_tests(
+        mut self,
+        deadline: Instant,
+        cancellation: &Cancellation,
+    ) -> Result<Self, Report<ReleaseError>> {
+        self.toolchain = Some(MeasuredToolchain::measure(
+            &self.facts.clang,
+            &self.facts.developer_dir,
+            deadline,
+            cancellation,
+        )?);
+        // One verification after measuring suffices: it rehashes every
+        // recorded file against the facts (so an earlier change is still
+        // caught) and also remeasures the new toolchain receipt. A second
+        // pass before measuring would only rehash the same files again.
+        self.verify()?;
+        Ok(self)
+    }
+
+    /// Stages an explicit test selection through the same detached SDK policy.
+    ///
+    /// # Errors
+    ///
+    /// Rejects invalid source facts, unsafe trees, changes, cancellation or expiration.
+    #[cfg(test)]
+    pub(crate) fn with_detached_sdk_for_tests(
+        facts: AppleToolFacts,
+        deadline: Instant,
+        cancellation: &Cancellation,
+    ) -> Result<Self, Report<ReleaseError>> {
+        let selected = Self::stage_detached_sdk(facts, deadline, cancellation)?;
+        selected.verify()?;
+        Ok(selected)
+    }
+
+    /// Stages the detached SDK of an explicit test selection without the
+    /// trailing full verification.
+    ///
+    /// The recorded tools and SDK settings are verified before staging. Only
+    /// a caller that runs a full [`Self::verify`] next, such as
+    /// [`Self::measure_selected_developer`] through
+    /// [`Self::with_measured_toolchain_for_tests`], may skip the trailing
+    /// pass; every other caller uses [`Self::with_detached_sdk_for_tests`].
+    ///
+    /// # Errors
+    ///
+    /// Rejects invalid source facts, unsafe trees, changes, cancellation or expiration.
+    #[cfg(test)]
+    fn stage_detached_sdk(
+        facts: AppleToolFacts,
+        deadline: Instant,
+        cancellation: &Cancellation,
+    ) -> Result<Self, Report<ReleaseError>> {
+        let mut selected = Self::from_facts_for_tests(facts)?;
+        selected.verify()?;
+        let sdk = OwnedSdk::stage(&selected.facts.sdk_root, deadline, cancellation)?;
+        plain_path("owned Apple SDK root", sdk.root())?;
+        selected.sdk = Some(Arc::new(sdk));
+        Ok(selected)
+    }
+
+    /// Measures the selected Xcode of an ordinary CI macOS runner.
+    ///
+    /// The developer directory is the target of `/var/db/xcode_select_link`,
+    /// which `xcode-select --switch` maintains; nothing is executed. The SDK
+    /// version is `SDKSettings.json`'s `Version` and the Xcode version is the
+    /// `CFBundleShortVersionString` of the bundle's `version.plist`. This
+    /// measures the host, so only CI runs it.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] when the selection link, the default
+    /// toolchain, the macOS SDK or a version cannot be read, or as
+    /// [`Self::from_facts_for_tests`].
+    #[cfg(test)]
+    pub(crate) fn for_ordinary_ci(
+        deadline: Instant,
+        cancellation: &Cancellation,
+    ) -> Result<Self, Report<ReleaseError>> {
+        let io = |error: std::io::Error| recipe_error(format!("cannot measure Xcode: {error}"));
+        let link = std::fs::read_link("/var/db/xcode_select_link").map_err(io)?;
+        let developer_dir = std::fs::canonicalize(link).map_err(io)?;
+        Self::measure_selected_developer(developer_dir, deadline, cancellation)
+    }
+
+    /// Measures one explicitly selected canonical test developer directory.
+    ///
+    /// This is shared only by the strict CI link selection and the ignored
+    /// local smoke override. Neither grants qualification or acquisition trust.
+    #[cfg(test)]
+    fn measure_selected_developer(
+        developer_dir: PathBuf,
+        deadline: Instant,
+        cancellation: &Cancellation,
+    ) -> Result<Self, Report<ReleaseError>> {
+        plain_path("Apple developer directory", &developer_dir)?;
+        real_directory("Apple developer directory", &developer_dir)?;
+        let io = |error: std::io::Error| recipe_error(format!("cannot measure Xcode: {error}"));
+        let sdk_root = std::fs::canonicalize(developer_dir.join(MACOS_SDK)).map_err(io)?;
+        let settings = read_small(&sdk_root.join(SDK_SETTINGS))?;
+        let sdk_version = sdk_settings_version(&settings)?;
+        let bundle = developer_dir
+            .parent()
+            .ok_or_else(|| recipe_error("Apple developer directory has no bundle"))?;
+        let plist = read_small(&bundle.join("version.plist"))?;
+        let xcode_version = plist_string(&plist, "CFBundleShortVersionString")?;
+        let bin = developer_dir.join(TOOLCHAIN_BIN);
+        let (clang, ar, ld) = (bin.join("clang"), bin.join("ar"), bin.join("ld"));
+        let facts = AppleToolFacts {
+            clang_sha256: hash_regular("Apple clang", &clang, EXECUTABLE_LIMIT)?,
+            ar_sha256: hash_regular("Apple ar", &ar, EXECUTABLE_LIMIT)?,
+            ld_sha256: hash_regular("Apple ld", &ld, EXECUTABLE_LIMIT)?,
+            sdk_settings_sha256: hex::encode(Sha256::digest(&settings)),
+            developer_dir,
+            sdk_root,
+            clang,
+            ar,
+            ld,
+            xcode_version,
+            sdk_version,
+        };
+        // The toolchain measurement ends with a full verification that
+        // rehashes the staged SDK as well, so staging skips its own trailing
+        // pass over the same tree.
+        Self::stage_detached_sdk(facts, deadline, cancellation)?
+            .with_measured_toolchain_for_tests(deadline, cancellation)
+    }
+
+    /// The authority of this selection.
+    pub(crate) fn authority(&self) -> Authority {
+        match self.selection {
+            AppleSelection::Qualified(qualification) => match qualification {},
+            #[cfg(test)]
+            AppleSelection::OrdinaryCi => Authority::Unqualified,
+        }
+    }
+
+    /// The developer directory, the only system root.
+    pub(crate) fn developer_dir(&self) -> &Path {
+        &self.facts.developer_dir
+    }
+
+    /// The macOS SDK root.
+    pub(crate) fn sdk_root(&self) -> &Path {
+        self.sdk
+            .as_ref()
+            .map_or(&self.facts.sdk_root, |sdk| sdk.root())
+    }
+
+    /// The separately owned SDK root, absent for lexical fixture records.
+    pub(crate) fn owned_sdk_root(&self) -> Option<&Path> {
+        self.sdk.as_ref().map(|sdk| sdk.root())
+    }
+
+    /// The selected `clang`.
+    pub(crate) fn clang(&self) -> &Path {
+        &self.facts.clang
+    }
+
+    /// The selected `ar`.
+    pub(crate) fn ar(&self) -> &Path {
+        &self.facts.ar
+    }
+
+    /// The measured SDK version a linked executable must record.
+    pub(crate) fn sdk_version(&self) -> MacosVersion {
+        self.facts.sdk_version
+    }
+
+    /// Rehashes the tools, SDK settings, detached SDK and measured toolchain
+    /// against the record.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] when the developer directory or SDK
+    /// root is not a real directory, a tool or the settings file is not a
+    /// regular file, or any digest or toolchain receipt differs.
+    pub(crate) fn verify(&self) -> Result<(), Report<ReleaseError>> {
+        real_directory("Apple developer directory", &self.facts.developer_dir)?;
+        real_directory("Apple SDK root", self.sdk_root())?;
+        if let Some(sdk) = &self.sdk {
+            sdk.verify()?;
+        }
+        if let Some(toolchain) = &self.toolchain {
+            toolchain.verify()?;
+        }
+        let settings = self.sdk_root().join(SDK_SETTINGS);
+        let expected = [
+            (
+                "Apple clang",
+                &self.facts.clang,
+                &self.facts.clang_sha256,
+                EXECUTABLE_LIMIT,
+            ),
+            (
+                "Apple ar",
+                &self.facts.ar,
+                &self.facts.ar_sha256,
+                EXECUTABLE_LIMIT,
+            ),
+            (
+                "Apple ld",
+                &self.facts.ld,
+                &self.facts.ld_sha256,
+                EXECUTABLE_LIMIT,
+            ),
+            (
+                "Apple SDK settings",
+                &settings,
+                &self.facts.sdk_settings_sha256,
+                SETTINGS_LIMIT,
+            ),
+        ];
+        for (label, path, digest, limit) in expected {
+            if hash_regular(label, path, limit)? != *digest {
+                return Err(recipe_error(format!("{label} changed after measurement")));
+            }
+        }
+        Ok(())
+    }
+
+    /// The identity record as a measurement value.
+    pub(crate) fn measurement(&self) -> Value {
+        let text = |path: &Path| path.to_string_lossy().into_owned();
+        let mut value = json!({
+            "developer_dir": text(&self.facts.developer_dir),
+            "sdk_root": if self.sdk.is_some() { REMAPPED_SDK.to_owned() } else { text(&self.facts.sdk_root) },
+            "clang": text(&self.facts.clang),
+            "ar": text(&self.facts.ar),
+            "ld": text(&self.facts.ld),
+            "xcode_version": self.facts.xcode_version,
+            "sdk_version": self.facts.sdk_version.to_string(),
+            "clang_sha256": self.facts.clang_sha256,
+            "ar_sha256": self.facts.ar_sha256,
+            "ld_sha256": self.facts.ld_sha256,
+            "sdk_settings_sha256": self.facts.sdk_settings_sha256,
+        });
+        if let Some(sdk) = &self.sdk {
+            value["sdk_tree"] = json!(sdk.receipt());
+        }
+        if let Some(toolchain) = &self.toolchain {
+            value["toolchain"] = json!(toolchain.receipt());
+        }
+        value
+    }
+
+    /// SHA-256 of the canonical identity record, bound into the plan digest.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] when the record cannot be encoded.
+    pub(crate) fn identity_sha256(&self) -> Result<String, Report<ReleaseError>> {
+        let bytes = canonical_json(&self.measurement(), Role::Metadata)
+            .map_err(|error| error.change_context(ReleaseError::Recipe))?;
+        Ok(hex::encode(Sha256::digest(bytes)))
+    }
+}
+
+/// Reads a small regular file without following links.
+#[cfg(test)]
+fn read_small(path: &Path) -> Result<Vec<u8>, Report<ReleaseError>> {
+    let io =
+        |error: std::io::Error| recipe_error(format!("cannot read {}: {error}", path.display()));
+    let file = File::options()
+        .read(true)
+        .custom_flags(libc::O_NOFOLLOW)
+        .open(path)
+        .map_err(io)?;
+    let mut bytes = Vec::new();
+    file.take(SETTINGS_LIMIT + 1)
+        .read_to_end(&mut bytes)
+        .map_err(io)?;
+    if bytes.len() as u64 > SETTINGS_LIMIT {
+        return Err(recipe_error(format!("{} is too large", path.display())));
+    }
+    Ok(bytes)
+}
+
+/// Returns the SDK version `SDKSettings.json` states.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Recipe`] when the bytes are not JSON with a
+/// dotted decimal `Version`.
+pub(crate) fn sdk_settings_version(bytes: &[u8]) -> Result<MacosVersion, Report<ReleaseError>> {
+    let value: Value = serde_json::from_slice(bytes)
+        .map_err(|error| recipe_error(format!("SDK settings are not JSON: {error}")))?;
+    value["Version"]
+        .as_str()
+        .and_then(MacosVersion::parse)
+        .ok_or_else(|| recipe_error("SDK settings hold no dotted decimal Version"))
+}
+
+/// Returns the `<string>` that follows `<key>name</key>` in a property list.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Recipe`] when the key or its string is absent or
+/// the text is not UTF-8.
+pub(crate) fn plist_string(bytes: &[u8], name: &str) -> Result<String, Report<ReleaseError>> {
+    let text = std::str::from_utf8(bytes)
+        .map_err(|error| recipe_error(format!("property list is not UTF-8: {error}")))?;
+    let key = format!("<key>{name}</key>");
+    let after = text
+        .find(&key)
+        .map(|start| text[start + key.len()..].trim_start())
+        .and_then(|rest| rest.strip_prefix("<string>"))
+        .and_then(|rest| rest.split_once("</string>"))
+        .map(|(value, _)| value.to_owned());
+    after.ok_or_else(|| recipe_error(format!("property list holds no string {name}")))
+}
diff --git a/crates/trusted-server-release/src/recipe/apple/sdk.rs b/crates/trusted-server-release/src/recipe/apple/sdk.rs
new file mode 100644
index 0000000000..2a2ef397f4
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/apple/sdk.rs
@@ -0,0 +1,761 @@
+//! Detached, bounded copies of the selected installed Apple SDK.
+//!
+//! The receipt measures the destination that the recipe actually selects.
+//! Copying is not an atomic observation of vendor directory membership and
+//! does not authenticate an original distribution or its acquisition.
+
+use std::ffi::CString;
+use std::fs::{self, File};
+use std::io::{Read as _, Write as _};
+use std::mem::MaybeUninit;
+use std::os::fd::{AsRawFd as _, FromRawFd as _};
+use std::os::unix::fs::{MetadataExt as _, OpenOptionsExt as _, PermissionsExt as _, symlink};
+use std::path::{Component, Path, PathBuf};
+use std::time::Instant;
+
+use error_stack::Report;
+use serde::Serialize;
+
+use super::super::fresh::real_directory;
+use super::super::recipe_error;
+use crate::error::ReleaseError;
+use crate::process::Cancellation;
+use crate::tool_tree::tool_tree_digest;
+
+const FILE_LIMIT: u64 = 512 * 1024 * 1024;
+const TREE_LIMIT: u64 = 2 * 1024 * 1024 * 1024;
+const ENTRY_LIMIT: usize = 100_000;
+
+/// Digest of a complete detached SDK tree, constructed only by measurement.
+#[derive(Clone, Debug, Serialize)]
+pub(super) struct SdkReceipt {
+    tree_sha256: String,
+    regular_bytes: u64,
+    entries: usize,
+}
+
+impl SdkReceipt {
+    /// Returns the detached SDK's measured structured-tree identity.
+    pub(super) fn tree_sha256(&self) -> &str {
+        &self.tree_sha256
+    }
+}
+
+/// Private SDK copy whose lifetime is retained by every tool selection clone.
+#[derive(Debug)]
+pub(super) struct OwnedSdk {
+    _directory: OwnedDirectory,
+    root: PathBuf,
+    receipt: SdkReceipt,
+    deadline: Instant,
+    cancellation: Cancellation,
+}
+
+/// Owns cleanup from creation, including errors after source modes are restored.
+///
+/// Only created directory paths are recorded, bounded by the SDK entry limit.
+/// Cleanup uses root-relative descriptors and never changes file permissions.
+#[derive(Debug)]
+struct OwnedDirectory {
+    directory: tempfile::TempDir,
+    root: Option<File>,
+    directories: Vec<PathBuf>,
+}
+
+impl OwnedDirectory {
+    fn new(directory: tempfile::TempDir) -> Result<Self, Report<ReleaseError>> {
+        let mut owned = Self {
+            directory,
+            root: None,
+            directories: Vec::new(),
+        };
+        owned.root = Some(
+            File::options()
+                .read(true)
+                .custom_flags(libc::O_DIRECTORY | libc::O_NOFOLLOW | libc::O_CLOEXEC)
+                .open(owned.directory.path())
+                .map_err(io)?,
+        );
+        Ok(owned)
+    }
+}
+
+/// Restores owner access through checked directory components, never aliases.
+fn restore_directory(root: &File, relative: &Path) -> std::io::Result<()> {
+    let mut parent = root.try_clone()?;
+    for component in relative.components() {
+        let Component::Normal(name) = component else {
+            return Err(std::io::Error::other(
+                "cleanup path is not relative normal text",
+            ));
+        };
+        let name = CString::new(name.as_encoded_bytes())?;
+        let mut metadata = MaybeUninit::<libc::stat>::uninit();
+        // SAFETY: the descriptor and NUL-terminated name remain valid, and
+        // fstatat initializes metadata on success without following aliases.
+        let status = unsafe {
+            libc::fstatat(
+                parent.as_raw_fd(),
+                name.as_ptr(),
+                metadata.as_mut_ptr(),
+                libc::AT_SYMLINK_NOFOLLOW,
+            )
+        };
+        if status != 0 {
+            return Err(std::io::Error::last_os_error());
+        }
+        // SAFETY: successful fstatat initialized the entire metadata value.
+        let metadata = unsafe { metadata.assume_init() };
+        if metadata.st_mode & libc::S_IFMT != libc::S_IFDIR {
+            return Err(std::io::Error::other(
+                "cleanup component is not a real directory",
+            ));
+        }
+        // SAFETY: the live parent descriptor anchors the relative name;
+        // AT_SYMLINK_NOFOLLOW prevents a swapped alias changing its target.
+        if unsafe {
+            libc::fchmodat(
+                parent.as_raw_fd(),
+                name.as_ptr(),
+                metadata.st_mode | 0o700,
+                libc::AT_SYMLINK_NOFOLLOW,
+            )
+        } != 0
+        {
+            return Err(std::io::Error::last_os_error());
+        }
+        // SAFETY: openat borrows valid arguments and returns a new descriptor.
+        // Every component is opened without following a symlink.
+        let descriptor = unsafe {
+            libc::openat(
+                parent.as_raw_fd(),
+                name.as_ptr(),
+                libc::O_RDONLY
+                    | libc::O_DIRECTORY
+                    | libc::O_NOFOLLOW
+                    | libc::O_NONBLOCK
+                    | libc::O_CLOEXEC,
+            )
+        };
+        if descriptor < 0 {
+            return Err(std::io::Error::last_os_error());
+        }
+        // SAFETY: openat returned an owned descriptor, transferred exactly once.
+        parent = unsafe { File::from_raw_fd(descriptor) };
+    }
+    Ok(())
+}
+
+impl Drop for OwnedDirectory {
+    fn drop(&mut self) {
+        if let Some(root) = &self.root {
+            if let Ok(metadata) = root.metadata() {
+                let _ = root.set_permissions(fs::Permissions::from_mode(metadata.mode() | 0o700));
+            }
+            // Created parents precede their descendants. Cleanup deliberately
+            // ignores the attempt budget so cancellation cannot retain copies.
+            for relative in &self.directories {
+                let _ = restore_directory(root, relative);
+            }
+        }
+        // TempDir now removes the accessible private tree. Destruction remains
+        // best effort for external I/O failures; the real SDK smoke observes
+        // that the copied root is actually gone before reporting its receipt.
+    }
+}
+
+fn check(deadline: Instant, cancellation: &Cancellation) -> Result<(), Report<ReleaseError>> {
+    if cancellation.is_cancelled() || Instant::now() >= deadline {
+        return Err(recipe_error("Apple SDK snapshot cancelled or timed out"));
+    }
+    Ok(())
+}
+
+fn io(error: impl std::fmt::Display) -> Report<ReleaseError> {
+    recipe_error(format!("Apple SDK snapshot: {error}"))
+}
+
+fn stamp(metadata: &fs::Metadata) -> (u64, u64, u64, u32, i64, i64, i64, i64) {
+    (
+        metadata.dev(),
+        metadata.ino(),
+        metadata.len(),
+        metadata.mode(),
+        metadata.mtime(),
+        metadata.mtime_nsec(),
+        metadata.ctime(),
+        metadata.ctime_nsec(),
+    )
+}
+
+impl OwnedSdk {
+    /// Copies a selected vendor tree without retaining any vendor hardlinks.
+    ///
+    /// # Errors
+    ///
+    /// Rejects unsafe aliases, special files, regular-file mutation during
+    /// copying, exhausted limits, cancellation and expiration. The destination
+    /// must pass the strict owned tool tree policy before it can become selected.
+    /// This installed-content copy is not an atomic vendor-source observation
+    /// or an authenticated distribution snapshot.
+    pub(super) fn stage(
+        source: &Path,
+        deadline: Instant,
+        cancellation: &Cancellation,
+    ) -> Result<Self, Report<ReleaseError>> {
+        Self::stage_with_limits(
+            source,
+            deadline,
+            cancellation,
+            (FILE_LIMIT, TREE_LIMIT, ENTRY_LIMIT),
+        )
+    }
+
+    fn stage_with_limits(
+        source: &Path,
+        deadline: Instant,
+        cancellation: &Cancellation,
+        limits: (u64, u64, usize),
+    ) -> Result<Self, Report<ReleaseError>> {
+        check(deadline, cancellation)?;
+        let source = fs::canonicalize(source).map_err(io)?;
+        real_directory("source Apple SDK", &source)?;
+        let mut directory = OwnedDirectory::new(
+            tempfile::Builder::new()
+                .prefix("ts-apple-sdk-")
+                .tempdir()
+                .map_err(io)?,
+        )?;
+        let root = fs::canonicalize(directory.directory.path()).map_err(io)?;
+        let mut pending = vec![source.clone()];
+        let mut directories = Vec::new();
+        let mut entries = 0;
+        let mut total = 0;
+        let mut buffer = vec![0; 64 * 1024];
+        while let Some(parent) = pending.pop() {
+            check(deadline, cancellation)?;
+            real_directory("source Apple SDK directory", &parent)?;
+            for entry in fs::read_dir(parent).map_err(io)? {
+                check(deadline, cancellation)?;
+                let path = entry.map_err(io)?.path();
+                let relative = path
+                    .strip_prefix(&source)
+                    .map_err(|error| recipe_error(error.to_string()))?;
+                if relative.to_str().is_none() {
+                    return Err(recipe_error("Apple SDK path is not UTF-8"));
+                }
+                entries += 1;
+                if entries > limits.2 {
+                    return Err(recipe_error("Apple SDK exceeds entry limit"));
+                }
+                let destination = root.join(relative);
+                let metadata = fs::symlink_metadata(&path).map_err(io)?;
+                if metadata.is_dir() {
+                    fs::create_dir(&destination).map_err(io)?;
+                    directory.directories.push(relative.to_owned());
+                    directories.push((destination, metadata.permissions()));
+                    pending.push(path);
+                } else if metadata.is_file() {
+                    if metadata.len() > limits.0 || total + metadata.len() > limits.1 {
+                        return Err(recipe_error("Apple SDK exceeds byte limit"));
+                    }
+                    let mut input = File::options()
+                        .read(true)
+                        .custom_flags(libc::O_NOFOLLOW | libc::O_NONBLOCK)
+                        .open(&path)
+                        .map_err(io)?;
+                    let opened = input.metadata().map_err(io)?;
+                    if !opened.is_file() || stamp(&opened) != stamp(&metadata) {
+                        return Err(recipe_error("Apple SDK source changed before copying"));
+                    }
+                    let mut output = File::options()
+                        .write(true)
+                        .create_new(true)
+                        .custom_flags(libc::O_NOFOLLOW)
+                        .open(&destination)
+                        .map_err(io)?;
+                    let mut size = 0;
+                    loop {
+                        check(deadline, cancellation)?;
+                        let read = input.read(&mut buffer).map_err(io)?;
+                        if read == 0 {
+                            break;
+                        }
+                        size += read as u64;
+                        total += read as u64;
+                        if size > limits.0 || total > limits.1 {
+                            return Err(recipe_error("Apple SDK grew beyond byte limit"));
+                        }
+                        output.write_all(&buffer[..read]).map_err(io)?;
+                    }
+                    if size != metadata.len()
+                        || stamp(&input.metadata().map_err(io)?) != stamp(&metadata)
+                        || stamp(&fs::symlink_metadata(&path).map_err(io)?) != stamp(&metadata)
+                    {
+                        return Err(recipe_error("Apple SDK source changed while copying"));
+                    }
+                    output.set_permissions(metadata.permissions()).map_err(io)?;
+                } else if metadata.file_type().is_symlink() {
+                    let target = fs::read_link(&path).map_err(io)?;
+                    if target.is_absolute()
+                        || target.to_str().is_none()
+                        || !fs::canonicalize(&path).map_err(io)?.starts_with(&source)
+                    {
+                        return Err(recipe_error("Apple SDK alias escapes source root"));
+                    }
+                    symlink(target, destination).map_err(io)?;
+                } else {
+                    return Err(recipe_error("Apple SDK contains a special file"));
+                }
+            }
+        }
+        for (path, permissions) in directories.into_iter().rev() {
+            check(deadline, cancellation)?;
+            fs::set_permissions(path, permissions).map_err(io)?;
+        }
+        fs::set_permissions(&root, fs::metadata(&source).map_err(io)?.permissions()).map_err(io)?;
+        let tree_sha256 = tool_tree_digest(&root, &|| check(deadline, cancellation))?;
+        Ok(Self {
+            _directory: directory,
+            root,
+            receipt: SdkReceipt {
+                tree_sha256,
+                regular_bytes: total,
+                entries,
+            },
+            deadline,
+            cancellation: cancellation.clone(),
+        })
+    }
+
+    /// The exact owned directory selected as SDKROOT.
+    pub(super) fn root(&self) -> &Path {
+        &self.root
+    }
+
+    /// The receipt measured from the private destination tree.
+    pub(super) fn receipt(&self) -> &SdkReceipt {
+        &self.receipt
+    }
+
+    /// Rehashes the owned SDK under the caller's original attempt budget.
+    ///
+    /// # Errors
+    ///
+    /// Rejects changed or unsafe entries, cancellation and expiration.
+    pub(super) fn verify(&self) -> Result<(), Report<ReleaseError>> {
+        check(self.deadline, &self.cancellation)?;
+        real_directory("owned Apple SDK", &self.root)?;
+        let digest = tool_tree_digest(&self.root, &|| check(self.deadline, &self.cancellation))?;
+        if digest != self.receipt.tree_sha256 {
+            return Err(recipe_error("owned Apple SDK changed after measurement"));
+        }
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::ffi::CString;
+    use std::fs;
+    use std::os::unix::fs::symlink;
+    use std::sync::Arc;
+    use std::time::{Duration, Instant};
+
+    use super::*;
+    use crate::process::Cancellation;
+
+    #[test]
+    fn explicit_smoke_developer_selection_requires_a_canonical_plain_directory() {
+        let directory = tempfile::tempdir().expect("should create selection fixture");
+        let canonical =
+            fs::canonicalize(directory.path()).expect("should resolve selection fixture");
+        symlink(&canonical, canonical.join("alias")).expect("should create developer alias");
+        for path in [PathBuf::from("relative-developer"), canonical.join("alias")] {
+            let error = super::super::AppleDeveloperTools::measure_selected_developer(
+                path,
+                Instant::now() + Duration::from_secs(30),
+                &Cancellation::default(),
+            )
+            .expect_err("should reject unchecked developer root before reading SDK");
+            let text = format!("{error:?}");
+            assert!(
+                text.contains("absolute normal path") || text.contains("symlink"),
+                "should reject root itself rather than missing SDK: {text}"
+            );
+        }
+    }
+
+    #[allow(
+        clippy::needless_pass_by_value,
+        reason = "the failed finalizer owns the SDK to exercise cleanup on its error return"
+    )]
+    fn fail_after_restoring_modes(sdk: OwnedSdk) -> Result<(), Report<ReleaseError>> {
+        fs::set_permissions(
+            sdk.root().join("readonly/inaccessible"),
+            fs::Permissions::from_mode(0o0),
+        )
+        .expect("should restore inaccessible child mode");
+        fs::set_permissions(
+            sdk.root().join("readonly"),
+            fs::Permissions::from_mode(0o555),
+        )
+        .expect("should restore readonly child mode");
+        fs::set_permissions(sdk.root(), fs::Permissions::from_mode(0o0))
+            .expect("should restore inaccessible root mode");
+        Err(recipe_error("finalization failed after mode restoration"))
+    }
+
+    #[test]
+    fn readonly_sdk_directory_is_removed_after_last_clone_even_when_cancelled() {
+        let source = tempfile::tempdir().expect("should create source");
+        fs::create_dir(source.path().join("readonly")).expect("should create readonly directory");
+        fs::write(source.path().join("readonly/header.h"), b"header").expect("should write header");
+        fs::set_permissions(
+            source.path().join("readonly"),
+            fs::Permissions::from_mode(0o555),
+        )
+        .expect("should set readonly mode");
+        let cancellation = Cancellation::default();
+        let sdk = Arc::new(
+            OwnedSdk::stage(
+                source.path(),
+                Instant::now() + Duration::from_secs(30),
+                &cancellation,
+            )
+            .expect("should copy readonly SDK"),
+        );
+        fs::set_permissions(
+            source.path().join("readonly"),
+            fs::Permissions::from_mode(0o755),
+        )
+        .expect("should restore source for fixture cleanup");
+        let root = sdk.root().to_owned();
+        let clone = Arc::clone(&sdk);
+        drop(sdk);
+        assert!(root.exists(), "should retain SDK while clone exists");
+        assert_eq!(
+            fs::metadata(root.join("readonly"))
+                .expect("should inspect readonly directory")
+                .mode()
+                & 0o7777,
+            0o555,
+            "should preserve measured mode while alive"
+        );
+        cancellation.cancel();
+        drop(clone);
+        let leaked = root.exists();
+        if leaked {
+            fs::set_permissions(root.join("readonly"), fs::Permissions::from_mode(0o755))
+                .expect("should clean regression failure");
+            fs::remove_dir_all(&root).expect("should remove regression failure");
+        }
+        assert!(
+            !leaked,
+            "should remove readonly SDK after last clone despite cancellation"
+        );
+    }
+
+    #[test]
+    fn failed_stage_scope_removes_restored_readonly_directories() {
+        let source = tempfile::tempdir().expect("should create source");
+        fs::create_dir_all(source.path().join("readonly/inaccessible"))
+            .expect("should create directory");
+        fs::write(
+            source.path().join("readonly/inaccessible/header.h"),
+            b"header",
+        )
+        .expect("should write header");
+        let sdk = OwnedSdk::stage(
+            source.path(),
+            Instant::now() + Duration::from_secs(30),
+            &Cancellation::default(),
+        )
+        .expect("should copy SDK before fallible finalization");
+        let root = sdk.root().to_owned();
+        let failed = fail_after_restoring_modes(sdk);
+        assert!(failed.is_err(), "should exercise failed finalization");
+        let leaked = root.exists();
+        if leaked {
+            fs::set_permissions(&root, fs::Permissions::from_mode(0o755))
+                .expect("should clean inaccessible regression failure");
+            fs::set_permissions(root.join("readonly"), fs::Permissions::from_mode(0o755))
+                .expect("should clean readonly regression failure");
+            fs::set_permissions(
+                root.join("readonly/inaccessible"),
+                fs::Permissions::from_mode(0o755),
+            )
+            .expect("should clean inaccessible child regression failure");
+            fs::remove_dir_all(&root).expect("should remove regression failure");
+        }
+        assert!(
+            !leaked,
+            "should clean failed stage after modes were restored"
+        );
+    }
+
+    #[test]
+    fn cleanup_never_follows_replaced_directory_aliases_or_chmods_files() {
+        let source = tempfile::tempdir().expect("should create source");
+        fs::create_dir(source.path().join("directory")).expect("should create directory");
+        let external = tempfile::tempdir().expect("should create external fixture");
+        fs::write(external.path().join("header.h"), b"external header")
+            .expect("should write external file");
+        fs::set_permissions(
+            external.path().join("header.h"),
+            fs::Permissions::from_mode(0o444),
+        )
+        .expect("should protect external file");
+        let sdk = OwnedSdk::stage(
+            source.path(),
+            Instant::now() + Duration::from_secs(30),
+            &Cancellation::default(),
+        )
+        .expect("should stage SDK");
+        let root = sdk.root().to_owned();
+        fs::remove_dir(root.join("directory")).expect("should replace owned directory");
+        symlink(external.path(), root.join("directory")).expect("should add external alias");
+        fs::hard_link(external.path().join("header.h"), root.join("hardlink.h"))
+            .expect("should add external file hardlink");
+        fs::set_permissions(external.path(), fs::Permissions::from_mode(0o555))
+            .expect("should protect external directory");
+        drop(sdk);
+        let mode = fs::metadata(external.path())
+            .expect("should inspect external directory")
+            .mode()
+            & 0o7777;
+        let file_mode = fs::metadata(external.path().join("header.h"))
+            .expect("should inspect external file")
+            .mode()
+            & 0o7777;
+        fs::set_permissions(external.path(), fs::Permissions::from_mode(0o755))
+            .expect("should restore external fixture for cleanup");
+        assert!(
+            !root.exists(),
+            "should remove aliases and hardlinks from owned tree"
+        );
+        assert_eq!(mode, 0o555, "should not chmod external alias target");
+        assert_eq!(
+            file_mode, 0o444,
+            "should not chmod external hardlinked file"
+        );
+    }
+
+    #[test]
+    #[ignore = "requires the explicitly selected local Xcode SDK and a receipt destination; copies the SDK, never modifies Xcode"]
+    fn ordinary_ci_selected_sdk_detached_snapshot_smoke() {
+        let destination = std::env::var_os("TS_RELEASE_APPLE_SDK_SMOKE_RECEIPT")
+            .map(PathBuf::from)
+            .expect("should explicitly supply a fresh smoke receipt destination");
+        let cancellation = Cancellation::default();
+        let deadline = Instant::now() + Duration::from_secs(15 * 60);
+        // This explicit local observation never changes CI link selection or
+        // grants qualification to the measured installed developer tools.
+        let apple = match std::env::var_os("TS_RELEASE_APPLE_SDK_SMOKE_DEVELOPER_ROOT") {
+            Some(root) => super::super::AppleDeveloperTools::measure_selected_developer(
+                PathBuf::from(root),
+                deadline,
+                &cancellation,
+            ),
+            None => super::super::AppleDeveloperTools::for_ordinary_ci(deadline, &cancellation),
+        }
+        .expect("should measure Xcode and stage the selected SDK");
+        let root = apple.sdk_root().to_owned();
+        let evidence = apple
+            .candidate_measurement()
+            .expect("should recheck selected SDK at evidence sealing");
+        let receipt = serde_json::to_vec(
+            &evidence
+                .sdk_tree
+                .expect("should have a complete selected SDK receipt"),
+        )
+        .expect("should serialize SDK receipt");
+        let clone = apple.clone();
+        drop(apple);
+        clone
+            .verify()
+            .expect("should retain and recheck selected SDK through clone");
+        drop(clone);
+        assert!(
+            !root.exists(),
+            "should clean copied SDK after last selection is dropped"
+        );
+        let mut output = File::options()
+            .write(true)
+            .create_new(true)
+            .open(destination)
+            .expect("should create fresh smoke receipt");
+        output
+            .write_all(&receipt)
+            .expect("should write observed SDK receipt after cleanup");
+    }
+
+    #[test]
+    fn snapshot_copies_vendor_hardlinks_independently_and_preserves_internal_aliases() {
+        let source = tempfile::tempdir().expect("should create source");
+        fs::write(source.path().join("header.h"), b"header").expect("should write header");
+        fs::hard_link(
+            source.path().join("header.h"),
+            source.path().join("other.h"),
+        )
+        .expect("should link vendor file");
+        symlink("header.h", source.path().join("alias.h")).expect("should link alias");
+        let sdk = OwnedSdk::stage(
+            source.path(),
+            Instant::now() + Duration::from_secs(30),
+            &Cancellation::default(),
+        )
+        .expect("should stage vendor SDK");
+        for name in ["header.h", "other.h"] {
+            assert_eq!(
+                fs::metadata(sdk.root().join(name))
+                    .expect("should inspect copy")
+                    .nlink(),
+                1,
+                "should create independent owned files"
+            );
+        }
+        assert_eq!(
+            fs::read_link(sdk.root().join("alias.h")).expect("should inspect alias"),
+            std::path::PathBuf::from("header.h"),
+            "should preserve relative alias"
+        );
+        sdk.verify().expect("should verify owned tree");
+    }
+
+    #[test]
+    fn snapshot_refuses_cancelled_or_expired_source_copy() {
+        let source = tempfile::tempdir().expect("should create source");
+        let cancellation = Cancellation::default();
+        cancellation.cancel();
+        assert!(
+            OwnedSdk::stage(
+                source.path(),
+                Instant::now() + Duration::from_secs(30),
+                &cancellation
+            )
+            .is_err(),
+            "should stop cancelled copy"
+        );
+        assert!(
+            OwnedSdk::stage(
+                source.path(),
+                Instant::now() - Duration::from_secs(1),
+                &Cancellation::default()
+            )
+            .is_err(),
+            "should stop expired copy"
+        );
+    }
+
+    #[test]
+    fn snapshot_preserves_source_modes_and_checks_empty_tree_cancellation() {
+        let source = tempfile::tempdir().expect("should create source");
+        fs::set_permissions(source.path(), fs::Permissions::from_mode(0o755))
+            .expect("should set source mode");
+        let cancellation = Cancellation::default();
+        let sdk = OwnedSdk::stage(
+            source.path(),
+            Instant::now() + Duration::from_secs(30),
+            &cancellation,
+        )
+        .expect("should stage source");
+        assert_eq!(
+            fs::metadata(sdk.root())
+                .expect("should inspect root")
+                .mode()
+                & 0o7777,
+            0o755,
+            "should preserve source root mode"
+        );
+        cancellation.cancel();
+        assert!(
+            sdk.verify().is_err(),
+            "should check cancellation even for empty tree"
+        );
+    }
+
+    #[test]
+    fn snapshot_rejects_unsafe_source_aliases_and_special_files() {
+        for target in ["/absolute", "../outside", "missing"] {
+            let source = tempfile::tempdir().expect("should create source");
+            symlink(target, source.path().join("alias")).expect("should write alias");
+            assert!(
+                OwnedSdk::stage(
+                    source.path(),
+                    Instant::now() + Duration::from_secs(30),
+                    &Cancellation::default()
+                )
+                .is_err(),
+                "should reject {target}"
+            );
+        }
+        let source = tempfile::tempdir().expect("should create source");
+        let fifo = CString::new(
+            source
+                .path()
+                .join("fifo")
+                .to_str()
+                .expect("should have UTF-8 path"),
+        )
+        .expect("should encode FIFO path");
+        // SAFETY: the CString remains alive and points to a NUL-terminated path.
+        assert_eq!(
+            unsafe { libc::mkfifo(fifo.as_ptr(), 0o600) },
+            0,
+            "should create special file"
+        );
+        assert!(
+            OwnedSdk::stage(
+                source.path(),
+                Instant::now() + Duration::from_secs(30),
+                &Cancellation::default()
+            )
+            .is_err(),
+            "should reject special file"
+        );
+    }
+
+    #[test]
+    fn snapshot_enforces_source_file_tree_and_entry_bounds() {
+        for limits in [(3, 20, 10), (20, 5, 10), (20, 20, 1)] {
+            let source = tempfile::tempdir().expect("should create source");
+            for name in ["first", "second"] {
+                fs::write(source.path().join(name), b"1234").expect("should write input");
+            }
+            assert!(
+                OwnedSdk::stage_with_limits(
+                    source.path(),
+                    Instant::now() + Duration::from_secs(30),
+                    &Cancellation::default(),
+                    limits
+                )
+                .is_err(),
+                "should reject exhausted {limits:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn snapshot_rejects_destination_hardlinks_and_changed_aliases() {
+        for hardlink in [true, false] {
+            let source = tempfile::tempdir().expect("should create source");
+            fs::write(source.path().join("header.h"), b"header").expect("should write header");
+            symlink("header.h", source.path().join("alias.h")).expect("should write alias");
+            let sdk = OwnedSdk::stage(
+                source.path(),
+                Instant::now() + Duration::from_secs(30),
+                &Cancellation::default(),
+            )
+            .expect("should stage source");
+            if hardlink {
+                fs::hard_link(sdk.root().join("header.h"), source.path().join("outside.h"))
+                    .expect("should add external hardlink");
+            } else {
+                fs::remove_file(sdk.root().join("alias.h")).expect("should remove alias");
+                symlink("../outside", sdk.root().join("alias.h")).expect("should change alias");
+            }
+            assert!(sdk.verify().is_err(), "should reject mutated owned SDK");
+        }
+    }
+}
diff --git a/crates/trusted-server-release/src/recipe/apple/toolchain.rs b/crates/trusted-server-release/src/recipe/apple/toolchain.rs
new file mode 100644
index 0000000000..e4a066298c
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/apple/toolchain.rs
@@ -0,0 +1,512 @@
+//! In-place identity of the selected toolchain's helpers, `libLTO`, optional
+//! `libtapi`, clang resources and the entire library directory.
+//!
+//! Everything is read below the selected `clang`'s toolchain `usr` directory,
+//! which stays part of the vendor developer root: nothing is copied, executed
+//! or resolved through `xcrun`. Vendor hard links are accepted because the
+//! tree is not owned; every measured file is rehashed at each verification
+//! point instead. The receipt states which bytes were present, not which of
+//! them clang actually read or ran. Libraries outside the selected directories
+//! and the dependency/load closure remain unresolved.
+//!
+//! # Swap window
+//!
+//! Only the leaf of each measured file is opened with `O_NOFOLLOW`; the
+//! intermediate directories are resolved by path. Between the canonical-root
+//! check and a later open, a process able to write the vendor tree could swap
+//! an intermediate directory for an alias. Such a change is detected, not
+//! prevented: each file's device, inode, size, mode and times must match
+//! before and after hashing, every root is rechecked as a real unaliased
+//! directory, and the whole receipt is remeasured at each verification
+//! point. Inside the confined build the developer directory is a read and
+//! execute only system root, so the build itself cannot perform the swap.
+//!
+//! [`vendor_tree_digest`] requires a canonical root (a real directory that
+//! resolves to itself); alias containment is checked by comparing canonical
+//! targets against that root, which is only meaningful when the root is
+//! canonical.
+
+use std::collections::BTreeMap;
+use std::fs::{self, File};
+use std::io::{ErrorKind, Read as _};
+use std::os::unix::fs::{MetadataExt as _, OpenOptionsExt as _, PermissionsExt as _};
+use std::path::{Component, Path, PathBuf};
+use std::time::Instant;
+
+use error_stack::Report;
+use serde::Serialize;
+use sha2::{Digest as _, Sha256};
+
+use super::super::fresh::real_directory;
+use super::super::recipe_error;
+use crate::error::ReleaseError;
+use crate::process::Cancellation;
+
+/// Toolchain library directory relative to the toolchain `usr` directory.
+const TOOLCHAIN_LIB: &str = "lib";
+/// The LTO library `ld` loads, relative to the toolchain `usr` directory.
+const LIBLTO: &str = "lib/libLTO.dylib";
+/// Optional TAPI library relative to the selected toolchain `usr` directory.
+const LIBTAPI: &str = "lib/libtapi.dylib";
+/// Parent of clang's versioned resource directory below the toolchain `usr`.
+const CLANG_RESOURCES: &str = "lib/clang";
+/// Largest accepted `libLTO.dylib`.
+const LIBLTO_LIMIT: u64 = 512 * 1024 * 1024;
+/// Largest accepted `libtapi.dylib`.
+const LIBTAPI_LIMIT: u64 = 128 * 1024 * 1024;
+/// Most entries accepted in the clang resource parent directory.
+const RESOURCE_PARENT_ENTRY_LIMIT: usize = 64;
+/// Longest accepted clang resource version or alias name.
+const MAX_RESOURCE_VERSION: usize = 32;
+/// File read size while hashing a vendor file.
+const HASH_CHUNK: usize = 64 * 1024;
+/// Versioned domain prefix of every vendor tree digest.
+const TREE_DOMAIN: &[u8] = b"ts-apple-vendor-tree-v1\0";
+
+/// The kind label and bounds of one in-place vendor tree.
+///
+/// The kind is hashed into the digest, so trees of different kinds never
+/// share an identity even with identical contents.
+#[derive(Clone, Copy, Debug)]
+struct TreePolicy {
+    kind: &'static str,
+    file_bytes: u64,
+    tree_bytes: u64,
+    entries: usize,
+}
+
+/// Policy for the clang resource directory (headers and runtime libraries).
+const RESOURCE_POLICY: TreePolicy = TreePolicy {
+    kind: "clang-resource-directory",
+    file_bytes: 128 * 1024 * 1024,
+    tree_bytes: 1024 * 1024 * 1024,
+    entries: 20_000,
+};
+
+/// Policy for the toolchain helper directory beside `clang`.
+const HELPER_POLICY: TreePolicy = TreePolicy {
+    kind: "toolchain-helper-directory",
+    file_bytes: 512 * 1024 * 1024,
+    tree_bytes: 4 * 1024 * 1024 * 1024,
+    entries: 4_000,
+};
+
+/// Policy for the selected toolchain's entire `usr/lib` directory.
+const LIBRARY_POLICY: TreePolicy = TreePolicy {
+    kind: "toolchain-library-directory",
+    file_bytes: 512 * 1024 * 1024,
+    tree_bytes: 4 * 1024 * 1024 * 1024,
+    entries: 20_000,
+};
+
+/// Structured digest of one vendor tree measured in place.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize)]
+pub(super) struct VendorTreeReceipt {
+    tree_sha256: String,
+    regular_bytes: u64,
+    entries: usize,
+}
+
+/// Measured toolchain inputs beyond `clang`, `ar` and `ld`.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize)]
+pub(super) struct ToolchainReceipt {
+    clang_resource_version: String,
+    clang_resource_aliases: Vec<String>,
+    clang_resource_tree: VendorTreeReceipt,
+    liblto_sha256: String,
+    libtapi_sha256: Option<String>,
+    helper_tree: VendorTreeReceipt,
+    library_tree: VendorTreeReceipt,
+}
+
+impl ToolchainReceipt {
+    /// Returns the clang resource directory's structured-tree digest.
+    pub(super) fn clang_resource_tree_sha256(&self) -> &str {
+        &self.clang_resource_tree.tree_sha256
+    }
+    /// Returns the raw-file digest of `libLTO.dylib`.
+    pub(super) fn liblto_sha256(&self) -> &str {
+        &self.liblto_sha256
+    }
+    /// Returns the raw-file digest of `libtapi.dylib`, when present.
+    pub(super) fn libtapi_sha256(&self) -> Option<&str> {
+        self.libtapi_sha256.as_deref()
+    }
+    /// Returns the helper directory's structured-tree digest.
+    pub(super) fn helper_tree_sha256(&self) -> &str {
+        &self.helper_tree.tree_sha256
+    }
+    /// Returns the entire library directory's structured-tree digest.
+    pub(super) fn library_tree_sha256(&self) -> &str {
+        &self.library_tree.tree_sha256
+    }
+}
+
+/// A toolchain receipt bound to the attempt budget that rechecks it.
+#[derive(Clone, Debug)]
+pub(super) struct MeasuredToolchain {
+    helper_dir: PathBuf,
+    usr_dir: PathBuf,
+    receipt: ToolchainReceipt,
+    deadline: Instant,
+    cancellation: Cancellation,
+}
+
+impl MeasuredToolchain {
+    /// Measures helpers, resources and the entire selected `usr/lib` in place.
+    ///
+    /// The toolchain holds `clang` strictly below `developer_dir`.
+    ///
+    /// # Errors
+    ///
+    /// Rejects a `clang` path with a non-normal component or not at
+    /// `<toolchain>/usr/bin/clang`, a toolchain outside the developer
+    /// directory, anything other than exactly one clang resource version
+    /// directory, a missing or non-regular `libLTO.dylib`, unsafe aliases,
+    /// special files, exhausted limits, cancellation and expiration.
+    pub(super) fn measure(
+        clang: &Path,
+        developer_dir: &Path,
+        deadline: Instant,
+        cancellation: &Cancellation,
+    ) -> Result<Self, Report<ReleaseError>> {
+        let (helper_dir, usr_dir) = toolchain_layout(clang, developer_dir)?;
+        let receipt = measure_receipt(&helper_dir, &usr_dir, &|| budget(deadline, cancellation))?;
+        Ok(Self {
+            helper_dir,
+            usr_dir,
+            receipt,
+            deadline,
+            cancellation: cancellation.clone(),
+        })
+    }
+
+    /// The receipt measured at selection.
+    pub(super) fn receipt(&self) -> &ToolchainReceipt {
+        &self.receipt
+    }
+
+    /// Remeasures the toolchain under the original attempt budget.
+    ///
+    /// # Errors
+    ///
+    /// Rejects any changed, added or removed entry, a changed resource
+    /// selection, unsafe entries, cancellation and expiration.
+    pub(super) fn verify(&self) -> Result<(), Report<ReleaseError>> {
+        let current = measure_receipt(&self.helper_dir, &self.usr_dir, &|| {
+            budget(self.deadline, &self.cancellation)
+        })?;
+        if current != self.receipt {
+            return Err(recipe_error("Apple toolchain changed after measurement"));
+        }
+        Ok(())
+    }
+}
+
+fn budget(deadline: Instant, cancellation: &Cancellation) -> Result<(), Report<ReleaseError>> {
+    if cancellation.is_cancelled() || Instant::now() >= deadline {
+        return Err(recipe_error(
+            "Apple toolchain measurement cancelled or timed out",
+        ));
+    }
+    Ok(())
+}
+
+fn measurement_error(error: impl std::fmt::Display) -> Report<ReleaseError> {
+    recipe_error(format!("Apple toolchain measurement: {error}"))
+}
+
+/// Returns the helper (`usr/bin`) and `usr` directories of `clang`.
+///
+/// The path must be absolute with only normal components, `clang` must sit
+/// in a directory named `bin` whose parent is named `usr`, and that `usr`
+/// directory must be strictly inside `developer_dir`.
+fn toolchain_layout(
+    clang: &Path,
+    developer_dir: &Path,
+) -> Result<(PathBuf, PathBuf), Report<ReleaseError>> {
+    let mut components = clang.components();
+    let normal = components.next() == Some(Component::RootDir)
+        && components.all(|component| matches!(component, Component::Normal(_)));
+    if !normal {
+        return Err(recipe_error(
+            "Apple clang path must be absolute with only normal components",
+        ));
+    }
+    let helper_dir = clang
+        .parent()
+        .filter(|bin| bin.file_name().is_some_and(|name| name == "bin"))
+        .ok_or_else(|| recipe_error("Apple clang must sit in a toolchain usr/bin directory"))?;
+    let usr_dir = helper_dir
+        .parent()
+        .filter(|usr| usr.file_name().is_some_and(|name| name == "usr"))
+        .ok_or_else(|| recipe_error("Apple clang must sit in a toolchain usr/bin directory"))?;
+    if !usr_dir.starts_with(developer_dir) || usr_dir == developer_dir {
+        return Err(recipe_error(
+            "Apple toolchain is not inside the Apple developer directory",
+        ));
+    }
+    Ok((helper_dir.to_owned(), usr_dir.to_owned()))
+}
+
+fn measure_receipt(
+    helper_dir: &Path,
+    usr_dir: &Path,
+    check: &dyn Fn() -> Result<(), Report<ReleaseError>>,
+) -> Result<ToolchainReceipt, Report<ReleaseError>> {
+    check()?;
+    real_directory("Apple toolchain helper directory", helper_dir)?;
+    real_directory(
+        "Apple toolchain library directory",
+        &usr_dir.join(TOOLCHAIN_LIB),
+    )?;
+    let resource_parent = usr_dir.join(CLANG_RESOURCES);
+    let (clang_resource_version, clang_resource_aliases) =
+        select_resource_version(&resource_parent, check)?;
+    let resource_dir = resource_parent.join(&clang_resource_version);
+    real_directory("Apple clang resource directory", &resource_dir)?;
+    let clang_resource_tree = vendor_tree_digest(&resource_dir, RESOURCE_POLICY, check)?;
+    let (liblto_sha256, _) = hash_vendor_file(&usr_dir.join(LIBLTO), LIBLTO_LIMIT, check)?;
+    let libtapi_sha256 = optional_libtapi_digest(&usr_dir.join(LIBTAPI), check)?;
+    let helper_tree = vendor_tree_digest(helper_dir, HELPER_POLICY, check)?;
+    let library_tree = vendor_tree_digest(&usr_dir.join(TOOLCHAIN_LIB), LIBRARY_POLICY, check)?;
+    Ok(ToolchainReceipt {
+        clang_resource_version,
+        clang_resource_aliases,
+        clang_resource_tree,
+        liblto_sha256,
+        libtapi_sha256,
+        helper_tree,
+        library_tree,
+    })
+}
+
+/// Records absence only when the exact leaf does not exist; aliases and all
+/// other metadata or read failures are rejected rather than treated as absent.
+fn optional_libtapi_digest(
+    path: &Path,
+    check: &dyn Fn() -> Result<(), Report<ReleaseError>>,
+) -> Result<Option<String>, Report<ReleaseError>> {
+    check()?;
+    match fs::symlink_metadata(path) {
+        Ok(_) => hash_vendor_file(path, LIBTAPI_LIMIT, check).map(|(digest, _)| Some(digest)),
+        Err(error) if error.kind() == ErrorKind::NotFound => {
+            check()?;
+            let parent = path
+                .parent()
+                .ok_or_else(|| recipe_error("Apple libtapi path has no library directory"))?;
+            real_directory("Apple toolchain library directory", parent)?;
+            Ok(None)
+        }
+        Err(error) => Err(measurement_error(error)),
+    }
+}
+
+fn resource_version_name(name: &str) -> bool {
+    !name.is_empty()
+        && name.len() <= MAX_RESOURCE_VERSION
+        && name
+            .bytes()
+            .all(|byte| byte.is_ascii_digit() || byte == b'.')
+        && name
+            .bytes()
+            .next()
+            .is_some_and(|byte| byte.is_ascii_digit())
+}
+
+/// Selects the only real clang version directory and its sibling aliases.
+///
+/// Every alias must name exactly that directory; any other entry fails closed.
+fn select_resource_version(
+    parent: &Path,
+    check: &dyn Fn() -> Result<(), Report<ReleaseError>>,
+) -> Result<(String, Vec<String>), Report<ReleaseError>> {
+    real_directory("Apple clang resource parent", parent)?;
+    let mut versions = Vec::new();
+    let mut aliases = Vec::new();
+    for (index, entry) in fs::read_dir(parent).map_err(measurement_error)?.enumerate() {
+        check()?;
+        if index >= RESOURCE_PARENT_ENTRY_LIMIT {
+            return Err(recipe_error(
+                "Apple clang resource parent exceeds entry limit",
+            ));
+        }
+        let entry = entry.map_err(measurement_error)?;
+        let name = entry
+            .file_name()
+            .into_string()
+            .ok()
+            .filter(|name| resource_version_name(name))
+            .ok_or_else(|| recipe_error("Apple clang resource entry is not a version name"))?;
+        let metadata = fs::symlink_metadata(entry.path()).map_err(measurement_error)?;
+        if metadata.is_dir() {
+            versions.push(name);
+        } else if metadata.file_type().is_symlink() {
+            aliases.push((
+                name,
+                fs::read_link(entry.path()).map_err(measurement_error)?,
+            ));
+        } else {
+            return Err(recipe_error(
+                "Apple clang resource parent holds a non-directory entry",
+            ));
+        }
+    }
+    let [version] = <[String; 1]>::try_from(versions).map_err(|_| {
+        recipe_error("Apple clang resources must hold exactly one version directory")
+    })?;
+    let mut alias_names = Vec::with_capacity(aliases.len());
+    for (name, target) in aliases {
+        if target != Path::new(&version) {
+            return Err(recipe_error(
+                "Apple clang resource alias names another target than the version directory",
+            ));
+        }
+        alias_names.push(name);
+    }
+    alias_names.sort();
+    Ok((version, alias_names))
+}
+
+fn stamp(metadata: &fs::Metadata) -> (u64, u64, u64, u32, i64, i64, i64, i64) {
+    (
+        metadata.dev(),
+        metadata.ino(),
+        metadata.len(),
+        metadata.mode(),
+        metadata.mtime(),
+        metadata.mtime_nsec(),
+        metadata.ctime(),
+        metadata.ctime_nsec(),
+    )
+}
+
+/// Hashes one vendor regular file in place, opened without following a leaf
+/// alias. Vendor hard links are accepted; the content is rechecked instead.
+fn hash_vendor_file(
+    path: &Path,
+    limit: u64,
+    check: &dyn Fn() -> Result<(), Report<ReleaseError>>,
+) -> Result<(String, u64), Report<ReleaseError>> {
+    check()?;
+    let mut file = File::options()
+        .read(true)
+        .custom_flags(libc::O_NOFOLLOW | libc::O_NONBLOCK | libc::O_CLOEXEC)
+        .open(path)
+        .map_err(measurement_error)?;
+    let before = file.metadata().map_err(measurement_error)?;
+    if !before.is_file() || before.len() > limit {
+        return Err(recipe_error(format!(
+            "Apple toolchain file {} is not a regular file within its size limit",
+            path.display()
+        )));
+    }
+    let mut hasher = Sha256::new();
+    let mut buffer = vec![0_u8; HASH_CHUNK];
+    let mut size = 0_u64;
+    loop {
+        check()?;
+        let read = match file.read(&mut buffer) {
+            Ok(read) => read,
+            Err(error) if error.kind() == ErrorKind::Interrupted => continue,
+            Err(error) => return Err(measurement_error(error)),
+        };
+        let Some(chunk) = buffer.get(..read).filter(|chunk| !chunk.is_empty()) else {
+            break;
+        };
+        size += u64::try_from(chunk.len()).map_err(measurement_error)?;
+        if size > before.len() {
+            return Err(recipe_error("Apple toolchain file grew while hashing"));
+        }
+        hasher.update(chunk);
+    }
+    if size != before.len()
+        || stamp(&file.metadata().map_err(measurement_error)?) != stamp(&before)
+        || stamp(&fs::symlink_metadata(path).map_err(measurement_error)?) != stamp(&before)
+    {
+        return Err(recipe_error("Apple toolchain file changed while hashing"));
+    }
+    Ok((hex::encode(hasher.finalize()), size))
+}
+
+/// Digests every entry below `root` in place: relative path, kind, mode and,
+/// for regular files, size and SHA-256; for aliases, their relative target.
+/// The digest is seeded with [`TREE_DOMAIN`] and the policy's tree kind.
+///
+/// `root` must be canonical (callers check it with `real_directory`), since
+/// alias containment compares canonical targets against it.
+///
+/// Rejects non-UTF-8 names, absolute, dangling or root-escaping aliases,
+/// special files and exhausted policy limits.
+fn vendor_tree_digest(
+    root: &Path,
+    policy: TreePolicy,
+    check: &dyn Fn() -> Result<(), Report<ReleaseError>>,
+) -> Result<VendorTreeReceipt, Report<ReleaseError>> {
+    let mut pending = vec![root.to_owned()];
+    let mut facts = BTreeMap::new();
+    let mut regular_bytes = 0_u64;
+    while let Some(directory) = pending.pop() {
+        for entry in fs::read_dir(directory).map_err(measurement_error)? {
+            check()?;
+            let path = entry.map_err(measurement_error)?.path();
+            let relative = path
+                .strip_prefix(root)
+                .map_err(measurement_error)?
+                .to_str()
+                .ok_or_else(|| recipe_error("Apple toolchain path is not UTF-8"))?
+                .to_owned();
+            if facts.len() >= policy.entries {
+                return Err(recipe_error("Apple toolchain tree exceeds entry limit"));
+            }
+            let metadata = fs::symlink_metadata(&path).map_err(measurement_error)?;
+            let mode = metadata.permissions().mode() & 0o7777;
+            let fact = if metadata.is_dir() {
+                pending.push(path);
+                format!("directory:{mode}")
+            } else if metadata.is_file() {
+                let (sha256, size) = hash_vendor_file(&path, policy.file_bytes, check)?;
+                regular_bytes += size;
+                if regular_bytes > policy.tree_bytes {
+                    return Err(recipe_error("Apple toolchain tree exceeds byte limit"));
+                }
+                format!("file:{mode}:{size}:{sha256}")
+            } else if metadata.file_type().is_symlink() {
+                let target = fs::read_link(&path).map_err(measurement_error)?;
+                let target = target
+                    .to_str()
+                    .filter(|text| !target.is_absolute() && !text.is_empty())
+                    .ok_or_else(|| recipe_error("Apple toolchain alias is not relative UTF-8"))?
+                    .to_owned();
+                if !fs::canonicalize(&path)
+                    .map_err(measurement_error)?
+                    .starts_with(root)
+                {
+                    return Err(recipe_error("Apple toolchain alias escapes its tree"));
+                }
+                format!("alias:{target}")
+            } else {
+                return Err(recipe_error("Apple toolchain tree contains a special file"));
+            };
+            facts.insert(relative, fact);
+        }
+    }
+    let mut digest = Sha256::new();
+    digest.update(TREE_DOMAIN);
+    digest.update(policy.kind.as_bytes());
+    digest.update([0]);
+    for (relative, fact) in &facts {
+        digest.update(relative.as_bytes());
+        digest.update([0]);
+        digest.update(fact.as_bytes());
+        digest.update([0]);
+    }
+    Ok(VendorTreeReceipt {
+        tree_sha256: hex::encode(digest.finalize()),
+        regular_bytes,
+        entries: facts.len(),
+    })
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/trusted-server-release/src/recipe/apple/toolchain/tests.rs b/crates/trusted-server-release/src/recipe/apple/toolchain/tests.rs
new file mode 100644
index 0000000000..eb145ca5e5
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/apple/toolchain/tests.rs
@@ -0,0 +1,808 @@
+use std::ffi::CString;
+use std::fs;
+use std::os::unix::ffi::OsStrExt as _;
+use std::os::unix::fs::symlink;
+use std::time::Duration;
+
+use super::*;
+
+/// A fictional developer directory with one default toolchain.
+struct Toolchain {
+    _directory: tempfile::TempDir,
+    developer: PathBuf,
+    usr: PathBuf,
+}
+
+impl Toolchain {
+    fn new() -> Self {
+        let directory = tempfile::tempdir().expect("should create toolchain fixture");
+        let developer = fs::canonicalize(directory.path())
+            .expect("should canonicalize fixture")
+            .join("developer");
+        let usr = developer.join("Toolchains/XcodeDefault.xctoolchain/usr");
+        for relative in ["bin", "lib/clang/17/include", "lib/clang/17/lib/darwin"] {
+            fs::create_dir_all(usr.join(relative)).expect("should create toolchain directory");
+        }
+        for (relative, bytes) in [
+            ("bin/clang", "fictional clang"),
+            ("bin/ar", "fictional ar"),
+            ("bin/ld", "fictional ld"),
+            ("lib/libLTO.dylib", "fictional libLTO"),
+            ("lib/clang/17/include/stddef.h", "fictional header"),
+            (
+                "lib/clang/17/lib/darwin/libclang_rt.osx.a",
+                "fictional runtime",
+            ),
+        ] {
+            fs::write(usr.join(relative), bytes).expect("should write toolchain file");
+        }
+        symlink("clang", usr.join("bin/clang++")).expect("should alias clang++");
+        symlink("17", usr.join("lib/clang/17.0.0")).expect("should alias resource version");
+        Self {
+            _directory: directory,
+            developer,
+            usr,
+        }
+    }
+
+    fn measure(&self) -> Result<MeasuredToolchain, Report<ReleaseError>> {
+        MeasuredToolchain::measure(
+            &self.usr.join("bin/clang"),
+            &self.developer,
+            Instant::now() + Duration::from_secs(30),
+            &Cancellation::default(),
+        )
+    }
+
+    fn receipt(&self) -> ToolchainReceipt {
+        self.measure()
+            .expect("should measure fictional toolchain")
+            .receipt()
+            .clone()
+    }
+
+    fn error(&self) -> String {
+        format!(
+            "{:?}",
+            self.measure()
+                .expect_err("should reject the fictional toolchain")
+        )
+    }
+}
+
+/// A named fixture edit of one toolchain directory.
+type Mutation = fn(&Path);
+
+fn make_fifo(path: &Path) {
+    let fifo = CString::new(path.to_str().expect("should have UTF-8 path"))
+        .expect("should encode FIFO path");
+    // SAFETY: the CString remains alive and points to a NUL-terminated path.
+    assert_eq!(
+        unsafe { libc::mkfifo(fifo.as_ptr(), 0o600) },
+        0,
+        "should create special file"
+    );
+}
+
+#[test]
+fn library_tree_detects_an_added_sibling_library() {
+    let toolchain = Toolchain::new();
+    let measured = toolchain
+        .measure()
+        .expect("should measure selected toolchain");
+    fs::write(
+        toolchain.usr.join("lib/additional.dylib"),
+        b"fictional library",
+    )
+    .expect("should add sibling library");
+    assert!(
+        measured.verify().is_err(),
+        "should reject a library added after measurement"
+    );
+}
+
+#[test]
+fn library_tree_records_all_subdirectories_and_structured_identity() {
+    let toolchain = Toolchain::new();
+    fs::create_dir_all(toolchain.usr.join("lib/swift/nested"))
+        .expect("should create library subdirectories");
+    fs::write(toolchain.usr.join("lib/swift/nested/extra.dylib"), b"extra")
+        .expect("should write nested library");
+    symlink("nested", toolchain.usr.join("lib/swift/current"))
+        .expect("should alias nested library directory");
+    let measured = toolchain
+        .measure()
+        .expect("should measure library inventory");
+    let receipt = measured.receipt();
+    assert_eq!(
+        receipt.library_tree.entries, 13,
+        "should count every library entry"
+    );
+    assert_eq!(
+        receipt.library_tree.regular_bytes,
+        u64::try_from(
+            b"fictional libLTO".len()
+                + b"fictional header".len()
+                + b"fictional runtime".len()
+                + b"extra".len()
+        )
+        .expect("should fit fixture size"),
+        "should include resources and LTO without following aliases"
+    );
+    let direct = vendor_tree_digest(&toolchain.usr.join("lib"), LIBRARY_POLICY, &|| Ok(()))
+        .expect("should independently measure entire library directory");
+    assert_eq!(
+        receipt.library_tree, direct,
+        "should preserve complete structured inventory"
+    );
+    assert_eq!(
+        receipt.library_tree_sha256(),
+        direct.tree_sha256,
+        "should expose structured digest"
+    );
+    assert_ne!(
+        receipt.library_tree_sha256(),
+        receipt.liblto_sha256(),
+        "should not expose a raw-file digest as tree identity"
+    );
+    assert_eq!(
+        toolchain.receipt(),
+        *receipt,
+        "should retain identical unchanged receipt"
+    );
+    measured
+        .verify()
+        .expect("should verify unchanged complete library tree");
+}
+
+#[test]
+fn library_tree_detects_content_deletion_and_alias_retargeting() {
+    for mutation in [
+        (
+            "content",
+            (|lib: &Path| {
+                fs::write(lib.join("extra.dylib"), b"changed")
+                    .expect("should edit sibling library");
+            }) as Mutation,
+        ),
+        ("deletion", |lib: &Path| {
+            fs::remove_file(lib.join("current.dylib")).expect("should remove library alias");
+            fs::remove_file(lib.join("extra.dylib")).expect("should delete sibling library");
+        }),
+        ("alias target", |lib: &Path| {
+            fs::remove_file(lib.join("current.dylib")).expect("should remove alias");
+            symlink("libLTO.dylib", lib.join("current.dylib")).expect("should retarget alias");
+        }),
+    ] {
+        let toolchain = Toolchain::new();
+        let lib = toolchain.usr.join("lib");
+        fs::write(lib.join("extra.dylib"), b"extra").expect("should write sibling library");
+        symlink("extra.dylib", lib.join("current.dylib")).expect("should add library alias");
+        let measured = toolchain.measure().expect("should measure sibling library");
+        mutation.1(&lib);
+        assert!(
+            measured.verify().is_err(),
+            "should reject changed {}",
+            mutation.0
+        );
+        assert_ne!(
+            toolchain.receipt().library_tree_sha256(),
+            measured.receipt().library_tree_sha256(),
+            "should bind changed {} in digest",
+            mutation.0
+        );
+    }
+}
+
+#[test]
+fn library_tree_rejects_unsafe_entries_and_oversized_files() {
+    let cases: [(&str, Mutation); 5] = [
+        ("absolute alias", |lib| {
+            symlink("/usr/lib", lib.join("absolute")).expect("should add absolute alias");
+        }),
+        ("escaping alias", |lib| {
+            symlink("../bin/clang", lib.join("escape")).expect("should add escaping alias");
+        }),
+        ("dangling alias", |lib| {
+            symlink("missing", lib.join("dangling")).expect("should add dangling alias");
+        }),
+        ("special file", |lib| make_fifo(&lib.join("fifo"))),
+        ("oversized file", |lib| {
+            File::create(lib.join("oversized.dylib"))
+                .expect("should create sparse library")
+                .set_len(LIBRARY_POLICY.file_bytes + 1)
+                .expect("should exceed library file bound");
+        }),
+    ];
+    for (label, mutate) in cases {
+        let toolchain = Toolchain::new();
+        mutate(&toolchain.usr.join("lib"));
+        assert!(
+            toolchain.measure().is_err(),
+            "should reject library {label}"
+        );
+    }
+}
+
+#[test]
+fn library_tree_requires_a_real_unaliased_directory_root() {
+    for alias in [false, true] {
+        let toolchain = Toolchain::new();
+        let lib = toolchain.usr.join("lib");
+        let measured = toolchain
+            .measure()
+            .expect("should measure real library directory");
+        fs::rename(&lib, toolchain.usr.join("other-lib")).expect("should move library directory");
+        if alias {
+            symlink("other-lib", &lib).expect("should alias library root");
+        } else {
+            fs::write(&lib, b"not a directory").expect("should replace library root with file");
+        }
+        assert!(
+            toolchain.measure().is_err(),
+            "should reject non-directory or aliased library root"
+        );
+        assert!(
+            measured.verify().is_err(),
+            "should reject changed library root"
+        );
+    }
+}
+
+#[test]
+fn library_tree_rejects_unreadable_entries_and_obeys_shared_budget() {
+    let toolchain = Toolchain::new();
+    let lib = toolchain.usr.join("lib");
+    let extra = lib.join("extra.dylib");
+    fs::write(&extra, b"extra").expect("should write extra library");
+    let measured = toolchain.measure().expect("should measure extra library");
+    fs::set_permissions(&extra, fs::Permissions::from_mode(0o0))
+        .expect("should remove library read permissions");
+    assert!(
+        measured.verify().is_err(),
+        "should reject unreadable library"
+    );
+    fs::set_permissions(&extra, fs::Permissions::from_mode(0o600))
+        .expect("should restore library read permissions");
+    for expired in [false, true] {
+        let cancellation = Cancellation::default();
+        let deadline = if expired {
+            Instant::now() - Duration::from_secs(1)
+        } else {
+            cancellation.cancel();
+            Instant::now() + Duration::from_secs(30)
+        };
+        assert!(
+            vendor_tree_digest(&lib, LIBRARY_POLICY, &|| budget(deadline, &cancellation)).is_err(),
+            "should reject exhausted library tree attempt budget"
+        );
+    }
+}
+
+#[test]
+fn libtapi_absence_requires_a_real_unaliased_parent() {
+    let toolchain = Toolchain::new();
+    let missing = toolchain.usr.join("missing");
+    let alias = toolchain.usr.join("aliased-lib");
+    symlink("lib", &alias).expect("should alias library directory");
+    let dangling = toolchain.usr.join("dangling-lib");
+    symlink("missing", &dangling).expect("should create dangling parent alias");
+    for parent in [&missing, &alias, &dangling] {
+        assert!(
+            optional_libtapi_digest(&parent.join("libtapi.dylib"), &|| Ok(())).is_err(),
+            "should not record absence below a missing or aliased parent"
+        );
+    }
+}
+
+#[test]
+fn libtapi_receipt_records_digest_or_explicit_null_and_detects_presence_changes() {
+    let toolchain = Toolchain::new();
+    let library = toolchain.usr.join(LIBTAPI);
+    let absent = toolchain.measure().expect("should measure without libtapi");
+    let serialized = serde_json::to_value(absent.receipt()).expect("should serialize receipt");
+    assert_eq!(
+        serialized.get("libtapi_sha256"),
+        Some(&serde_json::Value::Null),
+        "should explicitly record genuine absence"
+    );
+    assert_eq!(
+        absent.receipt().libtapi_sha256(),
+        None,
+        "should expose absence"
+    );
+    fs::write(&library, b"fictional libtapi").expect("should add libtapi");
+    assert!(absent.verify().is_err(), "should reject added libtapi");
+    let present = toolchain.measure().expect("should measure present libtapi");
+    let digest = hex::encode(Sha256::digest(b"fictional libtapi"));
+    assert_eq!(
+        present.receipt().libtapi_sha256(),
+        Some(digest.as_str()),
+        "should hash exact selected libtapi bytes"
+    );
+    let serialized = serde_json::to_value(present.receipt()).expect("should serialize receipt");
+    assert_eq!(
+        serialized["libtapi_sha256"], digest,
+        "should serialize measured digest"
+    );
+    present.verify().expect("should verify unchanged libtapi");
+    fs::remove_file(&library).expect("should remove libtapi");
+    assert!(present.verify().is_err(), "should reject removed libtapi");
+    assert_eq!(
+        toolchain.receipt(),
+        *absent.receipt(),
+        "should remeasure genuine absence identically"
+    );
+}
+
+#[test]
+fn libtapi_rejects_aliases_directories_special_files_and_oversize_files() {
+    let cases: [(&str, Mutation); 5] = [
+        ("alias", |path| {
+            symlink("libLTO.dylib", path).expect("should alias libtapi");
+        }),
+        ("dangling alias", |path| {
+            symlink("missing.dylib", path).expect("should add dangling alias");
+        }),
+        ("directory", |path| {
+            fs::create_dir(path).expect("should create directory");
+        }),
+        ("special file", make_fifo),
+        ("oversize file", |path| {
+            File::create(path)
+                .expect("should create sparse file")
+                .set_len(128 * 1024 * 1024 + 1)
+                .expect("should exceed fixed TAPI limit");
+        }),
+    ];
+    for (label, mutate) in cases {
+        let toolchain = Toolchain::new();
+        mutate(&toolchain.usr.join(LIBTAPI));
+        assert!(
+            toolchain.measure().is_err(),
+            "should reject libtapi {label}"
+        );
+    }
+}
+
+#[test]
+fn libtapi_rejects_unreadable_files_and_honors_the_attempt_budget() {
+    let toolchain = Toolchain::new();
+    let library = toolchain.usr.join(LIBTAPI);
+    fs::write(&library, b"fictional libtapi").expect("should write libtapi");
+    let measured = toolchain.measure().expect("should measure libtapi");
+    fs::set_permissions(&library, fs::Permissions::from_mode(0o0))
+        .expect("should remove read permissions");
+    assert!(
+        toolchain.measure().is_err(),
+        "should reject unreadable libtapi"
+    );
+    fs::set_permissions(&library, fs::Permissions::from_mode(0o600))
+        .expect("should restore permissions");
+    measured.cancellation.cancel();
+    assert!(
+        measured.verify().is_err(),
+        "should stop cancelled libtapi remeasurement"
+    );
+    for present in [false, true] {
+        if !present {
+            fs::remove_file(&library).expect("should remove libtapi");
+        } else {
+            fs::write(&library, b"fictional libtapi").expect("should restore libtapi");
+        }
+        assert!(
+            optional_libtapi_digest(&library, &|| budget(
+                Instant::now() - Duration::from_secs(1),
+                &Cancellation::default()
+            ))
+            .is_err(),
+            "should reject an expired budget even when presence is {present}"
+        );
+    }
+}
+
+#[test]
+fn libtapi_change_is_detected_during_remeasurement() {
+    let toolchain = Toolchain::new();
+    let library = toolchain.usr.join("lib/libtapi.dylib");
+    fs::write(&library, b"fictional libtapi").expect("should write libtapi");
+    let measured = toolchain.measure().expect("should measure toolchain");
+    fs::write(&library, b"changed libtapi").expect("should change libtapi");
+    assert!(measured.verify().is_err(), "should reject changed libtapi");
+}
+
+#[test]
+fn receipt_records_single_resource_version_aliases_and_measured_trees() {
+    let toolchain = Toolchain::new();
+    let receipt = toolchain.receipt();
+    assert_eq!(
+        receipt.clang_resource_version, "17",
+        "should select the only real version directory"
+    );
+    assert_eq!(
+        receipt.clang_resource_aliases,
+        vec!["17.0.0".to_owned()],
+        "should record the version alias"
+    );
+    assert_eq!(
+        receipt.liblto_sha256(),
+        hex::encode(Sha256::digest(b"fictional libLTO")),
+        "should hash libLTO bytes"
+    );
+    assert_eq!(
+        receipt.clang_resource_tree.entries, 5,
+        "should count every resource entry"
+    );
+    assert_eq!(
+        receipt.helper_tree.entries, 4,
+        "should count helper files and aliases"
+    );
+    assert_eq!(
+        toolchain.receipt(),
+        receipt,
+        "should remeasure identically when nothing changed"
+    );
+    toolchain
+        .measure()
+        .expect("should measure")
+        .verify()
+        .expect("should verify unchanged toolchain");
+}
+
+#[test]
+fn resource_tree_digest_changes_when_any_resource_entry_changes() {
+    let toolchain = Toolchain::new();
+    let measured = toolchain.measure().expect("should measure");
+    let original = measured.receipt().clang_resource_tree_sha256().to_owned();
+    fs::write(
+        toolchain.usr.join("lib/clang/17/include/stddef.h"),
+        b"edited header",
+    )
+    .expect("should edit resource header");
+    assert_ne!(
+        toolchain.receipt().clang_resource_tree_sha256(),
+        original,
+        "should bind resource header bytes"
+    );
+    assert!(
+        measured.verify().is_err(),
+        "should reject an edited resource directory"
+    );
+    fs::write(toolchain.usr.join("lib/clang/17/include/new.h"), b"added")
+        .expect("should add resource header");
+    assert!(
+        measured.verify().is_err(),
+        "should reject an added resource entry"
+    );
+}
+
+#[test]
+fn resource_selection_fails_closed_on_ambiguous_or_foreign_entries() {
+    let cases: [(&str, Mutation); 5] = [
+        ("second version", |resources| {
+            fs::create_dir(resources.join("18")).expect("should add second version");
+        }),
+        ("foreign alias", |resources| {
+            fs::create_dir(resources.join("18")).expect("should add directory");
+            fs::remove_dir_all(resources.join("17")).expect("should remove version");
+            symlink("../..", resources.join("17")).expect("should add foreign alias");
+        }),
+        ("alias to other", |resources| {
+            fs::remove_file(resources.join("17.0.0")).expect("should remove alias");
+            symlink("17/include", resources.join("17.0.0")).expect("should add nested alias");
+        }),
+        ("regular file", |resources| {
+            fs::write(resources.join("19"), b"file").expect("should add file");
+        }),
+        ("non version name", |resources| {
+            fs::create_dir(resources.join("include")).expect("should add directory");
+        }),
+    ];
+    for (label, mutate) in cases {
+        let toolchain = Toolchain::new();
+        mutate(&toolchain.usr.join("lib/clang"));
+        let error = toolchain.error();
+        assert!(
+            error.contains("clang resource"),
+            "should reject {label} in resource selection: {error}"
+        );
+    }
+    let toolchain = Toolchain::new();
+    fs::remove_dir_all(toolchain.usr.join("lib/clang/17")).expect("should remove version");
+    fs::remove_file(toolchain.usr.join("lib/clang/17.0.0")).expect("should remove alias");
+    assert!(
+        toolchain.error().contains("exactly one version directory"),
+        "should reject a missing resource version"
+    );
+}
+
+#[test]
+fn liblto_must_be_present_regular_and_unchanged() {
+    let toolchain = Toolchain::new();
+    let measured = toolchain.measure().expect("should measure");
+    fs::write(toolchain.usr.join("lib/libLTO.dylib"), b"changed libLTO")
+        .expect("should change libLTO");
+    assert!(measured.verify().is_err(), "should reject changed libLTO");
+    fs::remove_file(toolchain.usr.join("lib/libLTO.dylib")).expect("should remove libLTO");
+    assert!(
+        toolchain.measure().is_err(),
+        "should reject a missing libLTO"
+    );
+    fs::write(toolchain.usr.join("lib/real-lto.dylib"), b"aliased libLTO")
+        .expect("should write alias target");
+    symlink("real-lto.dylib", toolchain.usr.join("lib/libLTO.dylib")).expect("should alias libLTO");
+    assert!(
+        toolchain.measure().is_err(),
+        "should reject an aliased libLTO"
+    );
+    fs::remove_file(toolchain.usr.join("lib/libLTO.dylib")).expect("should remove alias");
+    fs::create_dir(toolchain.usr.join("lib/libLTO.dylib")).expect("should add directory");
+    assert!(
+        toolchain.measure().is_err(),
+        "should reject a non-regular libLTO"
+    );
+}
+
+#[test]
+fn helper_tree_records_alias_targets() {
+    let toolchain = Toolchain::new();
+    let measured = toolchain.measure().expect("should measure");
+    let original = measured.receipt().helper_tree_sha256().to_owned();
+    fs::remove_file(toolchain.usr.join("bin/clang++")).expect("should remove alias");
+    symlink("ld", toolchain.usr.join("bin/clang++")).expect("should retarget alias");
+    assert_ne!(
+        toolchain.receipt().helper_tree_sha256(),
+        original,
+        "should bind alias targets"
+    );
+    assert!(
+        measured.verify().is_err(),
+        "should reject a retargeted alias"
+    );
+}
+
+#[test]
+fn helper_tree_measures_vendor_hardlinks_and_detects_edits_through_the_other_path() {
+    let toolchain = Toolchain::new();
+    let unlinked = toolchain.receipt();
+    fs::hard_link(
+        toolchain.usr.join("bin/ar"),
+        toolchain.usr.join("bin/ranlib"),
+    )
+    .expect("should add in-tree vendor hardlink");
+    fs::hard_link(
+        toolchain.usr.join("bin/ld"),
+        toolchain.usr.join("lib/ld-copy"),
+    )
+    .expect("should add out-of-tree vendor hardlink");
+    let measured = toolchain
+        .measure()
+        .expect("should measure hardlinked vendor helpers in place");
+    assert_eq!(
+        measured.receipt().helper_tree.entries,
+        5,
+        "should count the in-tree hardlink as an entry"
+    );
+    assert_ne!(
+        measured.receipt().helper_tree_sha256(),
+        unlinked.helper_tree_sha256(),
+        "should bind the added hardlinked entry"
+    );
+    fs::write(
+        toolchain.usr.join("lib/ld-copy"),
+        b"edited through the other link",
+    )
+    .expect("should edit shared content outside the tree");
+    assert!(
+        measured.verify().is_err(),
+        "should reject helper content edited through an out-of-tree hardlink"
+    );
+}
+
+#[test]
+fn trees_accept_nested_directories_and_internal_directory_aliases() {
+    let toolchain = Toolchain::new();
+    let unnested = toolchain.receipt();
+    fs::create_dir_all(toolchain.usr.join("bin/nested/deeper")).expect("should nest helpers");
+    fs::write(
+        toolchain.usr.join("bin/nested/deeper/helper"),
+        b"fictional nested helper",
+    )
+    .expect("should write nested helper");
+    symlink(
+        "darwin",
+        toolchain.usr.join("lib/clang/17/lib/macho_embedded"),
+    )
+    .expect("should alias a resource subdirectory");
+    let measured = toolchain
+        .measure()
+        .expect("should accept nested directories and internal directory aliases");
+    let receipt = measured.receipt();
+    assert_eq!(
+        receipt.helper_tree.entries, 7,
+        "should count nested helper directories and files"
+    );
+    assert_eq!(
+        receipt.clang_resource_tree.entries, 6,
+        "should count the internal directory alias"
+    );
+    assert!(
+        receipt.helper_tree_sha256() != unnested.helper_tree_sha256()
+            && receipt.clang_resource_tree_sha256() != unnested.clang_resource_tree_sha256(),
+        "should bind nested and aliased entries"
+    );
+    fs::write(toolchain.usr.join("bin/nested/deeper/helper"), b"edited")
+        .expect("should edit nested helper");
+    assert!(
+        measured.verify().is_err(),
+        "should reject an edited nested helper"
+    );
+}
+
+#[test]
+fn resource_tree_rejects_special_files() {
+    let toolchain = Toolchain::new();
+    make_fifo(&toolchain.usr.join("lib/clang/17/include/fifo"));
+    assert!(
+        toolchain.error().contains("special file"),
+        "should reject a special file inside the resource tree"
+    );
+}
+
+#[test]
+fn trees_reject_non_utf8_names_where_the_filesystem_allows_them() {
+    let toolchain = Toolchain::new();
+    let name = std::ffi::OsStr::from_bytes(b"helper-\xff");
+    // APFS refuses invalid UTF-8 names, so on macOS the hazard cannot exist
+    // and creation fails; filesystems that accept the name must be rejected.
+    if fs::write(toolchain.usr.join("bin").join(name), b"fictional helper").is_err() {
+        return;
+    }
+    assert!(
+        toolchain.error().contains("not UTF-8"),
+        "should reject a non-UTF-8 helper name"
+    );
+}
+
+#[test]
+fn tree_kinds_are_domain_separated() {
+    let toolchain = Toolchain::new();
+    let bin = toolchain.usr.join("bin");
+    let unbounded = || Ok(());
+    let as_helpers =
+        vendor_tree_digest(&bin, HELPER_POLICY, &unbounded).expect("should digest as helpers");
+    let as_resources =
+        vendor_tree_digest(&bin, RESOURCE_POLICY, &unbounded).expect("should digest as resources");
+    assert_ne!(
+        as_helpers.tree_sha256, as_resources.tree_sha256,
+        "should separate identical contents by tree kind"
+    );
+    let as_libraries =
+        vendor_tree_digest(&bin, LIBRARY_POLICY, &unbounded).expect("should digest as libraries");
+    assert!(
+        as_libraries.tree_sha256 != as_helpers.tree_sha256
+            && as_libraries.tree_sha256 != as_resources.tree_sha256,
+        "should separate library identity from both other tree kinds"
+    );
+}
+
+#[test]
+fn clang_path_must_be_normal_and_inside_usr_bin() {
+    let toolchain = Toolchain::new();
+    fs::create_dir_all(toolchain.usr.join("libexec")).expect("should create other directory");
+    fs::write(toolchain.usr.join("libexec/clang"), b"fictional clang")
+        .expect("should write misplaced clang");
+    fs::create_dir_all(toolchain.usr.join("bin/bin")).expect("should create nested bin");
+    fs::write(toolchain.usr.join("bin/bin/clang"), b"fictional clang")
+        .expect("should write nested clang");
+    let cases = [
+        ("parent component", toolchain.usr.join("bin/../bin/clang")),
+        ("relative path", PathBuf::from("usr/bin/clang")),
+        ("not in bin", toolchain.usr.join("libexec/clang")),
+        ("bin not in usr", toolchain.usr.join("bin/bin/clang")),
+    ];
+    for (label, clang) in cases {
+        let error = format!(
+            "{:?}",
+            MeasuredToolchain::measure(
+                &clang,
+                &toolchain.developer,
+                Instant::now() + Duration::from_secs(30),
+                &Cancellation::default(),
+            )
+            .expect_err("should reject the clang path")
+        );
+        assert!(
+            error.contains("Apple clang"),
+            "should reject {label} before measuring: {error}"
+        );
+    }
+}
+
+#[test]
+fn helper_tree_rejects_unsafe_aliases_and_special_files() {
+    let cases: [(&str, Mutation); 4] = [
+        ("absolute alias", |bin| {
+            symlink("/usr/bin/true", bin.join("absolute")).expect("should add alias");
+        }),
+        ("escaping alias", |bin| {
+            symlink("../lib/libLTO.dylib", bin.join("escape")).expect("should add alias");
+        }),
+        ("dangling alias", |bin| {
+            symlink("missing", bin.join("dangling")).expect("should add alias");
+        }),
+        ("special file", |bin| make_fifo(&bin.join("fifo"))),
+    ];
+    for (label, mutate) in cases {
+        let toolchain = Toolchain::new();
+        mutate(&toolchain.usr.join("bin"));
+        assert!(toolchain.measure().is_err(), "should reject {label}");
+    }
+}
+
+#[test]
+fn vendor_tree_enforces_entry_file_and_tree_bounds() {
+    let toolchain = Toolchain::new();
+    let bin = toolchain.usr.join("bin");
+    let unbounded = || Ok(());
+    for base in [HELPER_POLICY, LIBRARY_POLICY] {
+        for policy in [
+            TreePolicy { entries: 3, ..base },
+            TreePolicy {
+                file_bytes: 4,
+                ..base
+            },
+            TreePolicy {
+                tree_bytes: 20,
+                ..base
+            },
+        ] {
+            assert!(
+                vendor_tree_digest(&bin, policy, &unbounded).is_err(),
+                "should reject exhausted {policy:?}"
+            );
+        }
+    }
+    assert!(
+        vendor_tree_digest(&bin, HELPER_POLICY, &unbounded).is_ok(),
+        "should accept the fixture within real limits"
+    );
+}
+
+#[test]
+fn measurement_stops_when_cancelled_expired_or_outside_developer_dir() {
+    let toolchain = Toolchain::new();
+    let cancellation = Cancellation::default();
+    cancellation.cancel();
+    let clang = toolchain.usr.join("bin/clang");
+    assert!(
+        MeasuredToolchain::measure(
+            &clang,
+            &toolchain.developer,
+            Instant::now() + Duration::from_secs(30),
+            &cancellation
+        )
+        .is_err(),
+        "should stop a cancelled measurement"
+    );
+    assert!(
+        MeasuredToolchain::measure(
+            &clang,
+            &toolchain.developer,
+            Instant::now() - Duration::from_secs(1),
+            &Cancellation::default()
+        )
+        .is_err(),
+        "should stop an expired measurement"
+    );
+    assert!(
+        MeasuredToolchain::measure(
+            &clang,
+            &toolchain.usr.join("bin"),
+            Instant::now() + Duration::from_secs(30),
+            &Cancellation::default()
+        )
+        .is_err(),
+        "should reject a toolchain outside the developer directory"
+    );
+}
diff --git a/crates/trusted-server-release/src/recipe/artifact.rs b/crates/trusted-server-release/src/recipe/artifact.rs
new file mode 100644
index 0000000000..12e3c01b09
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/artifact.rs
@@ -0,0 +1,292 @@
+//! Host-side copy of the built executable into the fresh output directory.
+//!
+//! The executable stays inside the writable build root, which a confined
+//! child could still hold open or relink, so it is never published in place.
+//! It is read once through a held descriptor and written into a new file
+//! created exclusively and without following links, hashing exactly the bytes
+//! written.
+
+use std::fs::{self, File, OpenOptions};
+use std::io::{Read as _, Write as _};
+use std::os::unix::fs::{MetadataExt as _, OpenOptionsExt as _, PermissionsExt as _};
+use std::path::{Component, Path, PathBuf};
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256};
+
+use super::recipe_error;
+use crate::error::ReleaseError;
+
+/// Largest executable the recipe copies.
+pub(crate) const EXECUTABLE_LIMIT: u64 = 512 * 1024 * 1024;
+/// Mode of the published asset, independent of the process umask.
+const ASSET_MODE: u32 = 0o755;
+/// Longest accepted asset file name.
+const NAME_LIMIT: usize = 160;
+
+/// The copied asset and the digest of exactly the bytes written.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct CopiedArtifact {
+    name: String,
+    size: u64,
+    sha256: String,
+    path: PathBuf,
+}
+
+impl CopiedArtifact {
+    /// Asset file name inside the output directory.
+    pub(crate) fn name(&self) -> &str {
+        &self.name
+    }
+
+    /// Written size in bytes.
+    pub(crate) fn size(&self) -> u64 {
+        self.size
+    }
+
+    /// Lowercase hex SHA-256 of the written bytes.
+    pub(crate) fn sha256(&self) -> &str {
+        &self.sha256
+    }
+
+    /// Host path of the written file.
+    pub(crate) fn path(&self) -> &Path {
+        &self.path
+    }
+}
+
+fn artifact_error(detail: impl std::fmt::Display) -> Report<ReleaseError> {
+    recipe_error(format!("artifact copy: {detail}"))
+}
+
+/// Requires a flat file name of letters, digits, `.`, `-` and `_` that does
+/// not start with a dot.
+fn check_name(name: &str) -> Result<(), Report<ReleaseError>> {
+    let first_ok = name
+        .bytes()
+        .next()
+        .is_some_and(|byte| byte.is_ascii_alphanumeric());
+    let body_ok = name
+        .bytes()
+        .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'-' | b'_'));
+    if name.len() > NAME_LIMIT || !first_ok || !body_ok || name.contains("..") {
+        return Err(artifact_error(format!(
+            "output name {name:?} is not a safe flat name"
+        )));
+    }
+    Ok(())
+}
+
+/// Requires an existing real directory that no symlink aliases.
+fn check_output_directory(output_dir: &Path) -> Result<(), Report<ReleaseError>> {
+    let metadata = fs::symlink_metadata(output_dir).map_err(|error| {
+        artifact_error(format!("output directory cannot be inspected: {error}"))
+    })?;
+    let resolved = fs::canonicalize(output_dir)
+        .map_err(|error| artifact_error(format!("output directory cannot be resolved: {error}")))?;
+    if !metadata.is_dir() || resolved.as_os_str() != output_dir.as_os_str() {
+        return Err(artifact_error(
+            "output directory is not a real directory reached without symlinks",
+        ));
+    }
+    Ok(())
+}
+
+/// Requires every directory from the writable `root` down to the source's
+/// parent to be a real directory, so no parent symlink can redirect the read.
+///
+/// Dot segments and sources outside `root` are rejected. The path is
+/// re-resolved at the end and must equal itself. The leaf is opened with
+/// `O_NOFOLLOW` separately. A confined child no longer runs when this is
+/// called, so only a concurrent host process could race the walk.
+fn check_source_path(root: &Path, source: &Path) -> Result<(), Report<ReleaseError>> {
+    let relative = source
+        .strip_prefix(root)
+        .map_err(|_| artifact_error("source is outside the writable root"))?;
+    let normal = source.components().collect::<PathBuf>().as_os_str() == source.as_os_str()
+        && relative
+            .components()
+            .all(|component| matches!(component, Component::Normal(_)));
+    let parent = source
+        .parent()
+        .filter(|_| normal && source.is_absolute() && !relative.as_os_str().is_empty())
+        .ok_or_else(|| artifact_error("source is not an absolute normal path below the root"))?;
+    let mut current = root.to_path_buf();
+    let mut directories = vec![root.to_path_buf()];
+    directories.extend(
+        parent
+            .strip_prefix(root)
+            .map_err(|_| artifact_error("source parent is outside the writable root"))?
+            .components()
+            .map(|component| {
+                current.push(component);
+                current.clone()
+            }),
+    );
+    for directory in &directories {
+        let metadata = fs::symlink_metadata(directory).map_err(|error| {
+            artifact_error(format!("source directory cannot be inspected: {error}"))
+        })?;
+        if !metadata.is_dir() {
+            return Err(artifact_error(format!(
+                "source directory {} is a symlink or not a directory",
+                directory.display()
+            )));
+        }
+    }
+    let resolved = fs::canonicalize(parent)
+        .map_err(|error| artifact_error(format!("source directory cannot be resolved: {error}")))?;
+    if resolved != parent || !resolved.starts_with(root) {
+        return Err(artifact_error(
+            "source directory resolves outside the writable root",
+        ));
+    }
+    Ok(())
+}
+
+/// Opens the source without following a leaf symlink and checks its facts.
+fn open_source(source: &Path, limit: u64) -> Result<(File, fs::Metadata), Report<ReleaseError>> {
+    let file = OpenOptions::new()
+        .read(true)
+        .custom_flags(libc::O_NOFOLLOW | libc::O_NONBLOCK | libc::O_CLOEXEC)
+        .open(source)
+        .map_err(|error| artifact_error(format!("source cannot be opened: {error}")))?;
+    let metadata = file
+        .metadata()
+        .map_err(|error| artifact_error(format!("source cannot be inspected: {error}")))?;
+    if !metadata.is_file() {
+        return Err(artifact_error("source is not a regular file"));
+    }
+    // Cargo hard-links the executable into `deps/`; a third link is foreign.
+    if !(1..=2).contains(&metadata.nlink()) {
+        return Err(artifact_error(format!(
+            "source has {} hard links; at most the Cargo deps link is expected",
+            metadata.nlink()
+        )));
+    }
+    if metadata.len() > limit {
+        return Err(artifact_error(format!(
+            "source exceeds the {limit} byte limit"
+        )));
+    }
+    Ok((file, metadata))
+}
+
+/// Streams `source` into `destination`, returning the byte count and digest.
+fn stream(
+    source: &File,
+    before: &fs::Metadata,
+    destination: &mut File,
+) -> Result<(u64, String), Report<ReleaseError>> {
+    let mut input = source;
+    let mut digest = Sha256::new();
+    let mut size = 0_u64;
+    let mut buffer = vec![0_u8; 64 * 1024];
+    loop {
+        let count = input
+            .read(&mut buffer)
+            .map_err(|error| artifact_error(format!("source read failed: {error}")))?;
+        if count == 0 {
+            break;
+        }
+        size += count as u64;
+        if size > before.len() {
+            return Err(artifact_error("source grows while it is copied"));
+        }
+        digest.update(&buffer[..count]);
+        destination
+            .write_all(&buffer[..count])
+            .map_err(|error| artifact_error(format!("output write failed: {error}")))?;
+    }
+    let after = source
+        .metadata()
+        .map_err(|error| artifact_error(format!("source cannot be re-inspected: {error}")))?;
+    let stable = (
+        before.dev(),
+        before.ino(),
+        before.len(),
+        before.mtime(),
+        before.mtime_nsec(),
+    ) == (
+        after.dev(),
+        after.ino(),
+        after.len(),
+        after.mtime(),
+        after.mtime_nsec(),
+    );
+    if size != before.len() || !stable {
+        return Err(artifact_error("source changes while it is copied"));
+    }
+    Ok((size, hex::encode(digest.finalize())))
+}
+
+/// Copies the executable at `source`, below the writable `source_root`, to
+/// `output_dir/name`.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Recipe`] for an unsafe name, a source path outside
+/// `source_root`, with dot segments or below a symlinked directory, an aliased output
+/// directory, a source that is a symlink, not a regular file, has more than
+/// two hard links, exceeds `limit` or changes while copied, or an output that
+/// already exists (including as a symlink). A failed copy removes the file it
+/// created.
+pub(crate) fn copy_artifact(
+    source: &Path,
+    source_root: &Path,
+    output_dir: &Path,
+    name: &str,
+    limit: u64,
+) -> Result<CopiedArtifact, Report<ReleaseError>> {
+    check_name(name)?;
+    check_output_directory(output_dir)?;
+    check_source_path(source_root, source)?;
+    let (input, before) = open_source(source, limit)?;
+    let path = output_dir.join(name);
+    let mut destination = OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .mode(0o600)
+        .custom_flags(libc::O_NOFOLLOW | libc::O_CLOEXEC)
+        .open(&path)
+        .map_err(|error| {
+            artifact_error(format!(
+                "output {name} cannot be created exclusively: {error}"
+            ))
+        })?;
+    let written = stream(&input, &before, &mut destination)
+        .and_then(|(size, sha256)| finish(&destination, &path, size).map(|()| (size, sha256)));
+    match written {
+        Ok((size, sha256)) => Ok(CopiedArtifact {
+            name: name.to_owned(),
+            size,
+            sha256,
+            path,
+        }),
+        Err(error) => {
+            // The file was created exclusively above, so it is ours to remove.
+            drop(destination);
+            let _ = fs::remove_file(&path);
+            Err(error)
+        }
+    }
+}
+
+/// Sets the final mode, syncs and verifies the written file.
+fn finish(destination: &File, path: &Path, size: u64) -> Result<(), Report<ReleaseError>> {
+    destination
+        .set_permissions(fs::Permissions::from_mode(ASSET_MODE))
+        .and_then(|()| destination.sync_all())
+        .map_err(|error| artifact_error(format!("output cannot be finalized: {error}")))?;
+    let metadata = fs::symlink_metadata(path)
+        .map_err(|error| artifact_error(format!("output cannot be re-inspected: {error}")))?;
+    if !metadata.is_file() || metadata.nlink() != 1 || metadata.len() != size {
+        return Err(artifact_error(
+            "output is not one regular file of the written size",
+        ));
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/trusted-server-release/src/recipe/artifact/tests.rs b/crates/trusted-server-release/src/recipe/artifact/tests.rs
new file mode 100644
index 0000000000..d483770305
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/artifact/tests.rs
@@ -0,0 +1,297 @@
+use std::fs;
+use std::os::unix::fs::symlink;
+use std::path::PathBuf;
+
+use sha2::Sha256;
+
+use super::*;
+
+const LIMIT: u64 = 1024;
+
+struct Layout {
+    _directory: tempfile::TempDir,
+    target: PathBuf,
+    output: PathBuf,
+}
+
+fn layout() -> Layout {
+    let directory = tempfile::tempdir().expect("should create layout");
+    let base = fs::canonicalize(directory.path()).expect("should canonicalize layout");
+    let target = base.join("target/release");
+    let output = base.join("output");
+    fs::create_dir_all(&target).expect("should create target release directory");
+    fs::create_dir(&output).expect("should create output directory");
+    fs::write(target.join("example-bin"), b"fictional executable").expect("should write source");
+    Layout {
+        _directory: directory,
+        target,
+        output,
+    }
+}
+
+impl Layout {
+    /// The writable root that holds `release/`.
+    fn root(&self) -> PathBuf {
+        self.target
+            .parent()
+            .expect("should have a writable root")
+            .to_path_buf()
+    }
+}
+
+fn copy(layout: &Layout, name: &str) -> Result<CopiedArtifact, Report<ReleaseError>> {
+    copy_artifact(
+        &layout.target.join("example-bin"),
+        &layout.root(),
+        &layout.output,
+        name,
+        LIMIT,
+    )
+}
+
+fn rejection(layout: &Layout, name: &str) -> String {
+    match copy(layout, name) {
+        Ok(_) => panic!("should reject the copy"),
+        Err(error) => format!("{error:?}"),
+    }
+}
+
+#[test]
+fn copy_records_name_size_and_sha256_of_the_written_bytes() {
+    let layout = layout();
+    let copied = copy(&layout, "ts-example-asset").expect("should copy the executable");
+    assert_eq!(
+        copied.name(),
+        "ts-example-asset",
+        "should keep the asset name"
+    );
+    assert_eq!(copied.size(), 20, "should record the byte count");
+    assert_eq!(
+        copied.sha256(),
+        hex::encode(Sha256::digest(b"fictional executable")),
+        "should hash the source bytes"
+    );
+    let written = layout.output.join("ts-example-asset");
+    assert_eq!(
+        fs::read(&written).expect("should read the output"),
+        b"fictional executable",
+        "should write identical bytes"
+    );
+    let metadata = fs::symlink_metadata(&written).expect("should stat the output");
+    assert!(
+        metadata.is_file() && metadata.nlink() == 1,
+        "should write one regular file"
+    );
+    assert_eq!(
+        metadata.permissions().mode() & 0o7777,
+        0o755,
+        "should set the mode independent of the umask"
+    );
+    assert_eq!(copied.path(), written, "should report the output path");
+}
+
+#[test]
+fn cargo_deps_hardlink_is_accepted_but_more_links_are_not() {
+    let layout = layout();
+    fs::create_dir(layout.target.join("deps")).expect("should create deps");
+    fs::hard_link(
+        layout.target.join("example-bin"),
+        layout.target.join("deps/example-bin-1234"),
+    )
+    .expect("should link like Cargo does");
+    copy(&layout, "ts-example-asset").expect("should accept the two-link Cargo layout");
+    fs::hard_link(
+        layout.target.join("example-bin"),
+        layout.target.join("deps/extra"),
+    )
+    .expect("should add a third link");
+    assert!(
+        rejection(&layout, "ts-example-other").contains("link"),
+        "should reject a source with three links"
+    );
+    assert!(
+        !layout.output.join("ts-example-other").exists(),
+        "should leave no output after a rejection"
+    );
+}
+
+#[test]
+fn symlink_directory_and_oversize_sources_are_rejected_without_output() {
+    let layout = layout();
+    fs::remove_file(layout.target.join("example-bin")).expect("should remove source");
+    fs::write(layout.target.join("real"), b"x").expect("should write real file");
+    symlink("real", layout.target.join("example-bin")).expect("should create source symlink");
+    assert!(
+        rejection(&layout, "ts-example-asset").contains("source"),
+        "should reject a symlink source"
+    );
+    fs::remove_file(layout.target.join("example-bin")).expect("should remove symlink");
+    fs::create_dir(layout.target.join("example-bin")).expect("should create directory source");
+    assert!(
+        rejection(&layout, "ts-example-asset").contains("source"),
+        "should reject a directory source"
+    );
+    fs::remove_dir(layout.target.join("example-bin")).expect("should remove directory");
+    fs::write(layout.target.join("example-bin"), vec![0_u8; 1025]).expect("should write oversize");
+    assert!(
+        rejection(&layout, "ts-example-asset").contains("limit"),
+        "should reject an oversize source"
+    );
+    assert_eq!(
+        fs::read_dir(&layout.output)
+            .expect("should list output")
+            .count(),
+        0,
+        "should leave the output directory empty after every rejection"
+    );
+}
+
+#[test]
+fn existing_or_aliased_output_is_never_overwritten() {
+    let layout = layout();
+    fs::write(layout.output.join("ts-example-asset"), b"previous").expect("should write existing");
+    assert!(
+        rejection(&layout, "ts-example-asset").contains("output"),
+        "should reject an existing file"
+    );
+    assert_eq!(
+        fs::read(layout.output.join("ts-example-asset")).expect("should read existing"),
+        b"previous",
+        "should leave the existing file untouched"
+    );
+    let victim = layout.target.join("victim");
+    fs::write(&victim, b"victim").expect("should write victim");
+    symlink(&victim, layout.output.join("ts-example-link")).expect("should plant symlink");
+    assert!(
+        rejection(&layout, "ts-example-link").contains("output"),
+        "should reject a planted symlink"
+    );
+    assert_eq!(
+        fs::read(&victim).expect("should read victim"),
+        b"victim",
+        "should not write through the link"
+    );
+    symlink("missing", layout.output.join("ts-example-dangling"))
+        .expect("should plant dangling link");
+    assert!(
+        rejection(&layout, "ts-example-dangling").contains("output"),
+        "should reject a dangling link"
+    );
+    fs::create_dir(layout.output.join("ts-example-dir")).expect("should plant directory");
+    assert!(
+        rejection(&layout, "ts-example-dir").contains("output"),
+        "should reject a directory"
+    );
+}
+
+#[test]
+fn unsafe_names_and_aliased_output_directories_are_rejected() {
+    let layout = layout();
+    for name in [
+        "",
+        ".",
+        "..",
+        "a/b",
+        "../escape",
+        "/abs",
+        "has space",
+        "nul\0byte",
+        ".hidden",
+    ] {
+        assert!(
+            copy(&layout, name).is_err(),
+            "should reject asset file name {name:?}"
+        );
+    }
+    let alias = layout
+        .output
+        .parent()
+        .expect("should have parent")
+        .join("alias");
+    symlink(&layout.output, &alias).expect("should alias the output directory");
+    let error = copy_artifact(
+        &layout.target.join("example-bin"),
+        &layout.root(),
+        &alias,
+        "ts-example-asset",
+        LIMIT,
+    )
+    .expect_err("should reject a symlinked output directory");
+    assert!(
+        format!("{error:?}").contains("output"),
+        "should name the output directory"
+    );
+    assert!(
+        fs::read_dir(&layout.output)
+            .expect("should list output")
+            .next()
+            .is_none(),
+        "should write nothing through the alias"
+    );
+}
+
+#[test]
+fn symlinked_source_directories_below_the_writable_root_are_rejected() {
+    let layout = layout();
+    let root = layout.root();
+    let real = root
+        .parent()
+        .expect("should have parent")
+        .join("real-release");
+    fs::rename(&layout.target, &real).expect("should move the release directory");
+    symlink(&real, &layout.target).expect("should alias the release directory");
+    assert!(
+        rejection(&layout, "ts-example-asset").contains("source directory"),
+        "should reject a symlinked release directory"
+    );
+
+    let layout = self::layout();
+    let root = layout.root();
+    let triple = root.join("example-triple");
+    let outside = root
+        .parent()
+        .expect("should have parent")
+        .join("outside-triple");
+    fs::create_dir_all(outside.join("release")).expect("should create the outside tree");
+    fs::write(outside.join("release/example-bin"), b"outside executable")
+        .expect("should write the outside executable");
+    symlink(&outside, &triple).expect("should alias the triple directory");
+    let error = copy_artifact(
+        &triple.join("release/example-bin"),
+        &root,
+        &layout.output,
+        "ts-example-asset",
+        LIMIT,
+    )
+    .expect_err("should reject a symlinked triple directory");
+    assert!(
+        format!("{error:?}").contains("source directory"),
+        "should name the aliased source directory"
+    );
+    assert!(
+        fs::read_dir(&layout.output)
+            .expect("should list output")
+            .next()
+            .is_none(),
+        "should copy nothing through the alias"
+    );
+}
+
+#[test]
+fn source_outside_the_writable_root_or_with_dot_segments_is_rejected() {
+    let layout = layout();
+    let root = layout.root();
+    for source in [
+        layout.output.join("example-bin"),
+        root.join("release/../release/example-bin"),
+        root.join("release/./example-bin"),
+        PathBuf::from("relative/example-bin"),
+    ] {
+        let error = copy_artifact(&source, &root, &layout.output, "ts-example-asset", LIMIT)
+            .expect_err("should reject the source path");
+        assert!(
+            format!("{error:?}").contains("source"),
+            "should reject {source:?} as a source path"
+        );
+    }
+}
diff --git a/crates/trusted-server-release/src/recipe/cargo_home.rs b/crates/trusted-server-release/src/recipe/cargo_home.rs
new file mode 100644
index 0000000000..8fcfb08579
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/cargo_home.rs
@@ -0,0 +1,114 @@
+//! Reject fetched sources while admitting exact Cargo registry bookkeeping.
+
+use std::fs::{self, Metadata, OpenOptions};
+use std::io;
+use std::os::unix::fs::{MetadataExt as _, OpenOptionsExt as _};
+use std::path::Path;
+
+use error_stack::{Report, ResultExt as _};
+use sha2::{Digest as _, Sha256};
+
+use super::recipe_error;
+use crate::documents::hash_bounded_with_check;
+use crate::error::ReleaseError;
+
+// Cargo 1.98's cargo-util creates exactly this tag before source replacement.
+// The upstream URL is a required wire-format byte sequence, never a fetch target.
+const CACHE_TAG: &[u8] = concat!(
+    "Signature: 8a477f597d28d172789f06886806bc55\n",
+    "# This file is a cache directory tag created by cargo.\n",
+    "# For information about cache directory tags see https://bford.info/cachedir/\n" // allow-domain: bford.info
+)
+.as_bytes();
+
+fn stamp(metadata: &Metadata) -> (u64, u64, u64, u64, u32, i64, i64, i64, i64) {
+    (
+        metadata.dev(),
+        metadata.ino(),
+        metadata.nlink(),
+        metadata.len(),
+        metadata.mode(),
+        metadata.mtime(),
+        metadata.mtime_nsec(),
+        metadata.ctime(),
+        metadata.ctime_nsec(),
+    )
+}
+
+/// Checks a private Cargo home without creating, deleting or repairing entries.
+///
+/// # Errors
+///
+/// Rejects fetched sources, unexpected bookkeeping, aliases, changed inputs,
+/// unreadable paths and cancellation or an expired owning attempt.
+pub(super) fn check(
+    cargo_home: &Path,
+    check_attempt: &dyn Fn() -> Result<(), Report<ReleaseError>>,
+) -> Result<(), Report<ReleaseError>> {
+    check_attempt()?;
+    match fs::symlink_metadata(cargo_home.join("git")) {
+        Ok(_) => return Err(recipe_error("Cargo home holds a git cache")),
+        Err(error) if error.kind() == io::ErrorKind::NotFound => {}
+        Err(error) => {
+            return Err(recipe_error(format!(
+                "Cargo home git cache cannot be inspected: {error}"
+            )));
+        }
+    }
+    let registry = cargo_home.join("registry");
+    let before = match fs::symlink_metadata(&registry) {
+        Ok(metadata) => metadata,
+        Err(error) if error.kind() == io::ErrorKind::NotFound => return check_attempt(),
+        Err(error) => {
+            return Err(recipe_error(format!(
+                "Cargo registry cannot be inspected: {error}"
+            )));
+        }
+    };
+    if !before.is_dir() {
+        return Err(recipe_error(
+            "Cargo registry bookkeeping must be a direct directory",
+        ));
+    }
+    let directory = OpenOptions::new()
+        .read(true)
+        .custom_flags(libc::O_DIRECTORY | libc::O_NOFOLLOW | libc::O_NONBLOCK | libc::O_CLOEXEC)
+        .open(&registry)
+        .map_err(recipe_error)?;
+    if stamp(&before) != stamp(&directory.metadata().map_err(recipe_error)?) {
+        return Err(recipe_error(
+            "Cargo registry directory changed before inspection",
+        ));
+    }
+    for entry in fs::read_dir(&registry).map_err(recipe_error)? {
+        check_attempt()?;
+        let entry = entry.map_err(recipe_error)?;
+        if entry.file_name() != "CACHEDIR.TAG" {
+            return Err(recipe_error(
+                "Cargo home holds a registry cache or unexpected registry entry",
+            ));
+        }
+        let tag = hash_bounded_with_check(&entry.path(), CACHE_TAG.len() as u64, check_attempt)
+            .change_context(ReleaseError::Recipe)?;
+        if tag.size != CACHE_TAG.len() as u64
+            || tag.sha256 != hex::encode(Sha256::digest(CACHE_TAG))
+        {
+            return Err(recipe_error(
+                "Cargo registry cache tag differs from exact Cargo bookkeeping",
+            ));
+        }
+    }
+    let after = fs::symlink_metadata(&registry).map_err(recipe_error)?;
+    if !after.is_dir()
+        || stamp(&before) != stamp(&after)
+        || stamp(&before) != stamp(&directory.metadata().map_err(recipe_error)?)
+    {
+        return Err(recipe_error(
+            "Cargo registry directory changed during inspection",
+        ));
+    }
+    check_attempt()
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/trusted-server-release/src/recipe/cargo_home/tests.rs b/crates/trusted-server-release/src/recipe/cargo_home/tests.rs
new file mode 100644
index 0000000000..5c23b80682
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/cargo_home/tests.rs
@@ -0,0 +1,172 @@
+use std::cell::Cell;
+use std::os::unix::fs::symlink;
+
+use super::*;
+
+fn home() -> tempfile::TempDir {
+    tempfile::tempdir().expect("should create a private Cargo home")
+}
+
+fn registry(home: &Path) -> std::path::PathBuf {
+    let registry = home.join("registry");
+    fs::create_dir(&registry).expect("should create registry bookkeeping");
+    registry
+}
+
+#[test]
+fn only_absent_empty_or_exact_tag_bookkeeping_is_accepted() {
+    let home = home();
+    check(home.path(), &|| Ok(())).expect("should accept no registry directory");
+    let registry = registry(home.path());
+    check(home.path(), &|| Ok(())).expect("should accept empty registry bookkeeping");
+    assert_eq!(
+        CACHE_TAG.len(),
+        177,
+        "should match the reviewed Cargo tag length"
+    );
+    fs::write(registry.join("CACHEDIR.TAG"), CACHE_TAG)
+        .expect("should write exact Cargo bookkeeping");
+    check(home.path(), &|| Ok(())).expect("should accept only the exact cache tag");
+}
+
+#[test]
+fn fetched_sources_and_unexpected_entries_are_rejected_even_with_a_valid_tag() {
+    for name in ["index", "cache", "src", "unexpected"] {
+        let home = home();
+        let registry = registry(home.path());
+        fs::write(registry.join("CACHEDIR.TAG"), CACHE_TAG).expect("should write a valid tag");
+        fs::create_dir(registry.join(name)).expect("should create a forbidden entry");
+        assert!(
+            check(home.path(), &|| Ok(())).is_err(),
+            "should reject any registry child beyond bookkeeping"
+        );
+    }
+    let home = home();
+    let registry = registry(home.path());
+    fs::write(registry.join("unexpected"), b"example").expect("should create a forbidden file");
+    assert!(
+        check(home.path(), &|| Ok(())).is_err(),
+        "should reject unexpected regular files"
+    );
+}
+
+#[test]
+fn changed_truncated_or_extended_tag_bytes_are_rejected() {
+    for bytes in [
+        &b"example bookkeeping"[..],
+        &CACHE_TAG[..CACHE_TAG.len() - 1],
+        &[CACHE_TAG, b"extra"].concat(),
+        &vec![b'x'; CACHE_TAG.len()],
+    ] {
+        let home = home();
+        let registry = registry(home.path());
+        fs::write(registry.join("CACHEDIR.TAG"), bytes).expect("should write invalid tag bytes");
+        assert!(
+            check(home.path(), &|| Ok(())).is_err(),
+            "should reject every noncanonical tag"
+        );
+    }
+}
+
+#[test]
+fn registry_aliases_and_nondirectories_are_rejected() {
+    let home = home();
+    let outside = home.path().join("example");
+    fs::create_dir(&outside).expect("should create a link target");
+    symlink(&outside, home.path().join("registry")).expect("should create an alias");
+    assert!(
+        check(home.path(), &|| Ok(())).is_err(),
+        "should reject a registry alias"
+    );
+    fs::remove_file(home.path().join("registry")).expect("should remove alias");
+    fs::write(home.path().join("registry"), b"example").expect("should create a nondirectory");
+    assert!(
+        check(home.path(), &|| Ok(())).is_err(),
+        "should require a directory"
+    );
+}
+
+#[test]
+fn tag_aliases_hardlinks_and_directories_are_rejected() {
+    let home = home();
+    let registry = registry(home.path());
+    let outside = home.path().join("example-tag");
+    let tag = registry.join("CACHEDIR.TAG");
+    fs::write(&outside, CACHE_TAG).expect("should write an external tag fixture");
+    symlink(&outside, &tag).expect("should create tag alias");
+    assert!(
+        check(home.path(), &|| Ok(())).is_err(),
+        "should reject a tag alias"
+    );
+    fs::remove_file(&tag).expect("should remove tag alias");
+    fs::hard_link(&outside, &tag).expect("should create a shared tag inode");
+    assert!(
+        check(home.path(), &|| Ok(())).is_err(),
+        "should reject a hard-linked tag"
+    );
+    fs::remove_file(&tag).expect("should remove hard link");
+    fs::create_dir(&tag).expect("should create a tag directory");
+    assert!(
+        check(home.path(), &|| Ok(())).is_err(),
+        "should require a regular tag file"
+    );
+}
+
+#[test]
+fn git_cache_stays_forbidden_including_empty_directories_and_dangling_aliases() {
+    let home = home();
+    let git = home.path().join("git");
+    fs::create_dir(&git).expect("should create an empty Git cache");
+    assert!(
+        check(home.path(), &|| Ok(())).is_err(),
+        "should reject even an empty Git cache"
+    );
+    fs::remove_dir(&git).expect("should remove the directory");
+    symlink("missing", &git).expect("should create a dangling Git alias");
+    assert!(
+        check(home.path(), &|| Ok(())).is_err(),
+        "should reject a dangling Git alias"
+    );
+}
+
+#[test]
+fn cancellation_is_not_skipped_for_absent_or_present_registry_state() {
+    let home = home();
+    let cancelled = || Err(recipe_error("example cancelled attempt"));
+    assert!(
+        check(home.path(), &cancelled).is_err(),
+        "should check an absent registry attempt"
+    );
+    registry(home.path());
+    assert!(
+        check(home.path(), &cancelled).is_err(),
+        "should check a present registry attempt"
+    );
+}
+
+#[test]
+fn replaced_registry_directory_is_rejected_even_with_identical_tag_bytes() {
+    let home = home();
+    let registry = registry(home.path());
+    fs::write(registry.join("CACHEDIR.TAG"), CACHE_TAG).expect("should write a tag");
+    let calls = Cell::new(0);
+    let mutate = || {
+        calls.set(calls.get() + 1);
+        if calls.get() == 2 {
+            fs::rename(&registry, home.path().join("original"))
+                .expect("should replace the registry directory");
+            fs::create_dir(&registry).expect("should create a replacement directory");
+            fs::write(registry.join("CACHEDIR.TAG"), CACHE_TAG)
+                .expect("should copy identical bytes");
+        }
+        Ok(())
+    };
+    assert!(
+        check(home.path(), &mutate).is_err(),
+        "should bind inspection to the original directory inode"
+    );
+    assert!(
+        calls.get() >= 2,
+        "should exercise replacement during inspection"
+    );
+}
diff --git a/crates/trusted-server-release/src/recipe/cargo_output.rs b/crates/trusted-server-release/src/recipe/cargo_output.rs
new file mode 100644
index 0000000000..55979a1752
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/cargo_output.rs
@@ -0,0 +1,228 @@
+//! Strict parser for Cargo's `--message-format=json` build stream.
+//!
+//! Cargo prints one JSON object per line. The recipe accepts the stream only
+//! when every line is a strict, bounded JSON object, the stream ends in one
+//! successful `build-finished`, and exactly one freshly compiled, debug-info
+//! carrying binary artifact of the requested package and binary names was
+//! produced, whose executable is a direct child of the target's release
+//! directory. The parser never opens a file: it returns where Cargo says the
+//! executable is, and the caller still re-reads and hashes those bytes.
+
+use std::path::{Component, Path, PathBuf};
+
+use error_stack::Report;
+use serde_json::Value;
+
+use super::fresh::normal_absolute;
+use super::paths::ExecutionPaths;
+use super::recipe_error;
+use crate::documents::{Role, parse_json};
+use crate::error::ReleaseError;
+
+/// `profile.debuginfo` the release profile must report (limited debug info).
+const REQUIRED_DEBUGINFO: u64 = 1;
+
+/// What the single binary artifact must be, in the execution namespace.
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct ExpectedBinary<'a> {
+    /// Cargo binary target name.
+    pub(crate) bin: &'a str,
+    /// Checkout path of the package manifest, as the child sees it.
+    pub(crate) manifest: &'a Path,
+    /// The `<target>/<triple>/release` directory, as the child sees it.
+    pub(crate) release_dir: &'a Path,
+}
+
+/// The located executable in both namespaces.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct LocatedBinary {
+    /// Executable path as the confined child reported it.
+    pub(crate) execution: PathBuf,
+    /// The same file on the host, inside a writable root.
+    pub(crate) host: PathBuf,
+}
+
+fn output_error(detail: impl std::fmt::Display) -> Report<ReleaseError> {
+    recipe_error(format!("cargo output: {detail}"))
+}
+
+/// Splits `stdout` into strict JSON objects, one per newline-terminated line.
+fn messages(stdout: &[u8]) -> Result<Vec<Value>, Report<ReleaseError>> {
+    if stdout.len() > 16 * 1024 * 1024 {
+        return Err(output_error("Cargo stream exceeds the build output bound"));
+    }
+    if stdout.is_empty() {
+        return Ok(Vec::new());
+    }
+    let body = stdout
+        .strip_suffix(b"\n")
+        .ok_or_else(|| output_error("final line is not newline-terminated"))?;
+    body.split(|byte| *byte == b'\n')
+        .enumerate()
+        .map(|(index, line)| {
+            let value = parse_json(line, Role::CargoMessage).map_err(|error| {
+                error.change_context(ReleaseError::Recipe).attach(format!(
+                    "cargo output line {} is not strict JSON",
+                    index + 1
+                ))
+            })?;
+            let has_reason = value
+                .as_object()
+                .is_some_and(|object| object.get("reason").is_some_and(Value::is_string));
+            if !has_reason {
+                return Err(output_error(format!(
+                    "line {} is not an object with a string reason",
+                    index + 1
+                )));
+            }
+            Ok(value)
+        })
+        .collect()
+}
+
+/// Requires the last message to be the only successful `build-finished`.
+fn require_success(messages: &[Value]) -> Result<(), Report<ReleaseError>> {
+    let reason = |message: &Value| message["reason"].as_str().map(str::to_owned);
+    let finished = messages
+        .iter()
+        .filter(|message| reason(message).as_deref() == Some("build-finished"))
+        .count();
+    let last = messages.last();
+    let ends_finished =
+        last.is_some_and(|message| reason(message).as_deref() == Some("build-finished"));
+    if finished != 1 || !ends_finished {
+        return Err(output_error(
+            "stream must end with exactly one build-finished message",
+        ));
+    }
+    let success = last
+        .and_then(|message| message.get("success"))
+        .and_then(Value::as_bool);
+    if success != Some(true) {
+        return Err(output_error("build-finished did not report success true"));
+    }
+    Ok(())
+}
+
+fn is_artifact(message: &Value) -> bool {
+    message["reason"].as_str() == Some("compiler-artifact")
+}
+
+fn kinds(message: &Value) -> Option<Vec<&str>> {
+    message["target"]["kind"]
+        .as_array()?
+        .iter()
+        .map(Value::as_str)
+        .collect()
+}
+
+fn is_requested(message: &Value, expected: &ExpectedBinary<'_>) -> bool {
+    kinds(message).as_deref() == Some(&["bin"][..])
+        && message["target"]["name"].as_str() == Some(expected.bin)
+        && message["manifest_path"].as_str().map(Path::new) == Some(expected.manifest)
+}
+
+/// Validates the one requested artifact and returns its executable path.
+fn executable_of(
+    message: &Value,
+    expected: &ExpectedBinary<'_>,
+) -> Result<PathBuf, Report<ReleaseError>> {
+    if message["fresh"].as_bool() != Some(false) {
+        return Err(output_error(
+            "binary artifact is not reported fresh false; a cached artifact proves nothing",
+        ));
+    }
+    if message["profile"]["debuginfo"].as_u64() != Some(REQUIRED_DEBUGINFO) {
+        return Err(output_error(format!(
+            "binary artifact profile debuginfo is not {REQUIRED_DEBUGINFO}"
+        )));
+    }
+    let text = message["executable"]
+        .as_str()
+        .ok_or_else(|| output_error("binary artifact has no executable path"))?;
+    let executable = PathBuf::from(text);
+    normal_absolute("cargo executable", &executable)
+        .map_err(|_| output_error("executable path is not an absolute normal path"))?;
+    let relative = executable
+        .strip_prefix(expected.release_dir)
+        .map_err(|_| output_error("executable is outside the release directory"))?;
+    let mut parts = relative.components();
+    match (parts.next(), parts.next()) {
+        (Some(Component::Normal(_)), None) => Ok(executable),
+        _ => Err(output_error(
+            "executable is not a direct child of the release directory",
+        )),
+    }
+}
+
+/// Parses the build stream and returns the container path of the executable.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Recipe`] for a non-strict or oversize line, a
+/// stream not ending in exactly one successful `build-finished`, zero or more
+/// than one artifact with `target.kind == ["bin"]`, the requested name and
+/// manifest, an additional binary artifact, a fresh or unreported-freshness
+/// artifact, `profile.debuginfo != 1`, or an executable that is missing,
+/// relative, dotted, outside or nested below the release directory.
+pub(crate) fn locate_binary(
+    stdout: &[u8],
+    expected: &ExpectedBinary<'_>,
+) -> Result<PathBuf, Report<ReleaseError>> {
+    let messages = successful_messages(stdout)?;
+    let artifacts: Vec<&Value> = messages
+        .iter()
+        .filter(|message| is_artifact(message))
+        .collect();
+    let matching: Vec<&&Value> = artifacts
+        .iter()
+        .filter(|message| is_requested(message, expected))
+        .collect();
+    let [requested] = matching.as_slice() else {
+        return Err(output_error(format!(
+            "expected exactly one binary artifact for {}, found {}",
+            expected.bin,
+            matching.len()
+        )));
+    };
+    if artifacts.iter().any(|message| {
+        !std::ptr::eq(*message, **requested)
+            && kinds(message).is_none_or(|kinds| kinds.contains(&"bin"))
+    }) {
+        return Err(output_error("unexpected additional binary artifact"));
+    }
+    executable_of(requested, expected)
+}
+
+/// Parses bounded strict JSONL ending in one successful build completion.
+///
+/// # Errors
+///
+/// Returns an error for malformed, oversized, duplicate-key or incomplete output.
+pub(crate) fn successful_messages(stdout: &[u8]) -> Result<Vec<Value>, Report<ReleaseError>> {
+    let messages = messages(stdout)?;
+    require_success(&messages)?;
+    Ok(messages)
+}
+
+/// Parses the build stream and maps the executable into a writable host root.
+///
+/// # Errors
+///
+/// As [`locate_binary`], or [`ReleaseError::Recipe`] when the executable does
+/// not map back through a writable root.
+pub(crate) fn locate_host_binary(
+    stdout: &[u8],
+    expected: &ExpectedBinary<'_>,
+    paths: &dyn ExecutionPaths,
+) -> Result<LocatedBinary, Report<ReleaseError>> {
+    let execution = locate_binary(stdout, expected)?;
+    let host = paths
+        .host_path(&execution)
+        .map_err(|error| error.change_context(ReleaseError::Recipe))
+        .map_err(|error| error.attach("executable is outside every writable root"))?;
+    Ok(LocatedBinary { execution, host })
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/trusted-server-release/src/recipe/cargo_output/tests.rs b/crates/trusted-server-release/src/recipe/cargo_output/tests.rs
new file mode 100644
index 0000000000..99d63bc60c
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/cargo_output/tests.rs
@@ -0,0 +1,312 @@
+use std::path::Path;
+
+use serde_json::{Value, json};
+
+use super::*;
+use crate::recipe::paths::PrefixPaths;
+
+const MANIFEST: &str = "/ts/immutable/0/crates/example-adapter/Cargo.toml";
+const RELEASE: &str = "/ts/writable/1/wasm32-example/release";
+
+/// A message edit applied before serialization.
+type Edit = fn(&mut Value);
+
+fn expected() -> ExpectedBinary<'static> {
+    ExpectedBinary {
+        bin: "example-bin",
+        manifest: Path::new(MANIFEST),
+        release_dir: Path::new(RELEASE),
+    }
+}
+
+fn artifact() -> Value {
+    json!({
+        "reason": "compiler-artifact",
+        "package_id": "path+file:///example#0.1.0",
+        "manifest_path": MANIFEST,
+        "target": {"kind": ["bin"], "crate_types": ["bin"], "name": "example-bin"},
+        "profile": {"opt_level": "3", "debuginfo": 1, "debug_assertions": false},
+        "filenames": [format!("{RELEASE}/example-bin.wasm")],
+        "executable": format!("{RELEASE}/example-bin.wasm"),
+        "fresh": false
+    })
+}
+
+fn build_script() -> Value {
+    json!({
+        "reason": "compiler-artifact",
+        "manifest_path": MANIFEST,
+        "target": {"kind": ["custom-build"], "crate_types": ["bin"], "name": "build-script-build"},
+        "profile": {"debuginfo": 0},
+        "executable": null,
+        "fresh": false
+    })
+}
+
+fn finished(success: &Value) -> Value {
+    json!({"reason": "build-finished", "success": success})
+}
+
+fn lines(messages: &[Value]) -> Vec<u8> {
+    let mut out = Vec::new();
+    for message in messages {
+        out.extend_from_slice(message.to_string().as_bytes());
+        out.push(b'\n');
+    }
+    out
+}
+
+fn rejection(stdout: &[u8]) -> String {
+    match locate_binary(stdout, &expected()) {
+        Ok(path) => panic!("should reject the output, got {path:?}"),
+        Err(error) => format!("{error:?}"),
+    }
+}
+
+fn modified(edit: impl FnOnce(&mut Value)) -> Vec<u8> {
+    let mut message = artifact();
+    edit(&mut message);
+    lines(&[build_script(), message, finished(&json!(true))])
+}
+
+#[test]
+fn single_fresh_false_debuginfo_one_artifact_is_located() {
+    let stdout = lines(&[
+        build_script(),
+        json!({"reason": "build-script-executed", "linked_libs": [], "env": []}),
+        artifact(),
+        finished(&json!(true)),
+    ]);
+    assert_eq!(
+        locate_binary(&stdout, &expected()).expect("should locate the executable"),
+        Path::new("/ts/writable/1/wasm32-example/release/example-bin.wasm"),
+        "should return the container executable path"
+    );
+}
+
+#[test]
+fn build_must_end_with_successful_build_finished() {
+    let cases: [(&str, Vec<u8>); 6] = [
+        ("missing", lines(&[build_script(), artifact()])),
+        ("empty", Vec::new()),
+        ("failed", lines(&[artifact(), finished(&json!(false))])),
+        (
+            "non-boolean success",
+            lines(&[artifact(), finished(&json!("true"))]),
+        ),
+        ("not last", lines(&[finished(&json!(true)), artifact()])),
+        (
+            "twice",
+            lines(&[artifact(), finished(&json!(true)), finished(&json!(true))]),
+        ),
+    ];
+    for (label, stdout) in cases {
+        assert!(
+            rejection(&stdout).contains("build-finished"),
+            "should reject a {label} build-finished"
+        );
+    }
+    assert!(
+        rejection(&lines(&[artifact(), json!({"reason": "build-finished"})]))
+            .contains("build-finished"),
+        "should reject build-finished without success"
+    );
+}
+
+#[test]
+fn zero_or_duplicate_matching_artifacts_are_rejected() {
+    let none = lines(&[build_script(), finished(&json!(true))]);
+    assert!(
+        rejection(&none).contains("exactly one"),
+        "should reject zero binary artifacts"
+    );
+    let twice = lines(&[artifact(), artifact(), finished(&json!(true))]);
+    assert!(
+        rejection(&twice).contains("exactly one"),
+        "should reject two binary artifacts"
+    );
+    let mut stray = artifact();
+    stray["target"]["name"] = json!("other-bin");
+    stray["executable"] = json!(format!("{RELEASE}/other-bin.wasm"));
+    let extra = lines(&[artifact(), stray, finished(&json!(true))]);
+    assert!(
+        rejection(&extra).contains("unexpected"),
+        "should reject an additional binary artifact"
+    );
+}
+
+#[test]
+fn wrong_kind_name_or_manifest_is_rejected() {
+    let edits: [(&str, Edit); 6] = [
+        ("lib kind", |m| m["target"]["kind"] = json!(["lib"])),
+        ("bin and lib kind", |m| {
+            m["target"]["kind"] = json!(["bin", "lib"])
+        }),
+        ("string kind", |m| m["target"]["kind"] = json!("bin")),
+        ("other name", |m| m["target"]["name"] = json!("other-bin")),
+        ("other manifest", |m| {
+            m["manifest_path"] = json!("/ts/immutable/0/crates/other/Cargo.toml");
+        }),
+        ("relative manifest", |m| {
+            m["manifest_path"] = json!("crates/example-adapter/Cargo.toml");
+        }),
+    ];
+    for (label, edit) in edits {
+        assert!(
+            rejection(&modified(edit)).contains("exactly one"),
+            "should reject an artifact with {label}"
+        );
+    }
+}
+
+#[test]
+fn fresh_or_unmeasured_artifact_is_rejected() {
+    let edits: [(&str, Edit); 4] = [
+        ("fresh true", |m| m["fresh"] = json!(true)),
+        ("fresh missing", |m| {
+            m.as_object_mut().expect("should be object").remove("fresh");
+        }),
+        ("fresh string", |m| m["fresh"] = json!("false")),
+        ("fresh null", |m| m["fresh"] = Value::Null),
+    ];
+    for (label, edit) in edits {
+        assert!(
+            rejection(&modified(edit)).contains("fresh"),
+            "should reject an artifact with {label}"
+        );
+    }
+}
+
+#[test]
+fn debuginfo_must_be_exactly_one() {
+    let edits: [(&str, Edit); 6] = [
+        ("zero", |m| m["profile"]["debuginfo"] = json!(0)),
+        ("two", |m| m["profile"]["debuginfo"] = json!(2)),
+        ("string one", |m| m["profile"]["debuginfo"] = json!("1")),
+        ("float one", |m| m["profile"]["debuginfo"] = json!(1.5)),
+        ("missing", |m| {
+            m["profile"]
+                .as_object_mut()
+                .expect("should be object")
+                .remove("debuginfo");
+        }),
+        ("no profile", |m| {
+            m.as_object_mut()
+                .expect("should be object")
+                .remove("profile");
+        }),
+    ];
+    for (label, edit) in edits {
+        assert!(
+            rejection(&modified(edit)).contains("debuginfo"),
+            "should reject an artifact with {label} debuginfo"
+        );
+    }
+}
+
+#[test]
+fn executable_must_be_a_direct_child_of_the_release_directory() {
+    let cases: [(&str, Value); 9] = [
+        ("null", Value::Null),
+        ("number", json!(7)),
+        ("relative", json!("release/example-bin.wasm")),
+        ("outside", json!("/ts/immutable/0/example-bin.wasm")),
+        (
+            "sibling prefix",
+            json!("/ts/writable/1/wasm32-example/release-evil/x"),
+        ),
+        ("nested", json!(format!("{RELEASE}/deps/example-bin.wasm"))),
+        ("dotdot", json!(format!("{RELEASE}/../example-bin.wasm"))),
+        ("directory itself", json!(RELEASE)),
+        (
+            "trailing slash",
+            json!(format!("{RELEASE}/example-bin.wasm/")),
+        ),
+    ];
+    for (label, value) in cases {
+        let stdout = modified(|m| m["executable"] = value);
+        assert!(
+            rejection(&stdout).contains("executable"),
+            "should reject a {label} executable"
+        );
+    }
+}
+
+#[test]
+fn malformed_lines_are_rejected() {
+    let good = lines(&[artifact(), finished(&json!(true))]);
+    let mut oversize = br#"{"reason":"build-script-executed","pad":""#.to_vec();
+    oversize.resize(oversize.len() + 1024 * 1024, b'a');
+    oversize.extend_from_slice(b"\"}\n");
+    oversize.extend_from_slice(&good);
+    let cases: [(&str, Vec<u8>); 9] = [
+        (
+            "non-JSON",
+            [b"Compiling example\n".as_slice(), &good].concat(),
+        ),
+        ("blank line", [b"\n".as_slice(), &good].concat()),
+        (
+            "duplicate keys",
+            [
+                br#"{"reason":"build-script-executed","reason":"compiler-artifact"}"#.as_slice(),
+                b"\n",
+                &good,
+            ]
+            .concat(),
+        ),
+        ("array line", [b"[]\n".as_slice(), &good].concat()),
+        ("null line", [b"null\n".as_slice(), &good].concat()),
+        (
+            "missing reason",
+            [b"{\"x\":1}\n".as_slice(), &good].concat(),
+        ),
+        ("oversize", oversize),
+        (
+            "invalid UTF-8",
+            [b"{\"reason\":\"\xff\"}\n".as_slice(), &good].concat(),
+        ),
+        ("unterminated final line", good[..good.len() - 1].to_vec()),
+    ];
+    for (label, stdout) in cases {
+        let message = rejection(&stdout);
+        assert!(
+            message.contains("line") || message.contains("Document"),
+            "should reject {label} output: {message}"
+        );
+    }
+}
+
+#[test]
+fn host_path_maps_only_through_writable_roots() {
+    let host = Path::new("/host/target");
+    let paths = PrefixPaths::new()
+        .with(Path::new("/host/checkout"), "/ts/immutable/0", false)
+        .with(host, "/ts/writable/1", true);
+    let located = locate_host_binary(
+        &lines(&[artifact(), finished(&json!(true))]),
+        &expected(),
+        &paths,
+    )
+    .expect("should locate and map the executable");
+    assert_eq!(
+        located.execution,
+        Path::new("/ts/writable/1/wasm32-example/release/example-bin.wasm"),
+        "should keep the container path"
+    );
+    assert_eq!(
+        located.host,
+        Path::new("/host/target/wasm32-example/release/example-bin.wasm"),
+        "should map back into the writable host root"
+    );
+    let immutable_only =
+        PrefixPaths::new().with(Path::new("/host/target"), "/ts/writable/1", false);
+    assert!(
+        locate_host_binary(
+            &lines(&[artifact(), finished(&json!(true))]),
+            &expected(),
+            &immutable_only
+        )
+        .is_err(),
+        "should reject an executable that maps only through a non-writable root"
+    );
+}
diff --git a/crates/trusted-server-release/src/recipe/compare.rs b/crates/trusted-server-release/src/recipe/compare.rs
new file mode 100644
index 0000000000..c3ce1aef31
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/compare.rs
@@ -0,0 +1,242 @@
+//! Complete final-byte comparison of the canonical and reproduction Fastly
+//! builds.
+//!
+//! The Fastly executable has no normalized or excluded region: the two final
+//! files must be identical byte for byte. Before comparing bytes, the pair
+//! must be one canonical and one reproduction build of the same asset from
+//! the same source, `Cargo.lock`, vendored materials, JS handoff and Rust
+//! tools, and their ambient records must vary exactly what the standard claim
+//! states.
+
+use std::io::Read as _;
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256};
+use wasmparser::{Parser, Payload};
+
+use super::ambient::{AmbientClaim, AmbientRecord};
+use super::artifact::EXECUTABLE_LIMIT;
+use super::{AssetId, RecipeCompleted, Role, recipe_error};
+use crate::error::ReleaseError;
+
+/// The only asset whose canonical and reproduction outputs must be byte-identical.
+pub(crate) const FASTLY_ASSET: &str = "trusted-server-fastly.wasm";
+/// Bytes shown from each side at the first difference.
+const WINDOW: usize = 16;
+
+/// Proof that the canonical and reproduction Fastly builds produced identical
+/// final bytes.
+///
+/// It has private fields and only [`check_fastly_equality`] constructs it.
+#[derive(Debug)]
+pub(crate) struct FastlyEqualityChecked {
+    asset: AssetId,
+    sha256: String,
+    size: u64,
+    ambient: AmbientRecord,
+}
+
+impl FastlyEqualityChecked {
+    /// The compared asset.
+    pub(crate) fn asset(&self) -> AssetId {
+        self.asset
+    }
+
+    /// SHA-256 of the identical final bytes.
+    pub(crate) fn sha256(&self) -> &str {
+        &self.sha256
+    }
+
+    /// Size of the identical final bytes.
+    pub(crate) fn size(&self) -> u64 {
+        self.size
+    }
+
+    /// The verified ambient pairing of the two builds.
+    pub(crate) fn ambient(&self) -> &AmbientRecord {
+        &self.ambient
+    }
+}
+
+/// Requires `canonical` and `reproduction` to be equal, naming `label` otherwise.
+fn same_input<T: PartialEq + ?Sized>(
+    label: &str,
+    canonical: &T,
+    reproduction: &T,
+) -> Result<(), Report<ReleaseError>> {
+    if canonical == reproduction {
+        return Ok(());
+    }
+    Err(recipe_error(format!(
+        "canonical and reproduction builds used different {label}"
+    )))
+}
+
+/// Requires one canonical and one reproduction build of `asset` over
+/// identical inputs.
+pub(super) fn check_pair(
+    canonical: &RecipeCompleted,
+    reproduction: &RecipeCompleted,
+    asset: AssetId,
+) -> Result<(), Report<ReleaseError>> {
+    if canonical.role() != Role::Canonical || reproduction.role() != Role::Reproduction {
+        return Err(recipe_error(
+            "a comparison needs a canonical then a reproduction build",
+        ));
+    }
+    if canonical.asset() != asset || reproduction.asset() != asset {
+        return Err(recipe_error(format!(
+            "this comparison compares only {}",
+            asset.artifact().name
+        )));
+    }
+    same_input("source commits", canonical.commit(), reproduction.commit())?;
+    same_input(
+        "Cargo.lock files",
+        canonical.cargo_lock_sha256(),
+        reproduction.cargo_lock_sha256(),
+    )?;
+    same_input(
+        "vendored materials",
+        canonical.materials_digest(),
+        reproduction.materials_digest(),
+    )?;
+    same_input(
+        "producer-normalized Git manifests",
+        canonical.normalized_manifest_digests(),
+        reproduction.normalized_manifest_digests(),
+    )?;
+    same_input(
+        "derived Git manifests",
+        canonical.derived_manifest_digests(),
+        reproduction.derived_manifest_digests(),
+    )?;
+    same_input(
+        "JS handoffs",
+        &canonical.js_digests(),
+        &reproduction.js_digests(),
+    )?;
+    same_input(
+        "Rust tools",
+        canonical.rust_tools_digest(),
+        reproduction.rust_tools_digest(),
+    )
+}
+
+/// Reads the retained artifact and requires its recorded size and digest.
+pub(super) fn read_artifact(completed: &RecipeCompleted) -> Result<Vec<u8>, Report<ReleaseError>> {
+    completed.rehash_for_handoff()?;
+    let artifact = completed.artifact();
+    if artifact.size() > EXECUTABLE_LIMIT {
+        return Err(recipe_error("artifact exceeds the executable limit"));
+    }
+    let mut bytes = Vec::new();
+    std::fs::File::open(artifact.path())
+        .and_then(|file| {
+            file.take(EXECUTABLE_LIMIT.saturating_add(1))
+                .read_to_end(&mut bytes)
+        })
+        .map_err(|error| recipe_error(format!("cannot read the final artifact: {error}")))?;
+    if bytes.len() as u64 != artifact.size()
+        || hex::encode(Sha256::digest(&bytes)) != artifact.sha256()
+    {
+        return Err(recipe_error("final artifact changed after its rehash"));
+    }
+    Ok(bytes)
+}
+
+/// Compares the complete final Fastly files of a canonical and a reproduction
+/// build.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Recipe`] when the pair is not the canonical then
+/// the reproduction build of the Fastly asset, the builds used different
+/// source, lock, materials, normalized or derived manifests, JS handoff or
+/// tools, the ambient records do not vary exactly what
+/// [`AmbientClaim::standard`] states, an artifact no longer rehashes, or the
+/// final bytes differ; a difference reports both sizes and digests, the first
+/// differing offset, the bytes there and their section.
+pub(crate) fn check_fastly_equality(
+    canonical: &RecipeCompleted,
+    reproduction: &RecipeCompleted,
+) -> Result<FastlyEqualityChecked, Report<ReleaseError>> {
+    check_pair(canonical, reproduction, AssetId::parse(FASTLY_ASSET)?)?;
+    let ambient = AmbientRecord::pair(
+        canonical.ambient(),
+        reproduction.ambient(),
+        &AmbientClaim::standard(),
+    )?;
+    let canonical_bytes = read_artifact(canonical)?;
+    let reproduction_bytes = read_artifact(reproduction)?;
+    if canonical_bytes != reproduction_bytes {
+        return Err(recipe_error(describe_mismatch(
+            &canonical_bytes,
+            &reproduction_bytes,
+        )));
+    }
+    Ok(FastlyEqualityChecked {
+        asset: canonical.asset(),
+        sha256: canonical.artifact().sha256().to_owned(),
+        size: canonical.artifact().size(),
+        ambient,
+    })
+}
+
+/// Returns the first offset where `first` and `second` differ, if any.
+///
+/// When one is a strict prefix of the other, the offset is the shorter length.
+pub(super) fn first_difference(first: &[u8], second: &[u8]) -> Option<usize> {
+    first
+        .iter()
+        .zip(second)
+        .position(|(left, right)| left != right)
+        .or_else(|| (first.len() != second.len()).then(|| first.len().min(second.len())))
+}
+
+/// Names the Wasm section whose payload holds `offset`, if the module parses.
+fn section_at(bytes: &[u8], offset: usize) -> String {
+    for payload in Parser::new(0).parse_all(bytes) {
+        let Ok(payload) = payload else {
+            return "unparsed module".to_owned();
+        };
+        let Some((id, range)) = payload.as_section() else {
+            continue;
+        };
+        if range.contains(&offset) {
+            return match payload {
+                Payload::CustomSection(reader) => format!("custom section {:?}", reader.name()),
+                _ => format!("section id {id}"),
+            };
+        }
+    }
+    "no section payload".to_owned()
+}
+
+/// Describes a final-byte mismatch with bounded diagnostics.
+pub(super) fn describe_mismatch(canonical: &[u8], reproduction: &[u8]) -> String {
+    let offset = first_difference(canonical, reproduction).unwrap_or(canonical.len());
+    let window = |bytes: &[u8]| {
+        let end = bytes.len().min(offset.saturating_add(WINDOW));
+        hex::encode(bytes.get(offset..end).unwrap_or_default())
+    };
+    let differing = canonical
+        .iter()
+        .zip(reproduction)
+        .filter(|(left, right)| left != right)
+        .count()
+        + canonical.len().abs_diff(reproduction.len());
+    format!(
+        "final Fastly bytes differ: canonical size {} sha256 {}, \
+         reproduction size {} sha256 {}; first differing offset {offset} \
+         (canonical {}: {}, reproduction {}: {}); {differing} differing bytes",
+        canonical.len(),
+        hex::encode(Sha256::digest(canonical)),
+        reproduction.len(),
+        hex::encode(Sha256::digest(reproduction)),
+        section_at(canonical, offset),
+        window(canonical),
+        section_at(reproduction, offset),
+        window(reproduction),
+    )
+}
diff --git a/crates/trusted-server-release/src/recipe/completed.rs b/crates/trusted-server-release/src/recipe/completed.rs
new file mode 100644
index 0000000000..7f4da7983a
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/completed.rs
@@ -0,0 +1,428 @@
+//! The proof a recipe build ran to completion, with its copied artifact.
+//!
+//! [`RecipeCompleted`] has private fields and no public constructor:
+//! [`RecipeCompleted::record_success`] is called only from the recipe's
+//! successful-run path, after Cargo's output was parsed and the artifact was
+//! copied and inspected. It binds everything an attestation needs and can
+//! re-measure the retained output before handoff.
+
+use std::fs;
+use std::io::Write as _;
+use std::os::unix::fs::{MetadataExt as _, OpenOptionsExt as _};
+use std::path::{Path, PathBuf};
+use std::time::Duration;
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256};
+
+use super::artifact::{CopiedArtifact, EXECUTABLE_LIMIT};
+use super::{
+    AssetId, CheckedAmbient, ExactInvocationDigest, RecipeDefinitionIdentity, Role, recipe_error,
+};
+use crate::boundary::{DenialReceipt, DescendantCleanup};
+use crate::composition::{CargoCapture, CompositionView, RetainedCompositionExport};
+use crate::documents::hash_bounded_with_check;
+use crate::error::ReleaseError;
+use crate::javascript::contributions::RetainedContributions;
+use crate::source::CommitId;
+
+/// File name of the retained Cargo message stream.
+const STDOUT_FILE: &str = "cargo-stdout.jsonl";
+/// Original JS observer bytes, retained independently of the preparation lease.
+const JS_INVENTORY_FILE: &str = "tsjs-inventory.json";
+
+/// Facts about one successful run, supplied by the recipe's run path.
+pub(super) struct SuccessFacts {
+    pub(super) asset: AssetId,
+    pub(super) role: Role,
+    pub(super) commit: CommitId,
+    pub(super) cargo_lock_sha256: String,
+    pub(super) materials_digest: String,
+    pub(super) js_inventory_sha256: String,
+    pub(super) js_settings_sha256: String,
+    pub(super) js_tools_sha256: String,
+    pub(super) js_contributions: Option<RetainedContributions>,
+    pub(super) rust_tools_digest: String,
+    pub(super) boundary_fingerprint: [u8; 32],
+    pub(super) denial_receipt: Option<DenialReceipt>,
+    pub(super) recipe_definition: Option<RecipeDefinitionIdentity>,
+    pub(super) plan_digest: ExactInvocationDigest,
+    pub(super) ambient: CheckedAmbient,
+    pub(super) started_at_seconds: u64,
+    pub(super) elapsed: Duration,
+    pub(super) descendant_cleanup: DescendantCleanup,
+    pub(super) stdout: Vec<u8>,
+    pub(super) stderr_sha256: String,
+    pub(super) artifact: CopiedArtifact,
+    pub(super) output_dir: PathBuf,
+    pub(super) normalized_manifest_digests: std::collections::BTreeMap<String, String>,
+    pub(super) derived_manifest_digests: std::collections::BTreeMap<String, String>,
+    pub(super) cargo_observations: Option<CargoCapture>,
+}
+
+/// A built, copied and bound artifact.
+pub(crate) struct RecipeCompleted {
+    facts: SuccessFacts,
+    stdout_sha256: String,
+    retained: tempfile::TempDir,
+}
+
+impl std::fmt::Debug for RecipeCompleted {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("RecipeCompleted")
+            .field("asset", &self.facts.asset)
+            .field("role", &self.facts.role)
+            .field("artifact", &self.facts.artifact)
+            .field("plan_digest", &self.facts.plan_digest)
+            .finish_non_exhaustive()
+    }
+}
+
+impl RecipeCompleted {
+    /// Returns the approved source-owned definition retained by this build.
+    ///
+    /// This selects recipe policy without proving tool qualification or which
+    /// bootstrap built the producer that executed it.
+    ///
+    /// # Errors
+    ///
+    /// Rejects changed outputs, an unbound fixture or another source/asset selection.
+    pub(crate) fn recipe_definition(
+        &self,
+    ) -> Result<&RecipeDefinitionIdentity, Report<ReleaseError>> {
+        self.rehash_for_handoff()?;
+        self.facts
+            .recipe_definition
+            .as_ref()
+            .filter(|definition| definition.matches_selection(&self.facts.commit, self.facts.asset))
+            .ok_or_else(|| {
+                recipe_error("completed build has no matching approved recipe definition")
+            })
+    }
+
+    /// Returns measured socket observations bound to this completed execution.
+    ///
+    /// This diagnostic receipt does not reconstruct a network-denial capability.
+    ///
+    /// # Errors
+    ///
+    /// Rejects changed retained outputs, an unmeasured fixture or another boundary.
+    pub(crate) fn denial_receipt(&self) -> Result<&DenialReceipt, Report<ReleaseError>> {
+        self.rehash_for_handoff()?;
+        self.facts
+            .denial_receipt
+            .as_ref()
+            .filter(|receipt| receipt.matches_fingerprint(&self.facts.boundary_fingerprint))
+            .ok_or_else(|| recipe_error("completed build has no matching measured socket receipt"))
+    }
+
+    /// Records one successful run and retains its Cargo message stream.
+    ///
+    /// Only the recipe's successful-run path calls this.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] when the stream cannot be retained.
+    pub(super) fn record_success(facts: SuccessFacts) -> Result<Self, Report<ReleaseError>> {
+        let retained = tempfile::tempdir()
+            .map_err(|error| recipe_error(format!("cannot retain Cargo output: {error}")))?;
+        let mut file = fs::OpenOptions::new()
+            .write(true)
+            .create_new(true)
+            .mode(0o600)
+            .open(retained.path().join(STDOUT_FILE))
+            .map_err(|error| recipe_error(format!("cannot retain Cargo output: {error}")))?;
+        file.write_all(&facts.stdout)
+            .and_then(|()| file.sync_all())
+            .map_err(|error| recipe_error(format!("cannot retain Cargo output: {error}")))?;
+        let stdout_sha256 = hex::encode(Sha256::digest(&facts.stdout));
+        if let Some(captured) = &facts.cargo_observations {
+            captured.retain(retained.path())?;
+            captured.rehash(retained.path())?;
+        }
+        if let Some(javascript) = &facts.js_contributions {
+            check_javascript_binding(&facts, javascript)?;
+            let mut inventory = fs::OpenOptions::new()
+                .write(true)
+                .create_new(true)
+                .mode(0o600)
+                .custom_flags(libc::O_NOFOLLOW | libc::O_CLOEXEC)
+                .open(retained.path().join(JS_INVENTORY_FILE))
+                .map_err(|error| recipe_error(format!("cannot retain JS inventory: {error}")))?;
+            inventory
+                .write_all(javascript.raw_inventory())
+                .and_then(|()| inventory.sync_all())
+                .map_err(|error| recipe_error(format!("cannot retain JS inventory: {error}")))?;
+        }
+        Ok(Self {
+            facts,
+            stdout_sha256,
+            retained,
+        })
+    }
+
+    /// The asset that was built.
+    pub(crate) fn asset(&self) -> AssetId {
+        self.facts.asset
+    }
+
+    /// The role of this build.
+    pub(crate) fn role(&self) -> Role {
+        self.facts.role
+    }
+
+    /// The approved source commit that was built.
+    pub(crate) fn commit(&self) -> &CommitId {
+        &self.facts.commit
+    }
+
+    /// SHA-256 of the approved raw `Cargo.lock`.
+    pub(crate) fn cargo_lock_sha256(&self) -> &str {
+        &self.facts.cargo_lock_sha256
+    }
+
+    /// Digest of the vendored dependency tree.
+    pub(crate) fn materials_digest(&self) -> &str {
+        &self.facts.materials_digest
+    }
+
+    /// Digests of the Git manifests the producer normalized, by vendor directory.
+    ///
+    /// Each was derived from the verified Git tree alone by the producer's
+    /// reviewed normalization; on their own they do not make the build
+    /// unqualified. They are also covered by the materials digest.
+    pub(crate) fn normalized_manifest_digests(
+        &self,
+    ) -> &std::collections::BTreeMap<String, String> {
+        &self.facts.normalized_manifest_digests
+    }
+
+    /// Digests of caller-derived Git manifests the build consumed, by vendor directory.
+    ///
+    /// Production vendoring accepts no caller-supplied manifest, so this is
+    /// empty there. A non-empty set marks the build as built from derived
+    /// inputs, so it is unqualified, and a qualified authority must refuse
+    /// to attest it.
+    pub(crate) fn derived_manifest_digests(&self) -> &std::collections::BTreeMap<String, String> {
+        &self.facts.derived_manifest_digests
+    }
+
+    /// The JS handoff digests: inventory, settings and tools, in that order.
+    pub(crate) fn js_digests(&self) -> [&str; 3] {
+        [
+            &self.facts.js_inventory_sha256,
+            &self.facts.js_settings_sha256,
+            &self.facts.js_tools_sha256,
+        ]
+    }
+
+    /// Digest of the Rust tool tree measured at binding.
+    pub(crate) fn rust_tools_digest(&self) -> &str {
+        &self.facts.rust_tools_digest
+    }
+
+    /// Execution fingerprint of the boundary instance that ran the build.
+    pub(crate) fn boundary_fingerprint(&self) -> [u8; 32] {
+        self.facts.boundary_fingerprint
+    }
+
+    /// Digest of the exact Cargo plan that ran.
+    pub(crate) fn plan_digest(&self) -> &str {
+        self.facts.plan_digest.sha256()
+    }
+
+    /// The ambient conditions the build ran under.
+    pub(crate) fn ambient(&self) -> &CheckedAmbient {
+        &self.facts.ambient
+    }
+
+    /// Unix start time of the build in seconds.
+    pub(crate) fn started_at_seconds(&self) -> u64 {
+        self.facts.started_at_seconds
+    }
+
+    /// How the boundary that ran the build ended its descendants.
+    pub(crate) fn descendant_cleanup(&self) -> DescendantCleanup {
+        self.facts.descendant_cleanup
+    }
+
+    /// Wall time the build took.
+    pub(crate) fn elapsed(&self) -> Duration {
+        self.facts.elapsed
+    }
+
+    /// SHA-256 of Cargo's message stream.
+    pub(crate) fn stdout_sha256(&self) -> &str {
+        &self.stdout_sha256
+    }
+
+    /// SHA-256 of the captured diagnostics stream.
+    pub(crate) fn stderr_sha256(&self) -> &str {
+        &self.facts.stderr_sha256
+    }
+
+    /// Supporting Cargo observations; absent only in pure completion fixtures.
+    pub(crate) fn cargo_observations_summary(&self) -> Option<serde_json::Value> {
+        self.facts
+            .cargo_observations
+            .as_ref()
+            .map(CargoCapture::summary)
+    }
+
+    /// Exports exact composition receipts bound to this completed build.
+    ///
+    /// # Errors
+    ///
+    /// Rejects changed owned outputs, missing composition, or summary-only
+    /// observations. The export preserves existing incomplete coverage.
+    pub(crate) fn composition_export(
+        &self,
+    ) -> Result<RetainedCompositionExport, Report<ReleaseError>> {
+        self.rehash_for_handoff()?;
+        self.facts
+            .cargo_observations
+            .as_ref()
+            .ok_or_else(|| recipe_error("completed build has no retained composition"))?
+            .export(self.retained.path())
+    }
+
+    /// Borrows sealed typed composition after rechecking this completed build.
+    ///
+    /// # Errors
+    ///
+    /// Rejects changed owned outputs or missing actual composition receipts.
+    pub(crate) fn composition_view(&self) -> Result<CompositionView<'_>, Report<ReleaseError>> {
+        self.rehash_for_handoff()?;
+        self.facts
+            .cargo_observations
+            .as_ref()
+            .ok_or_else(|| recipe_error("completed build has no retained composition"))?
+            .view(self.retained.path())
+    }
+
+    /// Borrows checked original JS evidence retained when the recipe was bound.
+    ///
+    /// This snapshot survives cleanup and expiry of its original preparation
+    /// attempt. It grants no new execution or composition-coverage authority.
+    ///
+    /// # Errors
+    ///
+    /// Rejects missing evidence, changed retained bytes or another source/digest.
+    pub(crate) fn javascript_contributions(
+        &self,
+    ) -> Result<&RetainedContributions, Report<ReleaseError>> {
+        self.rehash_for_handoff()?;
+        self.facts
+            .js_contributions
+            .as_ref()
+            .ok_or_else(|| recipe_error("completed build has no retained original JS inventory"))
+    }
+
+    /// The copied artifact.
+    pub(crate) fn artifact(&self) -> &CopiedArtifact {
+        &self.facts.artifact
+    }
+
+    /// Reads the retained final bytes after rechecking their size and digest.
+    ///
+    /// # Errors
+    ///
+    /// Rejects changed owned outputs, an oversized artifact or bytes whose size
+    /// or SHA-256 differ from the recorded artifact.
+    pub(crate) fn read_final_bytes(&self) -> Result<Vec<u8>, Report<ReleaseError>> {
+        super::compare::read_artifact(self)
+    }
+
+    /// Re-measures the output directory and retained stream before handoff.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] when the output directory holds
+    /// anything but the artifact, the artifact is not one regular file with
+    /// one link and the recorded size and SHA-256, or the retained Cargo
+    /// stream no longer matches its digest.
+    pub(crate) fn rehash_for_handoff(&self) -> Result<&Path, Report<ReleaseError>> {
+        let artifact = &self.facts.artifact;
+        let names = fs::read_dir(&self.facts.output_dir)
+            .map_err(|error| recipe_error(format!("output cannot be listed: {error}")))?
+            .map(|entry| entry.map(|entry| entry.file_name()))
+            .collect::<Result<Vec<_>, _>>()
+            .map_err(|error| recipe_error(format!("output cannot be listed: {error}")))?;
+        if names != [std::ffi::OsString::from(artifact.name())] {
+            return Err(recipe_error(
+                "output directory holds more than the artifact",
+            ));
+        }
+        let metadata = fs::symlink_metadata(artifact.path())
+            .map_err(|error| recipe_error(format!("artifact cannot be inspected: {error}")))?;
+        if !metadata.is_file() || metadata.nlink() != 1 {
+            return Err(recipe_error("artifact is not one regular unlinked file"));
+        }
+        let measured = hash_bounded_with_check(artifact.path(), EXECUTABLE_LIMIT, &|| Ok(()))
+            .map_err(|error| error.change_context(ReleaseError::Recipe))?;
+        if measured.size != artifact.size() || measured.sha256 != artifact.sha256() {
+            return Err(recipe_error("artifact bytes changed after the copy"));
+        }
+        let stream = hash_bounded_with_check(
+            &self.retained.path().join(STDOUT_FILE),
+            64 * 1024 * 1024,
+            &|| Ok(()),
+        )
+        .map_err(|error| error.change_context(ReleaseError::Recipe))?;
+        if stream.sha256 != self.stdout_sha256 {
+            return Err(recipe_error("retained Cargo output changed"));
+        }
+        if let Some(captured) = &self.facts.cargo_observations {
+            captured.rehash(self.retained.path())?;
+        }
+        if let Some(javascript) = &self.facts.js_contributions {
+            check_javascript_binding(&self.facts, javascript)?;
+            let measured = hash_bounded_with_check(
+                &self.retained.path().join(JS_INVENTORY_FILE),
+                javascript.raw_inventory().len() as u64,
+                &|| Ok(()),
+            )
+            .map_err(|error| error.change_context(ReleaseError::Recipe))?;
+            if measured.size != javascript.raw_inventory().len() as u64
+                || measured.sha256 != javascript.inventory_sha256()
+            {
+                return Err(recipe_error("retained original JS inventory changed"));
+            }
+        }
+        Ok(&self.facts.output_dir)
+    }
+}
+
+fn check_javascript_binding(
+    facts: &SuccessFacts,
+    javascript: &RetainedContributions,
+) -> Result<(), Report<ReleaseError>> {
+    if javascript.source_commit() != facts.commit.as_str()
+        || javascript.inventory_sha256() != facts.js_inventory_sha256
+        || hex::encode(Sha256::digest(javascript.raw_inventory())) != facts.js_inventory_sha256
+    {
+        return Err(recipe_error(
+            "retained JS inventory source or digest differs",
+        ));
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+impl RecipeCompleted {
+    /// Path of original retained JS observer bytes, for tamper tests.
+    pub(crate) fn retained_inventory_path(&self) -> PathBuf {
+        self.retained.path().join(JS_INVENTORY_FILE)
+    }
+
+    /// Path of the retained Cargo message stream, for tamper tests.
+    pub(crate) fn retained_stdout_path(&self) -> PathBuf {
+        self.retained.path().join(STDOUT_FILE)
+    }
+
+    /// Bound facts, for tests that forge one mismatched input.
+    pub(super) fn facts_mut_for_tests(&mut self) -> &mut SuccessFacts {
+        &mut self.facts
+    }
+}
diff --git a/crates/trusted-server-release/src/recipe/execute.rs b/crates/trusted-server-release/src/recipe/execute.rs
new file mode 100644
index 0000000000..8478593776
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/execute.rs
@@ -0,0 +1,672 @@
+//! The confined run of a bound recipe and the checks around it.
+//!
+//! Every input is rehashed immediately before and after the confined Cargo
+//! process, Cargo home must gain no fetched registry or Git sources, and only a
+//! successful run is parsed, copied and bound into a [`RecipeCompleted`].
+
+use std::path::Path;
+use std::time::{Duration, SystemTime, UNIX_EPOCH};
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256};
+
+use super::apple::AppleDeveloperTools;
+use super::artifact::{EXECUTABLE_LIMIT, copy_artifact};
+use super::cargo_output::{ExpectedBinary, locate_host_binary};
+use super::completed::SuccessFacts;
+use super::gnu::{GnuEvidence, MeasurementSandbox};
+use super::plan::CargoQuery;
+use super::{
+    Authority, ExactInvocationDigest, ExecutionPaths, PreparedRecipe, RecipeCompleted,
+    SelectedRustTools, WorkspaceSelection, recipe_error,
+};
+use crate::boundary::{Boundary, DenialProof, DenialReceipt, DescendantCleanup};
+use crate::composition::external::ExternalRequirements;
+use crate::composition::javascript::{JsInputs, JsRetentionPolicy, collect_js};
+use crate::composition::native::{self, NativeInputs};
+use crate::composition::origin::join_origins;
+use crate::composition::platform::PlatformEvidence;
+use crate::composition::{CargoCapture, CargoLayout};
+use crate::documents::{Role as DocumentRole, read_bounded};
+use crate::error::ReleaseError;
+use crate::inspect::{ElfPolicy, MachoCpu, MachoPolicy, inspect_elf, inspect_macho, inspect_wasm};
+use crate::policy::ReleaseTarget;
+use crate::process::ProcessLimits;
+use crate::tool_tree::tool_tree_digest;
+
+/// Captured output limit of each Cargo stream.
+const BUILD_STREAM_MAX: u64 = 16 * 1024 * 1024;
+
+/// Limits of the confined Cargo process under the selection's build wall.
+fn build_limits(tools: &SelectedRustTools) -> ProcessLimits {
+    ProcessLimits {
+        wall: tools.build_wall(),
+        stdout_max: BUILD_STREAM_MAX,
+        stderr_max: BUILD_STREAM_MAX,
+    }
+}
+
+/// What a successful confined run produced, as the run path reports it.
+pub(super) struct RunOutput {
+    pub(super) gnu: Option<GnuEvidence>,
+    pub(super) stdout: Vec<u8>,
+    pub(super) stderr_sha256: String,
+    pub(super) started_at_seconds: u64,
+    pub(super) elapsed: Duration,
+    /// The descendant cleanup of the boundary that ran the build.
+    pub(super) cleanup: DescendantCleanup,
+    /// Supporting output captured by this same denied recipe invocation.
+    pub(super) queries: CargoQueryOutput,
+}
+
+/// Supporting observations from execution, or an explicit pure-test fixture.
+pub(super) enum CargoQueryOutput {
+    /// Raw metadata and tree output from the selected Cargo under the proof.
+    Captured {
+        metadata: Vec<u8>,
+        tree: Vec<u8>,
+        plan_digests: [String; 2],
+        denial: DenialReceipt,
+        fastly_tools: Option<Box<super::fastly_tools::FastlyToolEvidence>>,
+    },
+    /// Pure completion tests never execute Cargo and cannot supply real observations.
+    #[cfg(test)]
+    Fixture,
+}
+
+/// Admits a boundary's descendant cleanup for a selection.
+///
+/// Container-owned cleanup is always admitted. Post-run-reaped cleanup,
+/// where survivors exist until the reap after the run, is admitted only when
+/// `allowance` (the selection's
+/// [`permits_post_run_reaped_cleanup`](super::SelectedRustTools::permits_post_run_reaped_cleanup))
+/// holds.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Recipe`] for post-run-reaped cleanup without the
+/// allowance.
+pub(super) fn cleanup_gate(
+    cleanup: DescendantCleanup,
+    allowance: bool,
+) -> Result<(), Report<ReleaseError>> {
+    match cleanup {
+        DescendantCleanup::OwnedByContainer => Ok(()),
+        DescendantCleanup::ReapedAfterRun if allowance => Ok(()),
+        DescendantCleanup::ReapedAfterRun => Err(recipe_error(
+            "post-run-reaped cleanup is not permitted for this selection",
+        )),
+    }
+}
+
+impl PreparedRecipe {
+    /// Requires the tools to be the tree measured at binding and any Apple
+    /// developer tools to still match their record.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] when anything under the tool root was
+    /// edited, linked, added or removed, or an Apple tool, the SDK settings,
+    /// the detached SDK or the measured toolchain changed.
+    pub(super) fn check_tools(&self) -> Result<(), Report<ReleaseError>> {
+        self.check_rust_tools()?;
+        self.tools
+            .apple()
+            .map_or(Ok(()), super::apple::AppleDeveloperTools::verify)
+    }
+
+    /// Requires the Rust tools to be the tree measured at binding.
+    ///
+    /// Unlike [`Self::check_tools`] this never rehashes the Apple developer
+    /// tools. Callers use it only where a full [`Self::check_inputs`]
+    /// brackets the same step: before the run (followed by the pre-run
+    /// inputs check) and at completion (preceded by the post-run one).
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] when anything under the tool root was
+    /// edited, linked, added or removed.
+    pub(super) fn check_rust_tools(&self) -> Result<(), Report<ReleaseError>> {
+        if self.tools.digest()? != self.tools_digest {
+            return Err(recipe_error("Rust tools changed after binding"));
+        }
+        Ok(())
+    }
+
+    /// Requires the prepared materials to be unchanged.
+    pub(super) fn check_materials(&self) -> Result<(), Report<ReleaseError>> {
+        self.materials.rehash().map_err(|error| {
+            error
+                .change_context(ReleaseError::Recipe)
+                .attach("prepared materials changed after binding")
+        })
+    }
+
+    /// Requires the retained JS handoff to be the tree measured at binding.
+    fn check_js_handoff(&self) -> Result<(), Report<ReleaseError>> {
+        if retained_tree_digest(&self.retained_root)? != self.retained_digest {
+            return Err(recipe_error("retained JS handoff changed after binding"));
+        }
+        Ok(())
+    }
+
+    /// Rechecks source and rehashes the JS handoff, tools and materials.
+    pub(super) fn check_inputs(&self) -> Result<(), Report<ReleaseError>> {
+        self.check_source()?;
+        self.check_js_handoff()?;
+        self.check_tools()?;
+        self.check_materials()
+    }
+
+    /// Rechecks source while its working root still exists, before receipt sealing.
+    fn check_source(&self) -> Result<(), Report<ReleaseError>> {
+        match &self.workspace {
+            WorkspaceSelection::Approved(workspace) => workspace.origins.verify_unchanged(),
+            #[cfg(test)]
+            WorkspaceSelection::Fixture => Ok(()),
+        }
+    }
+
+    /// Requires Cargo's private home to hold no registry or Git cache.
+    ///
+    /// Cargo may initialize its registry directory and cache tag before source
+    /// replacement. Only that exact bookkeeping is admitted; source/cache/index
+    /// entries and every Git cache remain forbidden.
+    pub(super) fn check_no_fetched_sources(&self) -> Result<(), Report<ReleaseError>> {
+        super::cargo_home::check(&self.request.cargo_home(), &|| Ok(()))
+    }
+
+    /// Requires unchanged inputs, a derivable plan, the exact planned roots
+    /// and a descendant cleanup the selection accepts; returns that cleanup.
+    ///
+    /// Only the Rust tools are rehashed here. The Apple developer tools are
+    /// rehashed by the full [`Self::check_inputs`] that [`Self::execute`]
+    /// runs next, with only pure plan and command derivation in between, so
+    /// a pass here would hash the same SDK and toolchain twice.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] when the Rust tools or materials
+    /// changed, the plan cannot be derived in the boundary's namespace, the
+    /// boundary roots differ from [`Self::boundary_roots`], or
+    /// [`cleanup_gate`] rejects the boundary's descendant cleanup.
+    fn check_boundary(
+        &self,
+        boundary: &Boundary,
+    ) -> Result<DescendantCleanup, Report<ReleaseError>> {
+        self.check_rust_tools()?;
+        self.check_materials()?;
+        self.plan(boundary)?;
+        if !boundary.matches_roots(&self.boundary_roots()?) {
+            return Err(recipe_error(
+                "boundary roots differ from the exact recipe roots",
+            ));
+        }
+        let cleanup = boundary.descendant_cleanup();
+        cleanup_gate(cleanup, self.tools.permits_post_run_reaped_cleanup())?;
+        Ok(cleanup)
+    }
+
+    /// Checks every gate, runs Cargo confined and completes the run.
+    ///
+    /// Only a selection that [permits a candidate run](super::SelectedRustTools::permits_candidate_run)
+    /// reaches the run: the test-only ordinary CI selection. That run is
+    /// unqualified CI evidence; production builds can name no selection, so
+    /// their gate stays closed. The JS handoff, tools and materials are
+    /// rehashed immediately before and after the run, and Cargo home must
+    /// gain no fetched sources beyond exact Cargo registry bookkeeping.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] when an input, plan, roots or
+    /// descendant cleanup gate fails, an input changed around the run, Cargo
+    /// fetched into its home, the build did not succeed or its completion is
+    /// rejected; [`ReleaseError::Unqualified`] for a selection that permits no
+    /// candidate run; or [`ReleaseError::Boundary`] / [`ReleaseError::Process`]
+    /// when the confined run itself fails.
+    pub(crate) fn execute(
+        self,
+        boundary: &Boundary,
+        proof: &DenialProof,
+    ) -> Result<RecipeCompleted, Report<ReleaseError>> {
+        let cleanup = self.check_boundary(boundary)?;
+        let command = self
+            .plan(boundary)?
+            .confined_command(build_limits(&self.tools))?;
+        if !self.tools.permits_candidate_run() {
+            return Err(Report::new(ReleaseError::Unqualified)
+                .attach("Cargo execution is closed until Rust tools and boundary are qualified"));
+        }
+        self.check_inputs()?;
+        self.check_no_fetched_sources()?;
+        // GNU measurements run in a sibling sandbox without the target root:
+        // after the build that root holds Cargo's in-root hard links, which
+        // the build boundary's pre-run single-link scan rejects.
+        let gnu_sandbox =
+            if self.request.asset.artifact().target == ReleaseTarget::X86_64UnknownLinuxGnu {
+                Some(MeasurementSandbox::establish(
+                    boundary,
+                    &self.tools,
+                    &self.request.target_dir,
+                )?)
+            } else {
+                None
+            };
+        let gnu = gnu_sandbox
+            .as_ref()
+            .map(|sandbox| {
+                GnuEvidence::measure(
+                    &self.tools,
+                    &self.plan(boundary)?,
+                    &boundary.execution_fingerprint(),
+                    sandbox,
+                )
+            })
+            .transpose()?;
+        let fastly_sandbox = if self.request.asset.artifact().target == ReleaseTarget::Wasm32Wasip1
+            && cfg!(all(target_os = "linux", target_arch = "x86_64"))
+        {
+            Some(MeasurementSandbox::establish(
+                boundary,
+                &self.tools,
+                &self.request.target_dir,
+            )?)
+        } else {
+            None
+        };
+        let fastly_tools = fastly_sandbox
+            .as_ref()
+            .map(|sandbox| {
+                super::fastly_tools::FastlyToolEvidence::measure(
+                    &self.tools,
+                    &self.plan(boundary)?,
+                    &boundary.execution_fingerprint(),
+                    sandbox,
+                )
+            })
+            .transpose()?;
+        let denial = proof.receipt_for(&boundary.execution_fingerprint())?;
+        let run: Result<_, Report<ReleaseError>> = (|| {
+            let query = |kind| {
+                let plan = self.plan(boundary)?.observation_query(kind)?;
+                let limits = ProcessLimits {
+                    wall: Duration::from_secs(120),
+                    ..build_limits(&self.tools)
+                };
+                let digest = plan.digest()?;
+                let stdout = boundary
+                    .run_confined(&plan.confined_command(limits)?, proof)?
+                    .require_success()?;
+                Ok::<_, Report<ReleaseError>>((stdout, digest))
+            };
+            let (metadata, metadata_plan) = query(CargoQuery::Metadata)?;
+            let (tree, tree_plan) = query(CargoQuery::Tree)?;
+            let started_at_seconds = unix_seconds()?;
+            let result = boundary.run_confined(&command, proof)?;
+            Ok((
+                CargoQueryOutput::Captured {
+                    metadata,
+                    tree,
+                    plan_digests: [metadata_plan, tree_plan],
+                    denial,
+                    fastly_tools: fastly_tools.map(Box::new),
+                },
+                result,
+                started_at_seconds,
+            ))
+        })();
+        let after = self
+            .check_inputs()
+            .and_then(|()| self.check_no_fetched_sources())
+            .and_then(|()| {
+                if let (Some(before), Some(sandbox)) = (&gnu, &gnu_sandbox) {
+                    let after = GnuEvidence::measure(
+                        &self.tools,
+                        &self.plan(boundary)?,
+                        &boundary.execution_fingerprint(),
+                        sandbox,
+                    )?;
+                    before.verify_after(&after)?;
+                }
+                if let (
+                    Some(sandbox),
+                    Ok((
+                        CargoQueryOutput::Captured {
+                            fastly_tools: Some(before),
+                            ..
+                        },
+                        _,
+                        _,
+                    )),
+                ) = (&fastly_sandbox, &run)
+                {
+                    let after = super::fastly_tools::FastlyToolEvidence::measure(
+                        &self.tools,
+                        &self.plan(boundary)?,
+                        &boundary.execution_fingerprint(),
+                        sandbox,
+                    )?;
+                    before.verify_after(&after)?;
+                }
+                Ok(())
+            });
+
+        let (queries, result, started_at_seconds) = match (run, after) {
+            (Ok(result), Ok(())) => result,
+            (Ok(_), Err(changed)) => return Err(changed),
+            (Err(run), Ok(())) => return Err(run),
+            (Err(run), Err(changed)) => {
+                return Err(run.attach(format!("inputs also failed their checks: {changed:?}")));
+            }
+        };
+        let stderr_sha256 = hex::encode(Sha256::digest(result.stderr()));
+        let elapsed = result.elapsed();
+        let stdout = result.require_success().map_err(|error| {
+            error
+                .change_context(ReleaseError::Recipe)
+                .attach("confined Cargo build did not succeed")
+        })?;
+        let output = RunOutput {
+            gnu,
+            stdout,
+            stderr_sha256,
+            started_at_seconds,
+            elapsed,
+            cleanup,
+            queries,
+        };
+        self.complete(output, boundary.execution_fingerprint(), boundary)
+    }
+
+    /// Turns one successful run into a [`RecipeCompleted`].
+    ///
+    /// Parses Cargo's stream, maps the executable back through a writable
+    /// root, copies it into the output directory and inspects the copy: a
+    /// Wasm module, Linux or macOS executable must pass its inspector and
+    /// keep the debug sections or debug map a stripped file lacks (see
+    /// [`inspect_copied`]). Every target must also exclude all bound host and
+    /// execution roots and contain a fixed remapped prefix.
+    ///
+    /// Only the Rust tools are rehashed here, since the receipt binds their
+    /// digest. [`Self::execute`] already rehashed the Apple developer tools
+    /// in its post-run [`Self::check_inputs`], with only in-process checks
+    /// in between, and platform evidence rechecks them when it seals.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] when the Rust tools or materials changed,
+    /// the stream is not exactly one fresh debug-info binary, or the
+    /// executable cannot be copied or rehashed, a bound path remains, no fixed
+    /// remapped prefix exists, or [`ReleaseError::Inspect`] when the
+    /// Wasm module or Linux executable is rejected or stripped.
+    pub(super) fn complete(
+        self,
+        run: RunOutput,
+        boundary_fingerprint: [u8; 32],
+        paths: &dyn ExecutionPaths,
+    ) -> Result<RecipeCompleted, Report<ReleaseError>> {
+        self.check_rust_tools()?;
+        self.check_materials()?;
+        let plan_digest = ExactInvocationDigest::from_plan(&self.plan(paths)?)?;
+        let artifact = self.request.asset.artifact();
+        let manifest = paths.execution_path(
+            &self
+                .ambient
+                .checkout_root()
+                .join("crates")
+                .join(artifact.package)
+                .join("Cargo.toml"),
+        )?;
+        let release_dir = paths
+            .execution_path(&self.request.target_dir)?
+            .join(artifact.target.triple())
+            .join("release");
+        let located = locate_host_binary(
+            &run.stdout,
+            &ExpectedBinary {
+                bin: artifact.bin,
+                manifest: &manifest,
+                release_dir: &release_dir,
+            },
+            paths,
+        )?;
+        let (mut cargo_observations, denial_receipt, fastly_tools) = match run.queries {
+            CargoQueryOutput::Captured {
+                metadata,
+                tree,
+                plan_digests,
+                denial,
+                fastly_tools,
+            } => {
+                if !denial.matches_fingerprint(&boundary_fingerprint) {
+                    return Err(recipe_error(
+                        "socket observations belong to another execution boundary",
+                    ));
+                }
+                let layout = CargoLayout::new(
+                    artifact.target,
+                    paths.execution_path(&self.request.target_dir)?,
+                    paths.execution_path(self.ambient.checkout_root())?,
+                )?;
+                let captured =
+                    CargoCapture::new(metadata, tree, &run.stdout, &layout, plan_digests)?;
+                let selected_package_id =
+                    captured.require_binary(&manifest, artifact.bin, &located.execution)?;
+                (
+                    Some((captured, selected_package_id)),
+                    Some(denial),
+                    fastly_tools,
+                )
+            }
+            #[cfg(test)]
+            CargoQueryOutput::Fixture => (None, None, None),
+        };
+        let copied = copy_artifact(
+            &located.host,
+            &self.request.target_dir,
+            &self.request.output,
+            artifact.name,
+            EXECUTABLE_LIMIT,
+        )?;
+        let raw = read_bounded(copied.path(), DocumentRole::Executable)
+            .map_err(|error| error.change_context(ReleaseError::Recipe))?;
+        if raw.sha256 != copied.sha256() || raw.bytes.len() as u64 != copied.size() {
+            return Err(recipe_error(
+                "copied artifact changed before final-byte checks",
+            ));
+        }
+        let requirements = inspect_copied(artifact.target, &raw.bytes, self.tools.apple())?;
+        self.check_final_paths(&raw.bytes, paths)?;
+
+        let cargo_observations = if let Some((captured, selected_package_id)) =
+            cargo_observations.take()
+        {
+            Some(match &self.workspace {
+                WorkspaceSelection::Approved(workspace) => {
+                    let origins = join_origins(
+                        captured.observations(),
+                        &workspace.origins,
+                        &self.materials,
+                        paths,
+                    )?;
+                    let plan = self.plan(paths)?;
+                    let native = native::collect(
+                        captured.observations(),
+                        &NativeInputs {
+                            origins: origins.native_sources(),
+                            execution_output_root: &paths
+                                .execution_path(&self.request.target_dir)?,
+                            host_output_root: &self.request.target_dir,
+                            target: artifact.target,
+                            environment: &plan.environment,
+                            check: &|| Ok(()),
+                        },
+                    )?;
+                    let javascript = collect_js(
+                        &raw.bytes,
+                        copied.sha256(),
+                        &JsInputs {
+                            retained_root: &self.retained_root,
+                            modules: &self.js.modules,
+                            inventory_sha256: &self.js.inventory_sha256,
+                            policy: if artifact.target == ReleaseTarget::Wasm32Wasip1 {
+                                JsRetentionPolicy::FastlyAll
+                            } else {
+                                JsRetentionPolicy::ObserveCli
+                            },
+                        },
+                    )?;
+                    self.check_source()?;
+                    let platform = PlatformEvidence::collect(
+                        &self.tools,
+                        &self.tools_digest,
+                        requirements,
+                        artifact.target,
+                        copied.sha256(),
+                    )?;
+                    let platform = if artifact.target == ReleaseTarget::X86_64UnknownLinuxGnu {
+                        let gnu = run.gnu.ok_or_else(|| {
+                            recipe_error("GNU completion lacks enforced in-image tool measurements")
+                        })?;
+                        gnu.verify_binding(&boundary_fingerprint, plan_digest.sha256())?;
+                        platform.with_gnu(gnu)?
+                    } else {
+                        platform
+                    };
+                    if artifact.target == ReleaseTarget::Wasm32Wasip1
+                        && cfg!(all(target_os = "linux", target_arch = "x86_64"))
+                        && fastly_tools.is_none()
+                    {
+                        return Err(recipe_error(
+                            "Fastly completion lacks enforced host-tool measurements",
+                        ));
+                    }
+                    let platform = if let Some(evidence) = fastly_tools {
+                        evidence.verify_binding(&boundary_fingerprint, plan_digest.sha256())?;
+                        platform.with_fastly_tools(*evidence)?
+                    } else {
+                        platform
+                    };
+                    let captured = captured.with_evidence(
+                        &selected_package_id,
+                        origins,
+                        native,
+                        javascript,
+                        platform,
+                    )?;
+                    self.check_source()?;
+                    captured
+                }
+                #[cfg(test)]
+                WorkspaceSelection::Fixture => captured,
+            })
+        } else {
+            None
+        };
+
+        if self.tools.authority() == Authority::Qualified
+            && !self.materials.derived_manifest_digests().is_empty()
+        {
+            return Err(Report::new(ReleaseError::Unqualified)
+                .attach("a build from caller-derived manifests cannot carry qualified authority"));
+        }
+        let recipe_definition = match self.workspace {
+            WorkspaceSelection::Approved(workspace) => Some(workspace.definition),
+            #[cfg(test)]
+            WorkspaceSelection::Fixture => None,
+        };
+        RecipeCompleted::record_success(SuccessFacts {
+            asset: self.request.asset,
+            role: self.request.role,
+            commit: self.request.commit.clone(),
+            cargo_lock_sha256: self.materials.cargo_lock_sha256().to_owned(),
+            materials_digest: self.materials.digest().to_owned(),
+            js_inventory_sha256: self.js.inventory_sha256.clone(),
+            js_settings_sha256: self.js.settings_sha256.clone(),
+            js_tools_sha256: self.js.tools_sha256.clone(),
+            js_contributions: self.js.contributions,
+            rust_tools_digest: self.tools_digest.clone(),
+            boundary_fingerprint,
+            denial_receipt,
+            recipe_definition,
+            plan_digest,
+            ambient: self.ambient.clone(),
+            started_at_seconds: run.started_at_seconds,
+            elapsed: run.elapsed,
+            descendant_cleanup: run.cleanup,
+            stdout: run.stdout,
+            stderr_sha256: run.stderr_sha256,
+            artifact: copied,
+            output_dir: self.request.output.clone(),
+            normalized_manifest_digests: self.materials.normalized_manifest_digests().clone(),
+            derived_manifest_digests: self.materials.derived_manifest_digests().clone(),
+            cargo_observations,
+        })
+    }
+}
+
+/// Returns observed runtime requirements after accepting the copied final bytes.
+///
+/// Wasm must be a core module that kept its debug sections. A Linux
+/// executable must pass the reviewed glibc 2.34 ELF policy (`x86_64`, the
+/// reviewed loader and libraries, no search path, no runner path) and keep
+/// its DWARF sections. A macOS executable must pass the reviewed Mach-O
+/// policy for its CPU (minimum macOS 13.0, reviewed loader and libraries,
+/// linker ad-hoc signature on arm64, relative zero-time debug map), keep a
+/// non-empty debug map, and record the SDK version measured from the bound
+/// Apple developer tools.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Inspect`] when the final bytes are rejected, or
+/// [`ReleaseError::Recipe`] for a Darwin artifact without Apple developer
+/// tools or whose recorded SDK differs from the measured one.
+fn inspect_copied(
+    target: ReleaseTarget,
+    bytes: &[u8],
+    apple: Option<&AppleDeveloperTools>,
+) -> Result<ExternalRequirements, Report<ReleaseError>> {
+    let cpu = match target {
+        ReleaseTarget::Wasm32Wasip1 => {
+            let facts = inspect_wasm(bytes)?;
+            facts.require_debug_sections()?;
+            return Ok(ExternalRequirements::from_wasm(&facts));
+        }
+        ReleaseTarget::X86_64UnknownLinuxGnu => {
+            let facts = inspect_elf(bytes, &ElfPolicy::linux_x86_64_gnu())?;
+            facts.require_debug_sections()?;
+            return Ok(ExternalRequirements::from_elf(&facts));
+        }
+        ReleaseTarget::Aarch64AppleDarwin => MachoCpu::Arm64,
+        ReleaseTarget::X86_64AppleDarwin => MachoCpu::X86_64,
+    };
+    let apple =
+        apple.ok_or_else(|| recipe_error("Darwin artifact has no Apple developer tools"))?;
+    let facts = inspect_macho(bytes, &MachoPolicy::macos(cpu))?;
+    facts.require_debug_map()?;
+    if facts.sdk() != apple.sdk_version() {
+        return Err(recipe_error(format!(
+            "Mach-O records SDK {}, but the bound Apple SDK is {}",
+            facts.sdk(),
+            apple.sdk_version()
+        )));
+    }
+    Ok(ExternalRequirements::from_macho(&facts))
+}
+
+/// Digest of the whole retained JS root: contents, modes, names and aliases.
+pub(super) fn retained_tree_digest(root: &Path) -> Result<String, Report<ReleaseError>> {
+    tool_tree_digest(root, &|| Ok(())).map_err(|error| {
+        error
+            .change_context(ReleaseError::Recipe)
+            .attach("retained JS handoff cannot be digested")
+    })
+}
+
+/// Current Unix time in whole seconds.
+fn unix_seconds() -> Result<u64, Report<ReleaseError>> {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|elapsed| elapsed.as_secs())
+        .map_err(|error| recipe_error(format!("system clock is before the Unix epoch: {error}")))
+}
diff --git a/crates/trusted-server-release/src/recipe/fastly_tools.rs b/crates/trusted-server-release/src/recipe/fastly_tools.rs
new file mode 100644
index 0000000000..04bfa4fe6c
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/fastly_tools.rs
@@ -0,0 +1,717 @@
+//! Bounded selected host files, without helper execution or closure claims.
+
+use std::collections::BTreeMap;
+use std::ffi::OsString;
+use std::fs;
+use std::path::{Component, Path, PathBuf};
+use std::time::Duration;
+
+use error_stack::Report;
+use serde::{Deserialize, Serialize};
+
+use super::gnu::MeasurementSandbox;
+use super::{CargoPlan, SelectedRustTools, recipe_error};
+use crate::boundary::ConfinedCommand;
+use crate::documents::{Role, canonical_json, hash_bounded_with_check, lower_hex, parse_json};
+use crate::error::ReleaseError;
+use crate::process::{BoundedCommand, ProcessLimits};
+
+const MODE: &str = "TRUSTED_SERVER_FASTLY_TOOL_MEASUREMENT";
+const PROFILE: &str = "fastly-linux-host-selected-files-v1";
+const HOST: &str = "x86_64-unknown-linux-gnu";
+const ROLES: [&str; 4] = [
+    "host_compiler",
+    "host_archiver",
+    "configured_host_assembler",
+    "wasm_rust_linker",
+];
+
+/// Selects C tools for host build units only.
+pub(super) fn environment() -> BTreeMap<String, String> {
+    [("HOST_CC", "/usr/bin/cc"), ("HOST_AR", "/usr/bin/ar")]
+        .into_iter()
+        .map(|(name, value)| (name.to_owned(), value.to_owned()))
+        .collect()
+}
+
+/// Selects host driver and target linker from the bound Rust root.
+pub(super) fn linker_arguments(root: &str) -> Vec<String> {
+    vec![
+        "--config".to_owned(),
+        format!("target.\"{HOST}\".linker=\"/usr/bin/cc\""),
+        "--config".to_owned(),
+        format!("target.\"wasm32-wasip1\".linker=\"{root}/lib/rustlib/{HOST}/bin/rust-lld\""),
+    ]
+}
+
+fn tool_root(path: &str) -> Result<PathBuf, Report<ReleaseError>> {
+    let bin = path
+        .strip_suffix(":/usr/bin:/bin")
+        .ok_or_else(|| recipe_error("Fastly helper requires exact recipe PATH"))?;
+    let root = Path::new(
+        bin.strip_suffix("/bin")
+            .ok_or_else(|| recipe_error("Fastly PATH lacks tool bin"))?,
+    );
+    if !root.starts_with("/boundary/tool")
+        || !root.is_absolute()
+        || root
+            .components()
+            .any(|part| !matches!(part, Component::RootDir | Component::Normal(_)))
+        || bin.contains(':')
+        || bin
+            .split('/')
+            .skip(1)
+            .any(|part| part.is_empty() || part == "." || part == "..")
+    {
+        return Err(recipe_error(
+            "Fastly Rust root is outside bound readonly tools",
+        ));
+    }
+    Ok(root.to_owned())
+}
+
+#[derive(Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct FileIdentity {
+    selected: PathBuf,
+    resolved: PathBuf,
+    sha256: String,
+    size: u64,
+}
+
+#[derive(Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Measurement {
+    profile: String,
+    rust_root: PathBuf,
+    rust_host: String,
+    assembler_query: String,
+    files: BTreeMap<String, FileIdentity>,
+}
+
+/// Files selected or configured by the bounded Linux Fastly recipe.
+#[derive(Debug, Serialize)]
+pub(crate) struct FastlyToolEvidence {
+    measurement: Measurement,
+    helper_sha256: String,
+    build_boundary_fingerprint: String,
+    measurement_boundary_fingerprint: String,
+    plan_sha256: String,
+    identity_scope: &'static str,
+    acquisition: &'static str,
+    full_closure_measured: bool,
+}
+
+fn limits() -> ProcessLimits {
+    ProcessLimits {
+        wall: Duration::from_secs(60),
+        stdout_max: 64 * 1024,
+        stderr_max: 64 * 1024,
+    }
+}
+
+fn query(
+    program: &Path,
+    argument: &str,
+    working: &Path,
+    path: &str,
+) -> Result<String, Report<ReleaseError>> {
+    let raw = BoundedCommand::new(program, working, limits())?
+        .arguments([OsString::from(argument)])
+        .environment("PATH", path)?
+        .environment("LC_ALL", "C")?
+        .environment("TMPDIR", working)?
+        .run()?
+        .require_success()?;
+    String::from_utf8(raw).map_err(|error| recipe_error(error.to_string()))
+}
+
+fn file_identity(
+    selected: &Path,
+    root: Option<&Path>,
+) -> Result<FileIdentity, Report<ReleaseError>> {
+    let resolved = fs::canonicalize(selected).map_err(|error| recipe_error(error.to_string()))?;
+    let permitted = root.map_or_else(
+        || {
+            resolved.starts_with("/usr")
+                || resolved.starts_with("/bin")
+                || resolved.starts_with("/lib")
+                || resolved.starts_with("/lib64")
+        },
+        |root| resolved.starts_with(root),
+    );
+    if !permitted {
+        return Err(recipe_error(
+            "Fastly selected file escapes reviewed image or Rust root",
+        ));
+    }
+    let (sha256, size) = super::gnu::hash_image_file(&resolved)?;
+    Ok(FileIdentity {
+        selected: selected.to_owned(),
+        resolved,
+        sha256,
+        size,
+    })
+}
+
+/// Measures fixed selected files inside the denied Linux image.
+///
+/// # Errors
+///
+/// Rejects another helper mode, host, root, missing tool or failed query.
+pub(super) fn helper_measurement() -> Result<Vec<u8>, Report<ReleaseError>> {
+    if !cfg!(all(target_os = "linux", target_arch = "x86_64"))
+        || std::env::var(MODE).as_deref() != Ok(PROFILE)
+    {
+        return Err(recipe_error(
+            "Fastly measurement requires fixed Linux x86_64 helper mode",
+        ));
+    }
+    let path = std::env::var("PATH").map_err(|error| recipe_error(error.to_string()))?;
+    let root = tool_root(&path)?;
+    let working =
+        PathBuf::from(std::env::var("TMPDIR").map_err(|error| recipe_error(error.to_string()))?);
+    if !working.starts_with("/boundary/writable")
+        || working
+            .components()
+            .any(|part| matches!(part, Component::ParentDir))
+    {
+        return Err(recipe_error("Fastly helper requires private TMPDIR"));
+    }
+    let version = query(&root.join("bin/rustc"), "-vV", &working, &path)?;
+    if version
+        .lines()
+        .filter(|line| line.starts_with("host: "))
+        .collect::<Vec<_>>()
+        != [format!("host: {HOST}")]
+    {
+        return Err(recipe_error("Fastly Rust host is not Linux x86_64"));
+    }
+    let assembler_query = query(
+        Path::new("/usr/bin/cc"),
+        "-print-prog-name=as",
+        &working,
+        &path,
+    )?;
+    let assembler = assembler_path(&assembler_query, &path)?;
+    let mut files = BTreeMap::new();
+    for (role, selected) in [
+        ("host_compiler", PathBuf::from("/usr/bin/cc")),
+        ("host_archiver", PathBuf::from("/usr/bin/ar")),
+        ("configured_host_assembler", assembler),
+    ] {
+        files.insert(role.to_owned(), file_identity(&selected, None)?);
+    }
+    files.insert(
+        "wasm_rust_linker".to_owned(),
+        file_identity(
+            &root.join(format!("lib/rustlib/{HOST}/bin/rust-lld")),
+            Some(&root),
+        )?,
+    );
+    let measurement = Measurement {
+        profile: PROFILE.to_owned(),
+        rust_root: root,
+        rust_host: HOST.to_owned(),
+        assembler_query,
+        files,
+    };
+    validate(&measurement, &measurement.rust_root)?;
+    canonical_json(
+        &serde_json::to_value(measurement).map_err(|error| recipe_error(error.to_string()))?,
+        Role::Metadata,
+    )
+    .map_err(|error| error.change_context(ReleaseError::Recipe))
+}
+
+fn assembler_path(output: &str, path: &str) -> Result<PathBuf, Report<ReleaseError>> {
+    let line = output
+        .strip_suffix('\n')
+        .filter(|line| !line.is_empty() && !line.chars().any(char::is_control))
+        .ok_or_else(|| recipe_error("Fastly assembler query lacks one result line"))?;
+    if line == "as" {
+        // The fixed recipe PATH puts measured Rust tools before image tools.
+        return std::env::split_paths(path)
+            .map(|root| root.join("as"))
+            .find(|candidate| candidate.is_file())
+            .ok_or_else(|| recipe_error("configured assembler missing from exact PATH"));
+    }
+    let selected = PathBuf::from(line);
+    if !selected.is_absolute() {
+        return Err(recipe_error("configured assembler is relative"));
+    }
+    Ok(selected)
+}
+
+fn validate(value: &Measurement, root: &Path) -> Result<(), Report<ReleaseError>> {
+    if value.profile != PROFILE
+        || value.rust_root != root
+        || value.rust_host != HOST
+        || value.files.len() != ROLES.len()
+        || ROLES.iter().any(|role| !value.files.contains_key(*role))
+    {
+        return Err(recipe_error("unsupported Fastly tool measurement"));
+    }
+    for file in value.files.values() {
+        if !file.selected.is_absolute()
+            || !file.resolved.is_absolute()
+            || !lower_hex(&file.sha256, 64)
+            || file
+                .resolved
+                .components()
+                .any(|part| matches!(part, Component::ParentDir))
+        {
+            return Err(recipe_error("invalid Fastly file identity"));
+        }
+    }
+    for (role, selected) in [
+        ("host_compiler", PathBuf::from("/usr/bin/cc")),
+        ("host_archiver", PathBuf::from("/usr/bin/ar")),
+        (
+            "wasm_rust_linker",
+            root.join(format!("lib/rustlib/{HOST}/bin/rust-lld")),
+        ),
+    ] {
+        if value.files[role].selected != selected {
+            return Err(recipe_error("Fastly selected tools differ from profile"));
+        }
+    }
+    if !value.files["wasm_rust_linker"].resolved.starts_with(root) {
+        return Err(recipe_error("Fastly Rust linker escaped measured root"));
+    }
+    let line = value
+        .assembler_query
+        .strip_suffix('\n')
+        .filter(|line| !line.is_empty() && !line.chars().any(char::is_control))
+        .ok_or_else(|| recipe_error("invalid Fastly assembler query"))?;
+    let assembler = &value.files["configured_host_assembler"];
+    if line == "as" {
+        if ![
+            root.join("bin/as"),
+            PathBuf::from("/usr/bin/as"),
+            PathBuf::from("/bin/as"),
+        ]
+        .contains(&assembler.selected)
+        {
+            return Err(recipe_error("assembler differs from recipe PATH"));
+        }
+    } else if !Path::new(line).is_absolute() || assembler.selected != Path::new(line) {
+        return Err(recipe_error("assembler differs from compiler query"));
+    }
+    for role in [
+        "host_compiler",
+        "host_archiver",
+        "configured_host_assembler",
+    ] {
+        let resolved = &value.files[role].resolved;
+        if !["/usr", "/bin", "/lib", "/lib64"]
+            .iter()
+            .any(|allowed| resolved.starts_with(allowed))
+        {
+            return Err(recipe_error("Fastly host tool escaped image roots"));
+        }
+    }
+    Ok(())
+}
+
+impl FastlyToolEvidence {
+    /// Supplies fictional typed observations for pure projection tests.
+    #[cfg(test)]
+    pub(crate) fn projection_fixture() -> Self {
+        let mut fixture = validation_tests::fixture();
+        fixture.plan_sha256 = "b".repeat(64);
+        fixture
+    }
+
+    /// Borrows measured raw file roles, including the configured assembler.
+    pub(crate) fn measured_files(&self) -> impl Iterator<Item = (&str, &str)> {
+        self.measurement
+            .files
+            .iter()
+            .map(|(role, file)| (role.as_str(), file.sha256.as_str()))
+    }
+    /// Requires the completed build boundary and exact plan.
+    ///
+    /// # Errors
+    ///
+    /// Rejects another owner or malformed selected-file measurement.
+    pub(crate) fn verify_binding(
+        &self,
+        boundary: &[u8; 32],
+        plan: &str,
+    ) -> Result<(), Report<ReleaseError>> {
+        if self.build_boundary_fingerprint != hex::encode(boundary)
+            || self.plan_sha256 != plan
+            || !lower_hex(&self.measurement_boundary_fingerprint, 64)
+            || self.measurement_boundary_fingerprint == self.build_boundary_fingerprint
+            || self.full_closure_measured
+            || self.acquisition != "unqualified_candidate_measurement"
+        {
+            return Err(recipe_error("Fastly tools differ from completed owner"));
+        }
+        validate(&self.measurement, &self.measurement.rust_root)
+    }
+    /// Captures selected files using the sibling sandbox and its denial proof.
+    ///
+    /// # Errors
+    ///
+    /// Rejects another boundary, plan, helper or malformed measurement.
+    pub(super) fn measure(
+        tools: &SelectedRustTools,
+        plan: &CargoPlan,
+        build: &[u8; 32],
+        sandbox: &MeasurementSandbox,
+    ) -> Result<Self, Report<ReleaseError>> {
+        if sandbox.boundary.derived_from() != Some(*build)
+            || !sandbox.boundary.has_owned_descendant_cleanup()
+        {
+            return Err(recipe_error(
+                "Fastly tools require derived Docker measurement boundary",
+            ));
+        }
+        let path = plan
+            .environment
+            .get("PATH")
+            .ok_or_else(|| recipe_error("missing Fastly PATH"))?;
+        let root = tool_root(path)?;
+        if root != sandbox.boundary.execution_path(tools.root())? {
+            return Err(recipe_error("Fastly PATH root differs from bound tools"));
+        }
+        for (name, expected) in environment() {
+            if plan.environment.get(&name) != Some(&expected) {
+                return Err(recipe_error("Fastly host tools differ from profile"));
+            }
+        }
+        for pair in linker_arguments(
+            root.to_str()
+                .ok_or_else(|| recipe_error("non-UTF8 tool root"))?,
+        )
+        .as_chunks::<2>()
+        .0
+        {
+            if !plan.arguments.windows(2).any(|window| window == pair) {
+                return Err(recipe_error("Fastly linker differs from profile"));
+            }
+        }
+        let helper = tools.root().join("probe");
+        let before = hash_bounded_with_check(&helper, 512 * 1024 * 1024, &|| Ok(()))
+            .map_err(|error| error.change_context(ReleaseError::Recipe))?;
+        let mut command = ConfinedCommand::new(&helper, &plan.working_directory, limits())?
+            .arguments([OsString::from("gnu-image-measurement")])
+            .environment(MODE, PROFILE)?;
+        for name in ["HOME", "TMPDIR", "LC_ALL", "PATH"] {
+            command = command.environment(
+                name,
+                plan.environment
+                    .get(name)
+                    .ok_or_else(|| recipe_error("incomplete Fastly measurement environment"))?,
+            )?;
+        }
+        let raw = sandbox
+            .boundary
+            .run_confined(&command, &sandbox.proof)?
+            .require_success()?;
+        let measurement: Measurement = serde_json::from_value(
+            parse_json(&raw, Role::Metadata)
+                .map_err(|error| error.change_context(ReleaseError::Recipe))?,
+        )
+        .map_err(|error| recipe_error(error.to_string()))?;
+        validate(&measurement, &root)?;
+        let after = hash_bounded_with_check(&helper, 512 * 1024 * 1024, &|| Ok(()))
+            .map_err(|error| error.change_context(ReleaseError::Recipe))?;
+        if before.sha256 != after.sha256 {
+            return Err(recipe_error(
+                "Fastly staged helper changed during measurement",
+            ));
+        }
+        Ok(Self {
+            measurement,
+            helper_sha256: before.sha256,
+            build_boundary_fingerprint: hex::encode(build),
+            measurement_boundary_fingerprint: hex::encode(sandbox.boundary.execution_fingerprint()),
+            plan_sha256: plan.digest()?,
+            identity_scope: "selected_and_configured_files_in_read_only_image",
+            acquisition: "unqualified_candidate_measurement",
+            full_closure_measured: false,
+        })
+    }
+    /// Requires stable selected files, helper, profile, boundaries and plan.
+    ///
+    /// # Errors
+    ///
+    /// Rejects any changed before/after receipt field.
+    pub(super) fn verify_after(&self, after: &Self) -> Result<(), Report<ReleaseError>> {
+        if serde_json::to_vec(self).map_err(|error| recipe_error(error.to_string()))?
+            != serde_json::to_vec(after).map_err(|error| recipe_error(error.to_string()))?
+        {
+            return Err(recipe_error("Fastly tools changed around execution"));
+        }
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn fastly_host_tools_are_explicit_and_target_linker_is_bound() {
+        assert_eq!(
+            environment()["HOST_CC"],
+            "/usr/bin/cc",
+            "should select host driver"
+        );
+        assert_eq!(
+            environment()["HOST_AR"],
+            "/usr/bin/ar",
+            "should select host archiver"
+        );
+        let arguments = linker_arguments("/boundary/tool/0");
+        assert!(
+            arguments.as_chunks::<2>().0.iter().any(|pair| pair
+                == &[
+                    "--config".to_owned(),
+                    "target.\"x86_64-unknown-linux-gnu\".linker=\"/usr/bin/cc\"".to_owned()
+                ]),
+            "should select the explicit host Rust linker driver"
+        );
+        assert!(arguments.iter().any(|argument| argument.contains("wasm32-wasip1\".linker=\"/boundary/tool/0/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld")), "should bind target linker to measured Rust root");
+    }
+
+    #[test]
+    fn fastly_tool_root_rejects_ambient_and_extra_path_entries() {
+        assert!(
+            tool_root("/usr/bin:/bin").is_err(),
+            "should reject ambient tools"
+        );
+        assert!(
+            tool_root("/boundary/tool/0/bin:/usr/bin:/bin:/tmp").is_err(),
+            "should reject extra roots"
+        );
+        assert_eq!(
+            tool_root("/boundary/tool/0/bin:/usr/bin:/bin").expect("should accept bound root"),
+            std::path::PathBuf::from("/boundary/tool/0"),
+            "should derive root from exact plan PATH"
+        );
+    }
+}
+
+#[cfg(test)]
+mod validation_tests {
+    use super::*;
+
+    pub(super) fn fixture() -> FastlyToolEvidence {
+        let root = PathBuf::from("/boundary/tool/0");
+        let mut files = BTreeMap::new();
+        for (role, selected) in [
+            ("host_compiler", PathBuf::from("/usr/bin/cc")),
+            ("host_archiver", PathBuf::from("/usr/bin/ar")),
+            ("configured_host_assembler", PathBuf::from("/usr/bin/as")),
+            (
+                "wasm_rust_linker",
+                root.join(format!("lib/rustlib/{HOST}/bin/rust-lld")),
+            ),
+        ] {
+            files.insert(
+                role.to_owned(),
+                FileIdentity {
+                    resolved: selected.clone(),
+                    selected,
+                    sha256: "a".repeat(64),
+                    size: 12,
+                },
+            );
+        }
+        FastlyToolEvidence {
+            measurement: Measurement {
+                profile: PROFILE.to_owned(),
+                rust_root: root,
+                rust_host: HOST.to_owned(),
+                assembler_query: "as\n".to_owned(),
+                files,
+            },
+            helper_sha256: "b".repeat(64),
+            build_boundary_fingerprint: hex::encode([1; 32]),
+            measurement_boundary_fingerprint: hex::encode([2; 32]),
+            plan_sha256: "c".repeat(64),
+            identity_scope: "selected_and_configured_files_in_read_only_image",
+            acquisition: "unqualified_candidate_measurement",
+            full_closure_measured: false,
+        }
+    }
+
+    #[test]
+    fn fastly_measurement_rejects_wrong_roles_hosts_roots_and_query_claims() {
+        let valid = fixture();
+        let root = valid.measurement.rust_root.clone();
+        assert!(
+            validate(&valid.measurement, &root).is_ok(),
+            "should accept fixed selected-file scope"
+        );
+        let mut changed = fixture();
+        changed.measurement.rust_host = "example-host".to_owned();
+        assert!(
+            validate(&changed.measurement, &root).is_err(),
+            "should reject other Rust host"
+        );
+        let mut changed = fixture();
+        changed
+            .measurement
+            .files
+            .remove("configured_host_assembler");
+        assert!(
+            validate(&changed.measurement, &root).is_err(),
+            "should reject missing role"
+        );
+        let mut changed = fixture();
+        changed
+            .measurement
+            .files
+            .get_mut("wasm_rust_linker")
+            .expect("should have linker")
+            .resolved = PathBuf::from("/usr/bin/ld");
+        assert!(
+            validate(&changed.measurement, &root).is_err(),
+            "should reject escaped Rust linker"
+        );
+        let mut changed = fixture();
+        changed.measurement.assembler_query = "/usr/bin/other-as\n".to_owned();
+        assert!(
+            validate(&changed.measurement, &root).is_err(),
+            "should reject query mismatch"
+        );
+        let mut changed = fixture();
+        changed
+            .measurement
+            .files
+            .get_mut("host_compiler")
+            .expect("should have compiler")
+            .sha256 = "z".repeat(64);
+        assert!(
+            validate(&changed.measurement, &root).is_err(),
+            "should reject malformed digest"
+        );
+    }
+
+    #[test]
+    fn fastly_measurement_rejects_raw_path_aliases() {
+        for path in [
+            "/boundary/tool/0/../1/bin:/usr/bin:/bin",
+            "/boundary/tool/./0/bin:/usr/bin:/bin",
+            "/boundary//tool/0/bin:/usr/bin:/bin",
+        ] {
+            assert!(
+                tool_root(path).is_err(),
+                "should reject noncanonical tool root {path}"
+            );
+        }
+    }
+
+    #[test]
+    fn fastly_assembler_query_rejects_malformed_and_relative_results() {
+        for output in [
+            "",
+            "as",
+            "as\nas\n",
+            "as\r\n",
+            "../as\n",
+            "relative/as\n",
+            "/usr/bin/as\0\n",
+        ] {
+            assert!(
+                assembler_path(output, "/boundary/tool/0/bin:/usr/bin:/bin").is_err(),
+                "should reject malformed compiler query {output:?}"
+            );
+        }
+        assert_eq!(
+            assembler_path("/usr/bin/as\n", "/boundary/tool/0/bin:/usr/bin:/bin")
+                .expect("should parse one absolute assembler path"),
+            PathBuf::from("/usr/bin/as"),
+            "should preserve the path for subsequent independent hashing"
+        );
+    }
+
+    #[test]
+    fn fastly_receipt_rejects_another_owner_and_changed_measurement() {
+        let before = fixture();
+        assert!(
+            before.verify_binding(&[1; 32], &"c".repeat(64)).is_ok(),
+            "should accept exact owner"
+        );
+        assert!(
+            before.verify_binding(&[3; 32], &"c".repeat(64)).is_err(),
+            "should reject another build boundary"
+        );
+        assert!(
+            before.verify_binding(&[1; 32], &"d".repeat(64)).is_err(),
+            "should reject another plan"
+        );
+        assert!(
+            before.verify_after(&fixture()).is_ok(),
+            "should accept stable before and after"
+        );
+        let mut after = fixture();
+        after
+            .measurement
+            .files
+            .get_mut("host_compiler")
+            .expect("should have compiler")
+            .sha256 = "e".repeat(64);
+        assert!(
+            before.verify_after(&after).is_err(),
+            "should reject changed tool bytes"
+        );
+        let mut after = fixture();
+        after.helper_sha256 = "e".repeat(64);
+        assert!(
+            before.verify_after(&after).is_err(),
+            "should reject changed helper bytes"
+        );
+        let mut after = fixture();
+        after.measurement_boundary_fingerprint = after.build_boundary_fingerprint.clone();
+        assert!(
+            after.verify_binding(&[1; 32], &"c".repeat(64)).is_err(),
+            "should require distinct measurement boundary"
+        );
+    }
+}
+
+#[cfg(test)]
+mod file_tests {
+    use std::os::unix::fs::symlink;
+
+    use sha2::{Digest as _, Sha256};
+
+    use super::*;
+
+    #[test]
+    fn fastly_file_identity_hashes_bytes_and_rejects_escape_and_nonregular_files() {
+        let directory = tempfile::tempdir().expect("should allocate fictional tool root");
+        let root = fs::canonicalize(directory.path()).expect("should resolve tool root");
+        let selected = root.join("rust-lld");
+        fs::write(&selected, b"fictional linker before").expect("should write selected file");
+        let before = file_identity(&selected, Some(&root)).expect("should measure selected file");
+        assert_eq!(
+            before.sha256,
+            hex::encode(Sha256::digest(b"fictional linker before")),
+            "should independently hash selected bytes"
+        );
+        assert_eq!(before.size, 23, "should measure raw byte length");
+        fs::write(&selected, b"fictional linker after").expect("should change selected bytes");
+        let after = file_identity(&selected, Some(&root)).expect("should measure changed file");
+        assert_ne!(before.sha256, after.sha256, "should bind changed raw bytes");
+        assert!(
+            file_identity(&root, Some(&root)).is_err(),
+            "should reject directory as selected file"
+        );
+        let outside = tempfile::tempdir().expect("should allocate fictional outside root");
+        let outside_file = outside.path().join("other-linker");
+        fs::write(&outside_file, b"fictional outside file").expect("should write outside file");
+        let alias = root.join("escaping-alias");
+        symlink(&outside_file, &alias).expect("should create fixture alias");
+        assert!(
+            file_identity(&alias, Some(&root)).is_err(),
+            "should reject alias escaping selected Rust root"
+        );
+    }
+}
diff --git a/crates/trusted-server-release/src/recipe/final_paths.rs b/crates/trusted-server-release/src/recipe/final_paths.rs
new file mode 100644
index 0000000000..f90bcefd70
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/final_paths.rs
@@ -0,0 +1,72 @@
+//! Final-byte path checks derived from the bound recipe rather than callers.
+
+use std::path::Path;
+
+use error_stack::Report;
+
+use super::paths::execution_text;
+use super::remap::scan_remapped_bytes;
+use super::{ExecutionPaths, PreparedRecipe, recipe_error};
+use crate::error::ReleaseError;
+
+/// Requires a bound host root to be strict absolute UTF-8 text.
+fn host_text(path: &Path) -> Result<String, Report<ReleaseError>> {
+    path.to_str()
+        .filter(|text| path.is_absolute() && !text.chars().any(char::is_control))
+        .map(str::to_owned)
+        .ok_or_else(|| recipe_error("a final-path root is not plain absolute UTF-8"))
+}
+
+impl PreparedRecipe {
+    /// Rejects every host and execution root and requires a fixed remapped prefix.
+    ///
+    /// The six mounted roots contribute both names. Output is host-only and
+    /// never translated because the build cannot access it. Whole material and
+    /// Cargo-state roots include vendor files, HOME, TMPDIR and Cargo home. A
+    /// Darwin build's Apple developer directory and detached SDK contribute
+    /// both names too.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for invalid root text, failed translation, a remaining
+    /// root or `/boundary/` prefix, or no fixed remapped prefix in the bytes.
+    pub(super) fn check_final_paths(
+        &self,
+        bytes: &[u8],
+        paths: &dyn ExecutionPaths,
+    ) -> Result<(), Report<ReleaseError>> {
+        let roots = [
+            self.ambient.checkout_root(),
+            self.retained_root.as_path(),
+            self.request.materials.as_path(),
+            self.tools.root(),
+            self.request.cargo_state.as_path(),
+            self.request.target_dir.as_path(),
+        ];
+        // Six host roots, six execution roots, the host output and a Darwin
+        // build's developer directory and detached SDK under both names stay
+        // below the existing scanner's fixed limit of sixty-four prefixes.
+        let mut forbidden = Vec::with_capacity(17);
+        for root in roots {
+            forbidden.push(host_text(root)?);
+            forbidden.push(execution_text(paths, "final-path root", root)?);
+        }
+        forbidden.push(host_text(&self.request.output)?);
+        if let Some(apple) = self.tools.apple() {
+            let developer = apple.developer_dir();
+            forbidden.push(host_text(developer)?);
+            forbidden.push(execution_text(
+                paths,
+                "Apple developer directory",
+                developer,
+            )?);
+            if let Some(sdk) = apple.owned_sdk_root() {
+                forbidden.push(host_text(sdk)?);
+                forbidden.push(execution_text(paths, "owned Apple SDK", sdk)?);
+            }
+        }
+        let forbidden: Vec<&str> = forbidden.iter().map(String::as_str).collect();
+        scan_remapped_bytes(bytes, &forbidden)?;
+        Ok(())
+    }
+}
diff --git a/crates/trusted-server-release/src/recipe/fresh.rs b/crates/trusted-server-release/src/recipe/fresh.rs
new file mode 100644
index 0000000000..ccab97af43
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/fresh.rs
@@ -0,0 +1,131 @@
+//! Lexical and on-disk checks for recipe request roots.
+
+use std::fs;
+use std::io;
+use std::path::Path;
+
+use error_stack::Report;
+
+use super::recipe_error;
+use crate::error::ReleaseError;
+
+/// Requires an absolute UTF-8 path that is already in normal form.
+///
+/// `Path::components` silently drops `.` and doubled or trailing separators,
+/// so the text is compared with its rebuilt components instead.
+pub(super) fn normal_absolute(label: &str, path: &Path) -> Result<(), Report<ReleaseError>> {
+    let normal = path.is_absolute()
+        && path.to_str().is_some()
+        && path
+            .components()
+            .collect::<std::path::PathBuf>()
+            .as_os_str()
+            == path.as_os_str()
+        && !path
+            .components()
+            .any(|component| matches!(component, std::path::Component::ParentDir));
+    if normal {
+        return Ok(());
+    }
+    Err(recipe_error(format!(
+        "{label} must be an absolute normal path without dot segments"
+    )))
+}
+
+/// Requires `path` to resolve to itself, so no ancestor or leaf is a symlink.
+fn unaliased(label: &str, path: &Path) -> Result<(), Report<ReleaseError>> {
+    match fs::canonicalize(path) {
+        Ok(resolved) if resolved == path => Ok(()),
+        Ok(_) => Err(recipe_error(format!(
+            "{label} is a symlink or traverses one"
+        ))),
+        Err(error) => Err(recipe_error(format!("{label} cannot be resolved: {error}"))),
+    }
+}
+
+/// Requires an existing real directory that is not an alias.
+pub(super) fn real_directory(label: &str, path: &Path) -> Result<(), Report<ReleaseError>> {
+    unaliased(label, path)?;
+    let metadata = fs::symlink_metadata(path)
+        .map_err(|error| recipe_error(format!("{label} cannot be inspected: {error}")))?;
+    if !metadata.is_dir() {
+        return Err(recipe_error(format!("{label} must be a directory")));
+    }
+    Ok(())
+}
+
+/// Requires an existing real regular file that is not an alias.
+pub(super) fn real_file(label: &str, path: &Path) -> Result<(), Report<ReleaseError>> {
+    unaliased(label, path)?;
+    let metadata = fs::symlink_metadata(path)
+        .map_err(|error| recipe_error(format!("{label} cannot be inspected: {error}")))?;
+    if !metadata.is_file() {
+        return Err(recipe_error(format!("{label} must be a regular file")));
+    }
+    Ok(())
+}
+
+/// Requires a fresh root: a real directory with no entries.
+pub(super) fn empty_directory(label: &str, path: &Path) -> Result<(), Report<ReleaseError>> {
+    real_directory(label, path)?;
+    let mut entries = fs::read_dir(path)
+        .map_err(|error| recipe_error(format!("{label} cannot be listed: {error}")))?;
+    if entries.next().is_some() {
+        return Err(recipe_error(format!(
+            "{label} already has entries and cannot be reused"
+        )));
+    }
+    Ok(())
+}
+
+/// Requires a path that does not exist yet inside a real parent directory.
+pub(super) fn absent_in_real_parent(label: &str, path: &Path) -> Result<(), Report<ReleaseError>> {
+    match fs::symlink_metadata(path) {
+        Ok(_) => {
+            return Err(recipe_error(format!(
+                "{label} already exists and cannot be reused"
+            )));
+        }
+        Err(error) if error.kind() == io::ErrorKind::NotFound => {}
+        Err(error) => {
+            return Err(recipe_error(format!(
+                "{label} cannot be inspected: {error}"
+            )));
+        }
+    }
+    let parent = path
+        .parent()
+        .ok_or_else(|| recipe_error(format!("{label} has no parent directory")))?;
+    real_directory(label, parent)
+}
+
+/// Rejects any two labelled paths where one contains or equals the other.
+pub(super) fn disjoint(paths: &[(&str, &Path)]) -> Result<(), Report<ReleaseError>> {
+    for (index, (first_label, first)) in paths.iter().enumerate() {
+        for (second_label, second) in paths.iter().skip(index + 1) {
+            if first.starts_with(second) || second.starts_with(first) {
+                return Err(recipe_error(format!(
+                    "{first_label} and {second_label} overlap"
+                )));
+            }
+        }
+    }
+    Ok(())
+}
+
+/// Requires the prepared materials root: a real directory holding exactly the
+/// `vendor` directory, which is itself a real directory.
+pub(super) fn prepared_materials(label: &str, path: &Path) -> Result<(), Report<ReleaseError>> {
+    real_directory(label, path)?;
+    let names = fs::read_dir(path)
+        .map_err(|error| recipe_error(format!("{label} cannot be listed: {error}")))?
+        .map(|entry| entry.map(|entry| entry.file_name()))
+        .collect::<Result<Vec<_>, _>>()
+        .map_err(|error| recipe_error(format!("{label} cannot be listed: {error}")))?;
+    if names != [std::ffi::OsString::from("vendor")] {
+        return Err(recipe_error(format!(
+            "{label} must hold exactly the prepared vendor directory"
+        )));
+    }
+    real_directory("vendor directory", &path.join("vendor"))
+}
diff --git a/crates/trusted-server-release/src/recipe/gnu.rs b/crates/trusted-server-release/src/recipe/gnu.rs
new file mode 100644
index 0000000000..79df270d62
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/gnu.rs
@@ -0,0 +1,612 @@
+//! Fixed GNU candidate profile; image identity supplies no release authority.
+
+use std::collections::BTreeMap;
+use std::ffi::OsString;
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::time::Duration;
+
+use error_stack::Report;
+use serde::{Deserialize, Serialize};
+use sha2::{Digest as _, Sha256};
+
+use super::{CargoPlan, SelectedRustTools, recipe_error};
+use crate::boundary::{Boundary, ConfinedCommand, DenialProof, ProbeProgram};
+use crate::documents::{Role, canonical_json, hash_bounded_with_check, lower_hex, parse_json};
+use crate::error::ReleaseError;
+use crate::process::{BoundedCommand, ProcessLimits};
+use image::{image_path, installed_snapshot};
+
+mod image;
+#[cfg(test)]
+mod tests;
+
+/// Explicit host and target C tools and fail-closed AWS-LC backend selection.
+pub(super) fn environment() -> BTreeMap<String, String> {
+    [
+        ("CC_x86_64_unknown_linux_gnu", "/usr/bin/gcc"),
+        ("AR_x86_64_unknown_linux_gnu", "/usr/bin/ar"),
+        ("HOST_CC", "/usr/bin/gcc"),
+        ("HOST_AR", "/usr/bin/ar"),
+        ("AWS_LC_SYS_CMAKE_BUILDER", "0"),
+        ("AWS_LC_SYS_CMAKE_BUILDER_x86_64_unknown_linux_gnu", "0"),
+    ]
+    .into_iter()
+    .map(|(name, value)| (name.to_owned(), value.to_owned()))
+    .collect()
+}
+
+/// Explicit Rust linker driver selected inside the image namespace.
+///
+/// Rust may ask this driver to use rust-lld from the measured Rust tree.
+/// Configured GCC leaf-linker candidates are not execution observations.
+pub(super) fn linker_arguments() -> Vec<String> {
+    vec![
+        "--config".to_owned(),
+        "target.\"x86_64-unknown-linux-gnu\".linker=\"/usr/bin/gcc\"".to_owned(),
+    ]
+}
+
+const PROFILE: &str = "gnu-cc-installed-image-v1";
+const HELPER_ARGUMENT: &str = "gnu-image-measurement";
+const MEASUREMENT_LIMIT: u64 = 64 * 1024;
+const FIXED_SELECTED_FILES: [(&str, &str); 4] = [
+    ("compiler", "/usr/bin/gcc"),
+    ("archiver", "/usr/bin/ar"),
+    ("gcc_linker_candidate", "/usr/bin/ld"),
+    ("gcc_assembler_candidate", "/usr/bin/as"),
+];
+const SELECTED_ROLES: [&str; 9] = [
+    "compiler",
+    "archiver",
+    "gcc_linker_candidate",
+    "gcc_assembler_candidate",
+    "configured_cc1",
+    "configured_collect2",
+    "configured_as",
+    "configured_ld",
+    "compiler_runtime",
+];
+const COMPILER_QUERIES: [&str; 8] = [
+    "-print-prog-name=cc1",
+    "-print-prog-name=collect2",
+    "-print-prog-name=as",
+    "-print-prog-name=ld",
+    "-print-libgcc-file-name",
+    "-print-file-name=include",
+    "-print-sysroot",
+    "-print-search-dirs",
+];
+
+/// Selected/configured installed-file facts, never a claim of executed helpers.
+#[derive(Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Measurement {
+    profile: String,
+    installed_files_sha256: String,
+    /// Image files recorded by metadata only because the helper cannot read them.
+    content_unmeasured_files: Vec<String>,
+    roots: Vec<String>,
+    selected_files: BTreeMap<String, SelectedFile>,
+    compiler_queries: BTreeMap<String, String>,
+    sysroot: String,
+}
+
+#[derive(Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct SelectedFile {
+    selected: PathBuf,
+    resolved: PathBuf,
+    sha256: String,
+    size: u64,
+}
+
+/// Candidate GNU receipt retained inside the owning composition receipt.
+///
+/// Installed bytes and configured helper paths do not authenticate acquisition
+/// or prove that every installed helper executed.
+#[derive(Debug, Serialize)]
+pub(crate) struct GnuEvidence {
+    measurement: Measurement,
+    profile_sha256: String,
+    helper_sha256: String,
+    /// The boundary that ran the Cargo build this receipt belongs to.
+    build_boundary_fingerprint: String,
+    /// The sibling sandbox, derived from the build boundary without its target
+    /// root, that ran both measurements.
+    measurement_boundary_fingerprint: String,
+    plan_sha256: String,
+    identity_scope: &'static str,
+    acquisition: &'static str,
+    full_closure_measured: bool,
+}
+
+fn limits() -> ProcessLimits {
+    ProcessLimits {
+        wall: Duration::from_secs(180),
+        stdout_max: MEASUREMENT_LIMIT,
+        stderr_max: MEASUREMENT_LIMIT,
+    }
+}
+
+/// Limits of the measurement sandbox's denial probe.
+fn probe_limits() -> ProcessLimits {
+    ProcessLimits {
+        wall: Duration::from_secs(60),
+        stdout_max: 4096,
+        stderr_max: 4096,
+    }
+}
+
+/// Selects the staged tool-root release helper as the denial probe.
+#[cfg(test)]
+fn measurement_probe(tools: &SelectedRustTools) -> Result<ProbeProgram, Report<ReleaseError>> {
+    ProbeProgram::from_staged_release_binary(&tools.root().join("probe"))
+}
+
+/// No production selection runs a candidate build, so none selects a probe.
+#[cfg(not(test))]
+fn measurement_probe(_tools: &SelectedRustTools) -> Result<ProbeProgram, Report<ReleaseError>> {
+    Err(Report::new(ReleaseError::Unqualified)
+        .attach("GNU measurement sandbox has no qualified denial probe"))
+}
+
+/// The sandbox that runs both GNU measurements, separate from the build.
+///
+/// It is a sibling of the build boundary without the recipe target root:
+/// after the build that root legitimately holds Cargo's in-root hard links,
+/// which the unchanged pre-run single-link scan rejects. Both measurements
+/// run in this one instance, so their receipts stay byte-identical, and the
+/// sandbox carries its own denial proof.
+pub(super) struct MeasurementSandbox {
+    pub(super) boundary: Boundary,
+    pub(super) proof: DenialProof,
+}
+
+impl MeasurementSandbox {
+    /// Derives the sibling of `build` without `target_dir` and proves denial
+    /// in it with the staged tool-root probe.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when the sibling cannot be derived (see
+    /// [`Boundary::sibling_without_writable`]), no probe is selectable, or
+    /// denial is not established.
+    pub(super) fn establish(
+        build: &Boundary,
+        tools: &SelectedRustTools,
+        target_dir: &Path,
+    ) -> Result<Self, Report<ReleaseError>> {
+        let boundary = build.sibling_without_writable(target_dir)?;
+        let probe = measurement_probe(tools)?;
+        let proof = boundary.establish_denial(&probe, probe_limits())?;
+        Ok(Self { boundary, proof })
+    }
+}
+
+/// Identity of the source-owned GNU selection and installed-root scope.
+fn profile_digest() -> String {
+    let mut digest = Sha256::new();
+    digest.update(PROFILE);
+    for root in image::ROOTS {
+        digest.update([0]);
+        digest.update(root);
+    }
+    for (name, value) in environment() {
+        digest.update([0]);
+        digest.update(name);
+        digest.update([0]);
+        digest.update(value);
+    }
+    for argument in linker_arguments() {
+        digest.update([0]);
+        digest.update(argument);
+    }
+    hex::encode(digest.finalize())
+}
+
+fn file_identity(selected: &Path) -> Result<SelectedFile, Report<ReleaseError>> {
+    file_identity_at(Path::new("/"), selected)
+}
+
+fn file_identity_at(root: &Path, selected: &Path) -> Result<SelectedFile, Report<ReleaseError>> {
+    let root = fs::canonicalize(root).map_err(|error| recipe_error(error.to_string()))?;
+    let relative = selected
+        .strip_prefix("/")
+        .map_err(|error| recipe_error(error.to_string()))?;
+    let actual = fs::canonicalize(root.join(relative))
+        .map_err(|error| recipe_error(format!("cannot resolve selected GNU file: {error}")))?;
+    let resolved = Path::new("/").join(
+        actual
+            .strip_prefix(&root)
+            .map_err(|error| recipe_error(error.to_string()))?,
+    );
+    image_path(&resolved)?;
+    if !fs::metadata(&actual)
+        .map_err(|error| recipe_error(error.to_string()))?
+        .is_file()
+    {
+        return Err(recipe_error("selected GNU tool is not a regular file"));
+    }
+    let (sha256, size) = image::image_file_hash(&actual)?;
+    Ok(SelectedFile {
+        selected: selected.to_owned(),
+        resolved,
+        sha256,
+        size,
+    })
+}
+
+fn compiler_query(argument: &str, working: &Path) -> Result<String, Report<ReleaseError>> {
+    let output = BoundedCommand::new(Path::new("/usr/bin/gcc"), working, limits())?
+        .arguments([OsString::from(argument)])
+        .environment(
+            "PATH",
+            std::env::var_os("PATH")
+                .ok_or_else(|| recipe_error("GNU helper requires the exact recipe PATH"))?,
+        )?
+        .environment("LC_ALL", "C")?
+        .environment("TMPDIR", working)?
+        .run()?
+        .require_success()?;
+    String::from_utf8(output)
+        .map_err(|error| recipe_error(format!("GNU query is not UTF-8: {error}")))
+}
+
+/// Writes the fixed installed-image measurement in the selected Linux namespace.
+///
+/// # Errors
+///
+/// Rejects non-Linux hosts, missing/escaping tools/resources, failed bounded
+/// compiler queries, unsupported sysroots and oversized installed inventories.
+/// This private helper supplies no selection or qualification capability.
+pub(crate) fn helper_measurement() -> Result<Vec<u8>, Report<ReleaseError>> {
+    if std::env::var_os("TRUSTED_SERVER_FASTLY_TOOL_MEASUREMENT").is_some() {
+        return super::fastly_tools::helper_measurement();
+    }
+    if !cfg!(target_os = "linux") {
+        return Err(recipe_error("GNU measurement helper requires Linux"));
+    }
+    let working = std::env::var_os("TMPDIR")
+        .map(PathBuf::from)
+        .ok_or_else(|| recipe_error("GNU helper requires private TMPDIR"))?;
+    if !working.is_absolute() || !working.starts_with("/boundary/writable") {
+        return Err(recipe_error(
+            "GNU helper TMPDIR is outside the private writable mount",
+        ));
+    }
+    let mut selected_files = BTreeMap::new();
+    for (role, path) in FIXED_SELECTED_FILES {
+        selected_files.insert(role.to_owned(), file_identity(Path::new(path))?);
+    }
+    let mut compiler_queries = BTreeMap::new();
+    for name in ["cc1", "collect2", "as", "ld"] {
+        let query = format!("-print-prog-name={name}");
+        let output = compiler_query(&query, &working)?;
+        let text = output
+            .strip_suffix('\n')
+            .ok_or_else(|| recipe_error("GNU helper query has no final newline"))?;
+        let selected = if text == name && matches!(name, "as" | "ld") {
+            let path = std::env::var_os("PATH")
+                .ok_or_else(|| recipe_error("GNU helper requires recipe PATH"))?;
+            std::env::split_paths(&path)
+                .map(|root| root.join(name))
+                .find(|candidate| candidate.is_file())
+                .ok_or_else(|| recipe_error("GNU helper is absent from recipe PATH"))?
+        } else {
+            PathBuf::from(text)
+        };
+        selected_files.insert(format!("configured_{name}"), file_identity(&selected)?);
+        compiler_queries.insert(query, output);
+    }
+    let query = "-print-libgcc-file-name";
+    let output = compiler_query(query, &working)?;
+    selected_files.insert(
+        "compiler_runtime".to_owned(),
+        file_identity(Path::new(output.trim_end_matches('\n')))?,
+    );
+    compiler_queries.insert(query.to_owned(), output);
+    let include = compiler_query("-print-file-name=include", &working)?;
+    let include_path = fs::canonicalize(include.trim_end_matches('\n'))
+        .map_err(|error| recipe_error(error.to_string()))?;
+    image_path(&include_path)?;
+    if !include_path.is_dir() {
+        return Err(recipe_error(
+            "GNU compiler include resource is not a directory",
+        ));
+    }
+    compiler_queries.insert("-print-file-name=include".to_owned(), include);
+    let sysroot = compiler_query("-print-sysroot", &working)?;
+    check_image_sysroot(&sysroot)?;
+    compiler_queries.insert("-print-sysroot".to_owned(), sysroot);
+    compiler_queries.insert(
+        "-print-search-dirs".to_owned(),
+        compiler_query("-print-search-dirs", &working)?,
+    );
+    let installed = installed_snapshot(Path::new("/"))?;
+    let measurement = Measurement {
+        profile: PROFILE.to_owned(),
+        installed_files_sha256: installed.sha256,
+        content_unmeasured_files: installed.content_unmeasured,
+        roots: image::ROOTS.iter().map(|root| (*root).to_owned()).collect(),
+        selected_files,
+        compiler_queries,
+        sysroot: "/".to_owned(),
+    };
+    canonical_json(
+        &serde_json::to_value(measurement).map_err(|error| recipe_error(error.to_string()))?,
+        Role::Metadata,
+    )
+    .map_err(|error| error.change_context(ReleaseError::Recipe))
+}
+
+/// Requires a strictly sorted subset of the reviewed unreadable image paths.
+fn valid_content_unmeasured(files: &[String]) -> bool {
+    files.windows(2).all(|pair| pair[0] < pair[1])
+        && files
+            .iter()
+            .all(|file| image::REVIEWED_UNREADABLE.contains(&file.as_str()))
+}
+
+fn check_image_sysroot(value: &str) -> Result<(), Report<ReleaseError>> {
+    // GCC prints no bytes when no alternate target sysroot was configured.
+    if !matches!(value, "" | "\n" | "/\n") {
+        let observed = value.chars().take(256).collect::<String>();
+        return Err(recipe_error(format!(
+            "GNU profile requires the image-root sysroot; compiler reported {observed:?}"
+        )));
+    }
+    Ok(())
+}
+
+fn validate_measurement(measurement: &Measurement) -> Result<(), Report<ReleaseError>> {
+    if measurement.profile != PROFILE
+        || !lower_hex(&measurement.installed_files_sha256, 64)
+        || !valid_content_unmeasured(&measurement.content_unmeasured_files)
+        || measurement.roots != image::ROOTS
+        || measurement.sysroot != "/"
+        || measurement.selected_files.len() != SELECTED_ROLES.len()
+        || SELECTED_ROLES
+            .iter()
+            .any(|role| !measurement.selected_files.contains_key(*role))
+        || measurement.compiler_queries.len() != COMPILER_QUERIES.len()
+        || COMPILER_QUERIES
+            .iter()
+            .any(|query| !measurement.compiler_queries.contains_key(*query))
+    {
+        return Err(recipe_error(
+            "GNU helper returned an unsupported measurement",
+        ));
+    }
+    for file in measurement.selected_files.values() {
+        if !file.selected.is_absolute() {
+            return Err(recipe_error("GNU query returned a relative file path"));
+        }
+        image_path(&file.resolved)?;
+        if !lower_hex(&file.sha256, 64) {
+            return Err(recipe_error("invalid GNU file identity"));
+        }
+    }
+    check_image_sysroot(&measurement.compiler_queries["-print-sysroot"])?;
+    for (role, path) in FIXED_SELECTED_FILES {
+        if measurement.selected_files[role].selected != Path::new(path) {
+            return Err(recipe_error(
+                "GNU selected driver differs from the fixed profile",
+            ));
+        }
+    }
+    for (role, query, bare_name) in [
+        ("configured_cc1", "-print-prog-name=cc1", None),
+        ("configured_collect2", "-print-prog-name=collect2", None),
+        ("configured_as", "-print-prog-name=as", Some("as")),
+        ("configured_ld", "-print-prog-name=ld", Some("ld")),
+        ("compiler_runtime", "-print-libgcc-file-name", None),
+    ] {
+        let output = measurement.compiler_queries[query]
+            .strip_suffix('\n')
+            .filter(|value| !value.is_empty() && !value.chars().any(char::is_control))
+            .ok_or_else(|| recipe_error("GNU path query lacks one bounded result line"))?;
+        let file = &measurement.selected_files[role];
+        let selected = &file.selected;
+        let matches = if let Some(name) = bare_name.filter(|name| *name == output) {
+            let candidate = &measurement.selected_files[if name == "as" {
+                "gcc_assembler_candidate"
+            } else {
+                "gcc_linker_candidate"
+            }];
+            // The fixed image candidate precedes /bin in the selected PATH.
+            // An alternate spelling must identify the same measured image file.
+            (selected == Path::new(&format!("/usr/bin/{name}"))
+                || selected == Path::new(&format!("/bin/{name}")))
+                && file.resolved == candidate.resolved
+                && file.sha256 == candidate.sha256
+                && file.size == candidate.size
+        } else {
+            Path::new(output).is_absolute() && selected == Path::new(output)
+        };
+        if !matches {
+            return Err(recipe_error(
+                "GNU selected file differs from its compiler query",
+            ));
+        }
+    }
+    Ok(())
+}
+
+impl GnuEvidence {
+    /// Returns whether installed-file measurements lack a complete tool closure.
+    pub(crate) fn tool_closure_unmeasured(&self) -> bool {
+        !self.full_closure_measured
+    }
+    /// Returns whether acquisition is recorded as an unqualified candidate measurement.
+    pub(crate) fn original_acquisition_unverified(&self) -> bool {
+        self.acquisition == "unqualified_candidate_measurement"
+    }
+    /// Supplies fictional typed observations for projection tests only.
+    #[cfg(test)]
+    pub(crate) fn projection_fixture() -> Self {
+        tests::projection_fixture()
+    }
+    /// Supplies an unreviewed fictional file role for fail-closed adapter tests.
+    #[cfg(test)]
+    pub(crate) fn projection_fixture_with_unknown_file_role() -> Self {
+        let mut fixture = Self::projection_fixture();
+        let file = fixture
+            .measurement
+            .selected_files
+            .remove("compiler_runtime")
+            .expect("should have fictional runtime archive");
+        fixture
+            .measurement
+            .selected_files
+            .insert("unreviewed_compiler_resource".to_owned(), file);
+        fixture
+    }
+    /// Returns the conservative installed-image tree identity.
+    pub(crate) fn installed_files_sha256(&self) -> &str {
+        &self.measurement.installed_files_sha256
+    }
+    /// Lists image files covered by metadata only, never by content.
+    pub(crate) fn content_unmeasured_files(&self) -> &[String] {
+        &self.measurement.content_unmeasured_files
+    }
+    /// Borrows selected/configured raw-file identities without private paths.
+    pub(crate) fn measured_files(&self) -> impl Iterator<Item = (&str, &str)> {
+        self.measurement
+            .selected_files
+            .iter()
+            .map(|(role, file)| (role.as_str(), file.sha256.as_str()))
+    }
+    /// Requires this receipt's build boundary and exact plan at completion
+    /// sealing.
+    ///
+    /// `build_boundary` is the boundary that ran the Cargo build. The
+    /// measurement sandbox was required to be derived from that boundary when
+    /// the receipt was measured; here its recorded fingerprint must be a
+    /// distinct well-formed instance fingerprint. This relies on in-process
+    /// construction through [`GnuEvidence::measure`]: a receipt read back from
+    /// serialized data cannot prove that derivation.
+    ///
+    /// # Errors
+    ///
+    /// Rejects another build boundary, invocation or source-owned GNU
+    /// profile, or a malformed measurement sandbox fingerprint.
+    pub(crate) fn verify_binding(
+        &self,
+        build_boundary: &[u8; 32],
+        plan: &str,
+    ) -> Result<(), Report<ReleaseError>> {
+        let build = hex::encode(build_boundary);
+        if self.build_boundary_fingerprint != build
+            || self.plan_sha256 != plan
+            || self.profile_sha256 != profile_digest()
+        {
+            return Err(recipe_error(
+                "GNU receipt differs from the completed boundary or plan",
+            ));
+        }
+        if !lower_hex(&self.measurement_boundary_fingerprint, 64)
+            || self.measurement_boundary_fingerprint == build
+        {
+            return Err(recipe_error(
+                "GNU receipt lacks a separate measurement sandbox fingerprint",
+            ));
+        }
+        Ok(())
+    }
+    /// Measures through the staged helper in the sandbox derived from the
+    /// build boundary `build_boundary`, under that sandbox's denial proof.
+    ///
+    /// # Errors
+    ///
+    /// Rejects a sandbox not derived from `build_boundary`, another boundary
+    /// type, missing helper, changed profile/plan or malformed, unsupported or
+    /// failed in-image measurements.
+    pub(super) fn measure(
+        tools: &SelectedRustTools,
+        plan: &CargoPlan,
+        build_boundary: &[u8; 32],
+        sandbox: &MeasurementSandbox,
+    ) -> Result<Self, Report<ReleaseError>> {
+        let boundary = &sandbox.boundary;
+        if boundary.derived_from() != Some(*build_boundary) {
+            return Err(recipe_error(
+                "GNU measurement sandbox was not derived from the build boundary",
+            ));
+        }
+        if !boundary.has_owned_descendant_cleanup() {
+            return Err(recipe_error(
+                "GNU profile requires the selected Docker boundary",
+            ));
+        }
+        for (name, expected) in environment() {
+            if plan.environment.get(&name) != Some(&expected) {
+                return Err(recipe_error("GNU plan differs from fixed native profile"));
+            }
+        }
+        let linker = linker_arguments();
+        if !plan
+            .arguments
+            .windows(2)
+            .any(|arguments| arguments == linker)
+        {
+            return Err(recipe_error(
+                "GNU plan does not select the reviewed linker driver",
+            ));
+        }
+        let helper = tools.root().join("probe");
+        let helper_hash = hash_bounded_with_check(&helper, 512 * 1024 * 1024, &|| Ok(()))
+            .map_err(|error| error.change_context(ReleaseError::Recipe))?;
+        let mut command = ConfinedCommand::new(&helper, &plan.working_directory, limits())?
+            .arguments([OsString::from(HELPER_ARGUMENT)]);
+        for name in ["HOME", "TMPDIR", "LC_ALL", "PATH"] {
+            command = command.environment(
+                name,
+                plan.environment
+                    .get(name)
+                    .ok_or_else(|| recipe_error("GNU measurement environment is incomplete"))?,
+            )?;
+        }
+        let raw = boundary
+            .run_confined(&command, &sandbox.proof)?
+            .require_success()?;
+        let value = parse_json(&raw, Role::Metadata)
+            .map_err(|error| error.change_context(ReleaseError::Recipe))?;
+        let measurement: Measurement = serde_json::from_value(value)
+            .map_err(|error| recipe_error(format!("invalid GNU measurement: {error}")))?;
+        validate_measurement(&measurement)?;
+        Ok(Self {
+            measurement,
+            profile_sha256: profile_digest(),
+            helper_sha256: helper_hash.sha256,
+            build_boundary_fingerprint: hex::encode(build_boundary),
+            measurement_boundary_fingerprint: hex::encode(boundary.execution_fingerprint()),
+            plan_sha256: plan.digest()?,
+            identity_scope: "selected_and_configured_files_in_read_only_image",
+            acquisition: "unqualified_candidate_measurement",
+            full_closure_measured: false,
+        })
+    }
+
+    /// Requires identical before/after in-image measurements for this invocation.
+    ///
+    /// # Errors
+    ///
+    /// Rejects changed installed bytes, helper, boundary, profile or Cargo plan.
+    pub(super) fn verify_after(&self, after: &Self) -> Result<(), Report<ReleaseError>> {
+        let encode = |value: &Self| {
+            serde_json::to_vec(value).map_err(|error| recipe_error(error.to_string()))
+        };
+        if encode(self)? != encode(after)? {
+            return Err(recipe_error(
+                "GNU image inputs or invocation changed around execution",
+            ));
+        }
+        Ok(())
+    }
+}
+
+/// Hashes a resolved image regular file without following its final alias.
+pub(super) fn hash_image_file(path: &Path) -> Result<(String, u64), Report<ReleaseError>> {
+    image::image_file_hash(path)
+}
diff --git a/crates/trusted-server-release/src/recipe/gnu/image.rs b/crates/trusted-server-release/src/recipe/gnu/image.rs
new file mode 100644
index 0000000000..bb54978f06
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/gnu/image.rs
@@ -0,0 +1,308 @@
+//! Bounded installed-image file identity, separate from owned tool-tree policy.
+
+use std::collections::BTreeMap;
+use std::fs;
+use std::io::Read as _;
+use std::os::unix::fs::{MetadataExt as _, OpenOptionsExt as _, PermissionsExt as _};
+use std::path::{Path, PathBuf};
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256};
+
+use super::super::recipe_error;
+use crate::error::ReleaseError;
+
+/// Image paths conservatively covering installed native tools and platform files.
+///
+/// Alias targets are recorded, never traversed. This is not execution tracing
+/// and does not imply that files outside these trees are unavailable.
+pub(super) const ROOTS: [&str; 10] = [
+    "/usr",
+    "/bin",
+    "/sbin",
+    "/lib",
+    "/lib64",
+    "/etc/alternatives",
+    "/etc/ld.so.conf",
+    "/etc/ld.so.conf.d",
+    "/etc/ld.so.cache",
+    "/etc/gcc",
+];
+const MAX_ENTRIES: usize = 250_000;
+const MAX_FILE: u64 = 512 * 1024 * 1024;
+const MAX_BYTES: u64 = 8 * 1024 * 1024 * 1024;
+/// Reviewed root-only privileged helpers in the ordinary UBI 9 builder image.
+///
+/// Observed in `registry.access.redhat.com/ubi9/ubi:9.6` with gcc, glibc-devel
+/// and git-core: the setgid `utempter`, the PAM `unix_update` and the setuid
+/// `userhelper`. None is a compiler, linker or build helper. Their content is
+/// not hashed; it is bound only through the image identity itself.
+pub(super) const REVIEWED_UNREADABLE: [&str; 3] = [
+    "/usr/libexec/utempter/utempter",
+    "/usr/sbin/unix_update",
+    "/usr/sbin/userhelper",
+];
+
+/// Which unreadable image files may be recorded by metadata only.
+pub(super) struct UnreadablePolicy<'a> {
+    /// Exact absolute image paths, sorted.
+    pub(super) paths: &'a [&'a str],
+    /// The owner every such file must have.
+    pub(super) owner_uid: u32,
+}
+
+/// The production policy: the reviewed paths, owned by root.
+pub(super) const PRODUCTION_UNREADABLE: UnreadablePolicy<'static> = UnreadablePolicy {
+    paths: &REVIEWED_UNREADABLE,
+    owner_uid: 0,
+};
+
+/// The installed-image identity and the files whose content it could not read.
+#[derive(Debug, PartialEq, Eq)]
+pub(super) struct InstalledSnapshot {
+    /// Digest of every recorded name and fact.
+    pub(super) sha256: String,
+    /// Sorted absolute image paths recorded by metadata only, never by content.
+    pub(super) content_unmeasured: Vec<String>,
+}
+
+/// Opens one image file without following a final alias.
+fn open_image_file(path: &Path) -> std::io::Result<fs::File> {
+    fs::OpenOptions::new()
+        .read(true)
+        .custom_flags(libc::O_NOFOLLOW | libc::O_CLOEXEC)
+        .open(path)
+}
+
+/// Hashes one held no-follow regular file from the read-only image namespace.
+///
+/// Unlike host document handling, image hardlinks are permitted. Only the
+/// confined GNU and Fastly helpers use this policy to measure candidate files.
+pub(super) fn image_file_hash(path: &Path) -> Result<(String, u64), Report<ReleaseError>> {
+    let file = open_image_file(path).map_err(|error| {
+        recipe_error(format!(
+            "cannot open image file {}: {error}",
+            path.display()
+        ))
+    })?;
+    hash_open_file(file)
+}
+
+/// Hashes an opened image file, requiring unchanged identity while reading.
+fn hash_open_file(mut file: fs::File) -> Result<(String, u64), Report<ReleaseError>> {
+    let before = file
+        .metadata()
+        .map_err(|error| recipe_error(error.to_string()))?;
+    if !before.is_file() || before.len() > MAX_FILE {
+        return Err(recipe_error("image input is not a bounded regular file"));
+    }
+    let mut digest = Sha256::new();
+    let mut bytes = 0_u64;
+    let mut buffer = [0_u8; 64 * 1024];
+    loop {
+        let length = file
+            .read(&mut buffer)
+            .map_err(|error| recipe_error(error.to_string()))?;
+        if length == 0 {
+            break;
+        }
+        bytes += length as u64;
+        if bytes > MAX_FILE {
+            return Err(recipe_error("image file exceeds byte limit"));
+        }
+        digest.update(&buffer[..length]);
+    }
+    let after = file
+        .metadata()
+        .map_err(|error| recipe_error(error.to_string()))?;
+    let facts = |metadata: &fs::Metadata| {
+        (
+            metadata.dev(),
+            metadata.ino(),
+            metadata.mode(),
+            metadata.len(),
+            metadata.mtime(),
+            metadata.mtime_nsec(),
+            metadata.ctime(),
+            metadata.ctime_nsec(),
+        )
+    };
+    if facts(&before) != facts(&after) || bytes != before.len() {
+        return Err(recipe_error("image file changed during measurement"));
+    }
+    Ok((hex::encode(digest.finalize()), bytes))
+}
+
+/// Requires an absolute normal selected path within the measured image trees.
+pub(super) fn image_path(path: &Path) -> Result<(), Report<ReleaseError>> {
+    let text = path
+        .to_str()
+        .ok_or_else(|| recipe_error("GNU path is not UTF-8"))?;
+    if !path.is_absolute()
+        || text.split('/').any(|part| matches!(part, "." | ".."))
+        || !ROOTS.iter().any(|root| path.starts_with(root))
+    {
+        return Err(recipe_error(
+            "GNU tool or resource escapes measured image paths",
+        ));
+    }
+    Ok(())
+}
+
+/// Measures installed file names, kinds, modes, content and alias targets.
+///
+/// Hard links are acceptable here because the owning Docker boundary supplies
+/// a read-only image filesystem; this function must never authorize host tools.
+/// Missing optional roots are explicit facts. Docker-generated host/network
+/// files and pseudo filesystems are outside the listed scope.
+///
+/// Only the exact reviewed paths in [`PRODUCTION_UNREADABLE`] may be recorded
+/// by mode, owner and size instead of content when the unprivileged helper
+/// cannot open them; they are listed in
+/// [`InstalledSnapshot::content_unmeasured`]. Any other unreadable file, or a
+/// reviewed path with another owner, a group/other write bit or other-read
+/// permission, is rejected. Execute-only files outside that list therefore
+/// fail closed. Selected build tools are hashed separately and never take
+/// this path.
+pub(super) fn installed_snapshot(root: &Path) -> Result<InstalledSnapshot, Report<ReleaseError>> {
+    installed_snapshot_with(root, &PRODUCTION_UNREADABLE)
+}
+
+/// [`installed_snapshot`] with an explicit unreadable-file policy.
+pub(super) fn installed_snapshot_with(
+    root: &Path,
+    unreadable: &UnreadablePolicy<'_>,
+) -> Result<InstalledSnapshot, Report<ReleaseError>> {
+    let mut pending: Vec<PathBuf> = ROOTS.iter().map(|path| root.join(&path[1..])).collect();
+    let mut facts = BTreeMap::new();
+    let mut content_unmeasured = Vec::new();
+    let mut bytes = 0_u64;
+    while let Some(path) = pending.pop() {
+        let name = path
+            .strip_prefix(root)
+            .map_err(|error| recipe_error(error.to_string()))?
+            .to_str()
+            .ok_or_else(|| recipe_error("image path is not UTF-8"))?
+            .to_owned();
+        let metadata = match fs::symlink_metadata(&path) {
+            Ok(metadata) => Some(metadata),
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => None,
+            Err(error) => {
+                return Err(recipe_error(format!(
+                    "cannot inspect image file {name}: {error}"
+                )));
+            }
+        };
+        let fact = if let Some(metadata) = metadata {
+            let mode = metadata.permissions().mode() & 0o7777;
+            if metadata.is_dir() {
+                for entry in fs::read_dir(&path).map_err(|error| recipe_error(error.to_string()))? {
+                    pending.push(
+                        entry
+                            .map_err(|error| recipe_error(error.to_string()))?
+                            .path(),
+                    );
+                    if pending.len() + facts.len() > MAX_ENTRIES {
+                        return Err(recipe_error("GNU image inventory exceeds entry limit"));
+                    }
+                }
+                format!("directory:{mode}")
+            } else if metadata.is_file() {
+                match open_image_file(&path) {
+                    Ok(file) => {
+                        let (sha256, size) = hash_open_file(file)?;
+                        bytes = bytes
+                            .checked_add(size)
+                            .filter(|bytes| *bytes <= MAX_BYTES)
+                            .ok_or_else(|| {
+                                recipe_error("GNU image inventory exceeds byte limit")
+                            })?;
+                        format!("file:{mode}:{size}:{sha256}")
+                    }
+                    Err(error) if error.kind() == std::io::ErrorKind::PermissionDenied => {
+                        let absolute = format!("/{name}");
+                        check_reviewed_unreadable(&absolute, &path, &metadata, unreadable)?;
+                        content_unmeasured.push(absolute);
+                        format!(
+                            "unmeasured-file:{mode}:{}:{}:{}",
+                            metadata.uid(),
+                            metadata.gid(),
+                            metadata.len()
+                        )
+                    }
+                    Err(error) => {
+                        return Err(recipe_error(format!(
+                            "cannot open image file /{name}: {error}"
+                        )));
+                    }
+                }
+            } else if metadata.file_type().is_symlink() {
+                let target =
+                    fs::read_link(&path).map_err(|error| recipe_error(error.to_string()))?;
+                format!(
+                    "alias:{mode}:{}",
+                    target
+                        .to_str()
+                        .ok_or_else(|| recipe_error("image alias is not UTF-8"))?
+                )
+            } else {
+                return Err(recipe_error("GNU image inventory contains a special file"));
+            }
+        } else {
+            "missing".to_owned()
+        };
+        facts.insert(name, fact);
+        if facts.len() > MAX_ENTRIES {
+            return Err(recipe_error("GNU image inventory exceeds entry limit"));
+        }
+    }
+    let mut digest = Sha256::new();
+    digest.update(b"trusted-server-gnu-installed-image-v2\n");
+    for (name, fact) in facts {
+        for value in [name, fact] {
+            digest.update((value.len() as u64).to_be_bytes());
+            digest.update(value.as_bytes());
+        }
+    }
+    content_unmeasured.sort();
+    Ok(InstalledSnapshot {
+        sha256: hex::encode(digest.finalize()),
+        content_unmeasured,
+    })
+}
+
+/// Accepts a permission-denied file only at a reviewed path with expected
+/// ownership and permissions, unchanged since it was first inspected.
+fn check_reviewed_unreadable(
+    absolute: &str,
+    path: &Path,
+    metadata: &fs::Metadata,
+    unreadable: &UnreadablePolicy<'_>,
+) -> Result<(), Report<ReleaseError>> {
+    let mode = metadata.mode();
+    if !unreadable.paths.contains(&absolute)
+        || metadata.uid() != unreadable.owner_uid
+        || mode & 0o022 != 0
+        || mode & 0o004 != 0
+    {
+        return Err(recipe_error(format!(
+            "image file {absolute} cannot be read and is not a reviewed privileged helper"
+        )));
+    }
+    let after = fs::symlink_metadata(path).map_err(|error| recipe_error(error.to_string()))?;
+    let facts = |metadata: &fs::Metadata| {
+        (
+            metadata.mode(),
+            metadata.uid(),
+            metadata.gid(),
+            metadata.len(),
+            metadata.is_file(),
+        )
+    };
+    if facts(metadata) != facts(&after) {
+        return Err(recipe_error(format!(
+            "image file {absolute} changed during measurement"
+        )));
+    }
+    Ok(())
+}
diff --git a/crates/trusted-server-release/src/recipe/gnu/tests.rs b/crates/trusted-server-release/src/recipe/gnu/tests.rs
new file mode 100644
index 0000000000..2e5de92591
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/gnu/tests.rs
@@ -0,0 +1,629 @@
+use std::fs;
+use std::os::unix::fs::{PermissionsExt as _, symlink};
+
+use super::*;
+
+/// Writes an image file with the given permission bits.
+fn image_file(root: &std::path::Path, relative: &str, mode: u32) {
+    let path = root.join(relative);
+    fs::create_dir_all(path.parent().expect("should have a parent"))
+        .expect("should create image directory");
+    fs::write(&path, b"privileged").expect("should write image file");
+    fs::set_permissions(&path, fs::Permissions::from_mode(mode)).expect("should set mode");
+}
+
+/// Reports whether mode bits deny this process; root bypasses them.
+fn mode_bits_apply() -> bool {
+    // SAFETY: `geteuid` has no preconditions.
+    unsafe { libc::geteuid() != 0 }
+}
+
+#[test]
+fn only_reviewed_unreadable_image_files_are_recorded_by_metadata() {
+    if !mode_bits_apply() {
+        return;
+    }
+    let temporary = tempfile::tempdir().expect("should create image fixture");
+    let root = temporary.path();
+    // SAFETY: `geteuid` has no preconditions.
+    let owner_uid = unsafe { libc::geteuid() };
+    let paths = ["/usr/sbin/userhelper"];
+    let policy = image::UnreadablePolicy {
+        paths: &paths,
+        owner_uid,
+    };
+    image_file(root, "usr/sbin/userhelper", 0o111);
+    let first = image::installed_snapshot_with(root, &policy)
+        .expect("should record the reviewed helper by metadata");
+    assert_eq!(
+        first.content_unmeasured,
+        vec!["/usr/sbin/userhelper".to_owned()],
+        "should name the file whose content was not measured"
+    );
+    fs::set_permissions(
+        root.join("usr/sbin/userhelper"),
+        fs::Permissions::from_mode(0o100),
+    )
+    .expect("should change helper mode");
+    assert_ne!(
+        first.sha256,
+        image::installed_snapshot_with(root, &policy)
+            .expect("should remeasure")
+            .sha256,
+        "should bind the unmeasured file's mode"
+    );
+    fs::set_permissions(
+        root.join("usr/sbin/userhelper"),
+        fs::Permissions::from_mode(0o121),
+    )
+    .expect("should add a group write bit");
+    assert!(
+        image::installed_snapshot_with(root, &policy).is_err(),
+        "should reject a group-writable reviewed helper"
+    );
+    fs::set_permissions(
+        root.join("usr/sbin/userhelper"),
+        fs::Permissions::from_mode(0o111),
+    )
+    .expect("should restore helper mode");
+    let other_owner = image::UnreadablePolicy {
+        paths: &paths,
+        owner_uid: owner_uid.wrapping_add(1),
+    };
+    assert!(
+        image::installed_snapshot_with(root, &other_owner).is_err(),
+        "should reject a reviewed path with another owner"
+    );
+    image_file(root, "usr/libexec/gcc/example/lto-wrapper", 0o111);
+    let rejected = image::installed_snapshot_with(root, &policy)
+        .expect_err("should reject an unreviewed execute-only helper");
+    assert!(
+        format!("{rejected:?}").contains("/usr/libexec/gcc/example/lto-wrapper"),
+        "should name the rejected file: {rejected:?}"
+    );
+}
+
+#[test]
+fn production_policy_reviews_only_the_known_root_owned_helpers() {
+    assert_eq!(
+        image::PRODUCTION_UNREADABLE.paths,
+        image::REVIEWED_UNREADABLE.as_slice(),
+        "should use exactly the reviewed paths"
+    );
+    assert_eq!(
+        image::PRODUCTION_UNREADABLE.owner_uid,
+        0,
+        "should require root ownership"
+    );
+    assert!(
+        image::REVIEWED_UNREADABLE
+            .windows(2)
+            .all(|pair| pair[0] < pair[1]),
+        "should keep the reviewed paths sorted"
+    );
+}
+
+#[test]
+fn content_unmeasured_lists_must_be_sorted_reviewed_paths() {
+    assert!(
+        valid_content_unmeasured(&[]),
+        "should accept no unmeasured files"
+    );
+    assert!(
+        valid_content_unmeasured(&[
+            "/usr/libexec/utempter/utempter".to_owned(),
+            "/usr/sbin/unix_update".to_owned(),
+            "/usr/sbin/userhelper".to_owned(),
+        ]),
+        "should accept the sorted reviewed paths"
+    );
+    for files in [
+        vec![
+            "/usr/sbin/userhelper".to_owned(),
+            "/usr/sbin/unix_update".to_owned(),
+        ],
+        vec![
+            "/usr/sbin/userhelper".to_owned(),
+            "/usr/sbin/userhelper".to_owned(),
+        ],
+        vec!["/usr/libexec/gcc/example/lto-wrapper".to_owned()],
+        vec!["/usr//sbin/userhelper".to_owned()],
+    ] {
+        assert!(
+            !valid_content_unmeasured(&files),
+            "should reject unsorted, duplicate or unreviewed lists {files:?}"
+        );
+    }
+}
+
+#[test]
+fn selected_tools_must_be_readable_even_when_executable() {
+    if !mode_bits_apply() {
+        return;
+    }
+    let temporary = tempfile::tempdir().expect("should create image fixture");
+    let root = temporary.path();
+    image_file(root, "usr/bin/gcc", 0o111);
+    assert!(
+        file_identity_at(root, std::path::Path::new("/usr/bin/gcc")).is_err(),
+        "should refuse to select an execute-only compiler without hashing it"
+    );
+}
+
+#[test]
+fn compiler_default_sysroot_can_have_no_output() {
+    for output in ["", "\n", "/\n"] {
+        assert!(
+            check_image_sysroot(output).is_ok(),
+            "should accept GCC's default or explicit image-root sysroot response"
+        );
+    }
+    for output in ["/other\n", "relative\n", " /\n", "/\r\n", "\n\n"] {
+        assert!(
+            check_image_sysroot(output).is_err(),
+            "should reject an unreviewed sysroot response {output:?}"
+        );
+    }
+}
+
+pub(super) fn projection_fixture() -> GnuEvidence {
+    GnuEvidence {
+        measurement: Measurement {
+            profile: PROFILE.to_owned(),
+            installed_files_sha256: "a".repeat(64),
+            content_unmeasured_files: Vec::new(),
+            roots: image::ROOTS.iter().map(|root| (*root).to_owned()).collect(),
+            selected_files: [
+                ("compiler", "/usr/bin/gcc"),
+                ("archiver", "/usr/bin/ar"),
+                ("gcc_linker_candidate", "/usr/bin/ld"),
+                ("gcc_assembler_candidate", "/usr/bin/as"),
+                ("configured_cc1", "/usr/libexec/gcc/example/cc1"),
+                ("configured_collect2", "/usr/libexec/gcc/example/collect2"),
+                ("configured_as", "/usr/bin/as"),
+                ("configured_ld", "/usr/bin/ld"),
+                ("compiler_runtime", "/usr/lib/gcc/example/libgcc.a"),
+            ]
+            .into_iter()
+            .map(|(role, path)| {
+                (
+                    role.to_owned(),
+                    SelectedFile {
+                        selected: path.into(),
+                        resolved: path.into(),
+                        sha256: "c".repeat(64),
+                        size: 128,
+                    },
+                )
+            })
+            .collect(),
+            compiler_queries: BTreeMap::new(),
+            sysroot: "/".to_owned(),
+        },
+        profile_sha256: profile_digest(),
+        helper_sha256: "d".repeat(64),
+        build_boundary_fingerprint: hex::encode([1; 32]),
+        measurement_boundary_fingerprint: hex::encode([3; 32]),
+        plan_sha256: "b".repeat(64),
+        identity_scope: "fictional_projection_fixture",
+        acquisition: "unqualified_candidate_measurement",
+        full_closure_measured: false,
+    }
+}
+
+fn measurement_fixture() -> Measurement {
+    let mut measurement = projection_fixture().measurement;
+    measurement.compiler_queries = [
+        ("-print-prog-name=cc1", "/usr/libexec/gcc/example/cc1\n"),
+        ("-print-prog-name=collect2", "/usr/libexec/gcc/example/collect2\n"),
+        ("-print-prog-name=as", "as\n"),
+        ("-print-prog-name=ld", "ld\n"),
+        ("-print-libgcc-file-name", "/usr/lib/gcc/example/libgcc.a\n"),
+        ("-print-file-name=include", "/usr/lib/gcc/example/include\n"),
+        ("-print-sysroot", ""),
+        ("-print-search-dirs", "install: /usr/lib/gcc/example/\nprograms: =/usr/libexec/gcc/example/\nlibraries: =/usr/lib/gcc/example/\n"),
+    ]
+    .into_iter()
+    .map(|(key, value)| (key.to_owned(), value.to_owned()))
+    .collect();
+    measurement
+}
+
+#[test]
+fn measurement_requires_exact_selected_roles_and_query_keys() {
+    for selected in [true, false] {
+        let mut measurement = measurement_fixture();
+        if selected {
+            let value = measurement
+                .selected_files
+                .remove("compiler")
+                .expect("should have compiler");
+            measurement
+                .selected_files
+                .insert("example_replacement".to_owned(), value);
+        } else {
+            let value = measurement
+                .compiler_queries
+                .remove("-print-sysroot")
+                .expect("should have sysroot query");
+            measurement
+                .compiler_queries
+                .insert("example_replacement".to_owned(), value);
+        }
+        assert!(
+            validate_measurement(&measurement).is_err(),
+            "should reject a missing required identity even when counts match"
+        );
+    }
+}
+
+#[test]
+fn measurement_binds_selected_drivers_and_configured_query_paths() {
+    for role in [
+        "compiler",
+        "archiver",
+        "gcc_linker_candidate",
+        "gcc_assembler_candidate",
+        "configured_cc1",
+        "configured_collect2",
+        "configured_as",
+        "configured_ld",
+        "compiler_runtime",
+    ] {
+        let mut measurement = measurement_fixture();
+        measurement
+            .selected_files
+            .get_mut(role)
+            .expect("should have selected role")
+            .selected = PathBuf::from("/usr/bin/example-replacement");
+        assert!(
+            validate_measurement(&measurement).is_err(),
+            "should join selected {role} to its fixed driver or compiler query"
+        );
+    }
+}
+
+#[test]
+fn measurement_rechecks_the_compiler_sysroot_observation() {
+    let mut measurement = measurement_fixture();
+    measurement.compiler_queries.insert(
+        "-print-sysroot".to_owned(),
+        "/example-other-root\n".to_owned(),
+    );
+    assert!(
+        validate_measurement(&measurement).is_err(),
+        "should reject a query contradicting the recorded image-root sysroot"
+    );
+}
+
+#[test]
+fn measurement_preserves_reviewed_bare_names_and_resolved_aliases() {
+    for sysroot in ["", "\n", "/\n"] {
+        for explicit_paths in [false, true] {
+            let mut measurement = measurement_fixture();
+            measurement
+                .compiler_queries
+                .insert("-print-sysroot".to_owned(), sysroot.to_owned());
+            for name in ["as", "ld"] {
+                let role = format!("configured_{name}");
+                let selected = &mut measurement
+                    .selected_files
+                    .get_mut(&role)
+                    .expect("should have configured helper")
+                    .selected;
+                *selected = PathBuf::from(format!("/bin/{name}"));
+                if explicit_paths {
+                    measurement
+                        .compiler_queries
+                        .insert(format!("-print-prog-name={name}"), format!("/bin/{name}\n"));
+                }
+            }
+            measurement
+                .selected_files
+                .get_mut("compiler")
+                .expect("should have compiler")
+                .resolved = PathBuf::from("/usr/bin/example-gcc");
+            validate_measurement(&measurement)
+                .expect("should accept measured aliases and supported GCC query spellings");
+        }
+    }
+}
+
+#[test]
+fn measurement_rejects_bare_helpers_with_conflicting_image_identities() {
+    for role in ["configured_as", "configured_ld"] {
+        for changed in ["resolved", "sha256", "size"] {
+            let mut measurement = measurement_fixture();
+            let file = measurement
+                .selected_files
+                .get_mut(role)
+                .expect("should have configured helper");
+            match changed {
+                "resolved" => file.resolved = PathBuf::from("/usr/libexec/example-other-tool"),
+                "sha256" => file.sha256 = "d".repeat(64),
+                _ => file.size += 1,
+            }
+            assert!(
+                validate_measurement(&measurement).is_err(),
+                "should join bare {role} to the fixed image tool {changed}"
+            );
+        }
+    }
+}
+
+#[test]
+fn measurement_accepts_an_explicit_alternate_image_helper() {
+    let mut measurement = measurement_fixture();
+    let file = measurement
+        .selected_files
+        .get_mut("configured_as")
+        .expect("should have assembler");
+    file.selected = PathBuf::from("/usr/libexec/example-as");
+    file.resolved = file.selected.clone();
+    file.sha256 = "d".repeat(64);
+    measurement.compiler_queries.insert(
+        "-print-prog-name=as".to_owned(),
+        "/usr/libexec/example-as\n".to_owned(),
+    );
+    validate_measurement(&measurement)
+        .expect("should preserve an explicit measured compiler-selected helper");
+}
+
+#[test]
+fn installed_image_identity_covers_helpers_headers_modes_and_aliases() {
+    let temporary = tempfile::tempdir().expect("should create image fixture");
+    let root = temporary.path();
+    fs::create_dir_all(root.join("usr/lib/gcc")).expect("should create resources");
+    fs::create_dir_all(root.join("usr/include")).expect("should create headers");
+    fs::write(root.join("usr/lib/gcc/cc1"), b"helper").expect("should write helper");
+    fs::write(root.join("usr/include/example.h"), b"header").expect("should write header");
+    symlink("usr/lib", root.join("lib")).expect("should create image alias");
+    let first = installed_snapshot(root).expect("should measure image files");
+    fs::write(root.join("usr/include/example.h"), b"changed").expect("should change header");
+    assert_ne!(
+        first,
+        installed_snapshot(root).expect("should remeasure"),
+        "should bind header bytes"
+    );
+    fs::write(root.join("usr/include/example.h"), b"header").expect("should restore header");
+    fs::write(root.join("usr/lib/gcc/cc1"), b"changed").expect("should change helper");
+    assert_ne!(
+        first,
+        installed_snapshot(root).expect("should remeasure"),
+        "should bind helper bytes"
+    );
+    fs::write(root.join("usr/lib/gcc/cc1"), b"helper").expect("should restore helper");
+    fs::remove_file(root.join("lib")).expect("should remove alias");
+    symlink("usr/include", root.join("lib")).expect("should retarget alias");
+    assert_ne!(
+        first,
+        installed_snapshot(root).expect("should remeasure"),
+        "should bind alias targets"
+    );
+}
+
+#[test]
+fn selected_image_paths_reject_build_roots_and_unmeasured_files() {
+    for path in [
+        "/boundary/writable/0/gcc",
+        "/tmp/cc1",
+        "/opt/cc1",
+        "/usr/../tmp/cc1",
+    ] {
+        assert!(
+            image_path(std::path::Path::new(path)).is_err(),
+            "should reject {path}"
+        );
+    }
+    assert!(
+        image_path(std::path::Path::new("/usr/libexec/gcc/cc1")).is_ok(),
+        "should accept measured compiler resources"
+    );
+}
+
+#[test]
+fn read_only_image_hardlinks_are_measured_and_selected_aliases_resolve_in_scope() {
+    let temporary = tempfile::tempdir().expect("should create image fixture");
+    let root = temporary.path();
+    fs::create_dir_all(root.join("usr/bin")).expect("should create image tools");
+    fs::create_dir_all(root.join("usr/lib")).expect("should create image resources");
+    fs::create_dir_all(root.join("tmp")).expect("should create outside scope");
+    fs::write(root.join("usr/bin/gcc"), b"compiler").expect("should write image compiler");
+    fs::hard_link(root.join("usr/bin/gcc"), root.join("usr/bin/cc"))
+        .expect("should create distro hardlink");
+    let before = installed_snapshot(root).expect("should accept read-only image hardlinks");
+    fs::write(root.join("usr/bin/cc"), b"changed").expect("should update fixture contents");
+    assert_ne!(
+        before,
+        installed_snapshot(root).expect("should remeasure hardlinks"),
+        "should bind hardlinked bytes"
+    );
+    assert!(
+        file_identity_at(root, std::path::Path::new("/usr/lib/../bin/gcc")).is_ok(),
+        "should accept GCC query dot segments resolving inside measured scope"
+    );
+    fs::write(root.join("tmp/helper"), b"foreign").expect("should write foreign helper");
+    symlink("../../tmp/helper", root.join("usr/bin/helper"))
+        .expect("should create escaping helper alias");
+    assert!(
+        file_identity_at(root, std::path::Path::new("/usr/bin/helper")).is_err(),
+        "should reject a resolved helper outside measured image roots"
+    );
+}
+
+#[test]
+fn helper_observations_must_agree_and_match_boundary_and_plan() {
+    let fixture = || GnuEvidence {
+        measurement: Measurement {
+            profile: PROFILE.to_owned(),
+            installed_files_sha256: "a".repeat(64),
+            content_unmeasured_files: Vec::new(),
+            roots: vec![],
+            selected_files: BTreeMap::new(),
+            compiler_queries: BTreeMap::new(),
+            sysroot: "/".to_owned(),
+        },
+        profile_sha256: profile_digest(),
+        helper_sha256: "b".repeat(64),
+        build_boundary_fingerprint: hex::encode([1; 32]),
+        measurement_boundary_fingerprint: hex::encode([3; 32]),
+        plan_sha256: "c".repeat(64),
+        identity_scope: "fixture",
+        acquisition: "unqualified",
+        full_closure_measured: false,
+    };
+    let first = fixture();
+    let mut after = fixture();
+    assert!(
+        first.verify_after(&after).is_ok(),
+        "should accept equal observations"
+    );
+    after.measurement.installed_files_sha256 = "d".repeat(64);
+    assert!(
+        first.verify_after(&after).is_err(),
+        "should reject changed installed inputs"
+    );
+    assert!(
+        first.verify_binding(&[1; 32], &"c".repeat(64)).is_ok(),
+        "should bind the actual completed invocation"
+    );
+    assert!(
+        first.verify_binding(&[2; 32], &"c".repeat(64)).is_err(),
+        "should reject another completed boundary"
+    );
+    assert!(
+        first.verify_binding(&[1; 32], &"d".repeat(64)).is_err(),
+        "should reject another completed plan"
+    );
+    assert!(
+        first.verify_binding(&[3; 32], &"c".repeat(64)).is_err(),
+        "should not accept the measurement sandbox as the build boundary"
+    );
+}
+
+#[test]
+fn binding_requires_a_separate_well_formed_measurement_sandbox() {
+    let mut evidence = GnuEvidence::projection_fixture();
+    let plan = "b".repeat(64);
+    assert_eq!(
+        serde_json::to_value(&evidence).expect("should serialize the receipt")["measurement_boundary_fingerprint"],
+        hex::encode([3; 32]),
+        "should record the measurement sandbox fingerprint"
+    );
+    assert!(
+        evidence.verify_binding(&[1; 32], &plan).is_ok(),
+        "should accept a distinct measurement sandbox"
+    );
+
+    evidence.measurement_boundary_fingerprint = hex::encode([1; 32]);
+    assert!(
+        evidence.verify_binding(&[1; 32], &plan).is_err(),
+        "should reject measurements recorded as the build boundary itself"
+    );
+    evidence.measurement_boundary_fingerprint = "not-a-fingerprint".to_owned();
+    assert!(
+        evidence.verify_binding(&[1; 32], &plan).is_err(),
+        "should reject a malformed measurement sandbox fingerprint"
+    );
+}
+
+/// Ordinary CI tools, a fictional GNU plan and a sandbox with `parent`.
+struct DerivationFixture {
+    _directory: tempfile::TempDir,
+    tools: SelectedRustTools,
+    plan: CargoPlan,
+    sandbox: MeasurementSandbox,
+}
+
+fn derivation_fixture(parent: Option<[u8; 32]>) -> DerivationFixture {
+    let directory = tempfile::tempdir().expect("should create fixture");
+    let base = fs::canonicalize(directory.path()).expect("should canonicalize fixture");
+    let target = crate::policy::ReleaseTarget::X86_64UnknownLinuxGnu;
+    let libraries = base.join(format!("tools/lib/rustlib/{}/lib", target.triple()));
+    fs::create_dir_all(&libraries).expect("should create tool libraries");
+    fs::create_dir_all(base.join("tools/bin")).expect("should create tool binaries");
+    for file in ["tools/bin/cargo", "tools/bin/rustc"] {
+        fs::write(base.join(file), b"fictional").expect("should write tool");
+    }
+    fs::write(libraries.join("libstd-example.rlib"), b"fictional").expect("should write std");
+    for root in ["checkout", "cargo-state"] {
+        fs::create_dir(base.join(root)).expect("should create root");
+    }
+    let roots = crate::boundary::BoundaryRoots::new(
+        &[base.join("checkout")],
+        &[base.join("tools")],
+        &[base.join("cargo-state")],
+    )
+    .expect("should build sandbox roots");
+    let asset = super::super::AssetId::parse(crate::policy::FIXED_ARTIFACTS[0].name)
+        .expect("should select a fixed asset");
+    DerivationFixture {
+        tools: SelectedRustTools::for_tests(&base.join("tools"), target)
+            .expect("should select fictional tools"),
+        plan: CargoPlan {
+            asset,
+            program: base.join("tools/bin/cargo"),
+            arguments: linker_arguments(),
+            environment: environment(),
+            working_directory: base.join("checkout"),
+            umask: crate::boundary::Umask::new(0o022).expect("should accept fixture umask"),
+            apple_identity_sha256: None,
+        },
+        sandbox: MeasurementSandbox {
+            boundary: Boundary::derivation_fixture_for_tests(roots, parent)
+                .expect("should build the derivation fixture"),
+            proof: DenialProof::for_tests(),
+        },
+        _directory: directory,
+    }
+}
+
+#[test]
+fn measurements_require_a_sandbox_derived_from_the_build_boundary() {
+    for parent in [None, Some([9; 32])] {
+        let fixture = derivation_fixture(parent);
+        let error = GnuEvidence::measure(&fixture.tools, &fixture.plan, &[1; 32], &fixture.sandbox)
+            .expect_err("should reject a sandbox from another build");
+        assert!(
+            format!("{error:?}").contains("not derived from the build boundary"),
+            "should name the derivation rule for parent {parent:?}"
+        );
+    }
+
+    let fixture = derivation_fixture(Some([1; 32]));
+    let error = GnuEvidence::measure(&fixture.tools, &fixture.plan, &[1; 32], &fixture.sandbox)
+        .expect_err("should still require a container-owned sandbox");
+    assert!(
+        format!("{error:?}").contains("requires the selected Docker boundary"),
+        "should pass derivation and reach the container gate"
+    );
+}
+
+#[test]
+fn backend_switch_exception_accepts_only_zero() {
+    let root = std::path::Path::new("/example");
+    let limits = crate::process::ProcessLimits {
+        wall: std::time::Duration::from_secs(1),
+        stdout_max: 1024,
+        stderr_max: 1024,
+    };
+    for name in [
+        "AWS_LC_SYS_CMAKE_BUILDER",
+        "AWS_LC_SYS_CMAKE_BUILDER_x86_64_unknown_linux_gnu",
+    ] {
+        assert!(
+            crate::process::BoundedCommand::new(&root.join("tool"), root, limits)
+                .expect("should describe command")
+                .environment(name, "0")
+                .is_ok(),
+            "should accept exact reviewed backend switch"
+        );
+        assert!(
+            crate::process::BoundedCommand::new(&root.join("tool"), root, limits)
+                .expect("should describe command")
+                .environment(name, "1")
+                .is_err(),
+            "should reject alternate backend value"
+        );
+    }
+}
diff --git a/crates/trusted-server-release/src/recipe/identity.rs b/crates/trusted-server-release/src/recipe/identity.rs
new file mode 100644
index 0000000000..641070999f
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/identity.rs
@@ -0,0 +1,147 @@
+//! Shared source-owned recipe definitions, distinct from exact invocations.
+//!
+//! A definition selects the approved source policy. It does not prove that the
+//! policy ran, authenticate the running bootstrap, or qualify tools/boundaries.
+
+use std::path::Path;
+
+use error_stack::Report;
+use serde::Serialize;
+use sha2::{Digest as _, Sha256};
+
+use super::{AssetId, CargoPlan, recipe_error};
+use crate::documents::{Role, canonical_json};
+use crate::error::ReleaseError;
+use crate::source::{ApprovedSource, CommitId};
+
+/// Canonical shared definition selected from approved source and a fixed asset.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+pub(crate) struct RecipeDefinitionIdentity {
+    descriptor: RecipeDefinition,
+    sha256: String,
+}
+
+/// Source-owned recipe policy description, without execution authority.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+pub(crate) struct RecipeDefinition {
+    domain: &'static str,
+    schema_version: u64,
+    source_commit: String,
+    asset: &'static str,
+    package: &'static str,
+    binary: &'static str,
+    target: &'static str,
+    variant: &'static str,
+    cargo: CargoDefinition,
+    profile_definition: ProfileDefinition,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+struct CargoDefinition {
+    command: &'static str,
+    profile: &'static str,
+    default_features: bool,
+    features: Vec<String>,
+    frozen: bool,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+struct ProfileDefinition {
+    path: &'static str,
+    sha256: String,
+}
+
+impl RecipeDefinitionIdentity {
+    /// Selects a common recipe definition without invocation-specific inputs.
+    ///
+    /// # Errors
+    ///
+    /// Rejects missing approved profile bytes or failed canonical serialization.
+    pub(crate) fn from_source(
+        source: &ApprovedSource,
+        asset: AssetId,
+    ) -> Result<Self, Report<ReleaseError>> {
+        let manifests = source.cargo_manifest_digests();
+        let manifest_sha256 = manifests.get(Path::new("Cargo.toml")).ok_or_else(|| {
+            recipe_error("recipe definition requires an approved regular root Cargo.toml")
+        })?;
+        let artifact = asset.artifact();
+        let descriptor = RecipeDefinition {
+            domain: "trusted-server.release.recipe-definition",
+            schema_version: 1,
+            source_commit: source.commit().as_str().to_owned(),
+            asset: artifact.name,
+            package: artifact.package,
+            binary: artifact.bin,
+            target: artifact.target.triple(),
+            variant: "default",
+            // The fixed cohort permits only default features. Profile bytes and
+            // all other implementation/tool policy are bound by approved source.
+            cargo: CargoDefinition {
+                command: "build",
+                profile: "release",
+                default_features: true,
+                features: Vec::new(),
+                frozen: true,
+            },
+            profile_definition: ProfileDefinition {
+                path: "Cargo.toml",
+                sha256: manifest_sha256.clone(),
+            },
+        };
+        let sha256 = hash_definition(&descriptor)?;
+        Ok(Self { descriptor, sha256 })
+    }
+
+    /// The source-owned descriptor whose canonical bytes were hashed.
+    pub(crate) fn descriptor(&self) -> &RecipeDefinition {
+        &self.descriptor
+    }
+
+    /// SHA-256 of the canonical domain-separated definition descriptor.
+    pub(crate) fn sha256(&self) -> &str {
+        &self.sha256
+    }
+
+    /// Checks the source and fixed asset without granting execution authority.
+    pub(super) fn matches_selection(&self, commit: &CommitId, asset: AssetId) -> bool {
+        let artifact = asset.artifact();
+        self.descriptor.source_commit == commit.as_str()
+            && self.descriptor.asset == artifact.name
+            && self.descriptor.package == artifact.package
+            && self.descriptor.binary == artifact.bin
+            && self.descriptor.target == artifact.target.triple()
+    }
+}
+
+/// Digest of the actual Cargo invocation, including paths and ambient choices.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+#[serde(transparent)]
+pub(crate) struct ExactInvocationDigest(String);
+
+impl ExactInvocationDigest {
+    /// Preserves the existing exact [`CargoPlan::digest`] calculation.
+    ///
+    /// # Errors
+    ///
+    /// Rejects plans whose exact digest cannot be serialized.
+    pub(crate) fn from_plan(plan: &CargoPlan) -> Result<Self, Report<ReleaseError>> {
+        plan.digest().map(Self)
+    }
+
+    /// SHA-256 of the exact invocation description.
+    pub(crate) fn sha256(&self) -> &str {
+        &self.0
+    }
+}
+
+fn hash_definition(descriptor: &RecipeDefinition) -> Result<String, Report<ReleaseError>> {
+    let value =
+        serde_json::to_value(descriptor).map_err(|error| recipe_error(error.to_string()))?;
+    let bytes = canonical_json(&value, Role::Metadata)
+        .map_err(|error| error.change_context(ReleaseError::Recipe))?;
+    Ok(hex::encode(Sha256::digest(bytes)))
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/trusted-server-release/src/recipe/identity/tests.rs b/crates/trusted-server-release/src/recipe/identity/tests.rs
new file mode 100644
index 0000000000..cf36f7872b
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/identity/tests.rs
@@ -0,0 +1,182 @@
+use std::collections::BTreeMap;
+use std::path::PathBuf;
+
+use serde_json::json;
+use sha2::Sha256;
+
+use super::*;
+use crate::boundary::Umask;
+use crate::documents::{Role, canonical_json};
+use crate::policy::FIXED_ARTIFACTS;
+use crate::source::CommitId;
+
+fn source(commit: char, manifest: bool) -> ApprovedSource {
+    ApprovedSource::in_memory_for_tests(
+        &CommitId::parse(&commit.to_string().repeat(40))
+            .expect("should parse fictional source commit"),
+        if manifest { &["Cargo.toml"] } else { &[] },
+    )
+}
+
+fn asset(index: usize) -> AssetId {
+    AssetId::parse(FIXED_ARTIFACTS[index].name).expect("should select a fixed cohort asset")
+}
+
+fn plan() -> CargoPlan {
+    CargoPlan {
+        asset: asset(0),
+        program: PathBuf::from("/example/tools/bin/cargo"),
+        arguments: vec![
+            "build".to_owned(),
+            "--release".to_owned(),
+            "--jobs".to_owned(),
+            "1".to_owned(),
+        ],
+        environment: BTreeMap::from([("LANG".to_owned(), "C".to_owned())]),
+        working_directory: PathBuf::from("/example/source-a"),
+        umask: Umask::new(0o022).expect("should accept canonical fixture umask"),
+        apple_identity_sha256: None,
+    }
+}
+
+#[test]
+fn shared_definition_binds_exact_source_owned_asset_and_profile_descriptor() {
+    let approved = source('a', true);
+    let definition = RecipeDefinitionIdentity::from_source(&approved, asset(0))
+        .expect("should select source-owned recipe definition");
+    let value =
+        serde_json::to_value(definition.descriptor()).expect("should serialize typed definition");
+    assert_eq!(
+        value,
+        json!({"domain":"trusted-server.release.recipe-definition","schema_version":1,"source_commit":"a".repeat(40),"asset":FIXED_ARTIFACTS[0].name,"package":FIXED_ARTIFACTS[0].package,"binary":FIXED_ARTIFACTS[0].bin,"target":FIXED_ARTIFACTS[0].target.triple(),"variant":"default","cargo":{"command":"build","profile":"release","default_features":true,"features":[],"frozen":true},"profile_definition":{"path":"Cargo.toml","sha256":"0".repeat(64)}}),
+        "should bind only selected source policy and fixed asset fields"
+    );
+    let bytes = canonical_json(&value, Role::Metadata).expect("should canonicalize descriptor");
+    assert_eq!(
+        definition.sha256(),
+        hex::encode(Sha256::digest(&bytes)),
+        "should hash exact domain-separated descriptor bytes"
+    );
+    assert_eq!(
+        definition,
+        RecipeDefinitionIdentity::from_source(&approved, asset(0))
+            .expect("should repeat identical selection"),
+        "should keep identical source and asset stable"
+    );
+}
+
+#[test]
+fn source_asset_target_and_profile_manifest_changes_change_definition_identity() {
+    let approved = source('a', true);
+    let original = RecipeDefinitionIdentity::from_source(&approved, asset(0))
+        .expect("should select baseline definition");
+    let changed_source = RecipeDefinitionIdentity::from_source(&source('b', true), asset(0))
+        .expect("should select another approved source");
+    assert_ne!(
+        original.sha256(),
+        changed_source.sha256(),
+        "should bind the exact approved source commit"
+    );
+    for index in 1..FIXED_ARTIFACTS.len() {
+        let other = RecipeDefinitionIdentity::from_source(&approved, asset(index))
+            .expect("should select another cohort asset and target");
+        assert_ne!(
+            original.sha256(),
+            other.sha256(),
+            "should distinguish fixed asset/target {index}"
+        );
+    }
+    let arm = RecipeDefinitionIdentity::from_source(&approved, asset(1))
+        .expect("should select ARM CLI definition");
+    let intel = RecipeDefinitionIdentity::from_source(&approved, asset(2))
+        .expect("should select Intel CLI definition");
+    assert_ne!(
+        arm.sha256(),
+        intel.sha256(),
+        "should distinguish the same package/binary on different targets"
+    );
+    let mut changed_manifest = original.descriptor().clone();
+    changed_manifest.profile_definition.sha256 = "1".repeat(64);
+    assert_ne!(
+        original.sha256(),
+        hash_definition(&changed_manifest).expect("should hash a changed private descriptor"),
+        "should include the raw approved release-profile manifest digest"
+    );
+}
+
+#[test]
+fn missing_approved_root_manifest_and_unknown_assets_are_rejected() {
+    assert!(
+        RecipeDefinitionIdentity::from_source(&source('a', false), asset(0)).is_err(),
+        "should require the approved tracked profile manifest"
+    );
+    assert!(
+        AssetId::parse("example-unknown-asset").is_err(),
+        "should preserve the existing fixed-asset constructor boundary"
+    );
+}
+
+#[test]
+fn retained_definition_matches_only_its_approved_source_and_fixed_asset() {
+    let approved = source('a', true);
+    let identity = RecipeDefinitionIdentity::from_source(&approved, asset(0))
+        .expect("should select a source-owned definition");
+    assert!(
+        identity.matches_selection(approved.commit(), asset(0)),
+        "should recognize the same immutable source and fixed asset"
+    );
+    assert!(
+        !identity.matches_selection(source('b', true).commit(), asset(0)),
+        "should reject another source commit at the checked handoff"
+    );
+    assert!(
+        !identity.matches_selection(approved.commit(), asset(1)),
+        "should reject another fixed asset at the checked handoff"
+    );
+}
+
+#[test]
+fn exact_invocations_preserve_existing_digest_and_ab_variations_do_not_change_definition() {
+    let approved = source('a', true);
+    let shared = RecipeDefinitionIdentity::from_source(&approved, asset(0))
+        .expect("should select common definition");
+    let canonical = plan();
+    let exact = ExactInvocationDigest::from_plan(&canonical)
+        .expect("should bind exact canonical invocation");
+    assert_eq!(
+        exact.sha256(),
+        canonical
+            .digest()
+            .expect("should calculate existing plan digest"),
+        "should preserve the existing exact invocation digest bytes"
+    );
+    for variation in ["jobs", "umask", "root", "environment", "tool"] {
+        let mut changed = canonical.clone();
+        match variation {
+            "jobs" => changed.arguments[3] = "4".to_owned(),
+            "umask" => {
+                changed.umask = Umask::new(0o027).expect("should accept reproduction fixture umask")
+            }
+            "root" => changed.working_directory = PathBuf::from("/example/source-b"),
+            "environment" => {
+                changed
+                    .environment
+                    .insert("LANG".to_owned(), "en_US.UTF-8".to_owned());
+            }
+            "tool" => changed.program = PathBuf::from("/example/other-tools/bin/cargo"),
+            _ => unreachable!(),
+        }
+        let observed =
+            ExactInvocationDigest::from_plan(&changed).expect("should bind varied invocation");
+        assert_ne!(
+            exact, observed,
+            "should retain actual {variation} differences in invocation identity"
+        );
+        assert_eq!(
+            shared,
+            RecipeDefinitionIdentity::from_source(&approved, changed.asset)
+                .expect("should retain shared source-owned definition"),
+            "should exclude observed {variation} from shared recipe definition"
+        );
+    }
+}
diff --git a/crates/trusted-server-release/src/recipe/native.rs b/crates/trusted-server-release/src/recipe/native.rs
new file mode 100644
index 0000000000..9fb388532f
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/native.rs
@@ -0,0 +1,212 @@
+//! Native executable evidence: repeatability measured, operator values gated.
+//!
+//! Complete final-byte equality is a shipping gate for Fastly only. A native
+//! `ts` executable built once canonically and once as a reproduction is
+//! compared over identical inputs and the outcome is recorded either way, so
+//! a nonmatching native pair is a preserved measurement, never a rejection.
+//!
+//! Operator configuration must never be compiled in. A build whose inherited
+//! environment carried fictional operator values (which preflight removes)
+//! must hold none of them in its final bytes; that scan is a gate.
+
+use error_stack::Report;
+use object::Endianness;
+use object::elf::{FileHeader64, SHT_NOBITS};
+use object::read::elf::{FileHeader as _, SectionHeader as _};
+use sha2::{Digest as _, Sha256};
+
+use super::ambient::{AmbientClaim, AmbientRecord};
+use super::compare::{check_pair, first_difference, read_artifact};
+use super::{AssetId, RecipeCompleted, recipe_error};
+use crate::error::ReleaseError;
+use crate::policy::ReleaseTarget;
+
+/// Size and digest of one final executable.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct ArtifactIdentity {
+    /// Lowercase hex SHA-256 of the final bytes.
+    pub(crate) sha256: String,
+    /// Length of the final bytes.
+    pub(crate) size: u64,
+}
+
+impl ArtifactIdentity {
+    fn of(bytes: &[u8]) -> Self {
+        Self {
+            sha256: hex::encode(Sha256::digest(bytes)),
+            size: bytes.len() as u64,
+        }
+    }
+}
+
+/// Where a nonmatching native pair first differs.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct NativeDifference {
+    /// First differing offset (the shorter length for a strict prefix).
+    pub(crate) first_offset: usize,
+    /// Differing positions plus the length difference.
+    pub(crate) differing_bytes: usize,
+    /// The canonical ELF section holding the offset, when one does.
+    pub(crate) canonical_section: Option<String>,
+}
+
+/// The recorded repeatability of one native canonical/reproduction pair.
+///
+/// It has private fields and only [`measure_native_repeatability`]
+/// constructs it; a difference is data, not an error.
+#[derive(Debug)]
+pub(crate) struct NativeRepeatability {
+    asset: AssetId,
+    canonical: ArtifactIdentity,
+    reproduction: ArtifactIdentity,
+    difference: Option<NativeDifference>,
+    ambient: AmbientRecord,
+}
+
+impl NativeRepeatability {
+    /// The compared native asset.
+    pub(crate) fn asset(&self) -> AssetId {
+        self.asset
+    }
+
+    /// Identity of the canonical final bytes.
+    pub(crate) fn canonical(&self) -> &ArtifactIdentity {
+        &self.canonical
+    }
+
+    /// Identity of the reproduction final bytes.
+    pub(crate) fn reproduction(&self) -> &ArtifactIdentity {
+        &self.reproduction
+    }
+
+    /// Whether the two final files are byte-identical.
+    pub(crate) fn identical(&self) -> bool {
+        self.difference.is_none()
+    }
+
+    /// Where the files first differ, if they do.
+    pub(crate) fn difference(&self) -> Option<&NativeDifference> {
+        self.difference.as_ref()
+    }
+
+    /// The verified ambient pairing of the two builds.
+    pub(crate) fn ambient(&self) -> &AmbientRecord {
+        &self.ambient
+    }
+}
+
+/// Measures whether a native canonical and reproduction build produced
+/// identical final bytes, recording a mismatch instead of failing on it.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Recipe`] for the Fastly asset (which takes the
+/// equality gate instead), a pair that is not the canonical then the
+/// reproduction build of one asset over identical source, lock, materials,
+/// manifests, JS handoff and tools, an ambient pairing that does not vary
+/// exactly what [`AmbientClaim::standard`] states, or an artifact that no
+/// longer rehashes. A byte difference is never an error.
+pub(crate) fn measure_native_repeatability(
+    canonical: &RecipeCompleted,
+    reproduction: &RecipeCompleted,
+) -> Result<NativeRepeatability, Report<ReleaseError>> {
+    let asset = canonical.asset();
+    if asset.artifact().target == ReleaseTarget::Wasm32Wasip1 {
+        return Err(recipe_error(
+            "Fastly outputs take the equality gate, not a native measurement",
+        ));
+    }
+    check_pair(canonical, reproduction, asset)?;
+    let ambient = AmbientRecord::pair(
+        canonical.ambient(),
+        reproduction.ambient(),
+        &AmbientClaim::standard(),
+    )?;
+    let canonical_bytes = read_artifact(canonical)?;
+    let reproduction_bytes = read_artifact(reproduction)?;
+    let difference = first_difference(&canonical_bytes, &reproduction_bytes).map(|first_offset| {
+        NativeDifference {
+            first_offset,
+            differing_bytes: differing_bytes(&canonical_bytes, &reproduction_bytes),
+            canonical_section: elf_section_at(&canonical_bytes, first_offset),
+        }
+    });
+    Ok(NativeRepeatability {
+        asset,
+        canonical: ArtifactIdentity::of(&canonical_bytes),
+        reproduction: ArtifactIdentity::of(&reproduction_bytes),
+        difference,
+        ambient,
+    })
+}
+
+/// Counts differing positions plus the length difference.
+fn differing_bytes(first: &[u8], second: &[u8]) -> usize {
+    first
+        .iter()
+        .zip(second)
+        .filter(|(left, right)| left != right)
+        .count()
+        + first.len().abs_diff(second.len())
+}
+
+/// Names the ELF section whose file bytes hold `offset`, if the file parses
+/// as a 64-bit ELF and one does.
+pub(crate) fn elf_section_at(bytes: &[u8], offset: usize) -> Option<String> {
+    let header = FileHeader64::<Endianness>::parse(bytes).ok()?;
+    let endian = header.endian().ok()?;
+    let sections = header.sections(endian, bytes).ok()?;
+    let offset = u64::try_from(offset).ok()?;
+    sections.iter().find_map(|section| {
+        let start = section.sh_offset(endian);
+        let end = start.checked_add(section.sh_size(endian))?;
+        let holds = section.sh_type(endian) != SHT_NOBITS && (start..end).contains(&offset);
+        holds
+            .then(|| sections.section_name(endian, section).ok())
+            .flatten()
+            .map(|name| String::from_utf8_lossy(name).into_owned())
+    })
+}
+
+/// Most planted operator values one scan accepts.
+const MAX_OPERATOR_VALUES: usize = 16;
+/// Shortest planted value: anything shorter could occur by chance.
+const MIN_OPERATOR_VALUE_BYTES: usize = 12;
+
+/// Requires the final bytes to hold none of the planted operator `values`.
+///
+/// Each value is a distinctive fictional string that the caller placed in
+/// the inherited environment as operator configuration. Preflight removes
+/// such variables, so finding one in the executable means configuration
+/// reached the build through another channel.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Recipe`] for no values, more than 16, a value
+/// shorter than 12 bytes, or any value found in `bytes`.
+pub(crate) fn check_operator_values_absent(
+    bytes: &[u8],
+    values: &[&str],
+) -> Result<(), Report<ReleaseError>> {
+    if values.is_empty() || values.len() > MAX_OPERATOR_VALUES {
+        return Err(recipe_error(
+            "an operator value scan needs between 1 and 16 planted values",
+        ));
+    }
+    for value in values {
+        if value.len() < MIN_OPERATOR_VALUE_BYTES {
+            return Err(recipe_error(
+                "a planted operator value is too short to be distinctive",
+            ));
+        }
+        if bytes
+            .windows(value.len())
+            .any(|window| window == value.as_bytes())
+        {
+            return Err(recipe_error(format!(
+                "final bytes embed the planted operator value {value:?}"
+            )));
+        }
+    }
+    Ok(())
+}
diff --git a/crates/trusted-server-release/src/recipe/paths.rs b/crates/trusted-server-release/src/recipe/paths.rs
new file mode 100644
index 0000000000..7270445ca4
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/paths.rs
@@ -0,0 +1,79 @@
+//! Translation between host paths and the build's execution namespace.
+//!
+//! The confined command sees the boundary roots under their execution paths
+//! (identical on macOS, `/boundary/<role>/<index>` mount points in the Linux container). Every
+//! path the recipe hands to Cargo, and every path Cargo reports back, crosses
+//! this seam, so the recipe never guesses a mount layout.
+
+use std::path::{Path, PathBuf};
+
+use error_stack::Report;
+
+use super::recipe_error;
+use crate::boundary::Boundary;
+use crate::error::ReleaseError;
+
+/// Maps host paths into the execution namespace and writable paths back.
+pub(crate) trait ExecutionPaths {
+    /// Translates a host path inside any boundary root.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when `host` is outside every root.
+    fn execution_path(&self, host: &Path) -> Result<PathBuf, Report<ReleaseError>>;
+
+    /// Translates an execution path inside a writable root back to the host.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when `execution` is outside every writable root, so
+    /// a build can never name an immutable or tool file as its output.
+    fn host_path(&self, execution: &Path) -> Result<PathBuf, Report<ReleaseError>>;
+}
+
+impl ExecutionPaths for Boundary {
+    fn execution_path(&self, host: &Path) -> Result<PathBuf, Report<ReleaseError>> {
+        Boundary::execution_path(self, host)
+    }
+
+    fn host_path(&self, execution: &Path) -> Result<PathBuf, Report<ReleaseError>> {
+        Boundary::host_path(self, execution)
+    }
+}
+
+/// Translates `host` and requires UTF-8 text without `:` or NUL, so the
+/// result can travel in an environment variable, a `PATH` or a Cargo config.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Recipe`] when `host` is outside the roots or the
+/// translation is not plain text.
+pub(super) fn execution_text(
+    paths: &dyn ExecutionPaths,
+    label: &str,
+    host: &Path,
+) -> Result<String, Report<ReleaseError>> {
+    let translated = paths
+        .execution_path(host)
+        .map_err(|error| error.change_context(ReleaseError::Recipe))
+        .map_err(|error| error.attach(format!("{label} is outside the boundary roots")))?;
+    translated
+        .to_str()
+        .filter(|text| {
+            translated.is_absolute()
+                && !text.contains([':', '"', '\\'])
+                && !text.chars().any(char::is_control)
+        })
+        .map(str::to_owned)
+        .ok_or_else(|| {
+            recipe_error(format!(
+                "{label} has an execution path that is not plain absolute UTF-8"
+            ))
+        })
+}
+
+#[cfg(test)]
+pub(super) use fake::PrefixPaths;
+
+#[cfg(test)]
+mod fake;
diff --git a/crates/trusted-server-release/src/recipe/paths/fake.rs b/crates/trusted-server-release/src/recipe/paths/fake.rs
new file mode 100644
index 0000000000..ddb3b2b0a1
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/paths/fake.rs
@@ -0,0 +1,93 @@
+//! A prefix-table translator for tests that never touch a real boundary.
+
+use std::path::{Path, PathBuf};
+
+use error_stack::Report;
+
+use super::ExecutionPaths;
+use crate::error::ReleaseError;
+use crate::recipe::recipe_error;
+
+/// One mapped root: host prefix, execution prefix and writability.
+#[derive(Clone, Debug)]
+pub(crate) struct MappedRoot {
+    host: PathBuf,
+    execution: PathBuf,
+    writable: bool,
+}
+
+/// Translates through an explicit table of mapped roots.
+#[derive(Clone, Debug, Default)]
+pub(crate) struct PrefixPaths {
+    roots: Vec<MappedRoot>,
+}
+
+impl PrefixPaths {
+    /// Creates an empty table.
+    pub(crate) fn new() -> Self {
+        Self::default()
+    }
+
+    /// Adds a root mapped from `host` to `execution`.
+    #[must_use]
+    pub(crate) fn with(mut self, host: &Path, execution: &str, writable: bool) -> Self {
+        self.roots.push(MappedRoot {
+            host: host.to_owned(),
+            execution: PathBuf::from(execution),
+            writable,
+        });
+        self
+    }
+}
+
+impl ExecutionPaths for PrefixPaths {
+    fn execution_path(&self, host: &Path) -> Result<PathBuf, Report<ReleaseError>> {
+        self.roots
+            .iter()
+            .find_map(|root| {
+                host.strip_prefix(&root.host).ok().map(|relative| {
+                    if relative.as_os_str().is_empty() {
+                        root.execution.clone()
+                    } else {
+                        root.execution.join(relative)
+                    }
+                })
+            })
+            .ok_or_else(|| recipe_error(format!("{} is outside the fake roots", host.display())))
+    }
+
+    fn host_path(&self, execution: &Path) -> Result<PathBuf, Report<ReleaseError>> {
+        let normal = execution.components().collect::<PathBuf>().as_os_str()
+            == execution.as_os_str()
+            && !execution
+                .components()
+                .any(|component| matches!(component, std::path::Component::ParentDir));
+        if !normal {
+            return Err(recipe_error(format!(
+                "{} is not in lexical normal form",
+                execution.display()
+            )));
+        }
+        self.roots
+            .iter()
+            .filter(|root| root.writable)
+            .find_map(|root| {
+                execution
+                    .strip_prefix(&root.execution)
+                    .ok()
+                    .map(|relative| {
+                        if relative.as_os_str().is_empty() {
+                            root.host.clone()
+                        } else {
+                            root.host.join(relative)
+                        }
+                    })
+            })
+            .ok_or_else(|| {
+                recipe_error(format!(
+                    "{} is outside the fake writable roots",
+                    execution.display()
+                ))
+            })
+    }
+}
diff --git a/crates/trusted-server-release/src/recipe/plan.rs b/crates/trusted-server-release/src/recipe/plan.rs
new file mode 100644
index 0000000000..94eeaf7ebe
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/plan.rs
@@ -0,0 +1,448 @@
+//! The exact Cargo invocation of one recipe, in the build's own namespace.
+//!
+//! Host paths exist only in `program` and `working_directory`, which
+//! [`ConfinedCommand`] translates itself. Every path inside the argument
+//! vector and the environment goes through [`ExecutionPaths`], so a root the
+//! boundary does not mount is an error here instead of a dangling path in the
+//! child.
+
+use std::collections::BTreeMap;
+use std::ffi::OsString;
+use std::path::PathBuf;
+
+use error_stack::Report;
+use serde_json::json;
+use sha2::{Digest as _, Sha256};
+
+use super::ambient::CheckedAmbient;
+use super::apple::{AppleDeveloperTools, REMAPPED_SDK};
+use super::paths::{ExecutionPaths, execution_text};
+use super::remap::{RemapSources, c_prefix_map_environment_with, remap_arguments_with};
+use super::sources::source_replacement_arguments;
+use super::tools::SelectedRustTools;
+use super::{AssetId, RecipeRequest, recipe_error};
+use crate::boundary::{ConfinedCommand, Umask};
+use crate::documents::{Role, canonical_json};
+use crate::error::ReleaseError;
+use crate::materials::PreparedCargoMaterials;
+use crate::preflight::child::ChildEnvironment;
+use crate::process::ProcessLimits;
+
+const PREBUILT_DIR_VARIABLE: &str = "TSJS_PREBUILT_DIR";
+const PREBUILT_INVENTORY_VARIABLE: &str = "TRUSTED_SERVER__TSJS_PREBUILT_INVENTORY";
+const TARGET_DIR_VARIABLE: &str = "CARGO_TARGET_DIR";
+const CARGO_HOME_VARIABLE: &str = "CARGO_HOME";
+const HOME_VARIABLE: &str = "HOME";
+const TMPDIR_VARIABLE: &str = "TMPDIR";
+const RUSTC_VARIABLE: &str = "RUSTC";
+const PATH_VARIABLE: &str = "PATH";
+const DEVELOPER_DIR_VARIABLE: &str = "DEVELOPER_DIR";
+const SDKROOT_VARIABLE: &str = "SDKROOT";
+const ZERO_AR_DATE_VARIABLE: &str = "ZERO_AR_DATE";
+
+/// The exact Cargo invocation of one recipe.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct CargoPlan {
+    pub(super) asset: AssetId,
+    pub(super) program: PathBuf,
+    pub(super) arguments: Vec<String>,
+    pub(super) environment: BTreeMap<String, String>,
+    pub(super) working_directory: PathBuf,
+    pub(super) umask: Umask,
+    /// Digest of the Apple developer tool record a Darwin plan links with.
+    pub(super) apple_identity_sha256: Option<String>,
+}
+
+/// Fixed supporting observations of the selected explicit-target build.
+#[derive(Clone, Copy, Debug)]
+pub(super) enum CargoQuery {
+    /// Unfiltered identities, including host-only build dependencies.
+    Metadata,
+    /// Selected package's non-dev dependency tree, retained as raw evidence.
+    Tree,
+}
+
+impl CargoPlan {
+    /// Derives supporting queries without changing tools, inputs or the boundary.
+    ///
+    /// Compiler messages remain the authority for effective unit features.
+    /// Metadata/tree features are only package-level graph observations.
+    ///
+    /// # Errors
+    ///
+    /// Rejects incomplete config/feature argument pairs in the selected plan.
+    pub(super) fn observation_query(&self, kind: CargoQuery) -> Result<Self, Report<ReleaseError>> {
+        let artifact = self.asset.artifact();
+        let arguments: &[&str] = match kind {
+            CargoQuery::Metadata => &["metadata", "--format-version", "1", "--frozen"],
+            CargoQuery::Tree => &[
+                "tree",
+                "--package",
+                artifact.package,
+                "--target",
+                artifact.target.triple(),
+                "--edges",
+                "normal,build",
+                "--prefix",
+                "depth",
+                "--format",
+                "{p}",
+                "--charset",
+                "ascii",
+                "--no-dedupe",
+                "--frozen",
+            ],
+        };
+        let mut query = self.clone();
+        query.arguments = arguments
+            .iter()
+            .map(|argument| (*argument).to_owned())
+            .collect();
+        let mut selected = self.arguments.iter();
+        while let Some(argument) = selected.next() {
+            match argument.as_str() {
+                "--config" | "--features" => {
+                    let value = selected.next().ok_or_else(|| {
+                        recipe_error("incomplete selected Cargo config or features")
+                    })?;
+                    query.arguments.extend([argument.clone(), value.clone()]);
+                }
+                "--all-features" | "--no-default-features" => {
+                    query.arguments.push(argument.clone())
+                }
+                _ => {}
+            }
+        }
+        Ok(query)
+    }
+
+    /// Describes the plan as a confined command running under the role's umask.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Boundary`] for a non-normal program or working
+    /// directory, or [`ReleaseError::Process`] for a rejected variable.
+    pub(crate) fn confined_command(
+        &self,
+        limits: ProcessLimits,
+    ) -> Result<ConfinedCommand, Report<ReleaseError>> {
+        let mut command = ConfinedCommand::new(&self.program, &self.working_directory, limits)?
+            .arguments(self.arguments.iter().map(OsString::from))
+            .umask(self.umask);
+        for (name, value) in &self.environment {
+            // The compiler path is the one tool selector the plan sets, on purpose.
+            command = if name == RUSTC_VARIABLE {
+                command.tool_environment(name, value)?
+            } else {
+                command.environment(name, value)?
+            };
+        }
+        Ok(command)
+    }
+
+    /// Returns the SHA-256 of the canonical description of the whole plan.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] when a path is not UTF-8.
+    pub(crate) fn digest(&self) -> Result<String, Report<ReleaseError>> {
+        let text = |label: &str, path: &std::path::Path| {
+            path.to_str()
+                .map(str::to_owned)
+                .ok_or_else(|| recipe_error(format!("plan {label} is not UTF-8")))
+        };
+        let mut description = json!({
+            "asset": self.asset.artifact().name,
+            "program": text("program", &self.program)?,
+            "arguments": self.arguments,
+            "environment": self.environment,
+            "working_directory": text("working directory", &self.working_directory)?,
+            "umask": self.umask.to_string(),
+        });
+        if let Some(identity) = &self.apple_identity_sha256 {
+            description["apple_developer_tools_sha256"] = json!(identity);
+        }
+        let bytes = canonical_json(&description, Role::Metadata)
+            .map_err(|error| error.change_context(ReleaseError::Recipe))?;
+        Ok(hex::encode(Sha256::digest(bytes)))
+    }
+}
+
+/// Returns the fixed argument vector of the release Cargo build.
+///
+/// The only `--config` entries are `configs`: the exact source replacements
+/// followed by the target path remap.
+pub(super) fn cargo_arguments(asset: AssetId, jobs: u32, configs: &[String]) -> Vec<String> {
+    let artifact = asset.artifact();
+    [
+        "build",
+        "--package",
+        artifact.package,
+        "--bin",
+        artifact.bin,
+        "--target",
+        artifact.target.triple(),
+        "--release",
+        "--frozen",
+    ]
+    .into_iter()
+    .map(str::to_owned)
+    .chain(configs.iter().cloned())
+    .chain(
+        ["--message-format=json-render-diagnostics", "--jobs"]
+            .into_iter()
+            .map(str::to_owned),
+    )
+    .chain([jobs.to_string()])
+    .collect()
+}
+
+/// Requires the child's `HOME` and `CARGO_HOME` to be the request's private state.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Recipe`] when either variable is missing or names
+/// another location.
+pub(super) fn check_child_state(
+    request: &RecipeRequest,
+    child: &ChildEnvironment,
+) -> Result<(), Report<ReleaseError>> {
+    for (name, host) in [
+        (HOME_VARIABLE, request.home()),
+        (CARGO_HOME_VARIABLE, request.cargo_home()),
+    ] {
+        if child.variables().get(name).map(String::as_str) != host.to_str() {
+            return Err(recipe_error(format!(
+                "child {name} is not the request's private cargo state"
+            )));
+        }
+    }
+    Ok(())
+}
+
+/// Everything [`plan_for`] derives the plan from.
+pub(super) struct PlanInputs<'a> {
+    pub(super) request: &'a RecipeRequest,
+    pub(super) tools: &'a SelectedRustTools,
+    pub(super) ambient: &'a CheckedAmbient,
+    pub(super) child: &'a ChildEnvironment,
+    pub(super) materials: &'a PreparedCargoMaterials,
+    pub(super) paths: &'a dyn ExecutionPaths,
+}
+
+/// Derives the exact Cargo invocation from the bound inputs.
+///
+/// The arguments carry the source replacement and the deterministic target
+/// path remap of [`super::remap`]; a native asset's environment also carries
+/// the same remap for C code. All of it is bound by [`CargoPlan::digest`].
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Recipe`] when the child environment's `HOME` or
+/// `CARGO_HOME` is not the request's private state, or any path variable,
+/// the tool directory, the vendor directory, the checkout root or the Rust
+/// tool root lies outside the boundary roots or is not plain text, two
+/// remapped roots overlap in the execution namespace, or a native asset's
+/// remapped root holds whitespace.
+pub(super) fn plan_for(inputs: &PlanInputs<'_>) -> Result<CargoPlan, Report<ReleaseError>> {
+    let PlanInputs {
+        request,
+        tools,
+        ambient,
+        child,
+        materials,
+        paths,
+    } = inputs;
+    check_child_state(request, child)?;
+    let cargo_home = request.cargo_home();
+    let home = request.home();
+    let tmpdir = request.tmpdir();
+    let rustc = tools.rustc();
+    let mut environment = child.variables().clone();
+    for (name, host) in [
+        (TARGET_DIR_VARIABLE, request.target_dir()),
+        (CARGO_HOME_VARIABLE, cargo_home.as_path()),
+        (HOME_VARIABLE, home.as_path()),
+        (TMPDIR_VARIABLE, tmpdir.as_path()),
+        (PREBUILT_DIR_VARIABLE, request.js_dir()),
+        (PREBUILT_INVENTORY_VARIABLE, request.js_inventory()),
+        (RUSTC_VARIABLE, rustc.as_path()),
+    ] {
+        environment.insert(name.to_owned(), execution_text(*paths, name, host)?);
+    }
+    let tool_bin = execution_text(*paths, PATH_VARIABLE, &tools.bin_dir())?;
+    environment.insert(
+        PATH_VARIABLE.to_owned(),
+        format!("{tool_bin}:/usr/bin:/bin"),
+    );
+    let vendor = execution_text(*paths, "vendor directory", materials.vendor_dir())?;
+    let mut configs = source_replacement_arguments(&vendor, materials.git_sources());
+    let target = request.asset().artifact().target;
+    let checkout = execution_text(*paths, "checkout root", ambient.checkout_root())?;
+    let tool_root = execution_text(*paths, "Rust tools root", tools.root())?;
+    let darwin = tools
+        .apple()
+        .map(|apple| darwin_plan(*paths, target, apple, &tool_root))
+        .transpose()?;
+    let sources = RemapSources {
+        checkout: &checkout,
+        vendor: &vendor,
+        cargo_home: &environment[CARGO_HOME_VARIABLE],
+        tools: &tool_root,
+        target: &environment[TARGET_DIR_VARIABLE],
+    };
+    let link_flags = darwin
+        .as_ref()
+        .map_or(&[][..], |darwin| darwin.rustflags.as_slice());
+    configs.extend(remap_arguments_with(target.triple(), &sources, link_flags)?);
+    if target == crate::policy::ReleaseTarget::X86_64UnknownLinuxGnu {
+        configs.extend(super::gnu::linker_arguments());
+    }
+    if target == crate::policy::ReleaseTarget::Wasm32Wasip1
+        && cfg!(all(target_os = "linux", target_arch = "x86_64"))
+    {
+        configs.extend(super::fastly_tools::linker_arguments(&tool_root));
+    }
+    let developer = darwin.as_ref().map(|darwin| darwin.developer.as_str());
+    let c_prefix_map = c_prefix_map_environment_with(target, &sources, developer)?;
+    if let Some((name, mut value)) = c_prefix_map {
+        if let Some(sdk) = darwin.as_ref().and_then(|darwin| darwin.sdk.as_deref()) {
+            super::fresh::disjoint(&[
+                ("owned SDK", std::path::Path::new(sdk)),
+                ("checkout", std::path::Path::new(&checkout)),
+                ("vendor", std::path::Path::new(&vendor)),
+                (
+                    "Cargo home",
+                    std::path::Path::new(&environment[CARGO_HOME_VARIABLE]),
+                ),
+                ("Rust tools", std::path::Path::new(&tool_root)),
+                (
+                    "target",
+                    std::path::Path::new(&environment[TARGET_DIR_VARIABLE]),
+                ),
+                (
+                    "Apple developer",
+                    std::path::Path::new(developer.expect("should have Darwin developer root")),
+                ),
+            ])?;
+            value.push_str(&format!(" -isysroot {sdk} -ffile-prefix-map={sdk}={REMAPPED_SDK} -fdebug-prefix-map={sdk}={REMAPPED_SDK}"));
+        }
+        environment.insert(name, value);
+    }
+    if target == crate::policy::ReleaseTarget::X86_64UnknownLinuxGnu {
+        environment.extend(super::gnu::environment());
+    }
+    if target == crate::policy::ReleaseTarget::Wasm32Wasip1
+        && cfg!(all(target_os = "linux", target_arch = "x86_64"))
+    {
+        environment.extend(super::fastly_tools::environment());
+    }
+    let apple_identity_sha256 = match darwin {
+        Some(darwin) => {
+            configs.extend(darwin.configs);
+            environment.extend(darwin.environment);
+            Some(darwin.identity_sha256)
+        }
+        None => None,
+    };
+    Ok(CargoPlan {
+        asset: request.asset(),
+        program: tools.cargo(),
+        arguments: cargo_arguments(request.asset(), ambient.jobs(), &configs),
+        environment,
+        working_directory: ambient.checkout_root().to_owned(),
+        umask: ambient.umask()?,
+        apple_identity_sha256,
+    })
+}
+
+/// The Darwin additions to one plan, all in the execution namespace.
+struct DarwinPlan {
+    /// Linker arguments appended inside the target rustflags entry.
+    rustflags: Vec<String>,
+    /// Extra `--config` pairs: the target linker.
+    configs: Vec<String>,
+    /// `DEVELOPER_DIR`, `SDKROOT`, `CC_<triple>`, `AR_<triple>` and
+    /// `ZERO_AR_DATE` and the fixed Cargo OpenSSL configuration.
+    environment: BTreeMap<String, String>,
+    /// Execution path of the developer directory for the C path remap.
+    developer: String,
+    /// Execution path of a separately owned SDK.
+    sdk: Option<String>,
+    /// Digest of the Apple tool identity record.
+    identity_sha256: String,
+}
+
+/// Derives the Darwin linker, C tool and debug-map settings.
+///
+/// The Mach-O debug map is kept, but `-oso_prefix` makes the linker strip
+/// the recipe-owned parent of the Rust tool root (and, as binding requires,
+/// of the target directory) from every object path, and `ZERO_AR_DATE=1`
+/// makes it record zero object modification times. The linker is selected
+/// through `--config target."<triple>".linker` because the environment form
+/// is a denied tool selector; `xcrun` and the `/usr/bin` shims are never used.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Recipe`] when the target is not Darwin, an Apple
+/// path is outside the boundary roots or not plain text, or the parent of the
+/// Rust tool root is missing or holds a `,` that `-Wl,` would split.
+fn darwin_plan(
+    paths: &dyn ExecutionPaths,
+    target: crate::policy::ReleaseTarget,
+    apple: &AppleDeveloperTools,
+    tool_root: &str,
+) -> Result<DarwinPlan, Report<ReleaseError>> {
+    if !target.is_darwin() {
+        return Err(recipe_error(
+            "Apple developer tools apply only to Darwin targets",
+        ));
+    }
+    let developer = execution_text(paths, "Apple developer directory", apple.developer_dir())?;
+    let sdk = apple
+        .owned_sdk_root()
+        .map(|root| execution_text(paths, "owned Apple SDK", root))
+        .transpose()?;
+    let clang = execution_text(paths, "Apple clang", apple.clang())?;
+    let parent = std::path::Path::new(tool_root)
+        .parent()
+        .and_then(std::path::Path::to_str)
+        .filter(|parent| *parent != "/" && !parent.contains(','))
+        .ok_or_else(|| recipe_error("Rust tool root has no plain recipe-owned parent"))?;
+    let triple = target.triple();
+    let underscored = triple.replace('-', "_");
+    let environment = BTreeMap::from([
+        (DEVELOPER_DIR_VARIABLE.to_owned(), developer.clone()),
+        (
+            SDKROOT_VARIABLE.to_owned(),
+            execution_text(paths, "Apple SDK root", apple.sdk_root())?,
+        ),
+        (format!("CC_{underscored}"), clang.clone()),
+        (
+            format!("AR_{underscored}"),
+            execution_text(paths, "Apple ar", apple.ar())?,
+        ),
+        (ZERO_AR_DATE_VARIABLE.to_owned(), "1".to_owned()),
+        // Cargo's LibreSSL initialization must not read ambient host configuration.
+        ("OPENSSL_CONF".to_owned(), "/dev/null".to_owned()),
+    ]);
+    let mut rustflags = vec![format!("-Clink-arg=-Wl,-oso_prefix,{parent}/")];
+    if let Some(sdk) = &sdk {
+        rustflags.extend([
+            format!("--remap-path-prefix={sdk}={REMAPPED_SDK}"),
+            "-Clink-arg=-isysroot".to_owned(),
+            format!("-Clink-arg={sdk}"),
+        ]);
+    }
+    Ok(DarwinPlan {
+        rustflags,
+        configs: vec![
+            "--config".to_owned(),
+            format!("target.\"{triple}\".linker=\"{clang}\""),
+        ],
+        environment,
+        developer,
+        sdk,
+        identity_sha256: apple.identity_sha256()?,
+    })
+}
diff --git a/crates/trusted-server-release/src/recipe/remap.rs b/crates/trusted-server-release/src/recipe/remap.rs
new file mode 100644
index 0000000000..e9fd4c15f8
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/remap.rs
@@ -0,0 +1,347 @@
+//! Deterministic compiler path remapping for the target units of one build.
+//!
+//! Debug info (`debug = 1`), panic locations and `file!()` embed the paths
+//! rustc compiled from. Every root those paths can come from is remapped to a
+//! fixed prefix, so the final bytes do not depend on where a build's
+//! checkout, vendor tree, Cargo home, Rust tools or target directory live.
+//!
+//! # Cargo precedence
+//!
+//! Cargo takes rustflags from the first source that defines any:
+//! `CARGO_ENCODED_RUSTFLAGS`, then `RUSTFLAGS`, then every matching
+//! `target.<triple>.rustflags` and `target.<cfg>.rustflags` joined, and only
+//! then `build.rustflags`. A `--config` value merges with the configuration
+//! files and arrays concatenate with the command line last. The remap
+//! therefore travels as one `--config target."<triple>".rustflags=[...]`
+//! entry: reviewed target flags in `.cargo/config.toml` stay in effect before
+//! it. Either environment variable would replace every configured flag, so
+//! the audited environment rejects both and the plan never sets them. Any
+//! target rustflags supersede `build.rustflags`, so the reviewed
+//! configuration must not set it ([`check_cargo_config`]), and the legacy
+//! extensionless `.cargo/config` layer is refused outright
+//! ([`check_no_extensionless_config`]).
+//!
+//! # Ordering
+//!
+//! When several `--remap-path-prefix` flags match one path, rustc applies the
+//! last matching one. The remapped roots are required to be pairwise
+//! disjoint, so at most one ever matches and the emitted order cannot change
+//! the result.
+//!
+//! # Limitation
+//!
+//! Remapping rewrites paths rustc knows as source locations. A string built
+//! by `env!("CARGO_MANIFEST_DIR")`, `env!("OUT_DIR")` or `concat!` of them is
+//! an ordinary literal and keeps the execution path. The final bytes are
+//! therefore scanned ([`scan_remapped_bytes`]) so such a literal fails the
+//! build evidence instead of passing silently.
+//!
+//! With an explicit `--target`, rustflags reach only target units, never
+//! build scripts or procedural macros: exactly the code in the artifact.
+//! C code those build scripts compile into a native artifact gets the same
+//! maps through [`c_prefix_map_environment`].
+
+use std::io;
+use std::path::Path;
+
+use error_stack::Report;
+
+use super::apple::REMAPPED_DEVELOPER;
+use super::fresh::disjoint;
+use super::recipe_error;
+use crate::error::ReleaseError;
+use crate::policy::ReleaseTarget;
+
+/// Tracked Cargo configuration Cargo reads from the checkout root.
+pub(super) const CARGO_CONFIG: &str = ".cargo/config.toml";
+/// Legacy extensionless configuration Cargo also reads; always refused.
+pub(super) const LEGACY_CARGO_CONFIG: &str = ".cargo/config";
+/// Fixed prefix of the source checkout.
+pub(super) const REMAPPED_CHECKOUT: &str = "/trusted-server";
+/// Fixed prefix of the vendored dependency directory.
+pub(super) const REMAPPED_VENDOR: &str = "/cargo-vendor";
+/// Fixed prefix of the private Cargo home.
+pub(super) const REMAPPED_CARGO_HOME: &str = "/cargo-home";
+/// Fixed prefix of the Rust tool root, which is the compiler sysroot.
+pub(super) const REMAPPED_TOOLS: &str = "/rust-tools";
+/// Fixed prefix of the Cargo target directory, which holds every `OUT_DIR`.
+pub(super) const REMAPPED_TARGET: &str = "/cargo-target";
+/// Every fixed prefix, in emitted order.
+pub(super) const REMAPPED_PREFIXES: [&str; 5] = [
+    REMAPPED_CHECKOUT,
+    REMAPPED_VENDOR,
+    REMAPPED_CARGO_HOME,
+    REMAPPED_TOOLS,
+    REMAPPED_TARGET,
+];
+/// Execution-namespace prefix of every container mount; never in final bytes.
+const EXECUTION_MOUNT_PREFIX: &str = "/boundary/";
+/// Most forbidden prefixes one scan accepts.
+const MAX_FORBIDDEN: usize = 64;
+/// Longest forbidden prefix one scan accepts.
+const MAX_PREFIX_BYTES: usize = 4096;
+
+/// Execution paths of every root a compiled path can come from.
+///
+/// Each must already be plain absolute text without quotes, backslashes,
+/// `:` or control characters, as [`super::paths::execution_text`] returns.
+pub(super) struct RemapSources<'a> {
+    pub(super) checkout: &'a str,
+    pub(super) vendor: &'a str,
+    pub(super) cargo_home: &'a str,
+    pub(super) tools: &'a str,
+    pub(super) target: &'a str,
+}
+
+/// Returns the `--config` pair remapping every source root for `triple`.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Recipe`] when two remapped roots are equal or
+/// nested, since rustc's last-match-wins rule would then make the order of
+/// the flags decide the compiled path.
+pub(super) fn remap_arguments(
+    triple: &str,
+    sources: &RemapSources<'_>,
+) -> Result<Vec<String>, Report<ReleaseError>> {
+    remap_arguments_with(triple, sources, &[])
+}
+
+/// Returns the same `--config` pair with `extra` rustflags appended inside
+/// the one target rustflags entry, such as the Darwin linker arguments.
+///
+/// # Errors
+///
+/// As [`remap_arguments`], or [`ReleaseError::Recipe`] when an extra flag
+/// holds a quote, backslash or control character a TOML basic string would
+/// need to escape.
+pub(super) fn remap_arguments_with(
+    triple: &str,
+    sources: &RemapSources<'_>,
+    extra: &[String],
+) -> Result<Vec<String>, Report<ReleaseError>> {
+    if extra
+        .iter()
+        .any(|flag| flag.contains(['"', '\\']) || flag.chars().any(char::is_control))
+    {
+        return Err(recipe_error(
+            "an extra rustflag holds a quote, backslash or control character",
+        ));
+    }
+    let flags: Vec<String> = remapped_pairs(sources)?
+        .map(|(from, to)| format!("\"--remap-path-prefix={from}={to}\""))
+        .chain(extra.iter().map(|flag| format!("\"{flag}\"")))
+        .collect();
+    Ok(vec![
+        "--config".to_owned(),
+        format!("target.\"{triple}\".rustflags=[{}]", flags.join(",")),
+    ])
+}
+
+/// Pairs every source root with its fixed prefix after requiring the roots
+/// to be pairwise disjoint.
+fn remapped_pairs<'a>(
+    sources: &RemapSources<'a>,
+) -> Result<impl Iterator<Item = (&'a str, &'static str)>, Report<ReleaseError>> {
+    let pairs = [
+        ("remapped checkout", sources.checkout),
+        ("remapped vendor directory", sources.vendor),
+        ("remapped Cargo home", sources.cargo_home),
+        ("remapped Rust tools", sources.tools),
+        ("remapped target directory", sources.target),
+    ];
+    let labelled: Vec<(&str, &Path)> = pairs
+        .iter()
+        .map(|(label, from)| (*label, Path::new(*from)))
+        .collect();
+    disjoint(&labelled)?;
+    Ok(pairs
+        .into_iter()
+        .map(|(_, from)| from)
+        .zip(REMAPPED_PREFIXES))
+}
+
+/// Returns the target-scoped `CFLAGS` variable that applies the same remap to
+/// C code, or `None` for Wasm.
+///
+/// Native assets link C dependencies that `cc` compiles from build scripts
+/// (bundled `SQLite`, `ring`, `aws-lc-sys`). With the profile's debug info,
+/// Cargo tells those build scripts to emit DWARF, and `__FILE__` strings and
+/// DWARF directories then hold execution paths rustc's remap never sees.
+/// `-ffile-prefix-map` rewrites both in GCC 8+ and Clang 10+;
+/// `-fdebug-prefix-map` is repeated because the GCC driver forwards only that
+/// one to the assembler for `.S` sources. `cc` reads
+/// `CFLAGS_<triple with underscores>` first, the plan sets it (the audited
+/// environment rejects every inherited `CFLAGS` form), and it is bound by the
+/// plan digest. `cc` splits the value on whitespace, so a root containing any
+/// is refused instead of silently split.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Recipe`] when two roots overlap or a root holds
+/// whitespace.
+pub(super) fn c_prefix_map_environment(
+    target: ReleaseTarget,
+    sources: &RemapSources<'_>,
+) -> Result<Option<(String, String)>, Report<ReleaseError>> {
+    c_prefix_map_environment_with(target, sources, None)
+}
+
+/// Returns the same variable, also mapping the Apple developer directory to
+/// [`REMAPPED_DEVELOPER`] when `developer` is given, so SDK header paths in
+/// C debug info and `__FILE__` strings do not name the host Xcode.
+///
+/// # Errors
+///
+/// As [`c_prefix_map_environment`], with the developer directory included in
+/// the overlap and whitespace checks.
+pub(super) fn c_prefix_map_environment_with(
+    target: ReleaseTarget,
+    sources: &RemapSources<'_>,
+    developer: Option<&str>,
+) -> Result<Option<(String, String)>, Report<ReleaseError>> {
+    if target == ReleaseTarget::Wasm32Wasip1 {
+        return Ok(None);
+    }
+    let mut pairs: Vec<(&str, &str)> = remapped_pairs(sources)?.collect();
+    if let Some(developer) = developer {
+        let mut labelled: Vec<(&str, &Path)> = pairs
+            .iter()
+            .map(|(from, _)| ("remapped root", Path::new(*from)))
+            .collect();
+        labelled.push(("remapped Apple developer directory", Path::new(developer)));
+        disjoint(&labelled)?;
+        pairs.push((developer, REMAPPED_DEVELOPER));
+    }
+    let mut flags = Vec::new();
+    for (from, to) in pairs {
+        if from.chars().any(char::is_whitespace) {
+            return Err(recipe_error(
+                "a remapped root holds whitespace, which cc would split",
+            ));
+        }
+        flags.push(format!("-ffile-prefix-map={from}={to}"));
+        flags.push(format!("-fdebug-prefix-map={from}={to}"));
+    }
+    Ok(Some((
+        format!("CFLAGS_{}", target.triple().replace('-', "_")),
+        flags.join(" "),
+    )))
+}
+
+/// Requires the reviewed Cargo configuration not to set `build.rustflags`.
+///
+/// The remap is a target rustflags entry, and Cargo ignores `build.rustflags`
+/// whenever any target rustflags exist, so such a setting would be silently
+/// dropped instead of reviewed.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Recipe`] when the bytes are not UTF-8 TOML or set
+/// `build.rustflags`.
+pub(super) fn check_cargo_config(bytes: &[u8]) -> Result<(), Report<ReleaseError>> {
+    let text = std::str::from_utf8(bytes)
+        .map_err(|error| recipe_error(format!("{CARGO_CONFIG} is not UTF-8: {error}")))?;
+    let table: toml::Table = toml::from_str(text)
+        .map_err(|error| recipe_error(format!("{CARGO_CONFIG} is not TOML: {error}")))?;
+    let sets_build_rustflags = table
+        .get("build")
+        .and_then(toml::Value::as_table)
+        .is_some_and(|build| build.contains_key("rustflags"));
+    if sets_build_rustflags {
+        return Err(recipe_error(format!(
+            "{CARGO_CONFIG} sets build.rustflags, which the target path remap would supersede"
+        )));
+    }
+    Ok(())
+}
+
+/// Refuses the legacy extensionless `.cargo/config` at the checkout root.
+///
+/// Cargo reads it beside `.cargo/config.toml`, so an unreviewed layer could
+/// carry rustflags the remap check never sees.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Recipe`] when the approved source tracks it, it
+/// exists on disk in any form, or its absence cannot be established.
+pub(super) fn check_no_extensionless_config(
+    checkout: &Path,
+    tracked: bool,
+) -> Result<(), Report<ReleaseError>> {
+    if tracked {
+        return Err(recipe_error(format!(
+            "the approved source tracks {LEGACY_CARGO_CONFIG}, which is refused"
+        )));
+    }
+    match std::fs::symlink_metadata(checkout.join(LEGACY_CARGO_CONFIG)) {
+        Ok(_) => Err(recipe_error(format!(
+            "the checkout holds {LEGACY_CARGO_CONFIG}, which is refused"
+        ))),
+        Err(error) if error.kind() == io::ErrorKind::NotFound => Ok(()),
+        Err(error) => Err(recipe_error(format!(
+            "{LEGACY_CARGO_CONFIG} cannot be inspected: {error}"
+        ))),
+    }
+}
+
+/// Fixed prefixes found in final bytes that hold no forbidden path.
+#[derive(Debug, PartialEq, Eq)]
+pub(crate) struct RemapScan {
+    found: Vec<&'static str>,
+}
+
+impl RemapScan {
+    /// The fixed prefixes, each followed by `/`, found in the bytes.
+    pub(crate) fn found(&self) -> &[&'static str] {
+        &self.found
+    }
+}
+
+/// Returns whether `needle` occurs in `haystack`.
+fn contains(haystack: &[u8], needle: &[u8]) -> bool {
+    !needle.is_empty()
+        && haystack
+            .windows(needle.len())
+            .any(|window| window == needle)
+}
+
+/// Proves remapping on final bytes by substring search.
+///
+/// The bytes must contain none of `forbidden` (host roots of the build) nor
+/// the container mount prefix `/boundary/`, and at least one fixed prefix
+/// followed by `/`.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Recipe`] for more than 64 forbidden prefixes, an
+/// empty or longer than 4096-byte prefix, any forbidden prefix found, or no
+/// fixed prefix found.
+pub(crate) fn scan_remapped_bytes(
+    bytes: &[u8],
+    forbidden: &[&str],
+) -> Result<RemapScan, Report<ReleaseError>> {
+    if forbidden.len() > MAX_FORBIDDEN {
+        return Err(recipe_error("too many forbidden prefixes for one scan"));
+    }
+    for prefix in forbidden.iter().copied().chain([EXECUTION_MOUNT_PREFIX]) {
+        if prefix.is_empty() || prefix.len() > MAX_PREFIX_BYTES {
+            return Err(recipe_error("forbidden prefix is empty or too long"));
+        }
+        if contains(bytes, prefix.as_bytes()) {
+            return Err(recipe_error(format!(
+                "final bytes still hold the unremapped path prefix {prefix:?}"
+            )));
+        }
+    }
+    let found: Vec<&'static str> = REMAPPED_PREFIXES
+        .into_iter()
+        .filter(|prefix| contains(bytes, format!("{prefix}/").as_bytes()))
+        .collect();
+    if found.is_empty() {
+        return Err(recipe_error(
+            "final bytes hold no remapped path prefix, so remapping is unproven",
+        ));
+    }
+    Ok(RemapScan { found })
+}
diff --git a/crates/trusted-server-release/src/recipe/runtime.rs b/crates/trusted-server-release/src/recipe/runtime.rs
new file mode 100644
index 0000000000..85fc8187ac
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/runtime.rs
@@ -0,0 +1,594 @@
+//! Final-byte Fastly runtime acceptance through the pinned Viceroy.
+//!
+//! Before a final Fastly output is accepted, the gate validates the exact
+//! bytes as a core Wasm Fastly command and then serves them with the pinned
+//! Viceroy against a loopback publisher origin it starts itself. A publisher
+//! request must return the origin's page, carrying this run's marker, with
+//! exactly one injected Trusted Server script. The gate never invokes Cargo or
+//! the Fastly CLI and never rewrites the module: Viceroy reads a private
+//! read-only copy, and both the copy and the retained artifact must still
+//! hash to the accepted digest afterwards.
+//!
+//! The settings-free `/health` route only gates readiness. Any rejection after
+//! a successful health check (a failed publisher request, an unobserved
+//! origin, an early Viceroy exit or a guest failure in its output) carries
+//! [`HealthOnlySuccess`], so that outcome stays distinguishable from a
+//! runtime that never started.
+//!
+//! The Viceroy and origin ports are chosen by binding an ephemeral loopback
+//! port and releasing it, so another local process could take a port in that
+//! window; such a race fails the gate, it cannot make it pass.
+
+mod config;
+mod exchange;
+mod export;
+mod logs;
+mod viceroy;
+
+use std::ffi::OsString;
+use std::fs;
+use std::io::Write as _;
+use std::net::{Ipv4Addr, SocketAddr, TcpListener};
+use std::os::unix::fs::OpenOptionsExt as _;
+use std::path::Path;
+use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256};
+
+use super::compare::{FastlyEqualityChecked, read_artifact};
+use super::{RecipeCompleted, Role};
+use crate::error::ReleaseError;
+use crate::inspect::inspect_wasm;
+use crate::process::{BoundedCommand, Cancellation, ProcessLimits, ProcessOutcome};
+use crate::source::{ApprovedSource, CommitId};
+pub(crate) use exchange::PublisherObservation;
+pub(crate) use logs::ViceroyOutput;
+#[cfg(test)]
+pub(crate) use viceroy::PINNED_VICEROY_VERSION;
+pub(crate) use viceroy::SelectedViceroy;
+
+/// Wall-clock bound on the whole Viceroy run, compilation included.
+const VICEROY_WALL: Duration = Duration::from_secs(15 * 60);
+/// Bound on the time from spawn to a healthy runtime.
+const STARTUP_DEADLINE: Duration = Duration::from_secs(10 * 60);
+/// Interval between readiness probes.
+const READINESS_POLL: Duration = Duration::from_millis(250);
+/// Timeout of one readiness probe.
+const PROBE_TIMEOUT: Duration = Duration::from_secs(2);
+/// Timeout of the publisher request.
+const PUBLISHER_TIMEOUT: Duration = Duration::from_secs(60);
+/// Cap on each captured Viceroy output stream.
+const VICEROY_OUTPUT_LIMIT: u64 = 8 * 1024 * 1024;
+/// Headers of a top-level browser navigation.
+const NAVIGATION_HEADERS: [(&str, &str); 4] = [
+    ("Accept", "text/html,application/xhtml+xml"),
+    ("Sec-Fetch-Mode", "navigate"),
+    ("Sec-Fetch-Dest", "document"),
+    ("User-Agent", "trusted-server-release-runtime-gate"),
+];
+
+/// Typed reason attached to every [`ReleaseError::Runtime`] report.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, derive_more::Display)]
+pub(crate) enum RuntimeRejection {
+    /// The handed-off artifact is not the accepted, unchanged final output.
+    #[display("artifact is not the accepted final output")]
+    Artifact,
+    /// The Viceroy executable is unusable, unpinned or changed.
+    #[display("Viceroy selection failed")]
+    Viceroy,
+    /// The fixed fixture or its configuration could not be generated.
+    #[display("runtime fixture is unusable")]
+    Fixture,
+    /// Viceroy exited or never answered the health check in time.
+    #[display("runtime never became healthy")]
+    Startup,
+    /// A loopback HTTP exchange failed or did not parse.
+    #[display("HTTP exchange failed")]
+    Exchange,
+    /// The publisher page did not answer 200.
+    #[display("publisher page status is not 200")]
+    Status,
+    /// The Trusted Server script injection is missing or malformed.
+    #[display("Trusted Server script injection is missing or malformed")]
+    Injection,
+    /// The page does not carry this run's origin marker.
+    #[display("publisher page did not come from this run's origin")]
+    OriginMarker,
+    /// The origin fixture never received the publisher request.
+    #[display("origin fixture did not observe the publisher request")]
+    OriginUnobserved,
+    /// The executed copy changed during the run.
+    #[display("executed artifact changed during the run")]
+    Changed,
+    /// Viceroy ended other than by the gate's cancellation.
+    #[display("Viceroy did not end by the gate's cancellation")]
+    Supervision,
+    /// The captured Viceroy output reports a guest trap, panic or failed
+    /// request execution.
+    #[display("Viceroy output reports a guest failure")]
+    GuestFailure,
+}
+
+/// Marks a rejection whose health check succeeded before the publisher
+/// request failed.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, derive_more::Display)]
+#[display("health check succeeded but publisher acceptance failed")]
+pub(crate) struct HealthOnlySuccess;
+
+/// Builds a runtime rejection carrying `rejection` and a detail line.
+fn runtime_error(
+    rejection: RuntimeRejection,
+    message: impl std::fmt::Display,
+) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Runtime)
+        .attach(rejection)
+        .attach(message.to_string())
+}
+
+/// Whether the gate serves the publisher origin.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum OriginPresence {
+    /// The origin fixture serves the publisher page.
+    Served,
+    /// The origin port is closed, so only `/health` can succeed. Tests use
+    /// it to prove that a health-only success is rejected.
+    #[cfg(test)]
+    Closed,
+}
+
+/// Proof that the retained final Fastly output of an approved source passed
+/// core-format validation and a publisher request through the pinned
+/// Viceroy.
+///
+/// It has private fields and only [`accept_fastly_runtime`] constructs it;
+/// a bare [`run_gate`] observation is not acceptance.
+#[derive(Debug)]
+pub(crate) struct FastlyRuntimeAccepted {
+    source_commit: CommitId,
+    role: Role,
+    observed: GateObservation,
+}
+
+impl FastlyRuntimeAccepted {
+    /// The approved source commit whose fixtures and output were accepted.
+    pub(crate) fn source_commit(&self) -> &CommitId {
+        &self.source_commit
+    }
+
+    /// The build role whose final output was accepted.
+    pub(crate) fn role(&self) -> Role {
+        self.role
+    }
+
+    /// What the gate run observed.
+    pub(crate) fn observed(&self) -> &GateObservation {
+        &self.observed
+    }
+}
+
+/// What one successful gate run observed over exact final bytes.
+///
+/// It has private fields and only [`run_gate`] constructs it.
+#[derive(Debug)]
+pub(crate) struct GateObservation {
+    artifact_sha256: String,
+    artifact_size: u64,
+    viceroy_version: String,
+    viceroy_sha256: String,
+    fixture_sha256: String,
+    config_sha256: String,
+    health_status: u16,
+    publisher: PublisherObservation,
+    origin_requests: Vec<String>,
+    startup: Duration,
+    viceroy_outcome: ProcessOutcome,
+    viceroy_output: ViceroyOutput,
+}
+
+impl GateObservation {
+    /// Digests and sanitized stderr tail of the captured Viceroy output.
+    pub(crate) fn viceroy_output(&self) -> &ViceroyOutput {
+        &self.viceroy_output
+    }
+
+    /// SHA-256 of the executed final bytes, unchanged by the run.
+    pub(crate) fn artifact_sha256(&self) -> &str {
+        &self.artifact_sha256
+    }
+
+    /// Size of the executed final bytes.
+    pub(crate) fn artifact_size(&self) -> u64 {
+        self.artifact_size
+    }
+
+    /// The reported Viceroy version.
+    pub(crate) fn viceroy_version(&self) -> &str {
+        &self.viceroy_version
+    }
+
+    /// SHA-256 of the Viceroy executable.
+    pub(crate) fn viceroy_sha256(&self) -> &str {
+        &self.viceroy_sha256
+    }
+
+    /// SHA-256 binding the fixed template, app config and store ID.
+    pub(crate) fn fixture_sha256(&self) -> &str {
+        &self.fixture_sha256
+    }
+
+    /// SHA-256 of the generated Viceroy configuration of this run.
+    pub(crate) fn config_sha256(&self) -> &str {
+        &self.config_sha256
+    }
+
+    /// Status of the readiness health check.
+    pub(crate) fn health_status(&self) -> u16 {
+        self.health_status
+    }
+
+    /// What the accepted publisher response showed.
+    pub(crate) fn publisher(&self) -> &PublisherObservation {
+        &self.publisher
+    }
+
+    /// Request lines the origin fixture received.
+    pub(crate) fn origin_requests(&self) -> &[String] {
+        &self.origin_requests
+    }
+
+    /// Time from spawn to a healthy runtime.
+    pub(crate) fn startup(&self) -> Duration {
+        self.startup
+    }
+
+    /// How the Viceroy run ended; always the gate's cancellation.
+    pub(crate) fn viceroy_outcome(&self) -> ProcessOutcome {
+        self.viceroy_outcome
+    }
+}
+
+/// Runs the runtime gate over the retained final Fastly output that passed
+/// the canonical and reproduction equality check.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Runtime`] with [`RuntimeRejection::Artifact`] when
+/// `completed` is not the checked output of `source` or no longer rehashes,
+/// [`RuntimeRejection::Fixture`] when `source` does not track the embedded
+/// fixtures unchanged, [`ReleaseError::Inspect`] when the bytes are not a
+/// valid Fastly core command, and the gate's other rejections from
+/// [`run_gate`].
+pub(crate) fn accept_fastly_runtime(
+    source: &ApprovedSource,
+    completed: &RecipeCompleted,
+    checked: &FastlyEqualityChecked,
+    viceroy: &SelectedViceroy,
+) -> Result<FastlyRuntimeAccepted, Report<ReleaseError>> {
+    if source.commit() != completed.commit() {
+        return Err(runtime_error(
+            RuntimeRejection::Artifact,
+            "artifact was not built from the supplied approved source",
+        ));
+    }
+    config::require_built_source_fixtures(&|path| source.tracked_sha256(path).map(str::to_owned))?;
+    let artifact = completed.artifact();
+    if completed.asset() != checked.asset()
+        || artifact.sha256() != checked.sha256()
+        || artifact.size() != checked.size()
+    {
+        return Err(runtime_error(
+            RuntimeRejection::Artifact,
+            "artifact is not the output the equality check accepted",
+        ));
+    }
+    let bytes = read_artifact(completed).map_err(|error| {
+        error
+            .change_context(ReleaseError::Runtime)
+            .attach(RuntimeRejection::Artifact)
+    })?;
+    let observed = run_gate(&bytes, viceroy, OriginPresence::Served)?;
+    completed.rehash_for_handoff().map_err(|error| {
+        error
+            .change_context(ReleaseError::Runtime)
+            .attach(RuntimeRejection::Changed)
+    })?;
+    Ok(FastlyRuntimeAccepted {
+        source_commit: completed.commit().clone(),
+        role: completed.role(),
+        observed,
+    })
+}
+
+/// Validates `bytes` and serves them through `viceroy` against the origin.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Inspect`] for invalid core Wasm, a foreign host
+/// ABI, a missing entry ABI or stripped debug sections; otherwise
+/// [`ReleaseError::Runtime`] with a [`RuntimeRejection`]. Every rejection
+/// after a healthy readiness check also carries [`HealthOnlySuccess`].
+pub(super) fn run_gate(
+    bytes: &[u8],
+    viceroy: &SelectedViceroy,
+    origin: OriginPresence,
+) -> Result<GateObservation, Report<ReleaseError>> {
+    let facts = inspect_wasm(bytes)?;
+    facts.require_fastly_entry_abi()?;
+    facts.require_debug_sections()?;
+    viceroy.reverify()?;
+    let private = tempfile::tempdir().map_err(|error| fixture_io("private directory", &error))?;
+    let wasm = private.path().join("final.wasm");
+    write_private(&wasm, bytes, 0o400)?;
+    require_unchanged(&wasm, facts.sha256())?;
+    let marker = run_marker(facts.sha256());
+    let origin_fixture = match origin {
+        OriginPresence::Served => Some(exchange::OriginFixture::start(&marker)?),
+        #[cfg(test)]
+        OriginPresence::Closed => None,
+    };
+    let origin_address = match &origin_fixture {
+        Some(fixture) => fixture.address(),
+        None => free_loopback_address()?,
+    };
+    let generated = config::viceroy_config(&format!("http://{origin_address}"))?;
+    let config_path = private.path().join("viceroy.toml");
+    write_private(&config_path, generated.text.as_bytes(), 0o400)?;
+    let home = private.path().join("home");
+    fs::create_dir(&home).map_err(|error| fixture_io("home directory", &error))?;
+    let address = free_loopback_address()?;
+    let run = serve(&ServeInputs {
+        viceroy,
+        wasm: &wasm,
+        config: &config_path,
+        home: &home,
+        working_directory: private.path(),
+        address,
+        marker: &marker,
+    });
+    let origin_requests = origin_fixture
+        .map(exchange::OriginFixture::stop)
+        .unwrap_or_default();
+    require_unchanged(&wasm, facts.sha256())?;
+    viceroy.reverify()?;
+    let served = run?;
+    if !origin_requests
+        .iter()
+        .any(|line| line.starts_with("GET / "))
+    {
+        return Err(runtime_error(
+            RuntimeRejection::OriginUnobserved,
+            format!("origin fixture received {origin_requests:?}"),
+        )
+        .attach(HealthOnlySuccess));
+    }
+    Ok(GateObservation {
+        artifact_sha256: facts.sha256().to_owned(),
+        artifact_size: bytes.len() as u64,
+        viceroy_version: viceroy.version().to_owned(),
+        viceroy_sha256: viceroy.sha256().to_owned(),
+        fixture_sha256: generated.fixture_sha256,
+        config_sha256: generated.sha256,
+        health_status: served.health_status,
+        publisher: served.publisher,
+        origin_requests,
+        startup: served.startup,
+        viceroy_outcome: served.outcome,
+        viceroy_output: served.output,
+    })
+}
+
+/// Inputs of one Viceroy serving run.
+struct ServeInputs<'a> {
+    viceroy: &'a SelectedViceroy,
+    wasm: &'a Path,
+    config: &'a Path,
+    home: &'a Path,
+    working_directory: &'a Path,
+    address: SocketAddr,
+    marker: &'a str,
+}
+
+/// What one successful serving run observed.
+struct Served {
+    health_status: u16,
+    publisher: PublisherObservation,
+    startup: Duration,
+    outcome: ProcessOutcome,
+    output: ViceroyOutput,
+}
+
+/// Cancels the Viceroy run when dropped, so a panic while exchanging stops
+/// Viceroy at once instead of waiting out [`VICEROY_WALL`] in the scope join.
+struct CancelOnDrop<'a>(&'a Cancellation);
+
+impl Drop for CancelOnDrop<'_> {
+    fn drop(&mut self) {
+        self.0.cancel();
+    }
+}
+
+/// Runs Viceroy, waits for health, checks one publisher request and stops it.
+fn serve(inputs: &ServeInputs<'_>) -> Result<Served, Report<ReleaseError>> {
+    let cancellation = Cancellation::default();
+    let command = viceroy_command(inputs, &cancellation)?;
+    let started = Instant::now();
+    std::thread::scope(|scope| {
+        let running = scope.spawn(|| command.run());
+        let stop = CancelOnDrop(&cancellation);
+        let exchanged = exchange_while_running(inputs, started, &|| running.is_finished());
+        drop(stop);
+        let result = running
+            .join()
+            .map_err(|_| {
+                runtime_error(RuntimeRejection::Supervision, "Viceroy supervisor panicked")
+            })?
+            .map_err(|error| {
+                error
+                    .change_context(ReleaseError::Runtime)
+                    .attach(RuntimeRejection::Supervision)
+            })?;
+        let (publisher, startup) = exchanged.map_err(|error| {
+            error.attach(format!(
+                "Viceroy {} after {:?}; stderr tail: {}",
+                result.outcome(),
+                result.elapsed(),
+                logs::sanitized_tail(result.stderr())
+            ))
+        })?;
+        if result.outcome() != ProcessOutcome::Cancelled {
+            return Err(runtime_error(
+                RuntimeRejection::Supervision,
+                format!("Viceroy {} before the gate stopped it", result.outcome()),
+            )
+            .attach(HealthOnlySuccess));
+        }
+        let output = logs::scan_viceroy_output(result.stdout(), result.stderr())
+            .map_err(|error| error.attach(HealthOnlySuccess))?;
+        Ok(Served {
+            health_status: 200,
+            publisher,
+            startup,
+            outcome: result.outcome(),
+            output,
+        })
+    })
+}
+
+/// Builds the fixed Viceroy command line.
+fn viceroy_command(
+    inputs: &ServeInputs<'_>,
+    cancellation: &Cancellation,
+) -> Result<BoundedCommand, Report<ReleaseError>> {
+    let arguments = [
+        OsString::from("serve"),
+        OsString::from("--addr"),
+        OsString::from(inputs.address.to_string()),
+        OsString::from("--config"),
+        inputs.config.as_os_str().to_owned(),
+        OsString::from("--unknown-import-behavior"),
+        OsString::from("link-error"),
+        inputs.wasm.as_os_str().to_owned(),
+    ];
+    BoundedCommand::new(
+        inputs.viceroy.path(),
+        inputs.working_directory,
+        ProcessLimits {
+            wall: VICEROY_WALL,
+            stdout_max: VICEROY_OUTPUT_LIMIT,
+            stderr_max: VICEROY_OUTPUT_LIMIT,
+        },
+    )
+    .and_then(|command| {
+        command
+            .arguments(arguments)
+            .environment("HOME", inputs.home)
+    })
+    .map(|command| command.cancellation(cancellation.clone()))
+    .map_err(|error| {
+        error
+            .change_context(ReleaseError::Runtime)
+            .attach(RuntimeRejection::Supervision)
+    })
+}
+
+/// Waits for health, then sends and checks the publisher request.
+fn exchange_while_running(
+    inputs: &ServeInputs<'_>,
+    started: Instant,
+    exited: &dyn Fn() -> bool,
+) -> Result<(PublisherObservation, Duration), Report<ReleaseError>> {
+    loop {
+        if exited() {
+            return Err(runtime_error(
+                RuntimeRejection::Startup,
+                "Viceroy exited before answering the health check",
+            ));
+        }
+        if started.elapsed() > STARTUP_DEADLINE {
+            return Err(runtime_error(
+                RuntimeRejection::Startup,
+                "Viceroy did not answer the health check before the startup deadline",
+            ));
+        }
+        if exchange::get(inputs.address, "/health", &[], PROBE_TIMEOUT)
+            .is_ok_and(|response| exchange::is_health_ok(&response))
+        {
+            break;
+        }
+        std::thread::sleep(READINESS_POLL);
+    }
+    let startup = started.elapsed();
+    exchange::get(inputs.address, "/", &NAVIGATION_HEADERS, PUBLISHER_TIMEOUT)
+        .and_then(|response| exchange::check_publisher_response(&response, inputs.marker))
+        .map(|publisher| (publisher, startup))
+        .map_err(|error| error.attach(HealthOnlySuccess))
+}
+
+fn fixture_io(what: &str, error: &std::io::Error) -> Report<ReleaseError> {
+    runtime_error(
+        RuntimeRejection::Fixture,
+        format!("cannot create the {what}: {error}"),
+    )
+}
+
+/// Writes a new private file with `mode` and syncs it.
+fn write_private(path: &Path, bytes: &[u8], mode: u32) -> Result<(), Report<ReleaseError>> {
+    fs::OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .mode(mode)
+        .open(path)
+        .and_then(|mut file| file.write_all(bytes).and_then(|()| file.sync_all()))
+        .map_err(|error| fixture_io("private file", &error))
+}
+
+/// Requires the file at `path` to hash to `sha256`.
+fn require_unchanged(path: &Path, sha256: &str) -> Result<(), Report<ReleaseError>> {
+    let bytes = fs::read(path).map_err(|error| {
+        runtime_error(
+            RuntimeRejection::Changed,
+            format!("cannot reread the copy: {error}"),
+        )
+    })?;
+    if hex::encode(Sha256::digest(&bytes)) != sha256 {
+        return Err(runtime_error(
+            RuntimeRejection::Changed,
+            "executed copy no longer hashes to the accepted digest",
+        ));
+    }
+    Ok(())
+}
+
+/// Returns a loopback address whose port was free a moment ago.
+fn free_loopback_address() -> Result<SocketAddr, Report<ReleaseError>> {
+    TcpListener::bind((Ipv4Addr::LOCALHOST, 0))
+        .and_then(|listener| listener.local_addr())
+        .map_err(|error| fixture_io("loopback port", &error))
+}
+
+/// Returns a marker unique to this run, so a cached or foreign page fails.
+fn run_marker(artifact_sha256: &str) -> String {
+    let nanos = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map_or(0, |elapsed| elapsed.as_nanos());
+    let seed = format!("{artifact_sha256}:{nanos}:{}", std::process::id());
+    let digest = hex::encode(Sha256::digest(seed.as_bytes()));
+    format!("trusted-server-release-origin-{}", &digest[..24])
+}
+
+#[cfg(test)]
+pub(super) mod tests_support {
+    //! Narrow access to the gate's pure parts for the recipe tests.
+
+    pub(in crate::recipe) use super::config::{
+        app_config_data, canonical, config_store_id, envelope_json, require_built_source_fixtures,
+        viceroy_config,
+    };
+    pub(in crate::recipe) use super::exchange::{
+        HttpResponse, OriginFixture, check_publisher_response, get, is_health_ok, origin_page,
+        parse_response,
+    };
+    pub(in crate::recipe) use super::logs::{sanitized_tail, scan_viceroy_output};
+    pub(in crate::recipe) use super::viceroy::parse_version_output;
+}
diff --git a/crates/trusted-server-release/src/recipe/runtime/config.rs b/crates/trusted-server-release/src/recipe/runtime/config.rs
new file mode 100644
index 0000000000..ab6f3590db
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/runtime/config.rs
@@ -0,0 +1,340 @@
+//! Fixed Viceroy local configuration for the final-byte runtime gate.
+//!
+//! The gate reuses the integration harness fixtures verbatim: its Viceroy
+//! template (KV, secret and JWKS stores with generated test-only values) and
+//! its readable Trusted Server app config. Like the harness generator, it
+//! overrides only `publisher.origin_url`, wraps the app config in a version 1
+//! blob envelope and injects it into the template's single generated-store
+//! marker under the config store ID the tracked `edgezero.toml` declares.
+//!
+//! The producer has no dependency on the core crate, so the app config is
+//! converted from TOML to JSON here and its envelope digest is computed with
+//! the envelope's canonical form: compact JSON with object keys sorted by
+//! UTF-8 bytes. Floats and datetimes are rejected rather than canonicalized,
+//! so the fixture can never depend on number formatting.
+//!
+//! # Embedded fixtures
+//!
+//! The three fixture files are compiled into the producer from the producer's
+//! own source tree, not read from the source that was built. The producer may
+//! be built from a different revision than the approved source, so
+//! [`require_built_source_fixtures`] fails closed unless the built source
+//! tracks each file at the exact embedded content.
+
+use std::fmt::Write as _;
+
+use error_stack::Report;
+use serde_json::{Map, Value};
+use sha2::{Digest as _, Sha256};
+
+use super::{RuntimeRejection, runtime_error};
+use crate::error::ReleaseError;
+
+/// The integration harness Viceroy template.
+const VICEROY_TEMPLATE: &str = include_str!(concat!(
+    env!("CARGO_MANIFEST_DIR"),
+    "/../trusted-server-integration-tests/fixtures/configs/viceroy-template.toml"
+));
+/// The integration harness readable app config.
+const APP_CONFIG: &str = include_str!(concat!(
+    env!("CARGO_MANIFEST_DIR"),
+    "/../trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml"
+));
+/// The tracked `EdgeZero` manifest naming the default config store.
+const EDGEZERO_MANIFEST: &str =
+    include_str!(concat!(env!("CARGO_MANIFEST_DIR"), "/../../edgezero.toml"));
+/// The single line the generated config store replaces.
+const GENERATED_STORES_MARKER: &str = "        # GENERATED_TRUSTED_SERVER_CONFIG_STORES";
+/// Fixed envelope timestamp, the same one the harness generator stamps.
+const GENERATED_AT: &str = "2026-06-23T00:00:00Z";
+/// The only blob envelope version the runtime accepts.
+const ENVELOPE_VERSION: u64 = 1;
+
+/// Each embedded fixture with its repository-relative tracked path.
+const EMBEDDED_FIXTURES: [(&str, &str); 3] = [
+    (
+        "crates/trusted-server-integration-tests/fixtures/configs/viceroy-template.toml",
+        VICEROY_TEMPLATE,
+    ),
+    (
+        "crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml",
+        APP_CONFIG,
+    ),
+    ("edgezero.toml", EDGEZERO_MANIFEST),
+];
+
+/// Requires the built source to track every embedded fixture unchanged.
+///
+/// `tracked_sha256` returns the SHA-256 of a tracked path's content in the
+/// built source, or `None` when the path is not tracked.
+///
+/// # Errors
+///
+/// Returns [`RuntimeRejection::Fixture`] naming the first fixture that is
+/// untracked or differs from the built source.
+pub(in crate::recipe) fn require_built_source_fixtures(
+    tracked_sha256: &dyn Fn(&str) -> Option<String>,
+) -> Result<(), Report<ReleaseError>> {
+    for (path, embedded) in EMBEDDED_FIXTURES {
+        let expected = sha256_hex(embedded.as_bytes());
+        match tracked_sha256(path) {
+            Some(built) if built == expected => {}
+            Some(built) => {
+                return Err(runtime_error(
+                    RuntimeRejection::Fixture,
+                    format!(
+                        "embedded fixture {path} differs from built source \
+                         (embedded {expected}, built {built})"
+                    ),
+                ));
+            }
+            None => {
+                return Err(runtime_error(
+                    RuntimeRejection::Fixture,
+                    format!("embedded fixture {path} is not tracked by the built source"),
+                ));
+            }
+        }
+    }
+    Ok(())
+}
+
+/// One generated Viceroy configuration and the digests that identify it.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(in crate::recipe) struct GeneratedConfig {
+    /// The complete Viceroy `local_server` configuration.
+    pub(in crate::recipe) text: String,
+    /// SHA-256 of [`Self::text`].
+    pub(in crate::recipe) sha256: String,
+    /// SHA-256 binding the fixed template, app config and store ID.
+    pub(in crate::recipe) fixture_sha256: String,
+}
+
+/// Returns the default config store ID declared by `edgezero.toml`.
+///
+/// # Errors
+///
+/// Returns [`RuntimeRejection::Fixture`] when the manifest does not parse or
+/// the ID is missing or not a plain lowercase identifier.
+pub(in crate::recipe) fn config_store_id() -> Result<String, Report<ReleaseError>> {
+    let fixture = |message: &str| runtime_error(RuntimeRejection::Fixture, message);
+    let manifest: toml::Table = toml::from_str(EDGEZERO_MANIFEST)
+        .map_err(|error| fixture(&format!("edgezero.toml does not parse: {error}")))?;
+    let id = manifest
+        .get("stores")
+        .and_then(|stores| stores.get("config"))
+        .and_then(|config| config.get("default"))
+        .and_then(toml::Value::as_str)
+        .ok_or_else(|| fixture("edgezero.toml declares no default config store"))?;
+    let plain = !id.is_empty()
+        && id
+            .bytes()
+            .all(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit() || byte == b'_');
+    if !plain {
+        return Err(fixture("default config store ID is not a plain identifier"));
+    }
+    Ok(id.to_owned())
+}
+
+/// Converts a TOML value into JSON, rejecting floats and datetimes.
+fn toml_to_json(value: &toml::Value) -> Result<Value, Report<ReleaseError>> {
+    Ok(match value {
+        toml::Value::String(text) => Value::String(text.clone()),
+        toml::Value::Integer(number) => Value::from(*number),
+        toml::Value::Boolean(flag) => Value::Bool(*flag),
+        toml::Value::Array(items) => {
+            Value::Array(items.iter().map(toml_to_json).collect::<Result<_, _>>()?)
+        }
+        toml::Value::Table(table) => table_to_json(table)?,
+        toml::Value::Float(_) | toml::Value::Datetime(_) => {
+            return Err(runtime_error(
+                RuntimeRejection::Fixture,
+                "app config fixture holds a float or datetime",
+            ));
+        }
+    })
+}
+
+fn table_to_json(table: &toml::Table) -> Result<Value, Report<ReleaseError>> {
+    let mut map = Map::new();
+    for (key, value) in table {
+        map.insert(key.clone(), toml_to_json(value)?);
+    }
+    Ok(Value::Object(map))
+}
+
+/// Returns the integration app config as JSON with `origin_url` replaced.
+///
+/// # Errors
+///
+/// Returns [`RuntimeRejection::Fixture`] when the fixture does not parse,
+/// holds a float or datetime, or lacks a string `publisher.origin_url`.
+pub(in crate::recipe) fn app_config_data(origin_url: &str) -> Result<Value, Report<ReleaseError>> {
+    let table: toml::Table = toml::from_str(APP_CONFIG).map_err(|error| {
+        runtime_error(
+            RuntimeRejection::Fixture,
+            format!("app config fixture does not parse: {error}"),
+        )
+    })?;
+    let mut data = table_to_json(&table)?;
+    let origin = data
+        .pointer_mut("/publisher/origin_url")
+        .filter(|value| value.is_string())
+        .ok_or_else(|| {
+            runtime_error(
+                RuntimeRejection::Fixture,
+                "app config fixture lacks publisher.origin_url",
+            )
+        })?;
+    *origin = Value::String(origin_url.to_owned());
+    Ok(data)
+}
+
+/// Writes `value` in the envelope's canonical form.
+///
+/// # Errors
+///
+/// Returns [`RuntimeRejection::Fixture`] for a non-integer number.
+pub(in crate::recipe) fn write_canonical(
+    out: &mut String,
+    value: &Value,
+) -> Result<(), Report<ReleaseError>> {
+    match value {
+        Value::Null => out.push_str("null"),
+        Value::Bool(flag) => out.push_str(if *flag { "true" } else { "false" }),
+        Value::Number(number) => {
+            if let Some(integer) = number.as_i64() {
+                let _ = write!(out, "{integer}");
+            } else if let Some(integer) = number.as_u64() {
+                let _ = write!(out, "{integer}");
+            } else {
+                return Err(runtime_error(
+                    RuntimeRejection::Fixture,
+                    "canonical form rejects non-integer numbers",
+                ));
+            }
+        }
+        Value::String(text) => write_string(out, text),
+        Value::Array(items) => {
+            out.push('[');
+            for (index, item) in items.iter().enumerate() {
+                if index > 0 {
+                    out.push(',');
+                }
+                write_canonical(out, item)?;
+            }
+            out.push(']');
+        }
+        Value::Object(map) => {
+            let mut keys: Vec<&String> = map.keys().collect();
+            keys.sort_unstable_by(|left, right| left.as_bytes().cmp(right.as_bytes()));
+            out.push('{');
+            for (index, key) in keys.into_iter().enumerate() {
+                if index > 0 {
+                    out.push(',');
+                }
+                write_string(out, key);
+                out.push(':');
+                write_canonical(out, &map[key])?;
+            }
+            out.push('}');
+        }
+    }
+    Ok(())
+}
+
+/// Writes a JSON string with the envelope's fixed escape table.
+fn write_string(out: &mut String, text: &str) {
+    out.push('"');
+    for character in text.chars() {
+        match character {
+            '"' => out.push_str("\\\""),
+            '\\' => out.push_str("\\\\"),
+            '\n' => out.push_str("\\n"),
+            '\r' => out.push_str("\\r"),
+            '\t' => out.push_str("\\t"),
+            '\u{0008}' => out.push_str("\\b"),
+            '\u{000C}' => out.push_str("\\f"),
+            control if u32::from(control) < 0x20 => {
+                let _ = write!(out, "\\u{:04x}", u32::from(control));
+            }
+            other => out.push(other),
+        }
+    }
+    out.push('"');
+}
+
+/// Returns the canonical form of `value`.
+///
+/// # Errors
+///
+/// Returns [`RuntimeRejection::Fixture`] for a non-integer number.
+pub(in crate::recipe) fn canonical(value: &Value) -> Result<String, Report<ReleaseError>> {
+    let mut out = String::new();
+    write_canonical(&mut out, value)?;
+    Ok(out)
+}
+
+fn sha256_hex(bytes: &[u8]) -> String {
+    hex::encode(Sha256::digest(bytes))
+}
+
+/// Returns the blob envelope JSON wrapping `data`.
+///
+/// # Errors
+///
+/// Returns [`RuntimeRejection::Fixture`] for a non-integer number.
+pub(in crate::recipe) fn envelope_json(data: &Value) -> Result<String, Report<ReleaseError>> {
+    let sha256 = sha256_hex(canonical(data)?.as_bytes());
+    canonical(&serde_json::json!({
+        "data": data,
+        "generated_at": GENERATED_AT,
+        "sha256": sha256,
+        "version": ENVELOPE_VERSION,
+    }))
+}
+
+/// Builds the complete Viceroy configuration for `origin_url`.
+///
+/// # Errors
+///
+/// Returns [`RuntimeRejection::Fixture`] when the template does not hold
+/// exactly one generated-store marker, the store ID or app config is
+/// unusable, or the envelope cannot be embedded as a TOML literal string.
+pub(in crate::recipe) fn viceroy_config(
+    origin_url: &str,
+) -> Result<GeneratedConfig, Report<ReleaseError>> {
+    let markers = VICEROY_TEMPLATE.matches(GENERATED_STORES_MARKER).count();
+    if markers != 1 {
+        return Err(runtime_error(
+            RuntimeRejection::Fixture,
+            format!("Viceroy template holds {markers} generated-store markers, not one"),
+        ));
+    }
+    let store = config_store_id()?;
+    let envelope = envelope_json(&app_config_data(origin_url)?)?;
+    if envelope.contains("'''") {
+        return Err(runtime_error(
+            RuntimeRejection::Fixture,
+            "envelope cannot be embedded as a TOML literal string",
+        ));
+    }
+    let block = format!(
+        "        [local_server.config_stores.{store}]\n            format = \"inline-toml\"\n        \
+         [local_server.config_stores.{store}.contents]\n            {store} = '''{envelope}'''"
+    );
+    let text = VICEROY_TEMPLATE.replace(GENERATED_STORES_MARKER, &block);
+    let fixture_sha256 = sha256_hex(
+        format!(
+            "viceroy-template.toml {}\ntrusted-server.integration.toml {}\nconfig-store {store}\n",
+            sha256_hex(VICEROY_TEMPLATE.as_bytes()),
+            sha256_hex(APP_CONFIG.as_bytes()),
+        )
+        .as_bytes(),
+    );
+    Ok(GeneratedConfig {
+        sha256: sha256_hex(text.as_bytes()),
+        text,
+        fixture_sha256,
+    })
+}
diff --git a/crates/trusted-server-release/src/recipe/runtime/exchange.rs b/crates/trusted-server-release/src/recipe/runtime/exchange.rs
new file mode 100644
index 0000000000..32db26fa19
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/runtime/exchange.rs
@@ -0,0 +1,461 @@
+//! Loopback HTTP exchanges of the runtime gate: the publisher origin fixture,
+//! a minimal HTTP/1.1 client and the pure response checks.
+//!
+//! The client only speaks to loopback addresses the gate chose itself. It
+//! requests `identity` encoding with `Connection: close`, reads at most
+//! [`RESPONSE_LIMIT`] bytes and decodes `Content-Length` or chunked bodies
+//! strictly.
+
+use std::io::{ErrorKind, Read as _, Write as _};
+use std::net::{SocketAddr, TcpListener, TcpStream};
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, Mutex};
+use std::thread::JoinHandle;
+use std::time::Duration;
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256};
+
+use super::{RuntimeRejection, runtime_error};
+use crate::error::ReleaseError;
+
+/// Maximum bytes read from one response, head and body together.
+pub(in crate::recipe) const RESPONSE_LIMIT: u64 = 4 * 1024 * 1024;
+/// Maximum bytes the origin fixture reads from one request head.
+const REQUEST_HEAD_LIMIT: u64 = 64 * 1024;
+/// The attribute that identifies the injected Trusted Server script.
+const SCRIPT_ID: &str = "id=\"trustedserver-js\"";
+/// The required prefix of the injected script's `src`.
+const SCRIPT_SOURCE_PREFIX: &str = "/static/tsjs=";
+/// Interval at which the origin fixture checks its stop flag.
+const ACCEPT_POLL: Duration = Duration::from_millis(20);
+
+/// A parsed HTTP response with a fully decoded body.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(in crate::recipe) struct HttpResponse {
+    pub(in crate::recipe) status: u16,
+    /// Header names in lowercase, in received order.
+    pub(in crate::recipe) headers: Vec<(String, String)>,
+    pub(in crate::recipe) body: Vec<u8>,
+}
+
+impl HttpResponse {
+    /// Returns the first value of `name`, compared case-insensitively.
+    pub(in crate::recipe) fn header(&self, name: &str) -> Option<&str> {
+        self.headers
+            .iter()
+            .find(|(seen, _)| seen.eq_ignore_ascii_case(name))
+            .map(|(_, value)| value.as_str())
+    }
+}
+
+/// What the accepted publisher response showed.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct PublisherObservation {
+    pub(crate) status: u16,
+    pub(crate) body_size: usize,
+    pub(crate) body_sha256: String,
+    pub(crate) script_src: String,
+}
+
+fn exchange_error(message: impl std::fmt::Display) -> Report<ReleaseError> {
+    runtime_error(RuntimeRejection::Exchange, message)
+}
+
+/// Sends one `GET` to a loopback `address` and parses the response.
+///
+/// # Errors
+///
+/// Returns [`RuntimeRejection::Exchange`] when the connection, write or read
+/// fails or times out, the response exceeds [`RESPONSE_LIMIT`], or it does
+/// not parse.
+pub(in crate::recipe) fn get(
+    address: SocketAddr,
+    path: &str,
+    headers: &[(&str, &str)],
+    timeout: Duration,
+) -> Result<HttpResponse, Report<ReleaseError>> {
+    if !address.ip().is_loopback() {
+        return Err(exchange_error("the gate only contacts loopback addresses"));
+    }
+    let mut stream = TcpStream::connect_timeout(&address, timeout)
+        .map_err(|error| exchange_error(format!("cannot connect to {address}: {error}")))?;
+    stream
+        .set_read_timeout(Some(timeout))
+        .and_then(|()| stream.set_write_timeout(Some(timeout)))
+        .map_err(|error| exchange_error(format!("cannot set socket timeouts: {error}")))?;
+    let mut request = format!(
+        "GET {path} HTTP/1.1\r\nHost: {address}\r\nAccept-Encoding: identity\r\nConnection: close\r\n"
+    );
+    for (name, value) in headers {
+        request.push_str(&format!("{name}: {value}\r\n"));
+    }
+    request.push_str("\r\n");
+    stream
+        .write_all(request.as_bytes())
+        .map_err(|error| exchange_error(format!("cannot send the request: {error}")))?;
+    let mut raw = Vec::new();
+    stream
+        .take(RESPONSE_LIMIT + 1)
+        .read_to_end(&mut raw)
+        .map_err(|error| exchange_error(format!("cannot read the response: {error}")))?;
+    if raw.len() as u64 > RESPONSE_LIMIT {
+        return Err(exchange_error("response exceeds the byte limit"));
+    }
+    parse_response(&raw)
+}
+
+/// Parses a complete HTTP/1.x response read until the connection closed.
+///
+/// # Errors
+///
+/// Returns [`RuntimeRejection::Exchange`] for a malformed head or header
+/// name, a non-identity content encoding, a transfer encoding other than
+/// exactly `chunked`, duplicate or conflicting framing headers, a body
+/// shorter or longer than its `Content-Length`, or a malformed chunked body.
+pub(in crate::recipe) fn parse_response(raw: &[u8]) -> Result<HttpResponse, Report<ReleaseError>> {
+    let split = raw
+        .windows(4)
+        .position(|window| window == b"\r\n\r\n")
+        .ok_or_else(|| exchange_error("response head is incomplete"))?;
+    let head = std::str::from_utf8(&raw[..split])
+        .ok()
+        .filter(|head| head.is_ascii())
+        .ok_or_else(|| exchange_error("response head is not ASCII"))?;
+    let rest = &raw[split + 4..];
+    let mut lines = head.split("\r\n");
+    let status = parse_status_line(lines.next().unwrap_or_default())?;
+    let headers = lines
+        .map(parse_header_line)
+        .collect::<Result<Vec<_>, _>>()?;
+    let mut response = HttpResponse {
+        status,
+        headers,
+        body: Vec::new(),
+    };
+    if let Some(encoding) = response.header("content-encoding")
+        && !encoding.eq_ignore_ascii_case("identity")
+    {
+        return Err(exchange_error(format!(
+            "unexpected content encoding {encoding:?}"
+        )));
+    }
+    let count = |name: &str| {
+        response
+            .headers
+            .iter()
+            .filter(|(seen, _)| seen == name)
+            .count()
+    };
+    let transfer_encodings = count("transfer-encoding");
+    let content_lengths = count("content-length");
+    if transfer_encodings > 1 || content_lengths > 1 {
+        return Err(exchange_error("duplicate framing header"));
+    }
+    if transfer_encodings == 1 && content_lengths == 1 {
+        return Err(exchange_error(
+            "transfer encoding and content length are both present",
+        ));
+    }
+    response.body = if let Some(encoding) = response.header("transfer-encoding") {
+        if !encoding.eq_ignore_ascii_case("chunked") {
+            return Err(exchange_error(format!(
+                "unsupported transfer encoding {encoding:?}"
+            )));
+        }
+        decode_chunked(rest)?
+    } else if let Some(length) = response.header("content-length") {
+        let length: usize = length
+            .bytes()
+            .all(|byte| byte.is_ascii_digit())
+            .then(|| length.parse().ok())
+            .flatten()
+            .ok_or_else(|| exchange_error(format!("malformed content length {length:?}")))?;
+        if rest.len() != length {
+            return Err(exchange_error(format!(
+                "body holds {} bytes, content length says {length}",
+                rest.len()
+            )));
+        }
+        rest.to_vec()
+    } else {
+        rest.to_vec()
+    };
+    Ok(response)
+}
+
+/// Whether `byte` may appear in an HTTP header name (an RFC 9110 token).
+fn is_token_byte(byte: u8) -> bool {
+    byte.is_ascii_alphanumeric() || b"!#$%&'*+-.^_`|~".contains(&byte)
+}
+
+/// Parses one `name: value` header line, lowercasing the name.
+fn parse_header_line(line: &str) -> Result<(String, String), Report<ReleaseError>> {
+    line.split_once(':')
+        .filter(|(name, _)| !name.is_empty() && name.bytes().all(is_token_byte))
+        .map(|(name, value)| (name.to_ascii_lowercase(), value.trim().to_owned()))
+        .ok_or_else(|| exchange_error(format!("malformed header line {line:?}")))
+}
+
+/// Parses `HTTP/1.x NNN reason` into its status code.
+fn parse_status_line(line: &str) -> Result<u16, Report<ReleaseError>> {
+    let mut parts = line.splitn(3, ' ');
+    let version = parts.next().unwrap_or_default();
+    let code = parts.next().unwrap_or_default();
+    if !matches!(version, "HTTP/1.1" | "HTTP/1.0")
+        || code.len() != 3
+        || !code.bytes().all(|byte| byte.is_ascii_digit())
+    {
+        return Err(exchange_error(format!("malformed status line {line:?}")));
+    }
+    code.parse()
+        .map_err(|_| exchange_error(format!("malformed status line {line:?}")))
+}
+
+/// Decodes a complete chunked body, ignoring chunk extensions.
+///
+/// The last chunk must be exactly `0\r\n\r\n` with nothing after it, so
+/// trailers and trailing bytes are rejected.
+fn decode_chunked(mut rest: &[u8]) -> Result<Vec<u8>, Report<ReleaseError>> {
+    let mut body = Vec::new();
+    loop {
+        let line_end = rest
+            .windows(2)
+            .position(|window| window == b"\r\n")
+            .ok_or_else(|| exchange_error("chunk size line is incomplete"))?;
+        let size_text = std::str::from_utf8(&rest[..line_end])
+            .ok()
+            .map(|line| line.split(';').next().unwrap_or_default())
+            .filter(|size| {
+                !size.is_empty() && size.len() <= 8 && size.bytes().all(|b| b.is_ascii_hexdigit())
+            })
+            .ok_or_else(|| exchange_error("malformed chunk size"))?;
+        let size = usize::from_str_radix(size_text, 16)
+            .map_err(|_| exchange_error(format!("malformed chunk size {size_text:?}")))?;
+        rest = &rest[line_end + 2..];
+        if size == 0 {
+            if rest != b"\r\n" {
+                return Err(exchange_error(
+                    "last chunk is not followed by exactly one empty line",
+                ));
+            }
+            return Ok(body);
+        }
+        let data = rest
+            .get(..size)
+            .filter(|_| rest.get(size..size + 2) == Some(b"\r\n"))
+            .ok_or_else(|| exchange_error("chunk data is truncated"))?;
+        body.extend_from_slice(data);
+        rest = &rest[size + 2..];
+    }
+}
+
+/// Returns whether `response` is the settings-free health answer.
+pub(in crate::recipe) fn is_health_ok(response: &HttpResponse) -> bool {
+    response.status == 200 && response.body.trim_ascii() == b"ok"
+}
+
+/// Requires a successful publisher page proxied from this run's origin with
+/// exactly one injected Trusted Server script ahead of the origin content.
+///
+/// # Errors
+///
+/// Returns [`RuntimeRejection::Status`] for any status but 200,
+/// [`RuntimeRejection::Injection`] for a non-HTML or non-UTF-8 page or a
+/// missing, duplicated, malformed or misplaced script, and
+/// [`RuntimeRejection::OriginMarker`] when the page does not hold this run's
+/// origin marker exactly once.
+pub(in crate::recipe) fn check_publisher_response(
+    response: &HttpResponse,
+    marker: &str,
+) -> Result<PublisherObservation, Report<ReleaseError>> {
+    if response.status != 200 {
+        return Err(runtime_error(
+            RuntimeRejection::Status,
+            format!("publisher page answered {}", response.status),
+        ));
+    }
+    let injection = |message: &str| runtime_error(RuntimeRejection::Injection, message);
+    if !response
+        .header("content-type")
+        .is_some_and(|value| value.to_ascii_lowercase().starts_with("text/html"))
+    {
+        return Err(injection("publisher page is not text/html"));
+    }
+    let body = std::str::from_utf8(&response.body)
+        .map_err(|_| injection("publisher page is not UTF-8"))?;
+    if body.matches(marker).count() != 1 {
+        return Err(runtime_error(
+            RuntimeRejection::OriginMarker,
+            "publisher page does not hold this run's origin marker exactly once",
+        ));
+    }
+    let scripts = body.matches(SCRIPT_ID).count();
+    if scripts != 1 {
+        return Err(injection(&format!(
+            "publisher page holds {scripts} Trusted Server scripts, not one"
+        )));
+    }
+    let id_at = body.find(SCRIPT_ID).unwrap_or_default();
+    let open = body[..id_at]
+        .rfind("<script")
+        .filter(|open| !body[*open..id_at].contains('>'))
+        .ok_or_else(|| injection("Trusted Server script id is not on a script tag"))?;
+    let close = body[id_at..]
+        .find('>')
+        .map(|offset| id_at + offset)
+        .ok_or_else(|| injection("Trusted Server script tag is unterminated"))?;
+    let source = body[open..close]
+        .split_once("src=\"")
+        .and_then(|(_, rest)| rest.split_once('"'))
+        .map(|(source, _)| source)
+        .filter(|source| source.starts_with(SCRIPT_SOURCE_PREFIX))
+        .ok_or_else(|| injection("Trusted Server script does not load the tsjs bundle"))?;
+    if body.find(marker).is_some_and(|marker_at| marker_at < open) {
+        return Err(injection(
+            "Trusted Server script follows the origin content",
+        ));
+    }
+    Ok(PublisherObservation {
+        status: response.status,
+        body_size: response.body.len(),
+        body_sha256: hex::encode(Sha256::digest(&response.body)),
+        script_src: source.to_owned(),
+    })
+}
+
+/// The publisher page the origin fixture serves for `marker`.
+pub(in crate::recipe) fn origin_page(marker: &str) -> String {
+    format!(
+        "<!DOCTYPE html>\n<html lang=\"en\"><head><meta charset=\"utf-8\">\
+         <title>Example publisher</title></head>\n<body><main><h1>Example publisher</h1>\
+         <p id=\"origin-fixture\">{marker}</p></main></body></html>\n"
+    )
+}
+
+/// A loopback publisher origin that serves [`origin_page`] for `GET /` and
+/// records every request line it receives.
+pub(in crate::recipe) struct OriginFixture {
+    address: SocketAddr,
+    stop: Arc<AtomicBool>,
+    requests: Arc<Mutex<Vec<String>>>,
+    thread: Option<JoinHandle<()>>,
+}
+
+impl OriginFixture {
+    /// Binds an ephemeral loopback port and starts serving.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`RuntimeRejection::Fixture`] when the listener cannot be
+    /// bound or configured.
+    pub(in crate::recipe) fn start(marker: &str) -> Result<Self, Report<ReleaseError>> {
+        let fixture = |error: std::io::Error| {
+            runtime_error(
+                RuntimeRejection::Fixture,
+                format!("cannot start the origin fixture: {error}"),
+            )
+        };
+        let listener = TcpListener::bind(("127.0.0.1", 0)).map_err(fixture)?;
+        listener.set_nonblocking(true).map_err(fixture)?;
+        let address = listener.local_addr().map_err(fixture)?;
+        let stop = Arc::new(AtomicBool::new(false));
+        let requests = Arc::new(Mutex::new(Vec::new()));
+        let page = origin_page(marker);
+        let thread = {
+            let stop = Arc::clone(&stop);
+            let requests = Arc::clone(&requests);
+            std::thread::spawn(move || serve(&listener, &stop, &requests, &page))
+        };
+        Ok(Self {
+            address,
+            stop,
+            requests,
+            thread: Some(thread),
+        })
+    }
+
+    /// The bound loopback address.
+    pub(in crate::recipe) fn address(&self) -> SocketAddr {
+        self.address
+    }
+
+    /// Stops serving and returns every request line received.
+    pub(in crate::recipe) fn stop(mut self) -> Vec<String> {
+        self.halt();
+        self.requests
+            .lock()
+            .map(|requests| requests.clone())
+            .unwrap_or_default()
+    }
+
+    fn halt(&mut self) {
+        self.stop.store(true, Ordering::SeqCst);
+        if let Some(thread) = self.thread.take() {
+            let _ = thread.join();
+        }
+    }
+}
+
+impl Drop for OriginFixture {
+    fn drop(&mut self) {
+        self.halt();
+    }
+}
+
+/// Accepts connections until `stop` is set, answering each in turn.
+fn serve(listener: &TcpListener, stop: &AtomicBool, requests: &Mutex<Vec<String>>, page: &str) {
+    while !stop.load(Ordering::SeqCst) {
+        match listener.accept() {
+            Ok((stream, _)) => {
+                if let Some(line) = answer(stream, page)
+                    && let Ok(mut requests) = requests.lock()
+                {
+                    requests.push(line);
+                }
+            }
+            Err(error) if error.kind() == ErrorKind::WouldBlock => {
+                std::thread::sleep(ACCEPT_POLL);
+            }
+            Err(_) => std::thread::sleep(ACCEPT_POLL),
+        }
+    }
+}
+
+/// Reads one request head and answers it; returns its request line.
+fn answer(mut stream: TcpStream, page: &str) -> Option<String> {
+    stream.set_nonblocking(false).ok()?;
+    stream
+        .set_read_timeout(Some(Duration::from_secs(10)))
+        .ok()?;
+    stream
+        .set_write_timeout(Some(Duration::from_secs(10)))
+        .ok()?;
+    let mut head = Vec::new();
+    let mut limited = (&stream).take(REQUEST_HEAD_LIMIT);
+    let mut byte = [0_u8; 1];
+    while !head.ends_with(b"\r\n\r\n") {
+        match limited.read(&mut byte) {
+            Ok(1) => head.push(byte[0]),
+            _ => return None,
+        }
+    }
+    let line = String::from_utf8_lossy(&head)
+        .lines()
+        .next()
+        .unwrap_or_default()
+        .to_owned();
+    let (status, content_type, body) = if line.starts_with("GET / ") {
+        ("200 OK", "text/html; charset=utf-8", page)
+    } else {
+        ("404 Not Found", "text/plain; charset=utf-8", "not found\n")
+    };
+    let response = format!(
+        "HTTP/1.1 {status}\r\nContent-Type: {content_type}\r\nContent-Length: {}\r\n\
+         Connection: close\r\n\r\n{body}",
+        body.len()
+    );
+    let _ = stream.write_all(response.as_bytes());
+    let _ = stream.flush();
+    Some(line)
+}
diff --git a/crates/trusted-server-release/src/recipe/runtime/export.rs b/crates/trusted-server-release/src/recipe/runtime/export.rs
new file mode 100644
index 0000000000..df78b329e7
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/runtime/export.rs
@@ -0,0 +1,92 @@
+//! Checked diagnostic runtime export; it cannot reconstruct acceptance from JSON.
+
+use error_stack::Report;
+use serde_json::{Value, json};
+
+use super::{FastlyRuntimeAccepted, RuntimeRejection, runtime_error};
+use crate::documents::{Role as DocumentRole, canonical_json};
+use crate::error::ReleaseError;
+use crate::recipe::compare::FASTLY_ASSET;
+use crate::recipe::{AssetId, RecipeCompleted, Role};
+use crate::source::CommitId;
+
+impl FastlyRuntimeAccepted {
+    /// Exports accepted runtime facts bound to this exact source, role and artifact.
+    ///
+    /// The immutable owning result survives build/runtime working-root cleanup.
+    /// Its diagnostic representation grants no qualification or signing authority.
+    ///
+    /// # Errors
+    ///
+    /// Rejects changed completed outputs, another source/role/artifact or a record
+    /// exceeding the metadata bound. JSON cannot construct runtime acceptance.
+    pub(crate) fn diagnostic_for(
+        &self,
+        completed: &RecipeCompleted,
+    ) -> Result<Value, Report<ReleaseError>> {
+        completed.rehash_for_handoff()?;
+        self.check_export_binding(
+            completed.commit(),
+            completed.role(),
+            completed.asset(),
+            completed.artifact().sha256(),
+            completed.artifact().size(),
+        )?;
+        let record = self.diagnostic_record()?;
+        completed.rehash_for_handoff()?;
+        Ok(record)
+    }
+
+    fn check_export_binding(
+        &self,
+        commit: &CommitId,
+        role: Role,
+        asset: AssetId,
+        digest: &str,
+        size: u64,
+    ) -> Result<(), Report<ReleaseError>> {
+        if self.source_commit() != commit
+            || self.role != role
+            || asset.artifact().name != FASTLY_ASSET
+            || self.observed().artifact_sha256() != digest
+            || self.observed().artifact_size() != size
+        {
+            return Err(runtime_error(
+                RuntimeRejection::Artifact,
+                "runtime acceptance belongs to another source, role or final artifact",
+            ));
+        }
+        Ok(())
+    }
+
+    fn diagnostic_record(&self) -> Result<Value, Report<ReleaseError>> {
+        let observed = self.observed();
+        let publisher = observed.publisher();
+        let output = observed.viceroy_output();
+        let startup = u64::try_from(observed.startup().as_millis())
+            .map_err(|error| runtime_error(RuntimeRejection::Startup, error))?;
+        let record = json!({
+            "domain": "trusted-server.release.fastly-runtime-diagnostic",
+            "schema_version": 1, "release_qualification": false,
+            "source_commit": self.source_commit().as_str(), "role": self.role.spec_label(),
+            "asset": FASTLY_ASSET,
+            "artifact": {"sha256": observed.artifact_sha256(), "size": observed.artifact_size()},
+            "core_format": "core-wasm-fastly-command",
+            "viceroy": {"version": observed.viceroy_version(), "sha256": observed.viceroy_sha256()},
+            "fixture_sha256": observed.fixture_sha256(), "config_sha256": observed.config_sha256(),
+            "health_status": observed.health_status(),
+            "publisher": {"status": publisher.status, "body_size": publisher.body_size,
+                "body_sha256": publisher.body_sha256, "script_src": publisher.script_src},
+            "origin_requests": observed.origin_requests(), "startup_milliseconds": startup,
+            "viceroy_outcome": observed.viceroy_outcome().to_string(),
+            "viceroy_output": {"stdout_sha256": output.stdout_sha256,
+                "stderr_sha256": output.stderr_sha256, "stderr_tail": output.stderr_tail},
+        });
+        canonical_json(&record, DocumentRole::Metadata)
+            .map_err(|error| error.change_context(ReleaseError::Runtime))?;
+        Ok(record)
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/trusted-server-release/src/recipe/runtime/export/tests.rs b/crates/trusted-server-release/src/recipe/runtime/export/tests.rs
new file mode 100644
index 0000000000..3603f19624
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/runtime/export/tests.rs
@@ -0,0 +1,126 @@
+use std::time::Duration;
+
+use super::super::{FastlyRuntimeAccepted, GateObservation, PublisherObservation, ViceroyOutput};
+use crate::process::ProcessOutcome;
+use crate::recipe::{AssetId, Role};
+use crate::source::CommitId;
+
+// A fictional observation used only to exercise export joins and formatting.
+// Production acceptance is still minted only by the actual final-byte gate.
+fn accepted() -> FastlyRuntimeAccepted {
+    FastlyRuntimeAccepted {
+        source_commit: CommitId::parse(&"a".repeat(40)).expect("should parse fictional source"),
+        role: Role::Canonical,
+        observed: GateObservation {
+            artifact_sha256: "b".repeat(64),
+            artifact_size: 12,
+            viceroy_version: "0.21.0".to_owned(),
+            viceroy_sha256: "c".repeat(64),
+            fixture_sha256: "d".repeat(64),
+            config_sha256: "e".repeat(64),
+            health_status: 200,
+            publisher: PublisherObservation {
+                status: 200,
+                body_size: 42,
+                body_sha256: "f".repeat(64),
+                script_src: "/static/tsjs=example".to_owned(),
+            },
+            origin_requests: vec!["GET / HTTP/1.1".to_owned()],
+            startup: Duration::from_millis(1234),
+            viceroy_outcome: ProcessOutcome::Cancelled,
+            viceroy_output: ViceroyOutput {
+                stdout_sha256: "1".repeat(64),
+                stderr_sha256: "2".repeat(64),
+                stderr_tail: "fixture output".to_owned(),
+            },
+        },
+    }
+}
+
+#[test]
+fn runtime_export_rejects_another_source_role_asset_digest_or_size() {
+    let accepted = accepted();
+    let source = accepted.source_commit();
+    let fastly = AssetId::parse("trusted-server-fastly.wasm").expect("should parse Fastly asset");
+    assert!(
+        accepted
+            .check_export_binding(source, Role::Canonical, fastly, &"b".repeat(64), 12)
+            .is_ok(),
+        "should accept the exact runtime build binding"
+    );
+    for (commit, role, asset, digest, size) in [
+        (
+            CommitId::parse(&"f".repeat(40)).expect("should parse different source"),
+            Role::Canonical,
+            fastly,
+            "b".repeat(64),
+            12,
+        ),
+        (
+            source.clone(),
+            Role::Reproduction,
+            fastly,
+            "b".repeat(64),
+            12,
+        ),
+        (
+            source.clone(),
+            Role::Canonical,
+            AssetId::parse("ts-x86_64-unknown-linux-gnu").expect("should parse native asset"),
+            "b".repeat(64),
+            12,
+        ),
+        (source.clone(), Role::Canonical, fastly, "c".repeat(64), 12),
+        (source.clone(), Role::Canonical, fastly, "b".repeat(64), 13),
+    ] {
+        assert!(
+            accepted
+                .check_export_binding(&commit, role, asset, &digest, size)
+                .is_err(),
+            "should reject a runtime acceptance attached to another build"
+        );
+    }
+}
+
+#[test]
+fn runtime_export_preserves_actual_gate_facts_and_integer_duration() {
+    let accepted = accepted();
+    let record = accepted
+        .diagnostic_record()
+        .expect("should export checked diagnostic facts");
+    assert_eq!(record["role"], "A", "should retain the accepted build role");
+    assert_eq!(
+        record["viceroy"]["sha256"],
+        "c".repeat(64),
+        "should retain actual runtime executable identity"
+    );
+    assert_eq!(
+        record["publisher"]["body_sha256"],
+        "f".repeat(64),
+        "should retain accepted publisher body digest"
+    );
+    assert_eq!(
+        record["startup_milliseconds"], 1234,
+        "should avoid lossy floating-point duration"
+    );
+    assert_eq!(
+        record["release_qualification"], false,
+        "should grant no release authority"
+    );
+}
+
+#[test]
+fn runtime_export_rejects_oversized_records_and_duration_overflow() {
+    let mut oversized = accepted();
+    oversized.observed.origin_requests = vec!["x".repeat(1024 * 1024)];
+    assert!(
+        oversized.diagnostic_record().is_err(),
+        "should bound retained runtime diagnostic bytes"
+    );
+    let mut duration = accepted();
+    duration.observed.startup = Duration::MAX;
+    assert!(
+        duration.diagnostic_record().is_err(),
+        "should reject integer duration overflow"
+    );
+}
diff --git a/crates/trusted-server-release/src/recipe/runtime/logs.rs b/crates/trusted-server-release/src/recipe/runtime/logs.rs
new file mode 100644
index 0000000000..4a02258da2
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/runtime/logs.rs
@@ -0,0 +1,98 @@
+//! Scan of the captured Viceroy output for guest failures.
+//!
+//! A guest trap or panic can still leave a valid-looking response on the
+//! wire, so after the run the gate searches both captured streams (each
+//! bounded by the command's output cap) for failure markers that Viceroy or
+//! the Rust runtime print. Matching ignores ASCII case. The streams are
+//! retained only as digests plus a short sanitized stderr tail.
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256};
+
+use super::{RuntimeRejection, runtime_error};
+use crate::error::ReleaseError;
+
+/// Lowercase markers of a guest trap, panic or failed request execution.
+const GUEST_FAILURE_MARKERS: [&str; 7] = [
+    "wasm trap",
+    "wasm backtrace",
+    "panicked at",
+    "error while executing",
+    "there was an error handling the request",
+    "error handling request",
+    "guest exited with",
+];
+/// Bytes of stderr kept in the summary.
+const TAIL_BYTES: usize = 1024;
+
+/// Digests and a short tail of the captured Viceroy output.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct ViceroyOutput {
+    pub(crate) stdout_sha256: String,
+    pub(crate) stderr_sha256: String,
+    /// The last stderr bytes, lossily decoded with control characters other
+    /// than newline replaced by `?`.
+    pub(crate) stderr_tail: String,
+}
+
+/// Returns the last [`TAIL_BYTES`] of `stderr` as printable text.
+pub(in crate::recipe) fn sanitized_tail(stderr: &[u8]) -> String {
+    let start = stderr.len().saturating_sub(TAIL_BYTES);
+    String::from_utf8_lossy(&stderr[start..])
+        .chars()
+        .map(|character| {
+            if character.is_control() && character != '\n' {
+                '?'
+            } else {
+                character
+            }
+        })
+        .collect()
+}
+
+/// Rejects output carrying a guest failure marker and summarizes the rest.
+///
+/// # Errors
+///
+/// Returns [`RuntimeRejection::GuestFailure`] for a stderr line beginning
+/// with `Error:` or, naming the stream and marker, for the first failure
+/// marker found in either stream.
+pub(in crate::recipe) fn scan_viceroy_output(
+    stdout: &[u8],
+    stderr: &[u8],
+) -> Result<ViceroyOutput, Report<ReleaseError>> {
+    // A clean run leaves stderr empty; Viceroy reports a failed guest request
+    // there as an `Error: ...` line.
+    if String::from_utf8_lossy(stderr)
+        .lines()
+        .any(|line| line.trim_start().to_ascii_lowercase().starts_with("error:"))
+    {
+        return Err(runtime_error(
+            RuntimeRejection::GuestFailure,
+            format!(
+                "Viceroy stderr reports an error line; stderr tail: {}",
+                sanitized_tail(stderr)
+            ),
+        ));
+    }
+    for (stream, bytes) in [("stdout", stdout), ("stderr", stderr)] {
+        let text = String::from_utf8_lossy(bytes).to_ascii_lowercase();
+        if let Some(marker) = GUEST_FAILURE_MARKERS
+            .iter()
+            .find(|marker| text.contains(*marker))
+        {
+            return Err(runtime_error(
+                RuntimeRejection::GuestFailure,
+                format!(
+                    "Viceroy {stream} reports {marker:?}; stderr tail: {}",
+                    sanitized_tail(stderr)
+                ),
+            ));
+        }
+    }
+    Ok(ViceroyOutput {
+        stdout_sha256: hex::encode(Sha256::digest(stdout)),
+        stderr_sha256: hex::encode(Sha256::digest(stderr)),
+        stderr_tail: sanitized_tail(stderr),
+    })
+}
diff --git a/crates/trusted-server-release/src/recipe/runtime/viceroy.rs b/crates/trusted-server-release/src/recipe/runtime/viceroy.rs
new file mode 100644
index 0000000000..9b226a46be
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/runtime/viceroy.rs
@@ -0,0 +1,160 @@
+//! Explicit selection of the pinned Viceroy executable.
+//!
+//! The gate never searches `PATH`: the caller names one absolute regular
+//! file. Selection hashes it, requires `--version` to report exactly
+//! [`PINNED_VICEROY_VERSION`], and rehashes it so the reported version and
+//! the recorded digest describe the same bytes.
+
+use std::ffi::OsString;
+use std::path::{Path, PathBuf};
+use std::time::Duration;
+
+use error_stack::Report;
+
+use super::{RuntimeRejection, runtime_error};
+use crate::documents::hash_bounded_with_check;
+use crate::error::ReleaseError;
+use crate::process::{BoundedCommand, ProcessLimits};
+
+/// The Viceroy version pinned by `.tool-versions`.
+pub(crate) const PINNED_VICEROY_VERSION: &str = "0.21.0";
+/// Upper bound on the Viceroy executable size.
+const VICEROY_LIMIT: u64 = 512 * 1024 * 1024;
+
+/// A selected, version-checked and hashed Viceroy executable.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct SelectedViceroy {
+    path: PathBuf,
+    version: String,
+    sha256: String,
+}
+
+fn selection_error(message: impl std::fmt::Display) -> Report<ReleaseError> {
+    runtime_error(RuntimeRejection::Viceroy, message)
+}
+
+impl SelectedViceroy {
+    /// Selects the Viceroy executable at the absolute `path`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`RuntimeRejection::Viceroy`] when `path` is not absolute, is
+    /// not a regular file, cannot be hashed, does not report exactly the
+    /// pinned version, or changes while it is checked.
+    pub(crate) fn select(path: &Path) -> Result<Self, Report<ReleaseError>> {
+        if !path.is_absolute() {
+            return Err(selection_error("Viceroy path is not absolute"));
+        }
+        let metadata = std::fs::symlink_metadata(path)
+            .map_err(|error| selection_error(format!("cannot inspect Viceroy: {error}")))?;
+        if !metadata.is_file() {
+            return Err(selection_error("Viceroy is not a regular file"));
+        }
+        let sha256 = digest(path)?;
+        let working_directory = path
+            .parent()
+            .ok_or_else(|| selection_error("Viceroy path has no parent directory"))?;
+        let stdout = BoundedCommand::new(
+            path,
+            working_directory,
+            ProcessLimits {
+                wall: Duration::from_secs(60),
+                stdout_max: 4096,
+                stderr_max: 4096,
+            },
+        )
+        .map_err(|error| error.change_context(ReleaseError::Runtime))?
+        .arguments([OsString::from("--version")])
+        .run()
+        .and_then(crate::process::ProcessResult::require_success)
+        .map_err(|error| {
+            error
+                .change_context(ReleaseError::Runtime)
+                .attach(RuntimeRejection::Viceroy)
+        })?;
+        let version = parse_version_output(&stdout)?;
+        let selected = Self {
+            path: path.to_owned(),
+            version,
+            sha256,
+        };
+        selected.reverify()?;
+        Ok(selected)
+    }
+
+    /// The selected absolute path.
+    pub(crate) fn path(&self) -> &Path {
+        &self.path
+    }
+
+    /// The reported version, equal to [`PINNED_VICEROY_VERSION`].
+    pub(crate) fn version(&self) -> &str {
+        &self.version
+    }
+
+    /// SHA-256 of the selected executable.
+    pub(crate) fn sha256(&self) -> &str {
+        &self.sha256
+    }
+
+    /// Requires the executable to still hash to the recorded digest.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`RuntimeRejection::Viceroy`] when it cannot be hashed or its
+    /// bytes changed.
+    pub(crate) fn reverify(&self) -> Result<(), Report<ReleaseError>> {
+        if digest(&self.path)? != self.sha256 {
+            return Err(selection_error(
+                "Viceroy executable changed after selection",
+            ));
+        }
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+impl SelectedViceroy {
+    /// A selection that was never version-checked, for tests that must be
+    /// rejected before Viceroy would run.
+    pub(crate) fn unverified_for_tests(path: &Path, sha256: &str) -> Self {
+        Self {
+            path: path.to_owned(),
+            version: PINNED_VICEROY_VERSION.to_owned(),
+            sha256: sha256.to_owned(),
+        }
+    }
+}
+
+fn digest(path: &Path) -> Result<String, Report<ReleaseError>> {
+    hash_bounded_with_check(path, VICEROY_LIMIT, &|| Ok(()))
+        .map(|measured| measured.sha256)
+        .map_err(|error| {
+            error
+                .change_context(ReleaseError::Runtime)
+                .attach(RuntimeRejection::Viceroy)
+        })
+}
+
+/// Parses `viceroy <version>\n` and requires the pinned version.
+///
+/// # Errors
+///
+/// Returns [`RuntimeRejection::Viceroy`] for any other output, including a
+/// different, prefixed or suffixed version.
+pub(in crate::recipe) fn parse_version_output(
+    stdout: &[u8],
+) -> Result<String, Report<ReleaseError>> {
+    let version = std::str::from_utf8(stdout)
+        .ok()
+        .and_then(|text| text.strip_suffix('\n'))
+        .and_then(|line| line.strip_prefix("viceroy "))
+        .filter(|version| !version.contains(char::is_whitespace))
+        .ok_or_else(|| selection_error("unrecognized Viceroy version output"))?;
+    if version != PINNED_VICEROY_VERSION {
+        return Err(selection_error(format!(
+            "Viceroy reports {version:?}, not the pinned {PINNED_VICEROY_VERSION}"
+        )));
+    }
+    Ok(version.to_owned())
+}
diff --git a/crates/trusted-server-release/src/recipe/sources.rs b/crates/trusted-server-release/src/recipe/sources.rs
new file mode 100644
index 0000000000..7347c7753f
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/sources.rs
@@ -0,0 +1,35 @@
+//! Cargo source-replacement arguments for the vendored dependency tree.
+
+use crate::materials::GitSourceConfig;
+
+/// Name of the directory source every locked source is replaced with.
+pub(super) const VENDOR_SOURCE: &str = "ts-vendor";
+
+/// Returns the `--config` pairs replacing every locked source with the vendor
+/// directory.
+///
+/// `vendor_directory` is the directory as the confined build sees it and must
+/// already be plain text without quotes or backslashes. Each Git source is a
+/// full `[source."<key>"]` table (`git`, reference, `replace-with`), because
+/// Cargo rejects a source table without a location.
+pub(super) fn source_replacement_arguments(
+    vendor_directory: &str,
+    git_sources: &[GitSourceConfig],
+) -> Vec<String> {
+    let mut entries = vec![format!("source.crates-io.replace-with=\"{VENDOR_SOURCE}\"")];
+    for source in git_sources {
+        let key = source.key();
+        entries.push(format!("source.\"{key}\".git=\"{}\"", source.url()));
+        if let Some((kind, value)) = source.reference() {
+            entries.push(format!("source.\"{key}\".{kind}=\"{value}\""));
+        }
+        entries.push(format!("source.\"{key}\".replace-with=\"{VENDOR_SOURCE}\""));
+    }
+    entries.push(format!(
+        "source.{VENDOR_SOURCE}.directory=\"{vendor_directory}\""
+    ));
+    entries
+        .into_iter()
+        .flat_map(|entry| ["--config".to_owned(), entry])
+        .collect()
+}
diff --git a/crates/trusted-server-release/src/recipe/startup.rs b/crates/trusted-server-release/src/recipe/startup.rs
new file mode 100644
index 0000000000..2414406270
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/startup.rs
@@ -0,0 +1,701 @@
+//! Clean-container startup acceptance of the final Linux `ts` bytes.
+//!
+//! The exact final executable is copied once into a private read-only
+//! directory and started as `ts --version` in each reviewed clean
+//! distribution: the glibc 2.34 floor (UBI 9) and two newer mainstream
+//! distributions. Each container runs by local image ID with no network, a
+//! read-only root, an unprivileged numeric user, every capability dropped,
+//! no privilege escalation and bounded processes, memory and CPU time. No
+//! operator configuration exists in the container, and `--version` must
+//! print exactly the owning build facts and exit 0, so the startup proves
+//! the loader floor and that no configuration fallback runs before
+//! argument parsing. The copy must still hash to the accepted digest after
+//! every run.
+
+mod accepted;
+mod lifecycle;
+pub(crate) use accepted::NativeStartupAccepted;
+pub(crate) mod native;
+
+use std::ffi::OsString;
+use std::fs;
+use std::io::Write as _;
+use std::os::unix::fs::{OpenOptionsExt as _, PermissionsExt as _};
+use std::path::{Path, PathBuf};
+use std::time::Duration;
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256};
+
+use super::artifact::EXECUTABLE_LIMIT;
+use super::compare::read_artifact;
+use super::{RecipeCompleted, recipe_error};
+use crate::boundary::daemon::{ContainerId, DockerClient, host_arguments};
+use crate::documents::hash_bounded_with_check;
+use crate::error::ReleaseError;
+use crate::policy::ReleaseTarget;
+use crate::process::{ProcessLimits, ProcessOutcome, ProcessResult};
+use crate::source::CommitId;
+
+/// The only asset the Linux startup gate accepts.
+pub(crate) const LINUX_CLI_ASSET: &str = "ts-x86_64-unknown-linux-gnu";
+/// Numeric unprivileged account inside every startup container.
+const STARTUP_USER: &str = "65534:65534";
+/// Read-only mount point of the private copy inside the container.
+const MOUNT_POINT: &str = "/opt/ts";
+/// File name of the private copy.
+const EXECUTABLE_NAME: &str = "ts";
+/// Wall limit of attached execution; stopped-container creation is separately bounded.
+const STARTUP_WALL: Duration = Duration::from_secs(120);
+/// Captured stdout limit; the version line is short.
+const STARTUP_STDOUT_MAX: u64 = 4096;
+/// Captured stderr limit; the Docker client may warn about the kernel.
+const STARTUP_STDERR_MAX: u64 = 64 * 1024;
+/// Stderr bytes shown when a run is rejected.
+const STDERR_TAIL_BYTES: usize = 4096;
+
+/// One reviewed clean distribution the Linux executable must start on.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum StartupDistribution {
+    /// Red Hat UBI 9, the glibc 2.34 floor.
+    Ubi9,
+    /// Ubuntu 22.04 LTS (glibc 2.35).
+    Ubuntu2204,
+    /// Debian 12 (glibc 2.36).
+    Debian12,
+}
+
+impl StartupDistribution {
+    /// Every reviewed distribution, in run order.
+    pub(crate) const ALL: [Self; 3] = [Self::Ubi9, Self::Ubuntu2204, Self::Debian12];
+
+    /// Stable label used by fixtures and measurements.
+    pub(crate) fn label(self) -> &'static str {
+        match self {
+            Self::Ubi9 => "ubi9",
+            Self::Ubuntu2204 => "ubuntu-22.04",
+            Self::Debian12 => "debian-12",
+        }
+    }
+
+    /// The tag-pinned image reference the ordinary CI fixture pulls.
+    ///
+    /// A tag is not an identity: every run selects the pulled image by its
+    /// local image ID, which the measurement records.
+    pub(crate) fn reference(self) -> &'static str {
+        match self {
+            Self::Ubi9 => "registry.access.redhat.com/ubi9/ubi-minimal:9.6",
+            Self::Ubuntu2204 => "docker.io/library/ubuntu:22.04",
+            Self::Debian12 => "docker.io/library/debian:12",
+        }
+    }
+
+    /// Parses exactly one [`Self::label`].
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] for any other text.
+    pub(crate) fn parse(label: &str) -> Result<Self, Report<ReleaseError>> {
+        Self::ALL
+            .into_iter()
+            .find(|distribution| distribution.label() == label)
+            .ok_or_else(|| recipe_error(format!("unknown startup distribution {label:?}")))
+    }
+}
+
+/// Reports whether `text` is a local image ID: `sha256:` and 64 lowercase
+/// hex digits, never a tag or repository reference.
+pub(crate) fn is_local_image_id(text: &str) -> bool {
+    text.strip_prefix("sha256:").is_some_and(|digest| {
+        digest.len() == 64
+            && digest
+                .bytes()
+                .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+    })
+}
+
+/// A reviewed distribution selected by its local image ID.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct StartupImage {
+    distribution: StartupDistribution,
+    id: String,
+}
+
+impl StartupImage {
+    /// Selects `distribution` by the local image ID `id`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] unless `id` is `sha256:` followed by
+    /// 64 lowercase hex digits.
+    pub(crate) fn new(
+        distribution: StartupDistribution,
+        id: &str,
+    ) -> Result<Self, Report<ReleaseError>> {
+        if !is_local_image_id(id) {
+            return Err(recipe_error(format!(
+                "startup image for {} is not a local image ID",
+                distribution.label()
+            )));
+        }
+        Ok(Self {
+            distribution,
+            id: id.to_owned(),
+        })
+    }
+
+    /// The selected distribution.
+    pub(crate) fn distribution(&self) -> StartupDistribution {
+        self.distribution
+    }
+
+    /// The local image ID.
+    pub(crate) fn id(&self) -> &str {
+        &self.id
+    }
+}
+
+/// A Docker client whose host inputs are pinned and checked before every command.
+#[derive(Debug)]
+pub(crate) struct StartupClient {
+    client: DockerClient,
+}
+
+impl StartupClient {
+    /// Pins the Docker client and fresh private host inputs outside mounted roots.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for invalid, overlapping or unpinnable host inputs.
+    pub(crate) fn new(
+        docker: &Path,
+        state_parent: &Path,
+        mounted: &[&Path],
+    ) -> Result<Self, Report<ReleaseError>> {
+        Ok(Self {
+            client: DockerClient::new(
+                docker,
+                state_parent,
+                mounted,
+                ProcessLimits {
+                    wall: Duration::from_secs(15),
+                    stdout_max: 4096,
+                    stderr_max: STARTUP_STDERR_MAX,
+                },
+            )?,
+        })
+    }
+
+    /// Requires creation acknowledgement before any attached start request.
+    fn execute_created(
+        &self,
+        name: &str,
+        create_arguments: Vec<OsString>,
+        limits: ProcessLimits,
+        before_start: impl FnOnce() -> Result<(), Report<ReleaseError>>,
+        accept: impl FnOnce(&ProcessResult) -> Result<(), Report<ReleaseError>>,
+    ) -> Result<ProcessResult, Report<ReleaseError>> {
+        lifecycle::run_created(
+            || {
+                self.client.create(
+                    create_arguments,
+                    ProcessLimits {
+                        wall: Duration::from_secs(15),
+                        stdout_max: 4096,
+                        stderr_max: STARTUP_STDERR_MAX,
+                    },
+                )
+            },
+            |identity| {
+                before_start()?;
+                let result = self
+                    .client
+                    .command(
+                        startup_attach_arguments(self.client.inputs().config(), identity),
+                        limits,
+                    )?
+                    .run()?;
+                accept(&result)?;
+                Ok(result)
+            },
+            |identity, step| self.cleanup(identity, name, step),
+        )
+    }
+
+    /// Stops and removes only the uniquely named container owned by this run.
+    fn cleanup(
+        &self,
+        identity: Option<&ContainerId>,
+        name: &str,
+        step: &str,
+    ) -> Result<bool, Report<ReleaseError>> {
+        let target = identity.map_or(name, ContainerId::as_str);
+        let filter = cleanup_filter(identity, name);
+        let arguments: &[&str] = match step {
+            "stop" => &["stop", "--time", "2", target],
+            "rm" => &["rm", "--force", target],
+            "ps" => &["ps", "--all", "--quiet", "--filter", &filter],
+            _ => return Err(recipe_error("unknown startup cleanup step")),
+        };
+        let mut failures = Vec::new();
+        let result = self.client.cleanup_host(arguments, &mut failures);
+        if !failures.is_empty() {
+            let mut report = failures.remove(0);
+            for failure in failures {
+                report = report.attach(format!("cleanup also failed: {failure:?}"));
+            }
+            return Err(report);
+        }
+        Ok(result.is_some_and(|result| {
+            result.outcome() == (ProcessOutcome::Exited { code: 0 })
+                && (step != "ps" || result.stdout().is_empty())
+        }))
+    }
+}
+
+/// Selects the acknowledged immutable identity, or an unacknowledged owned name.
+fn cleanup_filter(identity: Option<&ContainerId>, name: &str) -> String {
+    identity.map_or_else(
+        || format!("name=^/{name}$"),
+        |id| format!("id={}", id.as_str()),
+    )
+}
+
+/// Formats fixture version output using the current producer's workspace version.
+///
+/// Owning [`NativeStartupAccepted`] gates derive the CLI version from their
+/// sealed selected-package observations instead of this fixture formatter.
+pub(crate) fn expected_version_output(commit: &CommitId, target: ReleaseTarget) -> String {
+    format!(
+        "ts package={} source={} target={} variant=default\n",
+        env!("CARGO_PKG_VERSION"),
+        commit.as_str(),
+        target.triple()
+    )
+}
+
+/// Returns the Docker client arguments of one startup run.
+pub(crate) fn startup_arguments(
+    config: &Path,
+    image: &StartupImage,
+    copy_directory: &Path,
+    name: &str,
+) -> Vec<OsString> {
+    let mut arguments = host_arguments(config);
+    arguments.extend([
+        "create".into(),
+        "--init".into(),
+        format!("--name={name}").into(),
+        "--pull=never".into(),
+        "--network=none".into(),
+        "--read-only".into(),
+        format!("--user={STARTUP_USER}").into(),
+        "--cap-drop=ALL".into(),
+        "--security-opt=no-new-privileges".into(),
+        "--pids-limit=64".into(),
+        "--memory=268435456".into(),
+        "--cpus=1".into(),
+        "--ulimit=cpu=30:30".into(),
+        "--workdir=/".into(),
+    ]);
+    let mut mount = OsString::from("--mount=type=bind,source=");
+    mount.push(copy_directory.as_os_str());
+    mount.push(format!(",target={MOUNT_POINT},readonly"));
+    arguments.push(mount);
+    arguments.push(format!("--entrypoint={MOUNT_POINT}/{EXECUTABLE_NAME}").into());
+    arguments.push(image.id.clone().into());
+    arguments.push("--version".into());
+    arguments
+}
+
+/// Returns attached-start arguments for one acknowledged immutable identity.
+pub(crate) fn startup_attach_arguments(config: &Path, identity: &ContainerId) -> Vec<OsString> {
+    let mut arguments = host_arguments(config);
+    arguments.extend(["start".into(), "--attach".into(), identity.as_str().into()]);
+    arguments
+}
+
+/// Accepts one startup run's outcome and stdout.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Recipe`] unless the run exited 0 and printed
+/// exactly `expected`.
+pub(crate) fn check_startup_output(
+    distribution: StartupDistribution,
+    outcome: ProcessOutcome,
+    stdout: &[u8],
+    expected: &str,
+) -> Result<(), Report<ReleaseError>> {
+    let label = distribution.label();
+    if outcome != (ProcessOutcome::Exited { code: 0 }) {
+        return Err(recipe_error(format!("ts --version on {label} {outcome}")));
+    }
+    if stdout != expected.as_bytes() {
+        return Err(recipe_error(format!(
+            "ts --version on {label} printed {:?}, expected {expected:?}",
+            String::from_utf8_lossy(stdout)
+        )));
+    }
+    Ok(())
+}
+
+/// One accepted startup run.
+#[derive(Clone, Debug)]
+pub(crate) struct StartupObserved {
+    /// The image the run used.
+    pub(crate) image: StartupImage,
+    /// The exact accepted stdout.
+    pub(crate) stdout: String,
+    /// SHA-256 of the captured Docker client stderr.
+    pub(crate) stderr_sha256: String,
+    /// Wall time of the Docker client.
+    pub(crate) elapsed: Duration,
+}
+
+/// A private read-only copy of the accepted final bytes.
+#[derive(Debug)]
+pub(crate) struct StartupCopy {
+    directory: PathBuf,
+    sha256: String,
+    size: u64,
+}
+
+impl StartupCopy {
+    /// Copies the accepted Linux executable into the fresh `directory`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] when `completed` is not the Linux
+    /// CLI asset or no longer rehashes, `directory` is not absolute UTF-8
+    /// free of the `,` and `=` that would split the bind mount, `directory`
+    /// exists, or the copy cannot be written read-only.
+    pub(crate) fn create(
+        completed: &RecipeCompleted,
+        directory: &Path,
+    ) -> Result<Self, Report<ReleaseError>> {
+        if completed.asset().artifact().name != LINUX_CLI_ASSET {
+            return Err(recipe_error(format!(
+                "the startup gate accepts only {LINUX_CLI_ASSET}"
+            )));
+        }
+        let mountable = directory.is_absolute()
+            && directory
+                .to_str()
+                .is_some_and(|text| !text.contains([',', '=']));
+        if !mountable {
+            return Err(recipe_error(
+                "startup copy directory cannot be bind-mounted verbatim",
+            ));
+        }
+        Self::write_private(completed, directory)
+    }
+
+    /// Writes the accepted bytes as the only `0555` file of the fresh
+    /// `0555` `directory` and rehashes the copy.
+    fn write_private(
+        completed: &RecipeCompleted,
+        directory: &Path,
+    ) -> Result<Self, Report<ReleaseError>> {
+        let bytes = read_artifact(completed)?;
+        let io = |error: std::io::Error| recipe_error(format!("cannot copy for startup: {error}"));
+        fs::create_dir(directory).map_err(io)?;
+        let copy = Self {
+            directory: directory.to_owned(),
+            sha256: completed.artifact().sha256().to_owned(),
+            size: completed.artifact().size(),
+        };
+        let path = directory.join(EXECUTABLE_NAME);
+        let mut file = fs::OpenOptions::new()
+            .write(true)
+            .create_new(true)
+            .mode(0o555)
+            .open(&path)
+            .map_err(io)?;
+        file.write_all(&bytes).map_err(io)?;
+        file.sync_all().map_err(io)?;
+        fs::set_permissions(&path, fs::Permissions::from_mode(0o555)).map_err(io)?;
+        fs::set_permissions(directory, fs::Permissions::from_mode(0o555)).map_err(io)?;
+        copy.verify()?;
+        Ok(copy)
+    }
+
+    /// Requires the copy to still hash to the accepted digest.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] when it cannot be read or changed.
+    pub(crate) fn verify(&self) -> Result<(), Report<ReleaseError>> {
+        let directory = fs::symlink_metadata(&self.directory)
+            .map_err(|error| recipe_error(format!("cannot inspect startup directory: {error}")))?;
+        if !directory.is_dir()
+            || fs::canonicalize(&self.directory).ok().as_deref() != Some(&self.directory)
+        {
+            return Err(recipe_error(
+                "startup directory is aliased or not a directory",
+            ));
+        }
+        let mut entries = fs::read_dir(&self.directory)
+            .map_err(|error| recipe_error(format!("cannot list startup directory: {error}")))?;
+        let entry = entries
+            .next()
+            .transpose()
+            .map_err(|error| recipe_error(format!("cannot inspect startup entry: {error}")))?;
+        if entry.is_none_or(|entry| entry.file_name() != EXECUTABLE_NAME)
+            || entries.next().is_some()
+        {
+            return Err(recipe_error(
+                "startup directory must hold only the executable",
+            ));
+        }
+        let digest = hash_bounded_with_check(
+            &self.directory.join(EXECUTABLE_NAME),
+            EXECUTABLE_LIMIT,
+            &|| Ok(()),
+        )?;
+        if digest.sha256 != self.sha256 || digest.size != self.size {
+            return Err(recipe_error("the startup copy changed"));
+        }
+        Ok(())
+    }
+
+    /// Starts the copy as `ts --version` in `image` and accepts the output.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Process`] when the Docker client cannot run,
+    /// or [`ReleaseError::Recipe`] for a rejected outcome or output, or a
+    /// copy that changed during the run.
+    pub(crate) fn start(
+        &self,
+        client: &StartupClient,
+        image: &StartupImage,
+        expected: &str,
+    ) -> Result<StartupObserved, Report<ReleaseError>> {
+        let limits = ProcessLimits {
+            wall: STARTUP_WALL,
+            stdout_max: STARTUP_STDOUT_MAX,
+            stderr_max: STARTUP_STDERR_MAX,
+        };
+        self.verify()?;
+        client.client.require_no_image_volumes(image.id())?;
+        let name = format!(
+            "ts-release-startup-{}",
+            hex::encode(crate::boundary::random_bytes::<12>()?)
+        );
+        self.verify()?;
+        let result = client.execute_created(
+            &name,
+            startup_arguments(
+                client.client.inputs().config(),
+                image,
+                &self.directory,
+                &name,
+            ),
+            limits,
+            || self.verify(),
+            |result| {
+                check_startup_output(
+                    image.distribution,
+                    result.outcome(),
+                    result.stdout(),
+                    expected,
+                )
+                .map_err(|error| {
+                    let stderr = result.stderr();
+                    let tail = &stderr[stderr.len().saturating_sub(STDERR_TAIL_BYTES)..];
+                    error.attach(format!(
+                        "docker stderr tail: {}",
+                        String::from_utf8_lossy(tail)
+                    ))
+                })
+            },
+        );
+        let after = self.verify();
+        let result = lifecycle::combine(result, after)?;
+        Ok(StartupObserved {
+            image: image.clone(),
+            stdout: expected.to_owned(),
+            stderr_sha256: hex::encode(Sha256::digest(result.stderr())),
+            elapsed: result.elapsed(),
+        })
+    }
+
+    /// Restores write permission and removes the copy.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] when the directory cannot be removed.
+    pub(crate) fn remove(self) -> Result<(), Report<ReleaseError>> {
+        self.remove_inner()
+    }
+
+    fn remove_inner(&self) -> Result<(), Report<ReleaseError>> {
+        let io = |error: std::io::Error| recipe_error(format!("cannot remove the copy: {error}"));
+        let metadata = fs::symlink_metadata(&self.directory).map_err(io)?;
+        if !metadata.is_dir()
+            || fs::canonicalize(&self.directory).ok().as_deref() != Some(&self.directory)
+        {
+            return Err(recipe_error("cannot remove an aliased startup directory"));
+        }
+        fs::set_permissions(&self.directory, fs::Permissions::from_mode(0o700)).map_err(io)?;
+        fs::remove_dir_all(&self.directory).map_err(io)
+    }
+}
+
+impl Drop for StartupCopy {
+    fn drop(&mut self) {
+        if self.directory.exists() {
+            let _ = self.remove_inner();
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn startup_client_pins_its_executable_and_empty_config() {
+        let scratch = tempfile::tempdir().expect("should create client scratch space");
+        let base = fs::canonicalize(scratch.path()).expect("should resolve client scratch space");
+        let program = base.join("docker");
+        fs::write(&program, b"fictional Docker client bytes").expect("should write client bytes");
+        let state = base.join("state");
+        fs::create_dir(&state).expect("should create disjoint host state");
+        let client = StartupClient::new(&program, &state, &[&base.join("mount")])
+            .expect("should pin host inputs without launching a process");
+        client
+            .client
+            .inputs()
+            .verify()
+            .expect("should verify fresh inputs");
+        fs::write(&program, b"changed Docker client bytes").expect("should change selected client");
+        assert!(
+            client.client.inputs().verify().is_err(),
+            "should reject a changed client before execution"
+        );
+        fs::write(&program, b"fictional Docker client bytes").expect("should restore client bytes");
+        let config = client.client.inputs().config();
+        fs::set_permissions(config, fs::Permissions::from_mode(0o700))
+            .expect("should reopen the configuration for a tamper case");
+        fs::write(config.join("config.json"), b"fictional configuration")
+            .expect("should add unreviewed configuration");
+        assert!(
+            client.client.inputs().verify().is_err(),
+            "should reject changed configuration before execution"
+        );
+    }
+
+    #[test]
+    fn acknowledged_container_is_attached_and_checked_by_immutable_id() {
+        let text = "a".repeat(64);
+        let identity = ContainerId::parse(text.as_bytes()).expect("should parse a full ID");
+        let arguments = startup_attach_arguments(Path::new("/example/config"), &identity);
+        let expected: Vec<OsString> = [
+            "--config",
+            "/example/config",
+            "--host",
+            "unix:///var/run/docker.sock",
+            "start",
+            "--attach",
+            &text,
+        ]
+        .into_iter()
+        .map(OsString::from)
+        .collect();
+        assert_eq!(
+            arguments, expected,
+            "should attach only to the acknowledged identity"
+        );
+        assert_eq!(
+            cleanup_filter(Some(&identity), "ts-release-startup-example"),
+            format!("id={text}"),
+            "should confirm ID absence using the ID filter rather than a name filter"
+        );
+        assert_eq!(
+            cleanup_filter(None, "ts-release-startup-example"),
+            "name=^/ts-release-startup-example$",
+            "should restrict unresolved creation cleanup to its owned name"
+        );
+    }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    #[ignore = "requires explicit ordinary CI CLI fixture and Linux Docker; starts only its own named container"]
+    fn startup_timeout_removes_only_its_owned_container() {
+        let root = PathBuf::from(
+            std::env::var_os("TS_RELEASE_CLI_FIXTURE_ROOT")
+                .expect("should explicitly supply the fixture root"),
+        );
+        let raw = crate::documents::read_bounded(
+            &root.join("cli-fixture.json"),
+            crate::documents::Role::Metadata,
+        )
+        .expect("should read bounded fixture description");
+        let document = crate::documents::parse_json(&raw.bytes, crate::documents::Role::Metadata)
+            .expect("should parse fixture description");
+        let id = document["startup_images"][1]["image_id"]
+            .as_str()
+            .expect("should name Ubuntu image");
+        let image = StartupImage::new(StartupDistribution::Ubuntu2204, id)
+            .expect("should select local image");
+        let scratch = tempfile::tempdir().expect("should create private host state");
+        let state = fs::canonicalize(scratch.path()).expect("should resolve host state");
+        let client = StartupClient::new(Path::new("/usr/bin/docker"), &state, &[])
+            .expect("should pin Docker host inputs");
+        let name = format!(
+            "ts-release-startup-{}",
+            hex::encode(
+                crate::boundary::random_bytes::<12>().expect("should choose an owned name")
+            )
+        );
+        let mut arguments = host_arguments(client.client.inputs().config());
+        arguments.extend(
+            [
+                "create",
+                "--init",
+                "--pull=never",
+                "--network=none",
+                "--read-only",
+                "--user=65534:65534",
+                "--cap-drop=ALL",
+                "--security-opt=no-new-privileges",
+                "--pids-limit=16",
+                "--memory=67108864",
+                "--cpus=1",
+            ]
+            .map(OsString::from),
+        );
+        arguments.extend([
+            format!("--name={name}").into(),
+            "--entrypoint=/bin/sleep".into(),
+            image.id().into(),
+            "60".into(),
+        ]);
+        let result = client
+            .execute_created(
+                &name,
+                arguments,
+                ProcessLimits {
+                    wall: Duration::from_millis(500),
+                    stdout_max: 4096,
+                    stderr_max: STARTUP_STDERR_MAX,
+                },
+                || Ok(()),
+                |_| Ok(()),
+            )
+            .expect("should clean up after the bounded client timeout");
+        assert_eq!(
+            result.outcome(),
+            ProcessOutcome::TimedOut,
+            "should exercise a real client timeout"
+        );
+        assert!(
+            client
+                .cleanup(None, &name, "ps")
+                .expect("should independently confirm absence"),
+            "should leave no owned container"
+        );
+    }
+}
diff --git a/crates/trusted-server-release/src/recipe/startup/accepted.rs b/crates/trusted-server-release/src/recipe/startup/accepted.rs
new file mode 100644
index 0000000000..8ee226e89f
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/startup/accepted.rs
@@ -0,0 +1,347 @@
+//! Owning native startup acceptance, without qualification or signing authority.
+
+use std::collections::BTreeSet;
+use std::path::Path;
+
+use error_stack::Report;
+use serde_json::{Value, json};
+
+#[cfg(target_os = "macos")]
+use super::native::NativeStartupLayout;
+use super::native::NativeStartupObserved;
+use super::{
+    StartupClient, StartupCopy, StartupDistribution, StartupImage, StartupObserved, lifecycle,
+};
+use crate::composition::origin::Original;
+use crate::documents::{Role as DocumentRole, canonical_json};
+use crate::error::ReleaseError;
+#[cfg(target_os = "macos")]
+use crate::inspect::{MachoCpu, MachoPolicy, inspect_macho};
+use crate::policy::ReleaseTarget;
+use crate::recipe::{AssetId, RecipeCompleted, Role, recipe_error};
+use crate::source::CommitId;
+
+#[cfg(test)]
+mod tests;
+
+#[derive(Debug, PartialEq, Eq)]
+struct Owner {
+    source_commit: CommitId,
+    role: Role,
+    asset: AssetId,
+    artifact_sha256: String,
+    artifact_size: u64,
+    package_version: String,
+}
+
+struct CliVersionInputs<'a> {
+    name: &'a str,
+    version: &'a str,
+    origin_name: &'a str,
+    origin_version: &'a str,
+    original: &'a Original,
+    commit: &'a CommitId,
+}
+
+fn checked_cli_version(inputs: &CliVersionInputs<'_>) -> Result<String, Report<ReleaseError>> {
+    if inputs.name != "trusted-server-cli"
+        || inputs.origin_name != inputs.name
+        || inputs.origin_version != inputs.version
+        || inputs.version.is_empty()
+        || inputs.version.len() > 128
+        || inputs
+            .version
+            .chars()
+            .any(|character| character.is_control() || character.is_whitespace())
+    {
+        return Err(recipe_error(
+            "startup CLI version is not the verified selected package version",
+        ));
+    }
+    match inputs.original {
+        Original::Workspace {
+            source_commit,
+            path,
+        } if source_commit == inputs.commit.as_str()
+            && path == Path::new("crates/trusted-server-cli/Cargo.toml") =>
+        {
+            Ok(inputs.version.to_owned())
+        }
+        _ => Err(recipe_error(
+            "startup selected CLI has no matching approved workspace origin",
+        )),
+    }
+}
+
+impl Owner {
+    fn from_completed(completed: &RecipeCompleted) -> Result<Self, Report<ReleaseError>> {
+        completed.recipe_definition()?;
+        if completed.asset().artifact().package != "trusted-server-cli"
+            || completed.asset().artifact().target == ReleaseTarget::Wasm32Wasip1
+        {
+            return Err(recipe_error(
+                "native startup requires an owning native CLI build",
+            ));
+        }
+        let view = completed.composition_view()?;
+        let origins = view.package_origins();
+        if origins.source_commit() != completed.commit().as_str()
+            || origins.materials_sha256() != completed.materials_digest()
+        {
+            return Err(recipe_error(
+                "startup CLI origins differ from the completed owner",
+            ));
+        }
+        let id = view.graph().selected_package_id();
+        let mut packages = view
+            .observations()
+            .packages()
+            .iter()
+            .filter(|package| package.id() == id);
+        let package = packages
+            .next()
+            .ok_or_else(|| recipe_error("startup has no selected CLI package"))?;
+        if packages.next().is_some() {
+            return Err(recipe_error("startup selected CLI package is ambiguous"));
+        }
+        let origin = origins
+            .package(id)
+            .ok_or_else(|| recipe_error("startup selected CLI has no verified origin"))?;
+        let package_version = checked_cli_version(&CliVersionInputs {
+            name: package.name(),
+            version: package.version(),
+            origin_name: origin.name(),
+            origin_version: origin.version(),
+            original: origin.origin(),
+            commit: completed.commit(),
+        })?;
+        Ok(Self {
+            source_commit: completed.commit().clone(),
+            role: completed.role(),
+            asset: completed.asset(),
+            artifact_sha256: completed.artifact().sha256().to_owned(),
+            artifact_size: completed.artifact().size(),
+            package_version,
+        })
+    }
+
+    fn expected_stdout(&self) -> String {
+        format!(
+            "ts package={} source={} target={} variant=default\n",
+            self.package_version,
+            self.source_commit.as_str(),
+            self.asset.artifact().target.triple()
+        )
+    }
+
+    fn check_same(&self, other: &Self) -> Result<(), Report<ReleaseError>> {
+        if self != other {
+            return Err(recipe_error(
+                "native startup acceptance belongs to another source, role, asset, artifact or CLI version",
+            ));
+        }
+        Ok(())
+    }
+
+    fn check_copy(&self, copy: &StartupCopy) -> Result<(), Report<ReleaseError>> {
+        if copy.sha256 != self.artifact_sha256 || copy.size != self.artifact_size {
+            return Err(recipe_error(
+                "startup copy differs from the owning final bytes",
+            ));
+        }
+        copy.verify()
+    }
+}
+
+fn check_linux_images(images: &[StartupImage]) -> Result<(), Report<ReleaseError>> {
+    if images.len() != StartupDistribution::ALL.len() {
+        return Err(recipe_error(
+            "Linux startup requires all three reviewed distributions",
+        ));
+    }
+    let mut identities = BTreeSet::new();
+    for (image, distribution) in images.iter().zip(StartupDistribution::ALL) {
+        if image.distribution() != distribution || !identities.insert(image.id()) {
+            return Err(recipe_error(
+                "Linux startup selection repeats or substitutes a reviewed distribution",
+            ));
+        }
+    }
+    Ok(())
+}
+
+#[derive(Debug)]
+enum Observed {
+    Linux(Vec<StartupObserved>),
+    Macos {
+        startup: NativeStartupObserved,
+        minimum_os: String,
+        sdk: String,
+    },
+}
+
+/// Successful actual native startup retained independently of its working copy.
+///
+/// Only actual owning startup methods construct this type. Public low-level
+/// observations and serialized diagnostics cannot reconstruct acceptance.
+#[derive(Debug)]
+pub(crate) struct NativeStartupAccepted {
+    owner: Owner,
+    observed: Observed,
+}
+
+impl NativeStartupAccepted {
+    /// Starts the owning Linux CLI bytes on all three reviewed clean selections.
+    ///
+    /// The supplied copy is consumed and removed on success or failure. Expected
+    /// output comes from the sealed selected CLI package and approved source.
+    ///
+    /// # Errors
+    ///
+    /// Rejects mismatched owner/copy, incomplete or duplicate image selections,
+    /// failed startup, changed bytes or failed cleanup. Local image IDs are not
+    /// authenticated distribution provenance.
+    pub(crate) fn accept_linux(
+        completed: &RecipeCompleted,
+        copy: StartupCopy,
+        client: &StartupClient,
+        images: &[StartupImage],
+    ) -> Result<Self, Report<ReleaseError>> {
+        let run = (|| {
+            let owner = Owner::from_completed(completed)?;
+            if owner.asset.artifact().target != ReleaseTarget::X86_64UnknownLinuxGnu {
+                return Err(recipe_error("Linux startup requires the Linux CLI target"));
+            }
+            owner.check_copy(&copy)?;
+            check_linux_images(images)?;
+            let expected = owner.expected_stdout();
+            let runs = images
+                .iter()
+                .map(|image| copy.start(client, image, &expected))
+                .collect::<Result<Vec<_>, _>>()?;
+            owner.check_copy(&copy)?;
+            completed.rehash_for_handoff()?;
+            Ok((owner, Observed::Linux(runs)))
+        })();
+        let (owner, observed) = lifecycle::combine(run, copy.remove())?;
+        completed.rehash_for_handoff()?;
+        Ok(Self { owner, observed })
+    }
+
+    /// Starts the owning Darwin CLI on its actual native macOS host.
+    ///
+    /// The same measured host that passes the execution gate is retained. The
+    /// accepted Mach-O CPU, minimum OS and SDK come from the owning final bytes.
+    ///
+    /// # Errors
+    ///
+    /// Rejects another owner/target/copy, nonnative host, incompatible minimum OS,
+    /// failed startup, changed bytes or failed cleanup.
+    #[cfg(target_os = "macos")]
+    pub(crate) fn accept_macos(
+        completed: &RecipeCompleted,
+        copy: StartupCopy,
+        layout: &NativeStartupLayout<'_>,
+    ) -> Result<Self, Report<ReleaseError>> {
+        let run = (|| {
+            let owner = Owner::from_completed(completed)?;
+            let target = owner.asset.artifact().target;
+            let cpu = match target {
+                ReleaseTarget::Aarch64AppleDarwin => MachoCpu::Arm64,
+                ReleaseTarget::X86_64AppleDarwin => MachoCpu::X86_64,
+                _ => {
+                    return Err(recipe_error(
+                        "native macOS startup requires a Darwin CLI target",
+                    ));
+                }
+            };
+            owner.check_copy(&copy)?;
+            let bytes = crate::recipe::compare::read_artifact(completed)?;
+            let facts = inspect_macho(&bytes, &MachoPolicy::macos(cpu))?;
+            let view = completed.composition_view()?;
+            let requirements = view.platform().external_requirements();
+            if requirements.target() != target
+                || requirements.artifact_sha256() != owner.artifact_sha256
+                || requirements.macho_sdk() != Some(facts.sdk().to_string().as_str())
+            {
+                return Err(recipe_error(
+                    "native startup Mach-O facts differ from the sealed platform requirements",
+                ));
+            }
+            let startup =
+                copy.start_native(layout, target, &owner.expected_stdout(), facts.minos())?;
+            owner.check_copy(&copy)?;
+            completed.rehash_for_handoff()?;
+            Ok((
+                owner,
+                Observed::Macos {
+                    startup,
+                    minimum_os: facts.minos().to_string(),
+                    sdk: facts.sdk().to_string(),
+                },
+            ))
+        })();
+        let (owner, observed) = lifecycle::combine(run, copy.remove())?;
+        completed.rehash_for_handoff()?;
+        Ok(Self { owner, observed })
+    }
+
+    /// Borrows actual Linux run observations when this acceptance is Linux.
+    pub(crate) fn linux_runs(&self) -> Option<&[StartupObserved]> {
+        match &self.observed {
+            Observed::Linux(runs) => Some(runs),
+            _ => None,
+        }
+    }
+    /// Borrows actual native macOS stdout when this acceptance is Darwin.
+    pub(crate) fn macos_stdout(&self) -> Option<&str> {
+        match &self.observed {
+            Observed::Macos { startup, .. } => Some(&startup.stdout),
+            _ => None,
+        }
+    }
+
+    /// Exports successful startup facts for this exact completed build.
+    ///
+    /// # Errors
+    ///
+    /// Rejects changed retained outputs or another source, role, asset, artifact
+    /// or selected CLI version. JSON provides diagnostics without authority.
+    pub(crate) fn diagnostic_for(
+        &self,
+        completed: &RecipeCompleted,
+    ) -> Result<Value, Report<ReleaseError>> {
+        let actual = Owner::from_completed(completed)?;
+        self.owner.check_same(&actual)?;
+        let record = self.diagnostic_record()?;
+        completed.rehash_for_handoff()?;
+        Ok(record)
+    }
+
+    fn diagnostic_record(&self) -> Result<Value, Report<ReleaseError>> {
+        let observation = match &self.observed {
+            Observed::Linux(runs) => {
+                json!({"kind":"linux-clean-containers", "runs":runs.iter().map(|run|Ok(json!({"distribution":run.image.distribution().label(),"reference":run.image.distribution().reference(),"image_id":run.image.id(),"exit_code":0,"stdout":run.stdout,"stderr_sha256":run.stderr_sha256,"elapsed_milliseconds":milliseconds(run.elapsed)?}))).collect::<Result<Vec<Value>,Report<ReleaseError>>>()?,"environment_scope":"selected_image_defaults_no_host_environment_injection","image_authentication":"unqualified-local-image-selection"})
+            }
+            Observed::Macos {
+                startup,
+                minimum_os,
+                sdk,
+            } => {
+                json!({"kind":"native-macos", "host":startup.host,"minimum_os":minimum_os,"sdk":sdk,"exit_code":0,"stdout":startup.stdout,"stderr_sha256":startup.stderr_sha256,"elapsed_milliseconds":milliseconds(startup.elapsed)?,"environment":{"PATH":"/usr/bin:/bin","LC_ALL":"C","HOME":"private","TMPDIR":"private"}})
+            }
+        };
+        let record = json!({"domain":"trusted-server.release.native-startup-diagnostic","schema_version":1,"release_qualification":false,"source_commit":self.owner.source_commit.as_str(),"role":self.owner.role.spec_label(),"asset":self.owner.asset.artifact().name,"target":self.owner.asset.artifact().target.triple(),"package_version":self.owner.package_version,"artifact":{"sha256":self.owner.artifact_sha256,"size":self.owner.artifact_size},"startup":observation});
+        canonical_json(&record, DocumentRole::Metadata)
+            .map_err(|error| error.change_context(ReleaseError::Recipe))?;
+        Ok(record)
+    }
+}
+
+fn milliseconds(duration: std::time::Duration) -> Result<u64, Report<ReleaseError>> {
+    u64::try_from(duration.as_millis()).map_err(|error| {
+        recipe_error(format!(
+            "startup duration exceeds diagnostic bound: {error}"
+        ))
+    })
+}
diff --git a/crates/trusted-server-release/src/recipe/startup/accepted/tests.rs b/crates/trusted-server-release/src/recipe/startup/accepted/tests.rs
new file mode 100644
index 0000000000..5b778bb833
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/startup/accepted/tests.rs
@@ -0,0 +1,209 @@
+use super::*;
+
+fn owner() -> Owner {
+    Owner {
+        source_commit: crate::source::CommitId::parse(&"a".repeat(40))
+            .expect("should parse source"),
+        role: crate::recipe::Role::Canonical,
+        asset: crate::recipe::AssetId::parse("ts-x86_64-unknown-linux-gnu")
+            .expect("should resolve CLI"),
+        artifact_sha256: "b".repeat(64),
+        artifact_size: 128,
+        package_version: "9.8.7".to_owned(),
+    }
+}
+
+#[test]
+fn startup_expected_output_uses_the_sealed_cli_version() {
+    let owner = owner();
+    assert_eq!(
+        owner.expected_stdout(),
+        format!(
+            "ts package=9.8.7 source={} target=x86_64-unknown-linux-gnu variant=default\n",
+            "a".repeat(40)
+        ),
+        "should derive output from owning package facts rather than producer version"
+    );
+}
+
+#[test]
+fn linux_startup_requires_three_exact_distinct_selections() {
+    let images: Vec<_> = crate::recipe::startup::StartupDistribution::ALL
+        .iter()
+        .enumerate()
+        .map(|(index, distribution)| {
+            crate::recipe::startup::StartupImage::new(
+                *distribution,
+                &format!("sha256:{}", (index + 1).to_string().repeat(64)),
+            )
+            .expect("should create selected image")
+        })
+        .collect();
+    check_linux_images(&images).expect("should accept the complete reviewed startup set");
+    assert!(
+        check_linux_images(&images[..2]).is_err(),
+        "should reject a missing distribution"
+    );
+    let duplicates = vec![images[0].clone(), images[0].clone(), images[2].clone()];
+    assert!(
+        check_linux_images(&duplicates).is_err(),
+        "should reject repeated distribution"
+    );
+    let wrong_id = vec![
+        images[0].clone(),
+        crate::recipe::startup::StartupImage::new(
+            crate::recipe::startup::StartupDistribution::Ubuntu2204,
+            images[0].id(),
+        )
+        .expect("should select local image"),
+        images[2].clone(),
+    ];
+    assert!(
+        check_linux_images(&wrong_id).is_err(),
+        "should not reuse one image as multiple distributions"
+    );
+}
+
+#[test]
+fn native_startup_owner_rejects_another_source_role_asset_artifact_or_cli_version() {
+    let original = owner();
+    original
+        .check_same(&owner())
+        .expect("should accept exact owner binding");
+    for field in ["source", "role", "asset", "digest", "size", "version"] {
+        let mut other = owner();
+        match field {
+            "source" => {
+                other.source_commit =
+                    crate::source::CommitId::parse(&"c".repeat(40)).expect("should parse source")
+            }
+            "role" => other.role = crate::recipe::Role::Reproduction,
+            "asset" => {
+                other.asset = crate::recipe::AssetId::parse("ts-aarch64-apple-darwin")
+                    .expect("should resolve other asset")
+            }
+            "digest" => other.artifact_sha256 = "c".repeat(64),
+            "size" => other.artifact_size += 1,
+            "version" => other.package_version = "1.2.3".to_owned(),
+            _ => unreachable!("should select fixture field"),
+        }
+        assert!(
+            original.check_same(&other).is_err(),
+            "should reject different {field} owner"
+        );
+    }
+}
+
+#[test]
+fn cli_version_requires_the_exact_selected_approved_workspace_original() {
+    let owner = owner();
+    let original = crate::composition::origin::Original::Workspace {
+        source_commit: owner.source_commit.as_str().to_owned(),
+        path: "crates/trusted-server-cli/Cargo.toml".into(),
+    };
+    let valid = CliVersionInputs {
+        name: "trusted-server-cli",
+        version: "9.8.7",
+        origin_name: "trusted-server-cli",
+        origin_version: "9.8.7",
+        original: &original,
+        commit: &owner.source_commit,
+    };
+    assert_eq!(
+        checked_cli_version(&valid).expect("should use verified selected CLI version"),
+        "9.8.7",
+        "should retain source-owned CLI package version"
+    );
+    for original in [
+        Original::Workspace {
+            source_commit: "f".repeat(40),
+            path: "crates/trusted-server-cli/Cargo.toml".into(),
+        },
+        Original::Workspace {
+            source_commit: owner.source_commit.as_str().to_owned(),
+            path: "crates/fictional-cli/Cargo.toml".into(),
+        },
+    ] {
+        assert!(
+            checked_cli_version(&CliVersionInputs {
+                original: &original,
+                ..valid
+            })
+            .is_err(),
+            "should reject another approved workspace source or package path"
+        );
+    }
+    assert!(
+        checked_cli_version(&CliVersionInputs {
+            origin_version: "1.0.0",
+            ..valid
+        })
+        .is_err(),
+        "should reject metadata version differing from verified source"
+    );
+    assert!(
+        checked_cli_version(&CliVersionInputs {
+            version: "9.8.7\nforged",
+            origin_version: "9.8.7\nforged",
+            ..valid
+        })
+        .is_err(),
+        "should reject version output injection"
+    );
+}
+
+#[test]
+fn retained_linux_diagnostic_owns_all_run_facts_and_allows_explicit_optional_b() {
+    let mut owner = owner();
+    owner.role = crate::recipe::Role::Reproduction;
+    let runs = StartupDistribution::ALL
+        .iter()
+        .enumerate()
+        .map(|(index, distribution)| StartupObserved {
+            image: StartupImage::new(
+                *distribution,
+                &format!("sha256:{}", (index + 1).to_string().repeat(64)),
+            )
+            .expect("should select image"),
+            stdout: owner.expected_stdout(),
+            stderr_sha256: "d".repeat(64),
+            elapsed: std::time::Duration::from_millis(12),
+        })
+        .collect();
+    let accepted = NativeStartupAccepted {
+        owner,
+        observed: Observed::Linux(runs),
+    };
+    let record = accepted
+        .diagnostic_record()
+        .expect("should retain owned run facts without startup working roots");
+    assert_eq!(
+        record["role"], "B",
+        "should preserve an actually observed optional reproduction startup"
+    );
+    assert_eq!(
+        record["package_version"], "9.8.7",
+        "should retain actual selected CLI version"
+    );
+    assert_eq!(
+        record["startup"]["runs"]
+            .as_array()
+            .expect("should retain startup runs")
+            .len(),
+        3,
+        "should retain all reviewed clean-image observations"
+    );
+    assert_eq!(
+        record["startup"]["runs"][0]["elapsed_milliseconds"], 12,
+        "should retain integer bounded duration"
+    );
+    assert_eq!(
+        record["startup"]["runs"][0]["image_id"],
+        format!("sha256:{}", "1".repeat(64)),
+        "should bind actual selected local image identity"
+    );
+    assert_eq!(
+        record["release_qualification"], false,
+        "should not infer qualification from retained observations"
+    );
+}
diff --git a/crates/trusted-server-release/src/recipe/startup/lifecycle.rs b/crates/trusted-server-release/src/recipe/startup/lifecycle.rs
new file mode 100644
index 0000000000..bddea561d4
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/startup/lifecycle.rs
@@ -0,0 +1,193 @@
+//! Unconditional bounded cleanup sequencing for an owned startup container.
+
+use error_stack::Report;
+
+use crate::error::ReleaseError;
+
+/// Runs an owned container and attempts stop, removal and absence confirmation.
+pub(super) fn run_owned<T>(
+    run: impl FnOnce() -> Result<T, Report<ReleaseError>>,
+    mut cleanup: impl FnMut(&str) -> Result<bool, Report<ReleaseError>>,
+) -> Result<T, Report<ReleaseError>> {
+    let mut outcome = run();
+    for step in ["stop", "rm", "ps"] {
+        let checked = cleanup(step).and_then(|confirmed| {
+            if step == "ps" && !confirmed {
+                Err(crate::recipe::recipe_error(
+                    "startup container was not confirmed removed",
+                ))
+            } else {
+                Ok(())
+            }
+        });
+        outcome = combine(outcome, checked);
+    }
+    outcome
+}
+
+/// Preserves the original run failure and any later integrity or cleanup failure.
+pub(super) fn combine<T>(
+    run: Result<T, Report<ReleaseError>>,
+    later: Result<(), Report<ReleaseError>>,
+) -> Result<T, Report<ReleaseError>> {
+    match (run, later) {
+        (Ok(value), Ok(())) => Ok(value),
+        (Err(error), Ok(())) | (Ok(_), Err(error)) => Err(error),
+        (Err(error), Err(later)) => Err(error.attach(format!("startup also failed: {later:?}"))),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::recipe::recipe_error;
+
+    #[test]
+    fn every_run_outcome_attempts_all_cleanup_steps() {
+        for run_failure in [false, true] {
+            for cleanup_failure in [None, Some("stop"), Some("rm"), Some("ps")] {
+                let mut observed = Vec::new();
+                let outcome = run_owned(
+                    || {
+                        if run_failure {
+                            Err(recipe_error("launch or supervision failed"))
+                        } else {
+                            Ok(())
+                        }
+                    },
+                    |step| {
+                        observed.push(step.to_owned());
+                        if cleanup_failure == Some(step) {
+                            Err(recipe_error(format!("{step} failed")))
+                        } else {
+                            Ok(true)
+                        }
+                    },
+                );
+                assert_eq!(
+                    observed,
+                    ["stop", "rm", "ps"],
+                    "should always attempt all cleanup"
+                );
+                assert_eq!(
+                    outcome.is_err(),
+                    run_failure || cleanup_failure.is_some(),
+                    "should preserve every failure"
+                );
+                if run_failure {
+                    assert!(
+                        format!("{:?}", outcome.expect_err("should reject failed run"))
+                            .contains("launch or supervision failed"),
+                        "should retain the original failure"
+                    );
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn absence_confirmation_is_mandatory() {
+        let outcome = run_owned(|| Ok(()), |step| Ok(step != "ps"));
+        assert!(
+            outcome.is_err(),
+            "should reject a surviving or unconfirmed container"
+        );
+    }
+}
+
+/// Starts guest code only after acknowledged creation, then cleans that identity.
+pub(super) fn run_created<C, T>(
+    create: impl FnOnce() -> Result<C, Report<ReleaseError>>,
+    run: impl FnOnce(&C) -> Result<T, Report<ReleaseError>>,
+    mut cleanup: impl FnMut(Option<&C>, &str) -> Result<bool, Report<ReleaseError>>,
+) -> Result<T, Report<ReleaseError>> {
+    match create() {
+        Ok(created) => run_owned(|| run(&created), |step| cleanup(Some(&created), step)),
+        Err(error) => run_owned(
+            || {
+                Err(error.attach("container creation remains unresolved despite fallback cleanup; no guest start was issued"))
+            },
+            |step| cleanup(None, step),
+        ),
+    }
+}
+
+#[cfg(test)]
+mod creation_tests {
+    use std::cell::Cell;
+
+    use super::*;
+    use crate::recipe::recipe_error;
+
+    #[test]
+    fn failed_creation_never_starts_and_cannot_be_cleared_by_absence() {
+        let started = Cell::new(false);
+        let mut steps = Vec::new();
+        let result = run_created(
+            || Err::<u8, _>(recipe_error("create timed out")),
+            |_| {
+                started.set(true);
+                Ok(())
+            },
+            |identity, step| {
+                assert!(
+                    identity.is_none(),
+                    "should use name cleanup without acknowledged identity"
+                );
+                steps.push(step.to_owned());
+                Ok(true)
+            },
+        );
+        assert!(!started.get(), "should never start after failed creation");
+        assert_eq!(
+            steps,
+            ["stop", "rm", "ps"],
+            "should attempt every bounded fallback cleanup"
+        );
+        let error = format!(
+            "{:?}",
+            result.expect_err("should retain unresolved creation")
+        );
+        assert!(
+            error.contains("create timed out") && error.contains("unresolved"),
+            "should preserve original and unresolved creation errors: {error}"
+        );
+    }
+
+    #[test]
+    fn execution_uses_acknowledged_identity_for_all_cleanup() {
+        for fail_start in [false, true] {
+            let mut steps = Vec::new();
+            let result = run_created(
+                || Ok(7_u8),
+                |identity| {
+                    assert_eq!(*identity, 7, "should start only the acknowledged identity");
+                    if fail_start {
+                        Err(recipe_error("attach timed out"))
+                    } else {
+                        Ok(())
+                    }
+                },
+                |identity, step| {
+                    assert_eq!(
+                        identity,
+                        Some(&7),
+                        "should clean only the acknowledged identity"
+                    );
+                    steps.push(step.to_owned());
+                    Ok(true)
+                },
+            );
+            assert_eq!(
+                steps,
+                ["stop", "rm", "ps"],
+                "should always clean after execution"
+            );
+            assert_eq!(
+                result.is_err(),
+                fail_start,
+                "should preserve execution outcome"
+            );
+        }
+    }
+}
diff --git a/crates/trusted-server-release/src/recipe/startup/native.rs b/crates/trusted-server-release/src/recipe/startup/native.rs
new file mode 100644
index 0000000000..feb392b9be
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/startup/native.rs
@@ -0,0 +1,611 @@
+//! Actual macOS startup acceptance of the final Darwin `ts` bytes.
+//!
+//! The policy is pure and compiled everywhere; only measuring the host and
+//! executing the copy are macOS-only. Before anything runs, the host must be
+//! the reviewed cohort: macOS 15 on the asset's own CPU. An arm64 host must
+//! report `sysctl.proc_translated == 0`. An Intel host must not be a
+//! translated process on Apple silicon: `sysctl.proc_translated` absent or
+//! `0` and `hw.optional.arm64` absent or `0`, so Rosetta can never stand in
+//! for real Intel hardware.
+//!
+//! The exact final bytes are copied once into a fresh `0555` directory
+//! outside every build root and started as `ts --version` with exactly
+//! `PATH=/usr/bin:/bin`, a private `HOME` and `TMPDIR` and `LC_ALL=C`. No
+//! operator configuration exists, so the output must be exactly the owning
+//! build facts. The copy must still hash to the accepted digest afterwards.
+
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+
+use error_stack::Report;
+#[cfg(target_os = "macos")]
+use sha2::{Digest as _, Sha256};
+
+use super::super::fresh::{disjoint, normal_absolute};
+use super::super::{RecipeCompleted, recipe_error};
+use super::StartupCopy;
+use crate::error::ReleaseError;
+use crate::inspect::MacosVersion;
+use crate::policy::ReleaseTarget;
+#[cfg(target_os = "macos")]
+use crate::process::{BoundedCommand, ProcessLimits, ProcessOutcome};
+
+/// The only macOS major version the startup cohort accepts.
+pub(crate) const REQUIRED_MACOS_MAJOR: u32 = 15;
+/// The fixed search path of the startup child.
+const STARTUP_PATH: &str = "/usr/bin:/bin";
+/// The executable name inside the copy directory.
+const EXECUTABLE_NAME: &str = "ts";
+
+/// Host facts measured before the startup runs.
+#[derive(Clone, Debug, PartialEq, Eq, serde::Serialize)]
+pub(crate) struct HostIdentity {
+    /// `kern.osproductversion`, such as `15.5`.
+    pub(crate) product_version: String,
+    /// Architecture of the running producer: `aarch64` or `x86_64`.
+    pub(crate) architecture: String,
+    /// `sysctl.proc_translated`, or `None` when the name is absent.
+    pub(crate) proc_translated: Option<i32>,
+    /// `hw.optional.arm64`, or `None` when the name is absent.
+    pub(crate) hw_optional_arm64: Option<i32>,
+}
+
+/// Facts retained from the same actual native host and successful startup run.
+#[derive(Debug)]
+pub(crate) struct NativeStartupObserved {
+    pub(super) host: HostIdentity,
+    pub(super) stdout: String,
+    pub(super) stderr_sha256: String,
+    pub(super) elapsed: std::time::Duration,
+}
+
+/// Returns the major version of dotted decimal `text`.
+fn major_version(text: &str) -> Option<u32> {
+    let mut parts = text.split('.');
+    let major = parts.next()?;
+    let canonical = parts.all(|part| !part.is_empty() && part.bytes().all(|b| b.is_ascii_digit()))
+        && !major.is_empty()
+        && major.bytes().all(|byte| byte.is_ascii_digit())
+        && !major.starts_with('0');
+    canonical.then(|| major.parse().ok()).flatten()
+}
+
+/// Requires the host to be the reviewed macOS 15 cohort for `target`.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Recipe`] for a non-Darwin target, another or
+/// malformed macOS version, another architecture, a translated arm64
+/// process, or an Intel target on a translated process or Apple silicon.
+pub(crate) fn check_host_identity(
+    target: ReleaseTarget,
+    host: &HostIdentity,
+) -> Result<(), Report<ReleaseError>> {
+    if major_version(&host.product_version) != Some(REQUIRED_MACOS_MAJOR) {
+        return Err(recipe_error(format!(
+            "startup host runs macOS {:?}, expected macOS {REQUIRED_MACOS_MAJOR}",
+            host.product_version
+        )));
+    }
+    let native = match target {
+        ReleaseTarget::Aarch64AppleDarwin => {
+            host.architecture == "aarch64" && host.proc_translated == Some(0)
+        }
+        ReleaseTarget::X86_64AppleDarwin => {
+            host.architecture == "x86_64"
+                && matches!(host.proc_translated, None | Some(0))
+                && matches!(host.hw_optional_arm64, None | Some(0))
+        }
+        ReleaseTarget::Wasm32Wasip1 | ReleaseTarget::X86_64UnknownLinuxGnu => {
+            return Err(recipe_error(format!(
+                "native macOS startup does not accept {}",
+                target.triple()
+            )));
+        }
+    };
+    if !native {
+        return Err(recipe_error(format!(
+            "startup host {host:?} is not a native {} machine",
+            target.triple()
+        )));
+    }
+    Ok(())
+}
+
+/// Requires the actual host to satisfy the accepted artifact's deployment floor.
+fn check_host_minimum(
+    target: ReleaseTarget,
+    host: &HostIdentity,
+    minimum: MacosVersion,
+) -> Result<(), Report<ReleaseError>> {
+    check_host_identity(target, host)?;
+    let current = MacosVersion::parse(&host.product_version).ok_or_else(|| {
+        recipe_error("native startup host version cannot be compared to the artifact minimum")
+    })?;
+    if current < minimum {
+        return Err(recipe_error(
+            "native startup host is below the accepted deployment minimum",
+        ));
+    }
+    Ok(())
+}
+
+/// Where the startup copy and its private state live.
+pub(crate) struct NativeStartupLayout<'a> {
+    /// Fresh directory receiving the `0555` copy; must not exist yet.
+    pub(crate) copy_directory: &'a Path,
+    /// Private `HOME` of the child.
+    pub(crate) home: &'a Path,
+    /// Private `TMPDIR` of the child.
+    pub(crate) tmpdir: &'a Path,
+    /// Every root the build used; none may contain or sit inside the above.
+    pub(crate) build_roots: &'a [&'a Path],
+}
+
+/// The exact `ts --version` invocation of the native startup.
+///
+/// Its fields are private: only [`native_startup_command`] constructs it,
+/// after checking the layout.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct NativeStartupCommand {
+    /// The copied executable.
+    program: PathBuf,
+    /// Exactly `--version`.
+    arguments: Vec<String>,
+    /// Exactly `PATH`, `HOME`, `TMPDIR` and `LC_ALL`.
+    environment: BTreeMap<String, String>,
+    /// The copy directory.
+    working_directory: PathBuf,
+}
+
+/// Derives the startup invocation after checking the layout.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Recipe`] when a path is not absolute normal UTF-8
+/// or the copy directory, `HOME`, `TMPDIR` and build roots are not pairwise
+/// disjoint.
+pub(crate) fn native_startup_command(
+    layout: &NativeStartupLayout<'_>,
+) -> Result<NativeStartupCommand, Report<ReleaseError>> {
+    let mut labelled = vec![
+        ("startup copy directory", layout.copy_directory),
+        ("startup HOME", layout.home),
+        ("startup TMPDIR", layout.tmpdir),
+    ];
+    labelled.extend(layout.build_roots.iter().map(|root| ("build root", *root)));
+    for (label, path) in &labelled {
+        normal_absolute(label, path)?;
+    }
+    disjoint(&labelled)?;
+    let text = |path: &Path| {
+        path.to_str()
+            .map(str::to_owned)
+            .ok_or_else(|| recipe_error("startup path is not UTF-8"))
+    };
+    let environment = BTreeMap::from([
+        ("PATH".to_owned(), STARTUP_PATH.to_owned()),
+        ("HOME".to_owned(), text(layout.home)?),
+        ("TMPDIR".to_owned(), text(layout.tmpdir)?),
+        ("LC_ALL".to_owned(), "C".to_owned()),
+    ]);
+    Ok(NativeStartupCommand {
+        program: layout.copy_directory.join(EXECUTABLE_NAME),
+        arguments: vec!["--version".to_owned()],
+        environment,
+        working_directory: layout.copy_directory.to_owned(),
+    })
+}
+
+impl StartupCopy {
+    /// Copies an accepted Darwin executable into the fresh `directory`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] when `completed` is not a Darwin
+    /// asset or no longer rehashes, `directory` is not absolute normal UTF-8
+    /// or exists, or the copy cannot be written read-only.
+    pub(crate) fn create_native(
+        completed: &RecipeCompleted,
+        directory: &Path,
+    ) -> Result<Self, Report<ReleaseError>> {
+        if !completed.asset().artifact().target.is_darwin() {
+            return Err(recipe_error(
+                "the native startup gate accepts only Darwin assets",
+            ));
+        }
+        normal_absolute("startup copy directory", directory)?;
+        Self::write_private(completed, directory)
+    }
+
+    /// Measures the host, derives the command from `layout` and starts the
+    /// copy natively, accepting exactly `expected`.
+    ///
+    /// Nothing runs unless the measured host passes
+    /// [`check_host_identity`] for `target`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Process`] when the child cannot run, or
+    /// [`ReleaseError::Recipe`] when the host cannot be measured or is not
+    /// the reviewed cohort for `target`, the layout is rejected, the command
+    /// is not this copy's, the outcome or output is rejected, or the copy
+    /// changed.
+    #[cfg(target_os = "macos")]
+    pub(crate) fn start_native(
+        &self,
+        layout: &NativeStartupLayout<'_>,
+        target: ReleaseTarget,
+        expected: &str,
+        minimum: MacosVersion,
+    ) -> Result<NativeStartupObserved, Report<ReleaseError>> {
+        let host = measure_host_identity()?;
+        check_host_minimum(target, &host, minimum)?;
+        let command = native_startup_command(layout)?;
+        if command.program != self.directory.join(EXECUTABLE_NAME) {
+            return Err(recipe_error("startup command does not run this copy"));
+        }
+        self.verify()?;
+        let mut bounded = BoundedCommand::new(
+            &command.program,
+            &command.working_directory,
+            ProcessLimits {
+                wall: super::STARTUP_WALL,
+                stdout_max: super::STARTUP_STDOUT_MAX,
+                stderr_max: super::STARTUP_STDERR_MAX,
+            },
+        )?
+        .arguments(command.arguments.iter().map(std::ffi::OsString::from));
+        for (name, value) in &command.environment {
+            bounded = bounded.environment(name, value)?;
+        }
+        let result = bounded.run();
+        self.verify()?;
+        let result = result?;
+        if result.outcome() != (ProcessOutcome::Exited { code: 0 }) {
+            return Err(recipe_error(format!(
+                "native ts --version {}",
+                result.outcome()
+            )));
+        }
+        if result.stdout() != expected.as_bytes() {
+            return Err(recipe_error(format!(
+                "native ts --version printed {:?}, expected {expected:?}",
+                String::from_utf8_lossy(result.stdout())
+            )));
+        }
+        Ok(NativeStartupObserved {
+            host,
+            stdout: expected.to_owned(),
+            stderr_sha256: hex::encode(Sha256::digest(result.stderr())),
+            elapsed: result.elapsed(),
+        })
+    }
+}
+
+/// Measures the running host with `sysctlbyname`; nothing is executed.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Recipe`] when the product version cannot be read.
+#[cfg(target_os = "macos")]
+pub(crate) fn measure_host_identity() -> Result<HostIdentity, Report<ReleaseError>> {
+    Ok(HostIdentity {
+        product_version: sysctl_text("kern.osproductversion")?,
+        architecture: std::env::consts::ARCH.to_owned(),
+        proc_translated: sysctl_integer("sysctl.proc_translated"),
+        hw_optional_arm64: sysctl_integer("hw.optional.arm64"),
+    })
+}
+
+/// Reads one NUL-terminated string sysctl.
+#[cfg(target_os = "macos")]
+fn sysctl_text(name: &str) -> Result<String, Report<ReleaseError>> {
+    let key = std::ffi::CString::new(name).map_err(|_| recipe_error("sysctl name holds NUL"))?;
+    let mut buffer = [0_u8; 64];
+    let mut length: libc::size_t = buffer.len();
+    // SAFETY: `key` is a NUL-terminated C string, `buffer` is writable for
+    // `length` bytes, `length` points to its capacity, and no new value is set.
+    let status = unsafe {
+        libc::sysctlbyname(
+            key.as_ptr(),
+            buffer.as_mut_ptr().cast(),
+            &raw mut length,
+            std::ptr::null_mut(),
+            0,
+        )
+    };
+    let bytes = buffer
+        .get(..length)
+        .filter(|_| status == 0)
+        .ok_or_else(|| recipe_error(format!("cannot read sysctl {name}")))?;
+    let text = bytes.split(|byte| *byte == 0).next().unwrap_or_default();
+    String::from_utf8(text.to_vec())
+        .map_err(|_| recipe_error(format!("sysctl {name} is not UTF-8")))
+}
+
+/// Reads one 32-bit integer sysctl, or `None` when it is absent.
+#[cfg(target_os = "macos")]
+fn sysctl_integer(name: &str) -> Option<i32> {
+    let key = std::ffi::CString::new(name).ok()?;
+    let mut value: i32 = 0;
+    let mut length: libc::size_t = std::mem::size_of::<i32>();
+    // SAFETY: `key` is a NUL-terminated C string, `value` is a writable
+    // `i32` whose size `length` states, and no new value is set.
+    let status = unsafe {
+        libc::sysctlbyname(
+            key.as_ptr(),
+            (&raw mut value).cast(),
+            &raw mut length,
+            std::ptr::null_mut(),
+            0,
+        )
+    };
+    (status == 0 && length == std::mem::size_of::<i32>()).then_some(value)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::super::expected_version_output;
+    use super::*;
+    use crate::source::CommitId;
+
+    fn host(
+        version: &str,
+        architecture: &str,
+        translated: Option<i32>,
+        arm64: Option<i32>,
+    ) -> HostIdentity {
+        HostIdentity {
+            product_version: version.to_owned(),
+            architecture: architecture.to_owned(),
+            proc_translated: translated,
+            hw_optional_arm64: arm64,
+        }
+    }
+
+    #[test]
+    fn host_identity_accepts_only_native_macos_15() {
+        let arm = ReleaseTarget::Aarch64AppleDarwin;
+        let intel = ReleaseTarget::X86_64AppleDarwin;
+        let cases = [
+            (
+                "native arm64",
+                arm,
+                host("15.5", "aarch64", Some(0), Some(1)),
+                true,
+            ),
+            (
+                "arm64 point release",
+                arm,
+                host("15.6.1", "aarch64", Some(0), Some(1)),
+                true,
+            ),
+            (
+                "translated arm64",
+                arm,
+                host("15.5", "aarch64", Some(1), Some(1)),
+                false,
+            ),
+            (
+                "arm64 without translation report",
+                arm,
+                host("15.5", "aarch64", None, Some(1)),
+                false,
+            ),
+            (
+                "arm64 on macOS 14",
+                arm,
+                host("14.7", "aarch64", Some(0), Some(1)),
+                false,
+            ),
+            (
+                "arm64 on macOS 26",
+                arm,
+                host("26.0", "aarch64", Some(0), Some(1)),
+                false,
+            ),
+            (
+                "arm64 asset on Intel",
+                arm,
+                host("15.5", "x86_64", None, None),
+                false,
+            ),
+            (
+                "native Intel",
+                intel,
+                host("15.5", "x86_64", None, None),
+                true,
+            ),
+            (
+                "Intel reporting zeros",
+                intel,
+                host("15.5", "x86_64", Some(0), Some(0)),
+                true,
+            ),
+            (
+                "Intel under Rosetta",
+                intel,
+                host("15.5", "x86_64", Some(1), Some(1)),
+                false,
+            ),
+            (
+                "Intel process on Apple silicon",
+                intel,
+                host("15.5", "x86_64", Some(0), Some(1)),
+                false,
+            ),
+            (
+                "Intel asset on arm64",
+                intel,
+                host("15.5", "aarch64", Some(0), Some(1)),
+                false,
+            ),
+            (
+                "malformed version",
+                intel,
+                host("15.x", "x86_64", None, None),
+                false,
+            ),
+            (
+                "leading zero",
+                intel,
+                host("015.5", "x86_64", None, None),
+                false,
+            ),
+            (
+                "Linux target",
+                ReleaseTarget::X86_64UnknownLinuxGnu,
+                host("15.5", "x86_64", None, None),
+                false,
+            ),
+        ];
+        for (label, target, identity, accepted) in cases {
+            assert_eq!(
+                check_host_identity(target, &identity).is_ok(),
+                accepted,
+                "should decide the {label} host"
+            );
+        }
+    }
+
+    #[test]
+    fn startup_host_must_satisfy_the_accepted_artifact_minimum_before_execution() {
+        let host = host("15.5", "aarch64", Some(0), Some(1));
+        check_host_minimum(
+            crate::policy::ReleaseTarget::Aarch64AppleDarwin,
+            &host,
+            crate::inspect::MacosVersion::new(13, 0),
+        )
+        .expect("should accept native host above artifact minimum");
+        assert!(
+            check_host_minimum(
+                crate::policy::ReleaseTarget::Aarch64AppleDarwin,
+                &host,
+                crate::inspect::MacosVersion::new(15, 6)
+            )
+            .is_err(),
+            "should reject host below accepted artifact minimum"
+        );
+        assert!(
+            check_host_minimum(
+                crate::policy::ReleaseTarget::X86_64AppleDarwin,
+                &host,
+                crate::inspect::MacosVersion::new(13, 0)
+            )
+            .is_err(),
+            "should still reject another target CPU"
+        );
+    }
+
+    #[test]
+    fn startup_command_is_exact_and_outside_every_build_root() {
+        let layout = NativeStartupLayout {
+            copy_directory: Path::new("/startup/example/copy"),
+            home: Path::new("/startup/example/home"),
+            tmpdir: Path::new("/startup/example/tmp"),
+            build_roots: &[
+                Path::new("/build/example/checkout"),
+                Path::new("/build/example/target"),
+            ],
+        };
+
+        let command = native_startup_command(&layout).expect("should derive the command");
+
+        assert_eq!(command.program, Path::new("/startup/example/copy/ts"));
+        assert_eq!(command.arguments, ["--version"]);
+        assert_eq!(
+            command.working_directory,
+            Path::new("/startup/example/copy")
+        );
+        assert_eq!(
+            command.environment,
+            BTreeMap::from([
+                ("HOME".to_owned(), "/startup/example/home".to_owned()),
+                ("LC_ALL".to_owned(), "C".to_owned()),
+                ("PATH".to_owned(), "/usr/bin:/bin".to_owned()),
+                ("TMPDIR".to_owned(), "/startup/example/tmp".to_owned()),
+            ]),
+            "should pass exactly the fixed environment"
+        );
+    }
+
+    #[test]
+    fn startup_layout_rejects_overlap_and_relative_paths() {
+        let roots = [
+            Path::new("/build/example/checkout"),
+            Path::new("/build/example/target"),
+        ];
+        let cases = [
+            (
+                "copy inside a build root",
+                "/build/example/target/copy",
+                "/startup/home",
+                "/startup/tmp",
+            ),
+            (
+                "build roots below the copy",
+                "/build",
+                "/startup/home",
+                "/startup/tmp",
+            ),
+            (
+                "home inside the copy",
+                "/startup/copy",
+                "/startup/copy/home",
+                "/startup/tmp",
+            ),
+            (
+                "shared HOME and TMPDIR",
+                "/startup/copy",
+                "/startup/state",
+                "/startup/state",
+            ),
+            (
+                "a relative copy",
+                "startup/copy",
+                "/startup/home",
+                "/startup/tmp",
+            ),
+            (
+                "a dotted TMPDIR",
+                "/startup/copy",
+                "/startup/home",
+                "/startup/./tmp",
+            ),
+        ];
+        for (label, copy, home, tmpdir) in cases {
+            let layout = NativeStartupLayout {
+                copy_directory: Path::new(copy),
+                home: Path::new(home),
+                tmpdir: Path::new(tmpdir),
+                build_roots: &roots,
+            };
+            assert!(
+                native_startup_command(&layout).is_err(),
+                "should reject {label}"
+            );
+        }
+    }
+
+    #[test]
+    fn darwin_version_output_names_the_darwin_target() {
+        let commit =
+            CommitId::parse("0123456789abcdef0123456789abcdef01234567").expect("should parse");
+        for target in [
+            ReleaseTarget::Aarch64AppleDarwin,
+            ReleaseTarget::X86_64AppleDarwin,
+        ] {
+            assert_eq!(
+                expected_version_output(&commit, target),
+                format!(
+                    "ts package={} source=0123456789abcdef0123456789abcdef01234567 target={} \
+                     variant=default\n",
+                    env!("CARGO_PKG_VERSION"),
+                    target.triple()
+                ),
+                "should expect exactly the owning build facts"
+            );
+        }
+    }
+}
diff --git a/crates/trusted-server-release/src/recipe/tests.rs b/crates/trusted-server-release/src/recipe/tests.rs
new file mode 100644
index 0000000000..c57420c409
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/tests.rs
@@ -0,0 +1,381 @@
+use std::fs;
+use std::os::unix::fs::symlink;
+use std::path::PathBuf;
+
+use super::ambient::ObservedAmbient;
+use super::*;
+use serde_json::Value;
+
+const COHORT: &str = include_str!(concat!(
+    env!("CARGO_MANIFEST_DIR"),
+    "/../../scripts/release/release-cohort.json"
+));
+
+#[test]
+fn unknown_asset_id_is_rejected() {
+    for name in [
+        "",
+        "ts-aarch64-apple-darwin ",
+        "TS-AARCH64-APPLE-DARWIN",
+        "../ts-aarch64-apple-darwin",
+        "ts-riscv64-example-linux",
+    ] {
+        assert!(
+            AssetId::parse(name).is_err_and(|error| format!("{error:?}").contains("unknown asset")),
+            "should reject unknown asset id {name:?}"
+        );
+    }
+}
+
+#[test]
+fn asset_selection_comes_from_fixed_table_not_json() {
+    let cohort: Value = serde_json::from_str(COHORT).expect("should parse tracked cohort");
+    for entry in cohort["artifacts"]
+        .as_array()
+        .expect("should list cohort artifacts")
+    {
+        let name = entry["name"].as_str().expect("should name artifact");
+        let asset = AssetId::parse(name).expect("should accept every fixed asset");
+        let fixed = FIXED_ARTIFACTS
+            .iter()
+            .find(|fixed| fixed.name == name)
+            .expect("should find the fixed table row");
+        assert_eq!(
+            asset.artifact().package,
+            fixed.package,
+            "should use table package"
+        );
+        assert_eq!(asset.artifact().bin, fixed.bin, "should use table binary");
+        assert_eq!(
+            asset.artifact().target,
+            fixed.target,
+            "should use table target"
+        );
+        let mut forged = entry.clone();
+        forged["package"] = Value::from("example-forged-package");
+        assert_eq!(
+            AssetId::parse(forged["name"].as_str().expect("should keep forged name"))
+                .expect("should still resolve")
+                .artifact()
+                .package,
+            fixed.package,
+            "should ignore JSON-supplied package"
+        );
+    }
+}
+
+#[test]
+fn unknown_role_is_rejected() {
+    assert_eq!(Role::parse("A").expect("should accept A"), Role::Canonical);
+    assert_eq!(
+        Role::parse("B").expect("should accept B"),
+        Role::Reproduction
+    );
+    for text in ["", "a", "b", "C", "AB", " A"] {
+        assert!(
+            Role::parse(text).is_err_and(|error| format!("{error:?}").contains("unknown role")),
+            "should reject role {text:?}"
+        );
+    }
+}
+
+#[test]
+fn non_default_variant_is_rejected() {
+    check_variant("default").expect("should accept the default variant");
+    for variant in ["", "Default", "minimal", "default "] {
+        assert!(
+            check_variant(variant).is_err_and(|error| format!("{error:?}").contains("variant")),
+            "should reject variant {variant:?}"
+        );
+    }
+}
+
+/// A fictional on-disk layout in which every request root is individually valid.
+struct Workspace {
+    directory: tempfile::TempDir,
+    root: PathBuf,
+}
+
+impl Workspace {
+    fn new() -> Self {
+        let directory = tempfile::tempdir().expect("should create workspace");
+        let root = fs::canonicalize(directory.path()).expect("should canonicalize workspace");
+        fs::create_dir_all(root.join("js/bundles")).expect("should create JS bundle root");
+        fs::write(root.join("js/bundles/tsjs-core.js"), b"fictional module")
+            .expect("should write JS module");
+        fs::write(root.join("js/tsjs-inventory.json"), b"fictional inventory")
+            .expect("should write JS inventory");
+        fs::create_dir_all(root.join("materials/vendor")).expect("should create materials root");
+        fs::create_dir(root.join("cargo-state")).expect("should create cargo state root");
+        fs::create_dir(root.join("output")).expect("should create output root");
+        Self { directory, root }
+    }
+
+    fn path(&self, relative: &str) -> PathBuf {
+        self.root.join(relative)
+    }
+
+    fn input<'a>(&'a self, paths: &'a [PathBuf; 6]) -> RecipeInput<'a> {
+        RecipeInput {
+            asset: "ts-aarch64-apple-darwin",
+            variant: "default",
+            role: Role::Canonical.spec_label(),
+            commit: COMMIT,
+            js_dir: &paths[0],
+            js_inventory: &paths[1],
+            materials: &paths[2],
+            cargo_state: &paths[3],
+            output: &paths[4],
+            target_dir: &paths[5],
+        }
+    }
+
+    fn defaults(&self) -> [PathBuf; 6] {
+        [
+            self.path("js/bundles"),
+            self.path("js/tsjs-inventory.json"),
+            self.path("materials"),
+            self.path("cargo-state"),
+            self.path("output"),
+            self.path("target"),
+        ]
+    }
+}
+
+const COMMIT: &str = "0123456789abcdef0123456789abcdef01234567";
+
+fn parse_error(paths: &[PathBuf; 6], workspace: &Workspace) -> String {
+    let error = match RecipeRequest::parse(&workspace.input(paths)) {
+        Ok(_) => panic!("should reject the request"),
+        Err(error) => error,
+    };
+    format!("{error:?}")
+}
+
+#[test]
+fn relative_or_dotted_paths_are_rejected() {
+    let workspace = Workspace::new();
+    RecipeRequest::parse(&workspace.input(&workspace.defaults()))
+        .expect("should accept the baseline layout");
+    let bad_values = [
+        PathBuf::from("relative/path"),
+        workspace.path("output/../output"),
+        workspace.path("./output"),
+    ];
+    for index in 0..6 {
+        for bad in &bad_values {
+            let mut paths = workspace.defaults();
+            paths[index] = bad.clone();
+            assert!(
+                parse_error(&paths, &workspace).contains("absolute normal path"),
+                "should reject non-normal path {bad:?} at field {index}"
+            );
+        }
+    }
+}
+
+#[test]
+fn existing_nonempty_output_root_is_rejected() {
+    let workspace = Workspace::new();
+    fs::write(workspace.path("output/leftover"), b"previous attempt")
+        .expect("should write a leftover entry");
+    assert!(
+        parse_error(&workspace.defaults(), &workspace).contains("cannot be reused"),
+        "should reject an output root with prior entries"
+    );
+    let mut absent = workspace.defaults();
+    absent[4] = workspace.path("missing-output");
+    assert!(
+        parse_error(&absent, &workspace).contains("cannot be resolved"),
+        "should reject an output root that does not exist"
+    );
+}
+
+#[test]
+fn symlinked_or_preexisting_materials_root_is_rejected() {
+    let workspace = Workspace::new();
+    fs::create_dir(workspace.path("real-materials")).expect("should create alias target");
+    symlink(
+        workspace.path("real-materials"),
+        workspace.path("linked-materials"),
+    )
+    .expect("should create materials alias");
+    let mut linked = workspace.defaults();
+    linked[2] = workspace.path("linked-materials");
+    assert!(
+        parse_error(&linked, &workspace).contains("symlink"),
+        "should reject a symlinked materials root"
+    );
+    fs::write(workspace.path("materials/cache"), b"prepared earlier")
+        .expect("should populate materials");
+    assert!(
+        parse_error(&workspace.defaults(), &workspace).contains("exactly the prepared vendor"),
+        "should reject a materials root holding more than the vendor directory"
+    );
+}
+
+#[test]
+fn materials_root_must_hold_exactly_a_vendor_directory() {
+    let workspace = Workspace::new();
+    RecipeRequest::parse(&workspace.input(&workspace.defaults()))
+        .expect("should accept the prepared layout");
+    fs::remove_dir(workspace.path("materials/vendor")).expect("should remove vendor");
+    assert!(
+        parse_error(&workspace.defaults(), &workspace).contains("exactly the prepared vendor"),
+        "should reject an empty materials root"
+    );
+    fs::write(workspace.path("materials/vendor"), b"not a directory")
+        .expect("should write a vendor file");
+    assert!(
+        parse_error(&workspace.defaults(), &workspace).contains("vendor directory"),
+        "should reject a vendor entry that is a file"
+    );
+    fs::remove_file(workspace.path("materials/vendor")).expect("should remove vendor file");
+    fs::create_dir_all(workspace.path("elsewhere")).expect("should create alias target");
+    symlink(
+        workspace.path("elsewhere"),
+        workspace.path("materials/vendor"),
+    )
+    .expect("should alias vendor");
+    assert!(
+        parse_error(&workspace.defaults(), &workspace).contains("symlink"),
+        "should reject a symlinked vendor directory"
+    );
+}
+
+#[test]
+fn reused_cargo_state_root_is_rejected() {
+    let workspace = Workspace::new();
+    fs::create_dir(workspace.path("cargo-state/home")).expect("should create previous state");
+    assert!(
+        parse_error(&workspace.defaults(), &workspace).contains("cannot be reused"),
+        "should reject a cargo state root with prior entries"
+    );
+}
+
+#[test]
+fn reused_target_directory_is_rejected() {
+    let workspace = Workspace::new();
+    fs::create_dir(workspace.path("target")).expect("should create a previous target");
+    assert!(
+        parse_error(&workspace.defaults(), &workspace).contains("cannot be reused"),
+        "should reject a target directory that already exists"
+    );
+}
+
+#[test]
+fn overlapping_roots_are_rejected() {
+    let workspace = Workspace::new();
+    let cases: [(usize, &str); 6] = [
+        (3, "output"),
+        (4, "cargo-state"),
+        (5, "output/target"),
+        (5, "cargo-state/target"),
+        (5, "materials/target"),
+        (5, "js/target"),
+    ];
+    for (index, relative) in cases {
+        let mut paths = workspace.defaults();
+        paths[index] = workspace.path(relative);
+        assert!(
+            parse_error(&paths, &workspace).contains("overlap"),
+            "should reject {relative} overlapping another root"
+        );
+    }
+}
+
+fn observed_canonical() -> ObservedAmbient {
+    ObservedAmbient {
+        umask: 0o022,
+        jobs: 4,
+        host_locale: "C".to_owned(),
+        host_timezone: "UTC".to_owned(),
+        child_locale: "C".to_owned(),
+        child_timezone: "UTC".to_owned(),
+        execution_uid: 501,
+        checkout_root: PathBuf::from("/example/release-canonical"),
+        started_at_seconds: 1_700_000_000,
+    }
+}
+
+fn observed_reproduction() -> ObservedAmbient {
+    ObservedAmbient {
+        umask: 0o027,
+        jobs: 2,
+        host_locale: "en_US.UTF-8".to_owned(),
+        host_timezone: "Pacific/Auckland".to_owned(),
+        child_locale: "C".to_owned(),
+        child_timezone: "UTC".to_owned(),
+        execution_uid: 501,
+        checkout_root: PathBuf::from("/example/release-reproduction"),
+        started_at_seconds: 1_700_000_900,
+    }
+}
+
+fn checked_canonical() -> CheckedAmbient {
+    CheckedAmbient::check(
+        Role::Canonical,
+        &AmbientProfile::CANONICAL,
+        observed_canonical(),
+    )
+    .expect("should accept the baseline canonical ambient")
+}
+
+fn checked_reproduction() -> CheckedAmbient {
+    CheckedAmbient::check(
+        Role::Reproduction,
+        &AmbientProfile::alternate_for_tests(),
+        observed_reproduction(),
+    )
+    .expect("should accept the baseline reproduction ambient")
+}
+
+mod ambient;
+mod bind;
+mod candidate;
+#[cfg(any(target_os = "linux", target_os = "macos"))]
+mod candidate_entry;
+mod candidate_index;
+#[cfg(target_os = "linux")]
+mod cli;
+mod cli_candidate;
+mod compare;
+mod complete;
+mod complete_darwin;
+mod darwin;
+mod darwin_toolchain;
+mod fixture;
+#[cfg(target_os = "linux")]
+mod full;
+#[cfg(target_os = "macos")]
+mod full_macos;
+mod macos_candidate;
+#[cfg(target_os = "macos")]
+mod macos_cli;
+mod native;
+mod plan;
+#[cfg(any(target_os = "linux", target_os = "macos"))]
+mod real_fixture;
+mod remap;
+mod runtime;
+mod sources;
+mod spdx_candidate;
+mod tools;
+
+#[test]
+fn symlinked_ancestor_of_target_parent_is_rejected() {
+    let workspace = Workspace::new();
+    fs::create_dir(workspace.path("real-parent")).expect("should create alias target");
+    symlink(
+        workspace.path("real-parent"),
+        workspace.path("linked-parent"),
+    )
+    .expect("should create parent alias");
+    fs::create_dir(workspace.path("real-parent/inner")).expect("should create inner parent");
+    let mut paths = workspace.defaults();
+    paths[5] = workspace.path("linked-parent/inner/target");
+    assert!(
+        parse_error(&paths, &workspace).contains("symlink"),
+        "should reject a target below a symlinked ancestor"
+    );
+}
diff --git a/crates/trusted-server-release/src/recipe/tests/ambient.rs b/crates/trusted-server-release/src/recipe/tests/ambient.rs
new file mode 100644
index 0000000000..cfc37ba82f
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/tests/ambient.rs
@@ -0,0 +1,299 @@
+use std::path::PathBuf;
+
+use serde_json::Value;
+
+use super::super::ambient::{
+    AmbientClaim, AmbientRecord, Dimension, ObservedAmbient, check_profile_drift,
+};
+use super::*;
+
+const TOOLS: &str = include_str!(concat!(
+    env!("CARGO_MANIFEST_DIR"),
+    "/../../scripts/release/release-tools.json"
+));
+
+fn check_error(role: Role, profile: &AmbientProfile, observed: ObservedAmbient) -> String {
+    match CheckedAmbient::check(role, profile, observed) {
+        Ok(_) => panic!("should reject the ambient"),
+        Err(error) => format!("{error:?}"),
+    }
+}
+
+#[test]
+fn reproduction_with_canonical_umask_is_rejected() {
+    checked_canonical();
+    checked_reproduction();
+    let reproduction_profile = AmbientProfile::alternate_for_tests();
+    let wrong_umask = ObservedAmbient {
+        umask: 0o022,
+        ..observed_reproduction()
+    };
+    assert!(
+        check_error(Role::Reproduction, &reproduction_profile, wrong_umask).contains("umask"),
+        "should reject the reproduction build observed under the canonical umask"
+    );
+    let canonical_with_reproduction_umask = ObservedAmbient {
+        umask: 0o027,
+        ..observed_canonical()
+    };
+    assert!(
+        check_error(
+            Role::Canonical,
+            &AmbientProfile::CANONICAL,
+            canonical_with_reproduction_umask
+        )
+        .contains("umask"),
+        "should reject the canonical build observed under the reproduction umask"
+    );
+    assert!(
+        check_error(
+            Role::Reproduction,
+            &AmbientProfile::CANONICAL,
+            observed_canonical()
+        )
+        .contains("runnable profile"),
+        "should reject the reproduction build bound to the canonical profile"
+    );
+    assert!(
+        check_error(
+            Role::Canonical,
+            &reproduction_profile,
+            observed_reproduction()
+        )
+        .contains("runnable profile"),
+        "should reject the canonical build bound to an alternate profile"
+    );
+    let closed = AmbientProfile::for_role(Role::Reproduction)
+        .expect_err("should keep the reproduction build closed");
+    assert!(
+        format!("{closed:?}").contains("not qualified"),
+        "should name the missing qualification"
+    );
+}
+
+#[test]
+fn observed_jobs_mismatch_is_rejected() {
+    let canonical_wrong = ObservedAmbient {
+        jobs: 2,
+        ..observed_canonical()
+    };
+    assert!(
+        check_error(Role::Canonical, &AmbientProfile::CANONICAL, canonical_wrong).contains("jobs"),
+        "should reject the canonical build observed with reproduction jobs"
+    );
+    let reproduction_wrong = ObservedAmbient {
+        jobs: 8,
+        ..observed_reproduction()
+    };
+    assert!(
+        check_error(
+            Role::Reproduction,
+            &AmbientProfile::alternate_for_tests(),
+            reproduction_wrong
+        )
+        .contains("jobs"),
+        "should reject the reproduction build observed with unrelated jobs"
+    );
+}
+
+fn claim_error(
+    canonical: &CheckedAmbient,
+    reproduction: &CheckedAmbient,
+    claim: &AmbientClaim,
+) -> String {
+    match AmbientRecord::pair(canonical, reproduction, claim) {
+        Ok(_) => panic!("should reject the pairing"),
+        Err(error) => format!("{error:?}"),
+    }
+}
+
+#[test]
+fn normalized_locale_reported_as_varied_is_rejected() {
+    let record = AmbientRecord::pair(
+        &checked_canonical(),
+        &checked_reproduction(),
+        &AmbientClaim::standard(),
+    )
+    .expect("should accept the standard claim");
+    assert_eq!(
+        record.claim(),
+        &AmbientClaim::standard(),
+        "should keep the verified placement"
+    );
+    for dimension in [Dimension::Locale, Dimension::Timezone] {
+        let mut claim = AmbientClaim::standard();
+        claim.normalized.remove(&dimension);
+        claim.varied.insert(dimension);
+        assert!(
+            claim_error(&checked_canonical(), &checked_reproduction(), &claim)
+                .contains("misreports"),
+            "should reject {dimension} claimed as varied"
+        );
+    }
+    let leaking_child = ObservedAmbient {
+        child_locale: "en_US.UTF-8".to_owned(),
+        ..observed_reproduction()
+    };
+    assert!(
+        check_error(
+            Role::Reproduction,
+            &AmbientProfile::alternate_for_tests(),
+            leaking_child
+        )
+        .contains("child locale"),
+        "should reject a compiler child that sees the host locale"
+    );
+}
+
+#[test]
+fn unsupported_execution_user_claimed_as_varied_is_rejected() {
+    let mut claim = AmbientClaim::standard();
+    claim.unsupported.remove(&Dimension::ExecutionUser);
+    claim.varied.insert(Dimension::ExecutionUser);
+    assert!(
+        claim_error(&checked_canonical(), &checked_reproduction(), &claim).contains("misreports"),
+        "should reject an unqualified user claimed as varied"
+    );
+    let other_user = CheckedAmbient::check(
+        Role::Reproduction,
+        &AmbientProfile::alternate_for_tests(),
+        ObservedAmbient {
+            execution_uid: 502,
+            ..observed_reproduction()
+        },
+    )
+    .expect("should check the alternate user in isolation");
+    assert!(
+        claim_error(&checked_canonical(), &other_user, &AmbientClaim::standard())
+            .contains("execution user"),
+        "should reject an actually different unqualified user"
+    );
+}
+
+#[test]
+fn omitted_ambient_dimension_is_rejected() {
+    for dimension in Dimension::ALL {
+        let mut claim = AmbientClaim::standard();
+        claim.varied.remove(&dimension);
+        claim.normalized.remove(&dimension);
+        claim.unsupported.remove(&dimension);
+        assert!(
+            claim_error(&checked_canonical(), &checked_reproduction(), &claim).contains("omits"),
+            "should reject a claim omitting {dimension}"
+        );
+    }
+    let mut duplicated = AmbientClaim::standard();
+    duplicated.normalized.insert(Dimension::Jobs);
+    assert!(
+        claim_error(&checked_canonical(), &checked_reproduction(), &duplicated)
+            .contains("misreports"),
+        "should reject a dimension placed twice"
+    );
+}
+
+#[test]
+fn identical_canonical_and_reproduction_checkout_roots_are_rejected() {
+    for root in [
+        "/example/release-canonical",
+        "/example/release-canonical/nested",
+        "/example",
+    ] {
+        let overlapping = CheckedAmbient::check(
+            Role::Reproduction,
+            &AmbientProfile::alternate_for_tests(),
+            ObservedAmbient {
+                checkout_root: PathBuf::from(root),
+                ..observed_reproduction()
+            },
+        )
+        .expect("should check the alternate root in isolation");
+        assert!(
+            claim_error(
+                &checked_canonical(),
+                &overlapping,
+                &AmbientClaim::standard()
+            )
+            .contains("overlap"),
+            "should reject checkout root {root} overlapping the canonical build"
+        );
+    }
+    let same_start = CheckedAmbient::check(
+        Role::Reproduction,
+        &AmbientProfile::alternate_for_tests(),
+        ObservedAmbient {
+            started_at_seconds: observed_canonical().started_at_seconds,
+            ..observed_reproduction()
+        },
+    )
+    .expect("should check the alternate start in isolation");
+    assert!(
+        claim_error(&checked_canonical(), &same_start, &AmbientClaim::standard())
+            .contains("StartTime"),
+        "should reject builds that did not start at different times"
+    );
+}
+
+#[test]
+fn rust_profile_drift_from_release_tools_json_is_rejected() {
+    let tools: Value = serde_json::from_str(TOOLS).expect("should parse tracked tools");
+    let recipes = tools["recipes"].as_array().expect("should list recipes");
+    let mut checked = 0;
+    for recipe in recipes
+        .iter()
+        .filter(|recipe| recipe["script"] == "scripts/release/build.sh")
+    {
+        check_profile_drift(&recipe["settings"])
+            .expect("should accept the tracked ambient profiles");
+        checked += 1;
+        for (profile, field, value) in [
+            (Role::Canonical.spec_label(), "umask", Value::from("027")),
+            (Role::Canonical.spec_label(), "jobs", Value::from(2)),
+            (Role::Reproduction.spec_label(), "jobs", Value::from(4)),
+            (Role::Reproduction.spec_label(), "umask", Value::from("022")),
+            (Role::Reproduction.spec_label(), "locale", Value::from("C")),
+        ] {
+            let mut drifted = recipe["settings"].clone();
+            drifted["ambient_profiles"][profile][field] = value;
+            assert!(
+                check_profile_drift(&drifted)
+                    .is_err_and(|error| format!("{error:?}").contains(profile)),
+                "should reject drifted {profile}.{field}"
+            );
+        }
+        let mut missing = recipe["settings"].clone();
+        missing["ambient_profiles"]
+            .as_object_mut()
+            .expect("should hold profiles")
+            .remove(Role::Reproduction.spec_label());
+        assert!(
+            check_profile_drift(&missing).is_err_and(|error| {
+                format!("{error:?}")
+                    .contains(&format!("profile {}", Role::Reproduction.spec_label()))
+            }),
+            "should reject a missing reproduction profile"
+        );
+    }
+    assert_eq!(checked, 4, "should check every artifact recipe");
+}
+
+#[test]
+fn reproduction_with_canonical_locale_or_timezone_is_rejected() {
+    let same_locale = AmbientProfile::alternate_with_host_for_tests("C", "Pacific/Auckland");
+    let observed = ObservedAmbient {
+        host_locale: "C".to_owned(),
+        ..observed_reproduction()
+    };
+    assert!(
+        check_error(Role::Reproduction, &same_locale, observed).contains("runnable profile"),
+        "should reject a reproduction build that keeps the canonical locale"
+    );
+    let same_timezone = AmbientProfile::alternate_with_host_for_tests("en_US.UTF-8", "UTC");
+    let observed = ObservedAmbient {
+        host_timezone: "UTC".to_owned(),
+        ..observed_reproduction()
+    };
+    assert!(
+        check_error(Role::Reproduction, &same_timezone, observed).contains("runnable profile"),
+        "should reject a reproduction build that keeps the canonical timezone"
+    );
+}
diff --git a/crates/trusted-server-release/src/recipe/tests/bind.rs b/crates/trusted-server-release/src/recipe/tests/bind.rs
new file mode 100644
index 0000000000..7e5c593693
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/tests/bind.rs
@@ -0,0 +1,350 @@
+use std::fs;
+
+use super::fixture::*;
+use super::*;
+use crate::boundary::BoundaryRoots;
+#[cfg(target_os = "macos")]
+use crate::boundary::{Boundary, DenialProof};
+
+#[test]
+fn js_handoff_for_other_source_commit_is_rejected() {
+    Fixture::new(COMMIT)
+        .bind("ts-aarch64-apple-darwin", Role::Canonical)
+        .expect("should bind the matching handoff");
+    let other = Fixture::new(OTHER_COMMIT);
+    assert!(
+        bind_error(other.bind("ts-aarch64-apple-darwin", Role::Canonical))
+            .contains("another source commit"),
+        "should reject a JS handoff built from another commit"
+    );
+    assert!(
+        !other.base.join("target").exists(),
+        "should not create the target after a rejection"
+    );
+    let fixture = Fixture::new(COMMIT);
+    let request = fixture.request(
+        "ts-aarch64-apple-darwin",
+        Role::Canonical.spec_label(),
+        OTHER_COMMIT,
+    );
+    assert!(
+        bind_error(fixture.bind_with(request, Role::Canonical, COMMIT))
+            .contains("another source commit"),
+        "should reject a request naming another commit"
+    );
+}
+
+#[test]
+fn js_handoff_mutated_after_completion_is_rejected() {
+    let changed = Fixture::new(COMMIT);
+    let request = changed.request(
+        "ts-aarch64-apple-darwin",
+        Role::Canonical.spec_label(),
+        COMMIT,
+    );
+    fs::write(changed.retained().join("bundles/tsjs-core.js"), b"tampered")
+        .expect("should mutate a retained module");
+    assert!(
+        bind_error(changed.bind_with(request, Role::Canonical, COMMIT))
+            .contains("no longer rehashes"),
+        "should reject a mutated retained module"
+    );
+    let extra = Fixture::new(COMMIT);
+    let request = extra.request(
+        "ts-aarch64-apple-darwin",
+        Role::Canonical.spec_label(),
+        COMMIT,
+    );
+    fs::write(extra.retained().join("unrecorded"), b"extra").expect("should add an entry");
+    assert!(
+        bind_error(extra.bind_with(request, Role::Canonical, COMMIT))
+            .contains("no longer rehashes"),
+        "should reject an unrecorded retained entry"
+    );
+    assert!(
+        !changed.base.join("target").exists(),
+        "should not create the target after a rejection"
+    );
+}
+
+#[test]
+fn request_for_other_js_directory_or_role_is_rejected() {
+    let fixture = Fixture::new(COMMIT);
+    let foreign = Fixture::new(COMMIT);
+    let request = foreign.request(
+        "ts-aarch64-apple-darwin",
+        Role::Canonical.spec_label(),
+        COMMIT,
+    );
+    assert!(
+        bind_error(fixture.bind_with(request, Role::Canonical, COMMIT)).contains("does not name"),
+        "should reject a request naming another JS handoff directory"
+    );
+    let request = fixture.request(
+        "ts-aarch64-apple-darwin",
+        Role::Reproduction.spec_label(),
+        COMMIT,
+    );
+    assert!(
+        bind_error(fixture.bind_with(request, Role::Canonical, COMMIT)).contains("ambient role"),
+        "should reject an ambient of another role"
+    );
+}
+
+#[test]
+fn bind_creates_fresh_target_and_private_cargo_state() {
+    let fixture = Fixture::new(COMMIT);
+    fixture
+        .bind("ts-aarch64-apple-darwin", Role::Canonical)
+        .expect("should bind the recipe");
+    for relative in [
+        "target",
+        "cargo-state/home",
+        "cargo-state/cargo-home",
+        "cargo-state/tmp",
+    ] {
+        assert!(
+            fixture.base.join(relative).is_dir(),
+            "should create {relative}"
+        );
+    }
+    assert_eq!(
+        fs::read_dir(fixture.base.join("output"))
+            .expect("should list output")
+            .count(),
+        0,
+        "should leave the unmounted output root empty"
+    );
+}
+
+#[cfg(target_os = "macos")]
+#[test]
+fn execute_rejects_boundary_with_other_roots() {
+    let fixture = Fixture::new(COMMIT);
+    let prepared = fixture
+        .bind("ts-aarch64-apple-darwin", Role::Canonical)
+        .expect("should bind the recipe");
+    let other = BoundaryRoots::new(
+        &[fixture.base.join("other-source")],
+        &[fixture.base.join("tools")],
+        &[fixture.base.join("other-work")],
+    )
+    .expect("should build unrelated roots");
+    let boundary = Boundary::mac_sandbox_for_tests(other).expect("should configure, not run");
+    let error = prepared
+        .execute(&boundary, &DenialProof::for_tests())
+        .expect_err("should reject a boundary over other roots");
+    assert!(
+        format!("{error:?}").contains("outside the boundary roots"),
+        "should reject plan paths outside the other roots: {error:?}"
+    );
+}
+
+#[test]
+fn qualified_rust_tools_constructor_is_uninhabited() {
+    let never: fn(QualifiedRustTools) -> ! = |qualification| match qualification {};
+    let _constructor: fn(&Path, QualifiedRustTools) -> SelectedRustTools =
+        SelectedRustTools::qualified;
+    let _ = never;
+    let closed = AmbientProfile::for_role(Role::Reproduction)
+        .expect_err("should keep the alternate ambient closed");
+    assert!(
+        format!("{closed:?}").contains("not qualified"),
+        "should name the missing qualification"
+    );
+}
+
+#[test]
+fn ordinary_ci_selection_carries_no_release_authority() {
+    let fixture = Fixture::new(COMMIT);
+    let tools = fixture.tools_for(ReleaseTarget::Aarch64AppleDarwin);
+    assert_eq!(
+        tools.authority(),
+        Authority::Unqualified,
+        "should never report a test selection as qualified"
+    );
+    assert_eq!(
+        ToolSelection::OrdinaryCi.authority(),
+        Authority::Unqualified,
+        "should report the ordinary CI selection as unqualified"
+    );
+}
+
+#[test]
+fn root_filled_between_parse_and_bind_is_rejected() {
+    for (relative, label) in [("cargo-state", "cargo state"), ("output", "output")] {
+        let fixture = Fixture::new(COMMIT);
+        let request = fixture.request(
+            "ts-aarch64-apple-darwin",
+            Role::Canonical.spec_label(),
+            COMMIT,
+        );
+        fs::write(
+            fixture.base.join(relative).join("late"),
+            b"written after parse",
+        )
+        .expect("should fill the root after parsing");
+        let error = bind_error(fixture.bind_with(request, Role::Canonical, COMMIT));
+        assert!(
+            error.contains(label) && error.contains("cannot be reused"),
+            "should reject a {label} root filled after parsing"
+        );
+        assert!(
+            !fixture.base.join("target").exists(),
+            "should not create the target after a rejection"
+        );
+    }
+    let fixture = Fixture::new(COMMIT);
+    let request = fixture.request(
+        "ts-aarch64-apple-darwin",
+        Role::Canonical.spec_label(),
+        COMMIT,
+    );
+    fs::create_dir(fixture.base.join("target")).expect("should create the target after parse");
+    assert!(
+        bind_error(fixture.bind_with(request, Role::Canonical, COMMIT))
+            .contains("cannot be reused"),
+        "should reject a target created after parsing"
+    );
+}
+
+#[test]
+fn materials_changed_or_foreign_after_preparation_are_rejected() {
+    let fixture = Fixture::new(COMMIT);
+    let request = fixture.request(
+        "ts-aarch64-apple-darwin",
+        Role::Canonical.spec_label(),
+        COMMIT,
+    );
+    let materials = fixture.materials(COMMIT);
+    fs::write(
+        fixture
+            .base
+            .join("materials/vendor/example-1.0.0/Cargo.toml"),
+        b"tampered after preparation",
+    )
+    .expect("should edit a vendored file");
+    let tools = fixture.tools_for(ReleaseTarget::Aarch64AppleDarwin);
+    assert!(
+        bind_error(fixture.bind_parts(request, Role::Canonical, COMMIT, tools, materials))
+            .contains("no longer rehash"),
+        "should reject materials edited after preparation"
+    );
+    assert!(
+        !fixture.base.join("target").exists(),
+        "should not create the target after a rejection"
+    );
+
+    let fixture = Fixture::new(COMMIT);
+    let request = fixture.request(
+        "ts-aarch64-apple-darwin",
+        Role::Canonical.spec_label(),
+        COMMIT,
+    );
+    let foreign = fixture.materials(OTHER_COMMIT);
+    let tools = fixture.tools_for(ReleaseTarget::Aarch64AppleDarwin);
+    assert!(
+        bind_error(fixture.bind_parts(request, Role::Canonical, COMMIT, tools, foreign))
+            .contains("another source commit"),
+        "should reject materials derived from another commit"
+    );
+}
+
+#[test]
+fn tools_selected_for_another_target_are_rejected() {
+    let fixture = Fixture::new(COMMIT);
+    let request = fixture.request(
+        "ts-aarch64-apple-darwin",
+        Role::Canonical.spec_label(),
+        COMMIT,
+    );
+    let tools = fixture.tools_for(ReleaseTarget::X86_64UnknownLinuxGnu);
+    let materials = fixture.materials(COMMIT);
+    assert!(
+        bind_error(fixture.bind_parts(request, Role::Canonical, COMMIT, tools, materials))
+            .contains("another target"),
+        "should reject tools whose standard library was checked for another target"
+    );
+}
+
+#[test]
+fn target_inside_checkout_is_rejected_before_creation() {
+    let fixture = Fixture::new(COMMIT);
+    let inside = fixture.base.join("checkout-canonical/target");
+    let request = fixture.request_at(
+        "ts-aarch64-apple-darwin",
+        Role::Canonical.spec_label(),
+        COMMIT,
+        &inside,
+    );
+    assert!(
+        bind_error(fixture.bind_with(request, Role::Canonical, COMMIT)).contains("overlap"),
+        "should reject a target inside the checkout root"
+    );
+    assert!(!inside.exists(), "should create nothing in the checkout");
+    let fixture = Fixture::new(COMMIT);
+    let inside_tools = fixture.base.join("tools/target");
+    let request = fixture.request_at(
+        "ts-aarch64-apple-darwin",
+        Role::Canonical.spec_label(),
+        COMMIT,
+        &inside_tools,
+    );
+    assert!(
+        bind_error(fixture.bind_with(request, Role::Canonical, COMMIT)).contains("overlap"),
+        "should reject a target inside the tools root"
+    );
+    assert!(!inside_tools.exists(), "should create nothing in the tools");
+}
+
+#[test]
+fn boundary_roots_mount_materials_read_only_state_and_target_writable_output_unmounted() {
+    let fixture = Fixture::new(COMMIT);
+    let prepared = fixture
+        .bind("ts-aarch64-apple-darwin", Role::Canonical)
+        .expect("should bind the recipe");
+    let expected = BoundaryRoots::new(
+        &[
+            fixture.base.join("checkout-canonical"),
+            fixture.retained(),
+            fixture.base.join("materials"),
+        ],
+        &[fixture.base.join("tools")],
+        &[
+            fixture.base.join("cargo-state"),
+            fixture.base.join("target"),
+        ],
+    )
+    .and_then(|roots| roots.with_system(&[fixture.developer_dir()]))
+    .expect("should build the expected roots");
+    assert_eq!(
+        prepared.boundary_roots().expect("should derive roots"),
+        expected,
+        "should mount exactly the planned roles"
+    );
+    assert_eq!(
+        expected.system(),
+        [fixture.developer_dir()],
+        "should add the Apple developer directory as the only system root"
+    );
+    let all: Vec<_> = expected
+        .entries()
+        .map(|(_, _, path)| path.to_owned())
+        .collect();
+    assert!(
+        !all.iter()
+            .any(|path| path.starts_with(fixture.base.join("output"))),
+        "should not mount the output root"
+    );
+    assert_eq!(
+        expected.writable().len(),
+        2,
+        "should expose exactly two writable roots"
+    );
+    assert!(
+        expected
+            .immutable()
+            .contains(&fixture.base.join("materials")),
+        "should mount the vendor materials read-only"
+    );
+}
diff --git a/crates/trusted-server-release/src/recipe/tests/candidate.rs b/crates/trusted-server-release/src/recipe/tests/candidate.rs
new file mode 100644
index 0000000000..234ad33d56
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/tests/candidate.rs
@@ -0,0 +1,1016 @@
+//! Ordinary CI candidate support: the Cargo fixture description, the explicit
+//! container settings and the measurements the real Linux fixtures print.
+//!
+//! Nothing here is release qualification. The fixture is acquired without
+//! authentication, the toolchain and image are unqualified, and every
+//! measurement says so.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::path::{Component, Path, PathBuf};
+use std::time::Duration;
+
+use serde_json::{Map, Value, json};
+use sha2::Sha256;
+
+use super::super::ambient::Dimension;
+use super::super::compare::FastlyEqualityChecked;
+use super::*;
+use crate::boundary::DockerSettings;
+use crate::process::ProcessLimits;
+
+/// Schema version of `fixture.json` and of every measurement.
+pub(super) const SCHEMA_VERSION: u64 = 1;
+/// Kind of the Linux Cargo fixture description.
+const FIXTURE_KIND: &str = "ordinary-ci-cargo-fixture";
+/// Kind of the macOS Cargo fixture description, which names no image.
+const MACOS_FIXTURE_KIND: &str = "ordinary-ci-macos-cargo-fixture";
+
+/// Which host a Cargo fixture was prepared for.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(super) enum FixtureHost {
+    /// The Linux container job; the fixture names a local builder image ID.
+    LinuxContainer,
+    /// A macOS sandbox job; the fixture names no image (`image_id: null`).
+    MacosSandbox,
+}
+/// How the fixture inputs were acquired.
+const ACQUISITION: &str = "unauthenticated-ordinary-ci";
+
+/// Checks that a real candidate export outlives all owned build storage.
+pub(super) fn check_export_after_cleanup<T>(build: T, completed: fn(&T) -> &RecipeCompleted) {
+    check_owned_export_after_cleanup(build, completed, None);
+}
+
+/// Checks an export carrying the actual final-byte Fastly runtime acceptance.
+pub(super) fn check_fastly_export_after_cleanup<T>(
+    build: T,
+    completed: fn(&T) -> &RecipeCompleted,
+    accepted: &super::super::runtime::FastlyRuntimeAccepted,
+) {
+    check_owned_export_after_cleanup(build, completed, Some(RuntimeAcceptance::Fastly(accepted)));
+}
+
+/// Checks retained canonical native startup evidence after every build root is removed.
+pub(super) fn check_native_export_after_cleanup<T>(
+    build: T,
+    completed: fn(&T) -> &RecipeCompleted,
+    accepted: &super::super::NativeStartupAccepted,
+) {
+    check_owned_export_after_cleanup(build, completed, Some(RuntimeAcceptance::Native(accepted)));
+}
+
+#[derive(Clone, Copy)]
+enum RuntimeAcceptance<'a> {
+    Fastly(&'a super::super::FastlyRuntimeAccepted),
+    Native(&'a super::super::NativeStartupAccepted),
+}
+
+impl RuntimeAcceptance<'_> {
+    fn diagnostic_for(&self, completed: &RecipeCompleted) -> Value {
+        match self {
+            Self::Fastly(accepted) => accepted.diagnostic_for(completed),
+            Self::Native(accepted) => accepted.diagnostic_for(completed),
+        }
+        .expect("should retain exact owning runtime observations")
+    }
+}
+
+fn check_owned_export_after_cleanup<T>(
+    build: T,
+    completed: fn(&T) -> &RecipeCompleted,
+    accepted: Option<RuntimeAcceptance<'_>>,
+) {
+    let completed = completed(&build);
+    let artifact = completed.artifact().path().to_owned();
+    let view = completed
+        .composition_view()
+        .expect("should expose sealed typed receipts after working-root cleanup");
+    assert_eq!(
+        view.receipt_sha256(),
+        completed
+            .composition_export()
+            .expect("should export the same sealed receipt")
+            .sha256(),
+        "should bind the typed view to the exact original retained receipt bytes"
+    );
+    assert!(
+        !view.observations().units().is_empty(),
+        "should retain actual compiler units through the typed view"
+    );
+    for package in view.observations().packages() {
+        let origin = view
+            .package_origins()
+            .package(package.id())
+            .expect("should retain an exact verified origin for every observed package");
+        assert_eq!(
+            origin.name(),
+            package.name(),
+            "should retain the joined name"
+        );
+        assert_eq!(
+            origin.version(),
+            package.version(),
+            "should retain the joined version"
+        );
+    }
+    let projected = crate::spdx::cargo::CargoProjection::from_completed(completed)
+        .expect("should project verified Rust packages after working-root cleanup");
+    assert_eq!(
+        projected.component_count(),
+        view.observations().packages().len(),
+        "should project precisely the observed packages rather than the potential graph"
+    );
+    assert_eq!(
+        projected.observations().units().len(),
+        view.observations().units().len(),
+        "should retain the original per-unit feature and context evidence"
+    );
+    let javascript = completed
+        .javascript_contributions()
+        .expect("should retain checked original JS evidence without its preparation lease");
+    let inventory = javascript.raw_inventory().to_vec();
+    let javascript_projection =
+        crate::spdx::javascript::JavascriptProjection::from_completed(completed)
+            .expect("should project original JS evidence joined to final-byte membership");
+    assert!(
+        javascript_projection.component_count() > 0,
+        "should project actual checked JS material even when CLI discards complete bundles"
+    );
+    let native = crate::spdx::native::NativeProjection::from_completed(completed).expect(
+        "should project exact observed native contexts through verified original materials",
+    );
+    assert_eq!(
+        native.component_count(),
+        view.native().contributors().len(),
+        "should preserve measured native membership rather than every prepared dependency"
+    );
+    let platform = crate::spdx::platform::PlatformProjection::from_completed(completed)
+        .expect("should project artifact-bound installed tools and logical runtime requirements");
+    assert!(
+        platform.component_count() > 0,
+        "should retain measured platform facts"
+    );
+    assert_eq!(
+        platform.receipt_sha256(),
+        view.receipt_sha256(),
+        "should project the exact retained composition receipt"
+    );
+    let composition = completed
+        .composition_export()
+        .expect("should export the sealed composition receipt");
+    crate::collection::check_composition_receipt(
+        composition.bytes(),
+        &crate::collection::ReceiptFacts {
+            artifact_sha256: completed.artifact().sha256(),
+            source_commit: completed.commit().as_str(),
+            inventory_sha256: javascript.inventory_sha256(),
+            materials_sha256: completed.materials_digest(),
+            asset: completed.artifact().name(),
+        },
+    )
+    .unwrap_or_else(|error| {
+        panic!("should accept the real producer composition receipt: {error:?}")
+    });
+    let expected_runtime = accepted.map(|accepted| accepted.diagnostic_for(completed));
+    let export = match accepted {
+        Some(RuntimeAcceptance::Fastly(runtime)) => {
+            crate::collection::producer::CandidateBuildExport::with_fastly_runtime(
+                completed, runtime,
+            )
+        }
+        Some(RuntimeAcceptance::Native(startup)) => {
+            crate::collection::producer::CandidateBuildExport::with_native_startup(
+                completed, startup,
+            )
+        }
+        None => crate::collection::producer::CandidateBuildExport::from_completed(completed),
+    }
+    .expect("should export actual candidate receipts before closing their owners");
+    drop(build);
+    assert!(
+        !artifact.exists(),
+        "should remove the original artifact with its owning build storage"
+    );
+    let root = export
+        .rehash_for_handoff()
+        .expect("should retain exact exported bytes after all original build storage is removed");
+    assert_eq!(
+        std::fs::read(root.join("tsjs-inventory.json"))
+            .expect("should retain original JS inventory"),
+        inventory,
+        "should preserve original observer bytes after source, target and JS owners disappear"
+    );
+    let record: Value = serde_json::from_slice(
+        &std::fs::read(root.join("candidate-build-record.json"))
+            .expect("should retain build record"),
+    )
+    .expect("should parse exported diagnostic record");
+    let gaps = record["gaps"]
+        .as_array()
+        .expect("should list remaining gaps");
+    match expected_runtime {
+        Some(runtime) => {
+            assert_eq!(
+                record["runtime_acceptance"], runtime,
+                "should retain exact final-byte runtime observations after working-root cleanup"
+            );
+            assert!(
+                !gaps
+                    .iter()
+                    .any(|gap| gap == "runtime-acceptance-not-exported"),
+                "should remove only a gap satisfied by actual owning acceptance"
+            );
+        }
+        None => {
+            assert!(
+                record["runtime_acceptance"].is_null(),
+                "should not invent unobserved runtime acceptance"
+            );
+            assert!(
+                gaps.iter()
+                    .any(|gap| gap == "runtime-acceptance-not-exported"),
+                "should preserve the missing runtime gap"
+            );
+        }
+    }
+}
+
+/// Every field `fixture.json` must hold, and nothing else.
+const FIXTURE_FIELDS: [&str; 10] = [
+    "acquisition",
+    "cargo_lock_sha256",
+    "comparison_manifests",
+    "git",
+    "image_id",
+    "kind",
+    "registry",
+    "rustc_version",
+    "schema_version",
+    "source_commit",
+];
+
+/// Container process limit of an ordinary CI Cargo build.
+const CARGO_PIDS_LIMIT: u32 = 4096;
+/// Container memory of an ordinary CI Cargo build.
+const CARGO_MEMORY_BYTES: u64 = 8 * 1024 * 1024 * 1024;
+/// Most CPUs an ordinary CI Cargo container receives (a 4-vCPU runner).
+const CARGO_MAX_CPUS: u32 = 4;
+/// Private `/tmp` of the Cargo container; Cargo's own `TMPDIR` is a root.
+const CARGO_TMPFS_BYTES: u64 = 512 * 1024 * 1024;
+
+/// One retained Git object directory for a locked Git source.
+#[derive(Debug, PartialEq, Eq)]
+pub(super) struct GitObjects {
+    pub(super) selector: String,
+    pub(super) revision: String,
+    pub(super) objects: PathBuf,
+}
+
+/// The manifest `cargo vendor` wrote for one locked Git package.
+///
+/// It is a differential comparison fixture only: the producer never vendors
+/// it, and it names which locked Git packages to supply closures for.
+#[derive(Debug, PartialEq, Eq)]
+pub(super) struct ComparisonManifest {
+    pub(super) name: String,
+    pub(super) version: String,
+    pub(super) selector: String,
+    pub(super) cargo_vendor_manifest: PathBuf,
+}
+
+/// The parsed, unauthenticated ordinary CI Cargo fixture.
+#[derive(Debug)]
+pub(super) struct CargoFixture {
+    pub(super) root: PathBuf,
+    pub(super) source_commit: String,
+    pub(super) cargo_lock_sha256: String,
+    pub(super) host: FixtureHost,
+    pub(super) image_id: Option<String>,
+    pub(super) registry: BTreeMap<(String, String), PathBuf>,
+    pub(super) git: Vec<GitObjects>,
+    pub(super) comparison_manifests: Vec<ComparisonManifest>,
+}
+
+fn fixture_error(detail: impl std::fmt::Display) -> Report<ReleaseError> {
+    recipe_error(format!("cargo fixture: {detail}"))
+}
+
+fn lower_hex(text: &str, length: usize) -> bool {
+    text.len() == length
+        && text
+            .bytes()
+            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+}
+
+/// Returns the string field `name` of `value`.
+fn text<'a>(value: &'a Value, name: &str) -> Result<&'a str, Report<ReleaseError>> {
+    value[name]
+        .as_str()
+        .filter(|text| !text.is_empty())
+        .ok_or_else(|| fixture_error(format!("{name} is not a non-empty string")))
+}
+
+/// Joins a relative fixture path made only of normal components.
+fn below(root: &Path, value: &Value, name: &str) -> Result<PathBuf, Report<ReleaseError>> {
+    let relative = Path::new(text(value, name)?);
+    let normal = relative
+        .components()
+        .all(|component| matches!(component, Component::Normal(_)))
+        && relative.components().next().is_some();
+    if !normal {
+        return Err(fixture_error(format!(
+            "{name} must be a relative path of normal components"
+        )));
+    }
+    Ok(root.join(relative))
+}
+
+/// Returns the array field `name` of `value`.
+fn entries<'a>(value: &'a Value, name: &str) -> Result<&'a [Value], Report<ReleaseError>> {
+    value[name]
+        .as_array()
+        .map(Vec::as_slice)
+        .ok_or_else(|| fixture_error(format!("{name} is not an array")))
+}
+
+impl CargoFixture {
+    /// Parses `fixture.json` of the fixture at `root`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] for another schema, kind or
+    /// acquisition, a missing or extra field, a malformed commit or digest,
+    /// a Linux fixture without a local image ID or a macOS fixture with any
+    /// image ID, a path that is absolute or dotted, a repeated registry
+    /// identity, no Git source, or a comparison manifest whose selector names
+    /// no retained Git source.
+    pub(super) fn parse(root: &Path, document: &Value) -> Result<Self, Report<ReleaseError>> {
+        let fields: BTreeSet<&str> = document
+            .as_object()
+            .ok_or_else(|| fixture_error("description is not an object"))?
+            .keys()
+            .map(String::as_str)
+            .collect();
+        if fields != BTreeSet::from(FIXTURE_FIELDS) {
+            return Err(fixture_error("description fields differ from the schema"));
+        }
+        let host = match text(document, "kind")? {
+            FIXTURE_KIND => FixtureHost::LinuxContainer,
+            MACOS_FIXTURE_KIND => FixtureHost::MacosSandbox,
+            _ => return Err(fixture_error("unsupported schema, kind or acquisition")),
+        };
+        if document["schema_version"].as_u64() != Some(SCHEMA_VERSION)
+            || text(document, "acquisition")? != ACQUISITION
+        {
+            return Err(fixture_error("unsupported schema, kind or acquisition"));
+        }
+        let source_commit = text(document, "source_commit")?.to_owned();
+        let cargo_lock_sha256 = text(document, "cargo_lock_sha256")?.to_owned();
+        let image_id = match (host, &document["image_id"]) {
+            (FixtureHost::LinuxContainer, Value::String(id))
+                if id
+                    .strip_prefix("sha256:")
+                    .is_some_and(|digest| lower_hex(digest, 64)) =>
+            {
+                Some(id.clone())
+            }
+            (FixtureHost::MacosSandbox, Value::Null) => None,
+            _ => {
+                return Err(fixture_error(
+                    "a Linux fixture needs a local image ID and a macOS fixture none",
+                ));
+            }
+        };
+        if !lower_hex(&source_commit, 40) || !lower_hex(&cargo_lock_sha256, 64) {
+            return Err(fixture_error("malformed commit or lock digest"));
+        }
+        let git = entries(document, "git")?
+            .iter()
+            .map(|entry| {
+                Ok(GitObjects {
+                    selector: text(entry, "selector")?.to_owned(),
+                    revision: text(entry, "revision")?.to_owned(),
+                    objects: below(root, entry, "objects")?,
+                })
+            })
+            .collect::<Result<Vec<_>, Report<ReleaseError>>>()?;
+        if git.is_empty() || git.iter().any(|entry| !lower_hex(&entry.revision, 40)) {
+            return Err(fixture_error("needs Git sources with full revisions"));
+        }
+        Ok(Self {
+            registry: registry(root, document)?,
+            comparison_manifests: comparison_manifests(root, document, &git)?,
+            root: root.to_owned(),
+            source_commit,
+            cargo_lock_sha256,
+            host,
+            image_id,
+            git,
+        })
+    }
+
+    /// The local builder image ID of a Linux container fixture.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] for a macOS fixture, which names none.
+    pub(super) fn container_image_id(&self) -> Result<&str, Report<ReleaseError>> {
+        self.image_id
+            .as_deref()
+            .ok_or_else(|| fixture_error("a macOS fixture names no container image"))
+    }
+
+    /// The private single-link Rust tool root.
+    pub(super) fn tools(&self) -> PathBuf {
+        self.root.join("tools")
+    }
+
+    /// The staged producer probe inside the tool root.
+    pub(super) fn probe(&self) -> PathBuf {
+        self.root.join("tools/probe")
+    }
+}
+
+/// Parses the registry originals, keyed by exact locked identity.
+fn registry(
+    root: &Path,
+    document: &Value,
+) -> Result<BTreeMap<(String, String), PathBuf>, Report<ReleaseError>> {
+    let mut registry = BTreeMap::new();
+    for entry in entries(document, "registry")? {
+        let key = (
+            text(entry, "name")?.to_owned(),
+            text(entry, "version")?.to_owned(),
+        );
+        if registry
+            .insert(key.clone(), below(root, entry, "path")?)
+            .is_some()
+        {
+            return Err(fixture_error(format!(
+                "registry repeats {} {}",
+                key.0, key.1
+            )));
+        }
+    }
+    Ok(registry)
+}
+
+/// Parses the `cargo vendor` comparison manifests; each must name a retained
+/// Git source.
+fn comparison_manifests(
+    root: &Path,
+    document: &Value,
+    git: &[GitObjects],
+) -> Result<Vec<ComparisonManifest>, Report<ReleaseError>> {
+    entries(document, "comparison_manifests")?
+        .iter()
+        .map(|entry| {
+            let pair = ComparisonManifest {
+                name: text(entry, "name")?.to_owned(),
+                version: text(entry, "version")?.to_owned(),
+                selector: text(entry, "selector")?.to_owned(),
+                cargo_vendor_manifest: below(root, entry, "cargo_vendor_manifest")?,
+            };
+            if !git.iter().any(|source| source.selector == pair.selector) {
+                return Err(fixture_error(format!(
+                    "comparison manifest {} names no retained Git source",
+                    pair.name
+                )));
+            }
+            Ok(pair)
+        })
+        .collect()
+}
+
+/// Explicit container settings of an ordinary CI Cargo build.
+///
+/// These are fixture settings for the ordinary CI runner, not production
+/// pins: a qualified builder environment selects its own.
+pub(super) fn cargo_docker_settings(user: (u32, u32), parallelism: u32) -> DockerSettings {
+    DockerSettings {
+        client: PathBuf::from("/usr/bin/docker"),
+        cpus: parallelism.clamp(1, CARGO_MAX_CPUS),
+        memory_bytes: CARGO_MEMORY_BYTES,
+        pids_limit: CARGO_PIDS_LIMIT,
+        tmpfs_bytes: CARGO_TMPFS_BYTES,
+        user,
+        stop_timeout_seconds: 10,
+        host_limits: ProcessLimits {
+            wall: Duration::from_secs(300),
+            stdout_max: 1024 * 1024,
+            stderr_max: 1024 * 1024,
+        },
+    }
+}
+
+fn role_text(role: Role) -> &'static str {
+    match role {
+        Role::Canonical => "canonical",
+        Role::Reproduction => "reproduction",
+    }
+}
+
+/// The ordinary CI measurement of one confined Cargo build.
+pub(super) fn cargo_measurement(completed: &RecipeCompleted) -> Value {
+    let artifact = completed.artifact();
+    let [js_inventory, js_settings, js_tools] = completed.js_digests();
+    json!({
+        "schema_version": SCHEMA_VERSION,
+        "kind": "ordinary-ci-confined-cargo-build",
+        "asset": completed.asset().artifact().name,
+        "role": role_text(completed.role()),
+        "source_commit": completed.commit().as_str(),
+        "cargo_lock_sha256": completed.cargo_lock_sha256(),
+        "artifact": {
+            "name": artifact.name(),
+            "sha256": artifact.sha256(),
+            "size": artifact.size(),
+        },
+        "rust_tools_digest": completed.rust_tools_digest(),
+        "materials_digest": completed.materials_digest(),
+        "plan_digest": completed.plan_digest(),
+        "js_inventory_sha256": js_inventory,
+        "js_settings_sha256": js_settings,
+        "js_tools_sha256": js_tools,
+        "boundary_fingerprint": hex::encode(completed.boundary_fingerprint()),
+        "descendant_cleanup": completed.descendant_cleanup().to_string(),
+        "stdout_sha256": completed.stdout_sha256(),
+        "stderr_sha256": completed.stderr_sha256(),
+        "cargo_observations": completed.cargo_observations_summary(),
+        "elapsed_seconds": completed.elapsed().as_secs(),
+        "normalized_manifest_count": completed.normalized_manifest_digests().len(),
+        "normalized_manifest_digests": completed.normalized_manifest_digests(),
+        "derived_manifest_digests": completed.derived_manifest_digests().len(),
+        "release_qualification": false,
+    })
+}
+
+/// The ambient conditions one build ran under, as the measurement states them.
+///
+/// Umask and jobs are the profile values the plan enforced on the child, and
+/// the host locale and timezone are profile labels: the child always ran
+/// with the normalized `C` locale and `UTC` timezone.
+fn ambient_measurement(completed: &RecipeCompleted) -> Value {
+    let ambient = completed.ambient();
+    let observed = ambient.observed();
+    json!({
+        "role": role_text(ambient.role()),
+        "umask": format!("{:03o}", observed.umask),
+        "jobs": observed.jobs,
+        "checkout_root": observed.checkout_root.to_string_lossy(),
+        "ambient_started_at_seconds": observed.started_at_seconds,
+        "run_started_at_seconds": completed.started_at_seconds(),
+        "execution_uid": observed.execution_uid,
+        "host_locale_label": observed.host_locale,
+        "host_timezone_label": observed.host_timezone,
+        "child_locale": observed.child_locale,
+        "child_timezone": observed.child_timezone,
+        "observation": "profile-enforced-not-independently-observed",
+    })
+}
+
+/// The ordinary CI measurement of the Fastly canonical/reproduction final-byte
+/// comparison.
+pub(super) fn equality_measurement(
+    canonical: &RecipeCompleted,
+    reproduction: &RecipeCompleted,
+    checked: &FastlyEqualityChecked,
+) -> Value {
+    let claim = checked.ambient().claim();
+    let names = |set: &BTreeSet<Dimension>| -> Vec<String> {
+        set.iter().map(ToString::to_string).collect()
+    };
+    let build = |completed: &RecipeCompleted| {
+        let mut value = cargo_measurement(completed);
+        value["ambient"] = ambient_measurement(completed);
+        value
+    };
+    json!({
+        "schema_version": SCHEMA_VERSION,
+        "kind": "ordinary-ci-fastly-canonical-reproduction-equality",
+        "asset": checked.asset().artifact().name,
+        "source_commit": canonical.commit().as_str(),
+        "equality": true,
+        "artifact": {
+            "sha256": checked.sha256(),
+            "size": checked.size(),
+        },
+        "builds": {
+            "canonical": build(canonical),
+            "reproduction": build(reproduction),
+        },
+        "ambient_claim": {
+            "varied": names(&claim.varied),
+            "normalized": names(&claim.normalized),
+            "unsupported": names(&claim.unsupported),
+        },
+        "release_qualification": false,
+    })
+}
+
+/// Names the dependency build cache the CI job restored, or `miss`.
+const CI_BUILD_CACHE_VARIABLE: &str = "TS_RELEASE_CI_BUILD_CACHE";
+/// What the provenance records when the job reported no cache outcome.
+const UNREPORTED_BUILD_CACHE: &str = "unreported";
+
+/// How this run's producer probe and test binary were built, as ordinary CI
+/// evidence only.
+///
+/// CI jobs may restore third-party dependency artifacts written by an
+/// earlier main-branch run, which then link into the staged probe and this
+/// test binary. Recording both digests and the restored cache key makes that
+/// trust root auditable. A cache never makes the run release qualification:
+/// every measurement carrying this still states `release_qualification:
+/// false`.
+///
+/// # Panics
+///
+/// Panics when the staged probe or the running test binary cannot be read,
+/// or the cache variable is not UTF-8.
+pub(super) fn ci_build_provenance(fixture: &CargoFixture) -> Value {
+    let probe = std::fs::read(fixture.probe()).expect("should read the staged producer probe");
+    let test_binary = std::env::current_exe()
+        .and_then(std::fs::read)
+        .expect("should read the running test binary");
+    let cache = std::env::var_os(CI_BUILD_CACHE_VARIABLE).map(|value| {
+        value
+            .into_string()
+            .expect("should name the CI build cache in UTF-8")
+    });
+    build_provenance(&probe, &test_binary, cache.as_deref())
+}
+
+/// The provenance of explicit probe and test binary bytes and cache outcome.
+fn build_provenance(probe: &[u8], test_binary: &[u8], cache: Option<&str>) -> Value {
+    json!({
+        "producer_probe_sha256": hex::encode(Sha256::digest(probe)),
+        "test_binary_sha256": hex::encode(Sha256::digest(test_binary)),
+        "build_cache": cache
+            .filter(|cache| !cache.is_empty())
+            .unwrap_or(UNREPORTED_BUILD_CACHE),
+    })
+}
+
+/// The ordinary CI measurement of the Cargo denial fixture.
+pub(super) fn denial_measurement(
+    proof_errno: i32,
+    observed: &BTreeMap<String, i32>,
+    control: &RecipeCompleted,
+) -> Value {
+    let cases: Map<String, Value> = observed
+        .iter()
+        .map(|(case, errno)| (case.clone(), json!({ "errno": errno })))
+        .collect();
+    json!({
+        "schema_version": SCHEMA_VERSION,
+        "kind": "ordinary-ci-cargo-denial",
+        "proof_errno": proof_errno,
+        "attempts": cases,
+        "control": {
+            "asset": control.asset().artifact().name,
+            "sha256": control.artifact().sha256(),
+            "size": control.artifact().size(),
+        },
+        "release_qualification": false,
+    })
+}
+
+/// Returns the errno one denial fixture case reported in `text`.
+///
+/// The fixture prints `TS_DENIAL case=<case> errno=[<n>]`, or
+/// `... child errno=[<n>]` from the re-executed grandchild. A connected
+/// attempt, a child that never reported or any other text yields `None`.
+pub(super) fn reported_errno(case: &str, text: &str) -> Option<i32> {
+    let marker = format!("TS_DENIAL case={case} ");
+    let start = text.find(&marker)? + marker.len();
+    let rest = &text[start..];
+    let rest = rest.strip_prefix("child ").unwrap_or(rest);
+    let digits = rest.strip_prefix("errno=[")?;
+    let end = digits.find(']')?;
+    digits[..end].parse().ok()
+}
+
+#[test]
+fn fixture_description_parses_relative_inputs() {
+    let root = Path::new("/example/fixture");
+    let parsed = CargoFixture::parse(root, &description()).expect("should parse the description");
+    assert_eq!(
+        parsed
+            .registry
+            .get(&("example".to_owned(), "1.0.0".to_owned())),
+        Some(&root.join("crates/example-1.0.0.crate")),
+        "should key registry originals by locked identity"
+    );
+    assert_eq!(
+        parsed.git[0].objects,
+        root.join("git/0/objects"),
+        "should resolve Git objects below the root"
+    );
+    assert_eq!(
+        parsed.comparison_manifests[0].cargo_vendor_manifest,
+        root.join("cargo-vendor/example-git-0.1.0/Cargo.toml"),
+        "should resolve the comparison manifest below the root"
+    );
+    assert_eq!(
+        parsed.probe(),
+        root.join("tools/probe"),
+        "should fix the probe"
+    );
+}
+
+/// One in-place change to a fixture description.
+type Edit = fn(&mut Value);
+
+#[test]
+fn fixture_description_rejects_unsafe_or_foreign_inputs() {
+    let root = Path::new("/example/fixture");
+    let cases: [(&str, Edit); 8] = [
+        ("absolute path", |value| {
+            value["registry"][0]["path"] = json!("/example/elsewhere.crate");
+        }),
+        ("dotted path", |value| {
+            value["git"][0]["objects"] = json!("git/../../objects");
+        }),
+        ("extra field", |value| value["extra"] = json!(true)),
+        ("kind", |value| {
+            value["kind"] = json!("release-qualification")
+        }),
+        ("acquisition", |value| {
+            value["acquisition"] = json!("authenticated");
+        }),
+        ("image", |value| value["image_id"] = json!("example:latest")),
+        ("duplicate", |value| {
+            let first = value["registry"][0].clone();
+            value["registry"]
+                .as_array_mut()
+                .expect("should hold registry entries")
+                .push(first);
+        }),
+        ("orphan comparison manifest", |value| {
+            value["comparison_manifests"][0]["selector"] =
+                json!("git+https://example.com/other?tag=v2");
+        }),
+    ];
+    for (label, edit) in cases {
+        let mut value = description();
+        edit(&mut value);
+        assert!(
+            CargoFixture::parse(root, &value).is_err(),
+            "should reject a description with a bad {label}"
+        );
+    }
+}
+
+#[test]
+fn fixture_kind_decides_whether_an_image_is_named() {
+    let root = Path::new("/example/fixture");
+    let linux = CargoFixture::parse(root, &description()).expect("should parse Linux");
+    assert_eq!(linux.host, FixtureHost::LinuxContainer);
+    assert_eq!(
+        linux.container_image_id().ok(),
+        Some(format!("sha256:{}", "b".repeat(64)).as_str()),
+        "should keep the Linux builder image ID"
+    );
+
+    let mut macos = description();
+    macos["kind"] = json!("ordinary-ci-macos-cargo-fixture");
+    macos["image_id"] = Value::Null;
+    let parsed = CargoFixture::parse(root, &macos).expect("should parse macOS");
+    assert_eq!(parsed.host, FixtureHost::MacosSandbox);
+    assert_eq!(parsed.image_id, None, "should name no image");
+    assert!(
+        parsed.container_image_id().is_err(),
+        "should refuse a container image for a macOS fixture"
+    );
+
+    let cases: [(&str, &str, Value); 4] = [
+        (
+            "macOS with an image",
+            "ordinary-ci-macos-cargo-fixture",
+            json!(format!("sha256:{}", "b".repeat(64))),
+        ),
+        (
+            "Linux without an image",
+            "ordinary-ci-cargo-fixture",
+            Value::Null,
+        ),
+        (
+            "macOS with an empty image",
+            "ordinary-ci-macos-cargo-fixture",
+            json!(""),
+        ),
+        (
+            "an unknown kind",
+            "ordinary-ci-windows-cargo-fixture",
+            Value::Null,
+        ),
+    ];
+    for (label, kind, image) in cases {
+        let mut value = description();
+        value["kind"] = json!(kind);
+        value["image_id"] = image;
+        assert!(
+            CargoFixture::parse(root, &value).is_err(),
+            "should reject {label}"
+        );
+    }
+}
+
+#[test]
+fn cargo_container_settings_are_explicit_and_fit_the_runner() {
+    let settings = cargo_docker_settings((1001, 1001), 16);
+    assert_eq!(settings.pids_limit, 4096, "should allow Cargo's job tree");
+    assert_eq!(
+        settings.memory_bytes,
+        8 * 1024 * 1024 * 1024,
+        "should give the Wasm link 8 GiB"
+    );
+    assert_eq!(settings.cpus, 4, "should cap CPUs at a 4-vCPU runner");
+    assert_eq!(
+        cargo_docker_settings((1001, 1001), 2).cpus,
+        2,
+        "should never exceed host parallelism"
+    );
+}
+
+#[test]
+fn build_provenance_records_digests_and_an_explicit_cache_outcome() {
+    let probe = b"fictional probe bytes";
+    let test_binary = b"fictional test binary bytes";
+    let restored = build_provenance(probe, test_binary, Some("release-tool-example-key"));
+    assert_eq!(
+        restored["producer_probe_sha256"],
+        hex::encode(Sha256::digest(probe)),
+        "should hash the exact probe bytes"
+    );
+    assert_eq!(
+        restored["test_binary_sha256"],
+        hex::encode(Sha256::digest(test_binary)),
+        "should hash the exact test binary bytes"
+    );
+    assert_eq!(
+        restored["build_cache"], "release-tool-example-key",
+        "should record the restored cache key"
+    );
+    assert_eq!(
+        build_provenance(probe, test_binary, Some("miss"))["build_cache"],
+        "miss",
+        "should record a reported miss"
+    );
+    for absent in [None, Some("")] {
+        assert_eq!(
+            build_provenance(probe, test_binary, absent)["build_cache"],
+            "unreported",
+            "should record an unreported cache rather than omit it"
+        );
+    }
+}
+
+#[test]
+fn reported_errno_reads_only_the_named_case() {
+    let text = "--- stderr\n  TS_DENIAL case=build-direct errno=[1]\n";
+    assert_eq!(
+        reported_errno("build-direct", text),
+        Some(1),
+        "should read errno"
+    );
+    assert_eq!(
+        reported_errno(
+            "build-grandchild",
+            "TS_DENIAL case=build-grandchild child errno=[13]"
+        ),
+        Some(13),
+        "should read the grandchild report"
+    );
+    assert_eq!(
+        reported_errno("macro-attempt", text),
+        None,
+        "should not read another case"
+    );
+    for other in [
+        "TS_DENIAL case=build-direct connected",
+        "TS_DENIAL case=build-direct child failed with exit status: 1",
+        "TS_DENIAL case=build-direct errno=[1",
+    ] {
+        assert_eq!(
+            reported_errno("build-direct", other),
+            None,
+            "should not invent an errno from {other:?}"
+        );
+    }
+}
+
+#[test]
+fn denial_fixture_rows_stay_outside_the_fixed_table() {
+    for package in [
+        "build-direct",
+        "build-grandchild",
+        "macro-attempt",
+        "control",
+    ] {
+        let asset = AssetId::denial_fixture(package).expect("should resolve the fixture member");
+        let artifact = asset.artifact();
+        assert_eq!(
+            artifact.bin, package,
+            "should name the binary after the package"
+        );
+        assert_eq!(
+            artifact.target,
+            ReleaseTarget::Wasm32Wasip1,
+            "should build the fixture for Wasm"
+        );
+        assert!(
+            AssetId::parse(artifact.name).is_err(),
+            "should keep {} unreachable from request text",
+            artifact.name
+        );
+        assert!(
+            FIXED_ARTIFACTS
+                .iter()
+                .all(|fixed| fixed.name != artifact.name && fixed.package != package),
+            "should not touch the fixed release table"
+        );
+    }
+    assert!(
+        AssetId::denial_fixture("trusted-server-adapter-fastly").is_err(),
+        "should resolve only fixture members"
+    );
+}
+
+#[test]
+fn darwin_denial_rows_stay_outside_the_fixed_table() {
+    for target in [
+        ReleaseTarget::Aarch64AppleDarwin,
+        ReleaseTarget::X86_64AppleDarwin,
+    ] {
+        for package in [
+            "build-direct",
+            "build-grandchild",
+            "macro-attempt",
+            "control",
+        ] {
+            let artifact = AssetId::darwin_denial_fixture(package, target)
+                .expect("should resolve the Darwin fixture member")
+                .artifact();
+            assert_eq!(
+                artifact.bin, package,
+                "should name the binary after the package"
+            );
+            assert_eq!(
+                artifact.target, target,
+                "should build for the Darwin target"
+            );
+            assert!(
+                artifact.name.ends_with(target.triple()),
+                "should name the row after its target"
+            );
+            assert!(
+                AssetId::parse(artifact.name).is_err(),
+                "should keep {} unreachable from request text",
+                artifact.name
+            );
+            assert!(
+                FIXED_ARTIFACTS
+                    .iter()
+                    .all(|fixed| fixed.name != artifact.name && fixed.package != package),
+                "should not touch the fixed release table"
+            );
+        }
+    }
+    for (package, target) in [
+        ("trusted-server-cli", ReleaseTarget::Aarch64AppleDarwin),
+        ("control", ReleaseTarget::Wasm32Wasip1),
+        ("control", ReleaseTarget::X86_64UnknownLinuxGnu),
+    ] {
+        assert!(
+            AssetId::darwin_denial_fixture(package, target).is_err(),
+            "should resolve only Darwin fixture members, not {package} for {}",
+            target.triple()
+        );
+    }
+}
+
+fn description() -> Value {
+    let selector = "git+https://example.com/org/workspace?tag=v1";
+    json!({
+        "schema_version": 1,
+        "kind": "ordinary-ci-cargo-fixture",
+        "acquisition": "unauthenticated-ordinary-ci",
+        "source_commit": "0123456789abcdef0123456789abcdef01234567",
+        "cargo_lock_sha256": "a".repeat(64),
+        "image_id": format!("sha256:{}", "b".repeat(64)),
+        "rustc_version": "rustc 1.95.0 (example)",
+        "registry": [
+            {"name": "example", "version": "1.0.0", "path": "crates/example-1.0.0.crate"}
+        ],
+        "git": [
+            {"selector": selector, "revision": "c".repeat(40), "objects": "git/0/objects"}
+        ],
+        "comparison_manifests": [{
+            "name": "example-git",
+            "version": "0.1.0",
+            "selector": selector,
+            "cargo_vendor_manifest": "cargo-vendor/example-git-0.1.0/Cargo.toml",
+        }],
+    })
+}
diff --git a/crates/trusted-server-release/src/recipe/tests/candidate_entry.rs b/crates/trusted-server-release/src/recipe/tests/candidate_entry.rs
new file mode 100644
index 0000000000..a9f06ab90a
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/tests/candidate_entry.rs
@@ -0,0 +1,133 @@
+//! Checks of the candidate index entry each real CI build constructs from
+//! its canonical completed build and actual acceptance, and the summary it
+//! adds to that job's retained measurement.
+//!
+//! The four entries come from different CI jobs, so they are never joined
+//! here. Each job records its own entry and JS inventory digest and exports
+//! the rechecked entry, with its final executable, as flat files that the
+//! ordinary-CI collector (`distribution::ordinary`) downloads, rebuilds and
+//! joins into the unqualified candidate index.
+
+use std::path::Path;
+
+use serde_json::Value;
+
+use super::spdx_candidate::check_platform_gaps;
+use super::*;
+use crate::distribution::{CandidateAcceptance, candidate_entry_from_completed};
+use crate::policy::{FIXED_ARTIFACTS, ReleaseTarget};
+
+/// Gap every native entry states while no reproduction comparison exists.
+const NATIVE_REPRODUCTION_GAP: &str = "native-reproduction-unavailable";
+
+/// The rebuild-check outcome a canonical entry for `target` must record.
+fn expected_rebuild_outcome(target: ReleaseTarget) -> &'static str {
+    match target {
+        ReleaseTarget::Wasm32Wasip1 => "matched",
+        ReleaseTarget::X86_64UnknownLinuxGnu
+        | ReleaseTarget::Aarch64AppleDarwin
+        | ReleaseTarget::X86_64AppleDarwin => "unavailable",
+    }
+}
+
+/// SHA-256 of the exact original JS inventory this build consumed.
+///
+/// # Panics
+///
+/// Panics when the completed build retains no original JS inventory.
+pub(super) fn js_inventory_sha256(completed: &RecipeCompleted) -> String {
+    completed
+        .javascript_contributions()
+        .expect("should retain the original JS inventory")
+        .inventory_sha256()
+        .to_owned()
+}
+
+/// Where one real candidate job exports its entry for the index collector.
+pub(super) struct EntryExport<'a> {
+    /// New directory whose flat files the job uploads.
+    pub(super) upload_directory: &'a Path,
+    /// New transfer file, outside the upload, the job's describe step reads.
+    pub(super) transfer_file: &'a Path,
+}
+
+/// Builds and rechecks the candidate entry of one real canonical build,
+/// exports it for the ordinary-CI index collector and returns its
+/// measurement summary.
+///
+/// # Panics
+///
+/// Panics when the entry cannot be constructed, its rendered artifact fails
+/// the `#/$defs/artifact` sub-schema, a producer join fails, a companion's
+/// recomputed digest or size differs, the gaps miss the target family's
+/// platform gaps, the rebuild-check outcome is not the expected one, or the
+/// final executable or export cannot be read or written.
+pub(super) fn check_real_entry(
+    completed: &RecipeCompleted,
+    source: &ApprovedSource,
+    acceptance: &CandidateAcceptance<'_>,
+    export: &EntryExport<'_>,
+) -> Value {
+    let entry =
+        candidate_entry_from_completed(completed, source, acceptance).unwrap_or_else(|error| {
+            panic!("should build the candidate entry of the real canonical build: {error:?}")
+        });
+    let artifact = completed.asset().artifact();
+    assert_eq!(
+        entry.name(),
+        artifact.name,
+        "should name the completed asset"
+    );
+    let summary = entry.recheck_for_measurement().unwrap_or_else(|error| {
+        panic!("should recheck the real entry's schema, joins and companions: {error:?}")
+    });
+    assert_eq!(
+        summary.rebuild_outcome(),
+        expected_rebuild_outcome(artifact.target),
+        "should record the {} rebuild-check outcome",
+        artifact.target.triple()
+    );
+    assert_eq!(
+        summary.inventory_sha256(),
+        js_inventory_sha256(completed),
+        "should name the exact JS inventory this build consumed"
+    );
+    assert!(!entry.gaps().is_empty(), "should state its gaps");
+    check_platform_gaps(completed, entry.gaps());
+    assert_eq!(
+        entry
+            .gaps()
+            .iter()
+            .any(|gap| gap == NATIVE_REPRODUCTION_GAP),
+        artifact.target != ReleaseTarget::Wasm32Wasip1,
+        "should state the native reproduction gap exactly for native assets"
+    );
+    let final_bytes = completed
+        .read_final_bytes()
+        .expect("should read the rehashed final executable for export");
+    entry
+        .export_flat_for_ordinary_ci(&final_bytes, export.upload_directory, export.transfer_file)
+        .unwrap_or_else(|error| {
+            panic!("should export the real entry for the index collector: {error:?}")
+        });
+    summary.measurement()
+}
+
+#[test]
+fn only_the_fastly_asset_expects_a_matched_rebuild_check() {
+    let outcomes: Vec<(&str, &str)> = FIXED_ARTIFACTS
+        .iter()
+        .map(|fixed| (fixed.name, expected_rebuild_outcome(fixed.target)))
+        .collect();
+
+    assert_eq!(
+        outcomes,
+        [
+            ("trusted-server-fastly.wasm", "matched"),
+            ("ts-aarch64-apple-darwin", "unavailable"),
+            ("ts-x86_64-apple-darwin", "unavailable"),
+            ("ts-x86_64-unknown-linux-gnu", "unavailable"),
+        ],
+        "should expect a matched comparison only for the Fastly asset"
+    );
+}
diff --git a/crates/trusted-server-release/src/recipe/tests/candidate_index.rs b/crates/trusted-server-release/src/recipe/tests/candidate_index.rs
new file mode 100644
index 0000000000..c53739c33f
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/tests/candidate_index.rs
@@ -0,0 +1,107 @@
+//! Completed-build wiring rejections of a candidate index entry.
+//!
+//! A pure completion fixture has no composition receipts and no actual
+//! runtime or startup acceptance, so these tests reach only the owner checks
+//! that run before acceptance binding. Successful entries require the real
+//! completed candidate builds.
+
+use super::complete::{built, wasm_with};
+use super::fixture::OTHER_COMMIT;
+use super::*;
+use crate::distribution::{AcceptanceKind, check_candidate_owner};
+use crate::inspect::tests::builders::{ElfSpec, elf};
+
+const FASTLY: &str = "trusted-server-fastly.wasm";
+const LINUX: &str = "ts-x86_64-unknown-linux-gnu";
+
+fn completed(asset: &'static str, role: Role) -> RecipeCompleted {
+    let bytes = if asset == FASTLY {
+        wasm_with(&[(".debug_info", b"i"), (".debug_line", b"l")])
+    } else {
+        elf(&ElfSpec {
+            payload: b"/trusted-server/src/main.rs",
+            ..ElfSpec::conforming()
+        })
+    };
+    let mut build = built(asset, role, &bytes);
+    let stdout = build.stdout(|_| {});
+    build
+        .finish(stdout)
+        .expect("should complete the accepted fixture artifact")
+}
+
+fn source(commit: &str) -> ApprovedSource {
+    let commit = CommitId::parse(commit).expect("should parse the fixture commit");
+    ApprovedSource::in_memory_for_tests(&commit, &[])
+}
+
+fn rejection(result: Result<(), Report<ReleaseError>>) -> String {
+    format!(
+        "{:?}",
+        result.expect_err("should reject the candidate owner")
+    )
+}
+
+#[test]
+fn candidate_owner_accepts_the_canonical_build_with_its_acceptance_family() {
+    check_candidate_owner(
+        &completed(FASTLY, Role::Canonical),
+        &source(COMMIT),
+        AcceptanceKind::FastlyRuntime,
+    )
+    .expect("should accept the canonical Fastly owner");
+    check_candidate_owner(
+        &completed(LINUX, Role::Canonical),
+        &source(COMMIT),
+        AcceptanceKind::NativeStartup,
+    )
+    .expect("should accept the canonical native owner");
+}
+
+#[test]
+fn candidate_owner_rejects_a_reproduction_build() {
+    let error = rejection(check_candidate_owner(
+        &completed(FASTLY, Role::Reproduction),
+        &source(COMMIT),
+        AcceptanceKind::FastlyRuntime,
+    ));
+    assert!(
+        error.contains("only from the canonical build"),
+        "should reject the reproduction role: {error}"
+    );
+}
+
+#[test]
+fn candidate_owner_rejects_the_wrong_acceptance_family() {
+    let fastly = rejection(check_candidate_owner(
+        &completed(FASTLY, Role::Canonical),
+        &source(COMMIT),
+        AcceptanceKind::NativeStartup,
+    ));
+    assert!(
+        fastly.contains("requires FastlyRuntime acceptance"),
+        "should reject native acceptance for Fastly: {fastly}"
+    );
+    let native = rejection(check_candidate_owner(
+        &completed(LINUX, Role::Canonical),
+        &source(COMMIT),
+        AcceptanceKind::FastlyRuntime,
+    ));
+    assert!(
+        native.contains("requires NativeStartup acceptance"),
+        "should reject Fastly acceptance for a native CLI: {native}"
+    );
+}
+
+#[test]
+fn candidate_owner_rejects_a_source_at_another_commit() {
+    let error = rejection(check_candidate_owner(
+        &completed(FASTLY, Role::Canonical),
+        &source(OTHER_COMMIT),
+        AcceptanceKind::FastlyRuntime,
+    ));
+    assert!(
+        error.contains("approved source differs from the completed build commit"),
+        "should reject the mismatched source: {error}"
+    );
+}
diff --git a/crates/trusted-server-release/src/recipe/tests/cli.rs b/crates/trusted-server-release/src/recipe/tests/cli.rs
new file mode 100644
index 0000000000..cd62f121b4
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/tests/cli.rs
@@ -0,0 +1,502 @@
+//! Explicit real Linux CLI candidate fixture; never selected by a normal
+//! focused unit run.
+//!
+//! The run is ordinary CI candidate evidence (`release_qualification:
+//! false`): the toolchain, builder and startup images and fixture
+//! acquisition are unqualified and unauthenticated, so nothing here
+//! qualifies a release. The canonical build is gated (ELF policy, debug
+//! info, remap scan, planted operator values, clean startup); the
+//! reproduction build is a recorded measurement only, and runs only when
+//! `TS_RELEASE_NATIVE_REPRODUCTION=measure` (otherwise the measurement
+//! records it as deferred to the scheduled run).
+
+use std::ffi::OsString;
+use std::fs;
+use std::os::unix::fs::PermissionsExt as _;
+use std::path::{Path, PathBuf};
+use std::time::{Duration, Instant};
+
+use super::super::compare::read_artifact;
+use super::super::native::{check_operator_values_absent, measure_native_repeatability};
+use super::super::remap::scan_remapped_bytes;
+use super::super::startup::{LINUX_CLI_ASSET, NativeStartupAccepted, StartupCopy};
+use super::candidate::{CargoFixture, cargo_docker_settings, ci_build_provenance};
+use super::candidate_entry::{EntryExport, check_real_entry, js_inventory_sha256};
+use super::cli_candidate::{
+    CliCandidateFacts, CliFixture, NativeReproduction, OPERATOR_SENTINELS, ReproductionOutcome,
+    check_build_budget, cli_candidate_measurement, finish_cleanup, native_reproduction_from_env,
+    new_startup_client, reproduction_result,
+};
+use super::full::try_proven_boundary;
+use super::real_fixture::{
+    cargo_fixture, environment_with_operator_values, path_text, try_ordinary_ci_ambient,
+    try_prepare_vendor,
+};
+use super::spdx_candidate::{candidate_spdx_measurement, check_real_candidate};
+use super::*;
+use crate::boundary::{Boundary, BoundaryRoots, ConfinedCommand, ImageSelection, ProbeProgram};
+use crate::distribution::CandidateAcceptance;
+use crate::documents::{parse_json, read_bounded};
+use crate::inspect::{ElfPolicy, inspect_elf};
+use crate::preflight::AuditedEnvironment;
+use crate::preparation::tests::full::{JsFixtureRun, run_two_fresh_js_builds};
+use crate::process::{Cancellation, ProcessLimits};
+
+/// Reads the ordinary CI CLI fixture named by `TS_RELEASE_CLI_FIXTURE_ROOT`.
+fn cli_fixture() -> (PathBuf, CliFixture) {
+    let root = std::env::var_os("TS_RELEASE_CLI_FIXTURE_ROOT")
+        .map(PathBuf::from)
+        .expect("should explicitly supply the ordinary CI CLI fixture root");
+    let root = fs::canonicalize(root).expect("should resolve the CLI fixture root");
+    let raw = read_bounded(&root.join("cli-fixture.json"), DocumentRole::Metadata)
+        .expect("should read the CLI fixture description");
+    let document =
+        parse_json(&raw.bytes, DocumentRole::Metadata).expect("should parse the description");
+    let fixture = CliFixture::parse(&document).expect("should accept the CLI fixture description");
+    (root, fixture)
+}
+
+/// Everything shared by both CLI builds.
+struct CliInputs<'a> {
+    js: &'a JsFixtureRun,
+    fixture: &'a CargoFixture,
+    cli: &'a CliFixture,
+    audited: &'a AuditedEnvironment,
+    deadline: Instant,
+    cancellation: &'a Cancellation,
+}
+
+/// One confined CLI build with the private roots its output lives in.
+struct CliBuild {
+    _materials: tempfile::TempDir,
+    _work: tempfile::TempDir,
+    completed: RecipeCompleted,
+    /// Host roots of this build that must not appear in the final bytes.
+    host_roots: Vec<String>,
+}
+
+/// Builds the Linux `ts` for `role` from the shared JS handoff in the
+/// glibc 2.34 builder image.
+///
+/// Each role gets its own fresh source copy, vendor tree, state, output and
+/// target roots and its own proven boundary. Setup, execution and explicit
+/// source/target cleanup failures are returned so reproduction is optional.
+fn build_cli(inputs: &CliInputs<'_>, role: Role) -> Result<CliBuild, Report<ReleaseError>> {
+    check_build_budget(inputs.deadline, inputs.cancellation)?;
+    let fresh = inputs
+        .js
+        .source
+        .materialize(inputs.deadline, inputs.cancellation)?;
+    let mut materials_directory = None;
+    let mut work = None;
+    let mut target = None;
+    let built = (|| {
+        materials_directory = Some(tempfile::tempdir().map_err(fixture_io)?);
+        let materials_root = fs::canonicalize(
+            materials_directory
+                .as_ref()
+                .ok_or_else(|| recipe_error("missing materials root"))?
+                .path(),
+        )
+        .map_err(fixture_io)?;
+        let materials = try_prepare_vendor(
+            inputs.fixture,
+            &inputs.js.locked,
+            &materials_root,
+            inputs.deadline,
+            inputs.cancellation,
+        )?;
+        work = Some(tempfile::tempdir().map_err(fixture_io)?);
+        let base = fs::canonicalize(
+            work.as_ref()
+                .ok_or_else(|| recipe_error("missing work root"))?
+                .path(),
+        )
+        .map_err(fixture_io)?;
+        target = Some(base.join("target"));
+        for directory in ["cargo-state", "output"] {
+            fs::create_dir(base.join(directory)).map_err(fixture_io)?;
+        }
+        let retained =
+            fs::canonicalize(inputs.js.completed.rehash_for_handoff()?).map_err(fixture_io)?;
+        let request = RecipeRequest::parse(&RecipeInput {
+            asset: LINUX_CLI_ASSET,
+            variant: "default",
+            role: role.spec_label(),
+            commit: &inputs.fixture.source_commit,
+            js_dir: &retained.join("bundles"),
+            js_inventory: &retained.join("tsjs-inventory.json"),
+            materials: &materials_root,
+            cargo_state: &base.join("cargo-state"),
+            output: &base.join("output"),
+            target_dir: &base.join("target"),
+        })?;
+        let prepared = PreparedRecipe::new(
+            &inputs.js.source,
+            &fresh,
+            inputs.audited,
+            &inputs.js.completed,
+            SelectedRustTools::for_tests(
+                &inputs.fixture.tools(),
+                ReleaseTarget::X86_64UnknownLinuxGnu,
+            )?,
+            materials,
+            try_ordinary_ci_ambient(role, fresh.root())?,
+            request,
+        )?;
+        let proven = try_proven_boundary(&prepared, inputs.fixture, &inputs.cli.builder_image_id)?;
+        let host_roots = [
+            fresh.root(),
+            materials_root.as_path(),
+            base.as_path(),
+            retained.as_path(),
+        ]
+        .iter()
+        .map(|root| {
+            root.to_str()
+                .map(str::to_owned)
+                .ok_or_else(|| recipe_error("CLI root is not UTF-8"))
+        })
+        .collect::<Result<Vec<_>, _>>()?;
+        let completed = prepared.execute(&proven.boundary, &proven.proof)?;
+        completed.rehash_for_handoff()?;
+        Ok((completed, host_roots))
+    })();
+    // Attempt every cleanup even when setup, execution, or another cleanup fails.
+    let built = finish_cleanup(built, fresh.close());
+    let built = finish_cleanup(
+        built,
+        target
+            .as_ref()
+            .map_or(Ok(()), |target| match fs::remove_dir_all(target) {
+                Ok(()) => Ok(()),
+                Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(()),
+                Err(error) => Err(fixture_io(error)),
+            }),
+    );
+    let built = built.and_then(|(completed, host_roots)| {
+        completed.denial_receipt()?;
+        completed.recipe_definition()?;
+        Ok((completed, host_roots))
+    });
+    match built {
+        Ok((completed, host_roots)) => Ok(CliBuild {
+            _materials: materials_directory
+                .ok_or_else(|| recipe_error("missing materials root"))?,
+            _work: work.ok_or_else(|| recipe_error("missing work root"))?,
+            completed,
+            host_roots,
+        }),
+        Err(error) => {
+            let result = finish_cleanup::<()>(Err(error), close_directory(materials_directory));
+            Err(finish_cleanup(result, close_directory(work))
+                .expect_err("should retain the failed build and cleanup errors"))
+        }
+    }
+}
+
+fn fixture_io(error: std::io::Error) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Recipe)
+        .attach("CLI fixture filesystem operation failed")
+        .attach(error)
+}
+
+fn close_directory(directory: Option<tempfile::TempDir>) -> Result<(), Report<ReleaseError>> {
+    directory.map_or(Ok(()), |directory| directory.close().map_err(fixture_io))
+}
+
+/// Scans the final bytes for every host and fixture root and the container
+/// prefix, and returns the fixed remapped prefixes found.
+fn scan_final_bytes(bytes: &[u8], build: &CliBuild, fixture_roots: &[&Path]) -> Vec<&'static str> {
+    let mut forbidden = build.host_roots.clone();
+    forbidden.extend(fixture_roots.iter().map(|root| path_text(root)));
+    if let Some(runner_temp) = std::env::var_os("RUNNER_TEMP") {
+        forbidden.push(
+            runner_temp
+                .into_string()
+                .expect("should name RUNNER_TEMP in UTF-8"),
+        );
+    }
+    let forbidden: Vec<&str> = forbidden.iter().map(String::as_str).collect();
+    scan_remapped_bytes(bytes, &forbidden)
+        .unwrap_or_else(|error| panic!("should prove remapping in the final bytes: {error:?}"))
+        .found()
+        .to_vec()
+}
+
+/// Starts the exact final bytes as `ts --version` in every clean image.
+fn start_everywhere(completed: &RecipeCompleted, cli: &CliFixture) -> NativeStartupAccepted {
+    let scratch = tempfile::tempdir().expect("should create startup scratch space");
+    let base = fs::canonicalize(scratch.path()).expect("should resolve startup scratch space");
+    let copy_directory = base.join("startup-copy");
+    let copy = StartupCopy::create(completed, &copy_directory)
+        .expect("should copy the final bytes read-only");
+    let observed = (|| {
+        let (_state, client) = new_startup_client(Path::new("/usr/bin/docker"), &copy_directory)?;
+        NativeStartupAccepted::accept_linux(completed, copy, &client, &cli.startup_images)
+    })();
+    let observed = observed.expect("should start every clean image and remove the startup copy");
+    completed
+        .rehash_for_handoff()
+        .expect("should leave the accepted artifact unchanged");
+    observed
+}
+
+#[test]
+#[ignore = "requires explicit JS, Cargo and CLI ordinary CI fixtures and Linux Docker; run separately in producer CI"]
+fn linux_cli_candidate_builds_inspects_and_starts_cleanly() {
+    // Read before any build so a missing selection fails in seconds.
+    let native_reproduction = native_reproduction_from_env();
+    let fixture = cargo_fixture();
+    let provenance = ci_build_provenance(&fixture);
+    let (cli_root, cli) = cli_fixture();
+    preflight_cli_builder(&fixture, &cli, &cli_root)
+        .expect("should load the staged probe and Rust tools on glibc 2.34 before JS builds");
+    let js = run_two_fresh_js_builds();
+    assert_eq!(
+        js.source.commit().as_str(),
+        fixture.source_commit,
+        "should build the Cargo fixture's source commit"
+    );
+    let (audited, removed) = environment_with_operator_values();
+    let cancellation = Cancellation::default();
+    let inputs = CliInputs {
+        js: &js,
+        fixture: &fixture,
+        cli: &cli,
+        audited: &audited,
+        deadline: Instant::now() + Duration::from_secs(50 * 60),
+        cancellation: &cancellation,
+    };
+    let canonical = build_cli(&inputs, Role::Canonical).unwrap_or_else(|error| {
+        panic!("should build the canonical Linux ts through the confined recipe: {error:?}")
+    });
+    let bytes = read_artifact(&canonical.completed).expect("should reread the final bytes");
+    let elf = inspect_elf(&bytes, &ElfPolicy::linux_x86_64_gnu())
+        .expect("should accept the final bytes under the glibc 2.34 ELF policy");
+    elf.require_debug_sections()
+        .expect("should keep the profile's debug info");
+    let remap_found = scan_final_bytes(&bytes, &canonical, &[&fixture.root, &cli_root]);
+    let planted: Vec<&str> = OPERATOR_SENTINELS.iter().map(|(_, value)| *value).collect();
+    check_operator_values_absent(&bytes, &planted)
+        .expect("should embed none of the planted operator values");
+    let startup = start_everywhere(&canonical.completed, &cli);
+    let mut canonical_measurement = cli_candidate_measurement(&CliCandidateFacts {
+        canonical: &canonical.completed,
+        builder: &cli,
+        elf: &elf,
+        remap_found: &remap_found,
+        operator_values_removed: &removed,
+        startup: startup
+            .linux_runs()
+            .expect("should retain actual Linux startup runs"),
+        reproduction: ReproductionOutcome::NotAttempted,
+    });
+    let inventory_sha256 = js_inventory_sha256(&canonical.completed);
+    canonical_measurement["js_inventory_sha256"] = serde_json::json!(inventory_sha256);
+    canonical_measurement["ci_build_provenance"] = provenance.clone();
+    fs::write(
+        cli_root.join("linux-cli-candidate-measurement.json"),
+        serde_json::to_vec_pretty(&canonical_measurement)
+            .expect("should encode the canonical measurement"),
+    )
+    .expect("should retain accepted canonical evidence before optional reproduction");
+    let canonical_candidate = check_real_candidate(&canonical.completed, &js.source);
+    let reproduction_build = match native_reproduction {
+        NativeReproduction::Measure => Some(build_cli(&inputs, Role::Reproduction)),
+        NativeReproduction::Defer => None,
+    };
+    let reproduction_candidate = reproduction_build
+        .as_ref()
+        .and_then(|build| build.as_ref().ok())
+        .map(|reproduction| check_real_candidate(&reproduction.completed, &js.source));
+
+    let paired = reproduction_build.as_ref().map(|build| {
+        reproduction_result(
+            build
+                .as_ref()
+                .map_err(|error| recipe_error(format!("{error:?}"))),
+            |reproduction| {
+                measure_native_repeatability(&canonical.completed, &reproduction.completed)
+            },
+        )
+    });
+    let reproduction = match &paired {
+        None => ReproductionOutcome::Deferred,
+        Some((Ok(measured), _)) => ReproductionOutcome::Measured(measured),
+        Some((Err(error), Some(_))) => ReproductionOutcome::InvariantFailed(error.clone()),
+        Some((Err(error), None)) => ReproductionOutcome::BuildFailed(error.clone()),
+    };
+    let mut measurement = cli_candidate_measurement(&CliCandidateFacts {
+        canonical: &canonical.completed,
+        builder: &cli,
+        elf: &elf,
+        remap_found: &remap_found,
+        operator_values_removed: &removed,
+        startup: startup
+            .linux_runs()
+            .expect("should retain actual Linux startup runs"),
+        reproduction,
+    });
+    measurement["candidate_spdx"] =
+        candidate_spdx_measurement(&canonical_candidate, reproduction_candidate.as_ref());
+    measurement["js_inventory_sha256"] = serde_json::json!(inventory_sha256);
+    measurement["ci_build_provenance"] = provenance;
+    retain_cli_measurement(&cli_root, &measurement);
+    if let Some((_, Some(error))) = &paired {
+        panic!("should pair builds over identical inputs: {error:?}");
+    }
+    let upload_directory = cli_root.join("candidate-entry");
+    let transfer_file = cli_root.join("candidate-entry-transfer.json");
+    measurement["candidate_entry"] = check_real_entry(
+        &canonical.completed,
+        &js.source,
+        &CandidateAcceptance::Native(&startup),
+        &EntryExport {
+            upload_directory: &upload_directory,
+            transfer_file: &transfer_file,
+        },
+    );
+    retain_cli_measurement(&cli_root, &measurement);
+    super::candidate::check_native_export_after_cleanup(
+        canonical,
+        |build| &build.completed,
+        &startup,
+    );
+    if let Some(Ok(reproduction)) = reproduction_build {
+        super::candidate::check_export_after_cleanup(reproduction, |build| &build.completed);
+    }
+}
+
+/// Retains `measurement` as the Linux CLI candidate measurement.
+fn retain_cli_measurement(cli_root: &Path, measurement: &serde_json::Value) {
+    let text = serde_json::to_string_pretty(measurement).expect("should encode the measurement");
+    fs::write(cli_root.join("linux-cli-candidate-measurement.json"), text)
+        .expect("should retain the Linux CLI candidate measurement");
+}
+
+/// Loads the staged probe and copied Rust tools on the builder's ABI before JS work.
+fn preflight_cli_builder(
+    fixture: &CargoFixture,
+    cli: &CliFixture,
+    evidence_root: &Path,
+) -> Result<(), Report<ReleaseError>> {
+    let work = tempfile::tempdir().map_err(fixture_io)?;
+    let state = tempfile::tempdir().map_err(fixture_io)?;
+    let scripts = tempfile::tempdir().map_err(fixture_io)?;
+    let root = fs::canonicalize(work.path()).map_err(fixture_io)?;
+    let result = (|| {
+        let script_root = fs::canonicalize(scripts.path()).map_err(fixture_io)?;
+        let script = script_root.join("filesystem-controls.sh");
+        fs::write(&script, FILESYSTEM_CONTROLS).map_err(fixture_io)?;
+        fs::set_permissions(&script, fs::Permissions::from_mode(0o555)).map_err(fixture_io)?;
+        for directory in ["home", "tmp", "cargo-home"] {
+            fs::create_dir(root.join(directory)).map_err(fixture_io)?;
+        }
+        let roots = BoundaryRoots::new(
+            &[script_root],
+            &[fixture.tools()],
+            std::slice::from_ref(&root),
+        )?;
+
+        // These IDs select the existing unprivileged ordinary CI worker.
+        let user = unsafe { (libc::getuid(), libc::getgid()) };
+        let boundary = Boundary::linux_container(
+            roots,
+            cargo_docker_settings(user, 1),
+            ImageSelection::Test {
+                id: cli.builder_image_id.clone(),
+            },
+            state.path(),
+        )?;
+        let limits = ProcessLimits {
+            wall: Duration::from_secs(60),
+            stdout_max: 4096,
+            stderr_max: 4096,
+        };
+        let probe = ProbeProgram::from_staged_release_binary(&fixture.probe())?;
+        let proof = boundary.establish_denial(&probe, limits)?;
+        let controls = ConfinedCommand::new(&script, &root, limits)?
+            .environment("HOME", boundary.execution_path(&root.join("home"))?)?
+            .environment("TMPDIR", boundary.execution_path(&root.join("tmp"))?)?
+            .environment(
+                "CARGO_HOME",
+                boundary.execution_path(&root.join("cargo-home"))?,
+            )?
+            .environment("LC_ALL", "C")?;
+        let observed = boundary.run_confined(&controls, &proof)?;
+        let evidence = serde_json::json!({
+            "kind": "ordinary-ci-builder-filesystem-controls",
+            "builder_image_id": cli.builder_image_id,
+            "stdout": String::from_utf8_lossy(observed.stdout()),
+            "stderr": String::from_utf8_lossy(observed.stderr()),
+            "outcome": format!("{:?}", observed.outcome()),
+            "release_qualification": false,
+        });
+        let evidence = serde_json::to_vec_pretty(&evidence)
+            .map_err(|error| recipe_error(format!("cannot encode filesystem controls: {error}")))?;
+        fs::write(
+            evidence_root.join("builder-filesystem-controls.json"),
+            evidence,
+        )
+        .map_err(fixture_io)?;
+
+        let stdout = observed.require_success()?;
+        if stdout != FILESYSTEM_CONTROL_OUTPUT.as_bytes() {
+            return Err(recipe_error(
+                "filesystem controls did not report every denied root and bound TMPDIR success",
+            ));
+        }
+        if root
+            .join("tmp/ts-release-filesystem-control")
+            .try_exists()
+            .map_err(fixture_io)?
+        {
+            return Err(recipe_error(
+                "filesystem controls left the bound temporary file behind",
+            ));
+        }
+        for tool in ["rustc", "cargo"] {
+            let command =
+                ConfinedCommand::new(&fixture.tools().join("bin").join(tool), &root, limits)?
+                    .arguments([OsString::from("--version")])
+                    .environment("LC_ALL", "C")?;
+            boundary.run_confined(&command, &proof)?.require_success()?;
+        }
+        Ok(())
+    })();
+    let result = finish_cleanup(result, scripts.close().map_err(fixture_io));
+    let result = finish_cleanup(result, state.close().map_err(fixture_io));
+    finish_cleanup(result, work.close().map_err(fixture_io))
+}
+
+/// Fixed ordinary CI controls: redirections test permissions without external helpers.
+const FILESYSTEM_CONTROLS: &str = r#"#!/bin/sh
+set -eu
+for directory in /tmp /dev/shm /dev; do
+    if ( : > "$directory/ts-release-filesystem-control" ); then
+        printf 'unexpected writable root %s\n' "$directory" >&2
+        exit 1
+    fi
+    printf 'denied %s\n' "$directory"
+done
+for file in /etc/hosts /etc/hostname /etc/resolv.conf; do
+    [ -f "$file" ]
+    if ( : >> "$file" ); then
+        printf 'unexpected writable daemon file %s\n' "$file" >&2
+        exit 1
+    fi
+    printf 'denied %s\n' "$file"
+done
+path=$TMPDIR/ts-release-filesystem-control
+
+printf 'bound temporary root\n' > "$path"
+IFS= read -r observed < "$path"
+[ "$observed" = 'bound temporary root' ]
+/usr/bin/rm -- "$path"
+[ ! -e "$path" ]
+printf 'bound TMPDIR write read cleanup accepted\n'
+"#;
+
+/// Every expected control must report success, in the fixed script's order.
+const FILESYSTEM_CONTROL_OUTPUT: &str = "denied /tmp\ndenied /dev/shm\ndenied /dev\ndenied /etc/hosts\ndenied /etc/hostname\ndenied /etc/resolv.conf\nbound TMPDIR write read cleanup accepted\n";
diff --git a/crates/trusted-server-release/src/recipe/tests/cli_candidate.rs b/crates/trusted-server-release/src/recipe/tests/cli_candidate.rs
new file mode 100644
index 0000000000..6e0f1954c0
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/tests/cli_candidate.rs
@@ -0,0 +1,738 @@
+//! Ordinary CI Linux CLI candidate support: the CLI fixture description and
+//! the measurement the real Linux fixture prints.
+//!
+//! Nothing here is release qualification. The images are acquired without
+//! authentication and selected only by local image ID, the toolchain is
+//! unqualified, and the measurement says so.
+
+use std::collections::BTreeSet;
+use std::path::Path;
+use std::time::Instant;
+
+use crate::process::Cancellation;
+
+use serde_json::{Value, json};
+
+use super::super::native::NativeRepeatability;
+use super::super::startup::{
+    StartupClient, StartupDistribution, StartupImage, StartupObserved, is_local_image_id,
+};
+use super::candidate::{SCHEMA_VERSION, cargo_measurement};
+use super::complete::built;
+use super::*;
+use crate::inspect::ElfFacts;
+use crate::inspect::tests::builders::{ElfSpec, elf};
+use crate::inspect::{ElfPolicy, inspect_elf};
+
+/// Kind of the CLI fixture description.
+const FIXTURE_KIND: &str = "ordinary-ci-cli-fixture";
+/// How the fixture images were acquired.
+const ACQUISITION: &str = "unauthenticated-ordinary-ci";
+/// Every field `cli-fixture.json` must hold, and nothing else.
+const FIXTURE_FIELDS: [&str; 6] = [
+    "acquisition",
+    "builder_glibc",
+    "builder_image_id",
+    "kind",
+    "schema_version",
+    "startup_images",
+];
+/// Base image of the ordinary CI builder; the tracked Dockerfile must use it.
+pub(super) const CLI_BUILDER_BASE: &str = "registry.access.redhat.com/ubi9/ubi:9.6";
+/// The tracked ordinary CI builder Dockerfile.
+const CLI_BUILDER_DOCKERFILE: &str = include_str!(concat!(
+    env!("CARGO_MANIFEST_DIR"),
+    "/../../scripts/release/tests/cli-builder.Dockerfile"
+));
+/// Distinctive fictional operator values planted in the CLI build's
+/// inherited environment; preflight must remove them and the final bytes
+/// must hold none.
+pub(super) const OPERATOR_SENTINELS: [(&str, &str); 3] = [
+    (
+        "TRUSTED_SERVER__PUBLISHER__DOMAIN",
+        "ts-operator-sentinel-publisher.example.com",
+    ),
+    (
+        "TRUSTED_SERVER__PUBLISHER__ORIGIN_URL",
+        "https://ts-operator-sentinel-origin.example.com",
+    ),
+    (
+        "EDGEZERO__STORES__CONFIG__NAME",
+        "ts-operator-sentinel-config-store-0001",
+    ),
+];
+
+fn fixture_error(detail: impl std::fmt::Display) -> Report<ReleaseError> {
+    recipe_error(format!("cli fixture: {detail}"))
+}
+
+/// The parsed, unauthenticated ordinary CI CLI fixture.
+#[derive(Debug)]
+pub(super) struct CliFixture {
+    pub(super) builder_image_id: String,
+    pub(super) builder_glibc: String,
+    pub(super) startup_images: Vec<StartupImage>,
+}
+
+impl CliFixture {
+    /// Parses `cli-fixture.json`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] for another schema, kind or
+    /// acquisition, a missing or extra field, a builder that is not a local
+    /// image ID or does not report glibc 2.34, or startup images that are not
+    /// exactly the reviewed distributions, in order, at their reviewed
+    /// references and selected by local image ID.
+    pub(super) fn parse(document: &Value) -> Result<Self, Report<ReleaseError>> {
+        let fields: BTreeSet<&str> = document
+            .as_object()
+            .ok_or_else(|| fixture_error("description is not an object"))?
+            .keys()
+            .map(String::as_str)
+            .collect();
+        if fields != BTreeSet::from(FIXTURE_FIELDS) {
+            return Err(fixture_error("description fields differ from the schema"));
+        }
+        if document["schema_version"].as_u64() != Some(SCHEMA_VERSION)
+            || document["kind"].as_str() != Some(FIXTURE_KIND)
+            || document["acquisition"].as_str() != Some(ACQUISITION)
+        {
+            return Err(fixture_error("unsupported schema, kind or acquisition"));
+        }
+        let text = |name: &str| {
+            document[name]
+                .as_str()
+                .ok_or_else(|| fixture_error(format!("{name} is not a string")))
+        };
+        let builder_image_id = text("builder_image_id")?.to_owned();
+        if !is_local_image_id(&builder_image_id) {
+            return Err(fixture_error("builder is not a local image ID"));
+        }
+        let builder_glibc = text("builder_glibc")?.to_owned();
+        if !builder_glibc.ends_with(" 2.34") {
+            return Err(fixture_error("builder does not report glibc 2.34"));
+        }
+        let entries = document["startup_images"]
+            .as_array()
+            .ok_or_else(|| fixture_error("startup_images is not an array"))?;
+        if entries.len() != StartupDistribution::ALL.len() {
+            return Err(fixture_error("startup images differ from the reviewed set"));
+        }
+        let startup_images = entries
+            .iter()
+            .zip(StartupDistribution::ALL)
+            .map(|(entry, distribution)| startup_image(entry, distribution))
+            .collect::<Result<_, _>>()?;
+        Ok(Self {
+            builder_image_id,
+            builder_glibc,
+            startup_images,
+        })
+    }
+}
+
+/// Parses one startup entry, which must be `distribution` at its reference.
+fn startup_image(
+    entry: &Value,
+    distribution: StartupDistribution,
+) -> Result<StartupImage, Report<ReleaseError>> {
+    let fields: Option<BTreeSet<&str>> = entry
+        .as_object()
+        .map(|object| object.keys().map(String::as_str).collect());
+    if fields != Some(BTreeSet::from(["distribution", "image_id", "reference"])) {
+        return Err(fixture_error("startup entry fields differ from the schema"));
+    }
+    if entry["distribution"].as_str() != Some(distribution.label())
+        || entry["reference"].as_str() != Some(distribution.reference())
+    {
+        return Err(fixture_error(format!(
+            "startup entry is not {} at {}",
+            distribution.label(),
+            distribution.reference()
+        )));
+    }
+    let id = entry["image_id"]
+        .as_str()
+        .ok_or_else(|| fixture_error("startup image_id is not a string"))?;
+    StartupImage::new(distribution, id)
+}
+
+/// The ELF facts the measurement records.
+fn elf_measurement(facts: &ElfFacts) -> Value {
+    let debug: Vec<Value> = facts
+        .debug_sections()
+        .iter()
+        .map(|section| json!({"name": section.name(), "size": section.size()}))
+        .collect();
+    json!({
+        "sha256": facts.sha256(),
+        "interpreter": facts.interpreter(),
+        "needed": facts.needed(),
+        "max_glibc": facts.max_glibc().to_string(),
+        "version_requirements": facts.version_requirements().len(),
+        "debug_sections": debug,
+    })
+}
+
+/// The startup runs the measurement records.
+fn startup_measurement(runs: &[StartupObserved]) -> Value {
+    runs.iter()
+        .map(|run| {
+            let distribution = run.image.distribution();
+            json!({
+                "distribution": distribution.label(),
+                "reference": distribution.reference(),
+                "image_id": run.image.id(),
+                "exit_code": 0,
+                "stdout": run.stdout,
+                "stderr_sha256": run.stderr_sha256,
+                "elapsed_seconds": run.elapsed.as_secs_f64(),
+            })
+        })
+        .collect()
+}
+
+/// Selects whether a native CLI candidate job measures its reproduction build.
+///
+/// The ordinary CI workflow always sets it: `measure` on scheduled and
+/// dispatched runs (and on a labelled pull request), `defer` otherwise.
+pub(super) const NATIVE_REPRODUCTION_VARIABLE: &str = "TS_RELEASE_NATIVE_REPRODUCTION";
+/// The GitHub Actions variable naming the event that started the run.
+const GITHUB_EVENT_VARIABLE: &str = "GITHUB_EVENT_NAME";
+/// Events whose run exists to measure native reproduction, so may not defer it.
+const MEASURING_EVENTS: [&str; 2] = ["schedule", "workflow_dispatch"];
+
+/// Whether a native CLI candidate job builds and measures its reproduction.
+///
+/// The reproduction is a measurement, never a gate, for the native CLI
+/// candidates only; the Fastly equality step never reads this selection.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(super) enum NativeReproduction {
+    /// Build the reproduction and record how it compares.
+    Measure,
+    /// Skip the reproduction build and record that a scheduled run measures it.
+    Defer,
+}
+
+/// Parses the native reproduction selection and the GitHub event name.
+///
+/// # Errors
+///
+/// Returns a message for a missing or unknown selection (only the exact
+/// lowercase `measure` and `defer` are accepted), or for `defer` on a
+/// scheduled or dispatched run, which exists to measure the reproduction.
+pub(super) fn parse_native_reproduction(
+    value: Option<&str>,
+    event: Option<&str>,
+) -> Result<NativeReproduction, String> {
+    let selected = match value {
+        Some("measure") => NativeReproduction::Measure,
+        Some("defer") => NativeReproduction::Defer,
+        Some(other) => {
+            return Err(format!(
+                "{NATIVE_REPRODUCTION_VARIABLE} must be `measure` or `defer`, not {other:?}"
+            ));
+        }
+        None => {
+            return Err(format!(
+                "{NATIVE_REPRODUCTION_VARIABLE} must be set to `measure` or `defer`"
+            ));
+        }
+    };
+    if selected == NativeReproduction::Defer
+        && let Some(event) = event.filter(|event| MEASURING_EVENTS.contains(event))
+    {
+        return Err(format!(
+            "{NATIVE_REPRODUCTION_VARIABLE}=defer is not allowed on a {event} run, which exists to measure native reproduction"
+        ));
+    }
+    Ok(selected)
+}
+
+/// Reads the native reproduction selection from the test environment.
+///
+/// # Panics
+///
+/// Panics when [`parse_native_reproduction`] rejects the selection or either
+/// variable is not UTF-8, so a misconfigured job fails before any build.
+pub(super) fn native_reproduction_from_env() -> NativeReproduction {
+    let read = |name: &str| {
+        std::env::var_os(name).map(|value| {
+            value
+                .into_string()
+                .unwrap_or_else(|_| panic!("should name {name} in UTF-8"))
+        })
+    };
+    let value = read(NATIVE_REPRODUCTION_VARIABLE);
+    let event = read(GITHUB_EVENT_VARIABLE);
+    parse_native_reproduction(value.as_deref(), event.as_deref()).unwrap_or_else(|error| {
+        panic!("should select the native reproduction mode explicitly: {error}")
+    })
+}
+
+/// What the optional reproduction build produced.
+pub(super) enum ReproductionOutcome<'a> {
+    /// Canonical evidence is retained before the optional build starts.
+    NotAttempted,
+    /// The job selected `defer`; a scheduled or dispatched run measures it.
+    Deferred,
+    /// A completed pair violated its input invariants.
+    InvariantFailed(String),
+    /// Both builds completed and were compared.
+    Measured(&'a NativeRepeatability),
+    /// The reproduction build itself failed; recorded, not a gate.
+    BuildFailed(String),
+}
+
+/// The reproduction outcome the measurement records.
+pub(super) fn reproduction_measurement(outcome: &ReproductionOutcome<'_>) -> Value {
+    match outcome {
+        ReproductionOutcome::NotAttempted => {
+            json!({"status": "not-attempted", "gate": "measurement-only"})
+        }
+        ReproductionOutcome::Deferred => json!({
+            "status": "deferred-to-scheduled-run",
+            "gate": "measurement-only",
+            "selector": format!("{NATIVE_REPRODUCTION_VARIABLE}=defer"),
+            "measured_by": "scheduled/dispatched Run Tests on main",
+        }),
+        ReproductionOutcome::InvariantFailed(error) => {
+            json!({"status": "invariant-failed", "error": error, "gate": "fatal-input-invariant"})
+        }
+
+        ReproductionOutcome::Measured(measured) => {
+            let difference = measured.difference().map(|difference| {
+                json!({
+                    "first_offset": difference.first_offset,
+                    "differing_bytes": difference.differing_bytes,
+                    "canonical_section": difference.canonical_section,
+                })
+            });
+            json!({
+                "status": if measured.identical() { "identical" } else { "differing" },
+                "canonical": {
+                    "sha256": measured.canonical().sha256,
+                    "size": measured.canonical().size,
+                },
+                "reproduction": {
+                    "sha256": measured.reproduction().sha256,
+                    "size": measured.reproduction().size,
+                },
+                "difference": difference,
+                "gate": "measurement-only",
+            })
+        }
+        ReproductionOutcome::BuildFailed(error) => json!({
+            "status": "build-failed",
+            "error": error,
+            "gate": "measurement-only",
+        }),
+    }
+}
+
+/// Everything the Linux CLI candidate measurement states.
+pub(super) struct CliCandidateFacts<'a> {
+    pub(super) canonical: &'a RecipeCompleted,
+    pub(super) builder: &'a CliFixture,
+    pub(super) elf: &'a ElfFacts,
+    pub(super) remap_found: &'a [&'static str],
+    pub(super) operator_values_removed: &'a [String],
+    pub(super) startup: &'a [StartupObserved],
+    pub(super) reproduction: ReproductionOutcome<'a>,
+}
+
+/// The ordinary CI measurement of the Linux CLI candidate.
+pub(super) fn cli_candidate_measurement(facts: &CliCandidateFacts<'_>) -> Value {
+    json!({
+        "schema_version": SCHEMA_VERSION,
+        "kind": "ordinary-ci-linux-cli-candidate",
+        "asset": facts.canonical.asset().artifact().name,
+        "source_commit": facts.canonical.commit().as_str(),
+        "builder": {
+            "base": CLI_BUILDER_BASE,
+            "image_id": facts.builder.builder_image_id,
+            "glibc": facts.builder.builder_glibc,
+        },
+        "canonical": cargo_measurement(facts.canonical),
+        "elf": elf_measurement(facts.elf),
+        "remap_scan": {
+            "forbidden": ["/boundary/", "host build roots", "fixture roots", "RUNNER_TEMP"],
+            "found": facts.remap_found,
+        },
+        "operator_values": {
+            "removed_by_preflight": facts.operator_values_removed,
+            "found_in_final_bytes": 0,
+        },
+        "startup": startup_measurement(facts.startup),
+        "reproduction": reproduction_measurement(&facts.reproduction),
+        "release_qualification": false,
+    })
+}
+
+/// Returns the image named by the `FROM` line of `dockerfile`.
+fn dockerfile_base(dockerfile: &str) -> Option<&str> {
+    let mut bases = dockerfile
+        .lines()
+        .filter_map(|line| line.strip_prefix("FROM "));
+    match (bases.next(), bases.next()) {
+        (Some(base), None) => Some(base.trim()),
+        _ => None,
+    }
+}
+
+#[test]
+fn builder_dockerfile_uses_the_reviewed_glibc_floor_base() {
+    assert_eq!(
+        dockerfile_base(CLI_BUILDER_DOCKERFILE),
+        Some(CLI_BUILDER_BASE),
+        "should build from exactly the reviewed tag-pinned UBI 9 base"
+    );
+}
+
+#[test]
+fn cli_fixture_description_parses_the_reviewed_images() {
+    let parsed = CliFixture::parse(&description()).expect("should parse the description");
+    assert_eq!(parsed.builder_image_id, image('c'));
+    let labels: Vec<&str> = parsed
+        .startup_images
+        .iter()
+        .map(|image| image.distribution().label())
+        .collect();
+    assert_eq!(labels, ["ubi9", "ubuntu-22.04", "debian-12"]);
+}
+
+/// One in-place change to a CLI fixture description.
+type Edit = fn(&mut Value);
+
+#[test]
+fn cli_fixture_description_rejects_drift_or_unpinned_images() {
+    let cases: [(&str, Edit); 8] = [
+        ("extra field", |value| value["extra"] = json!(true)),
+        ("kind", |value| {
+            value["kind"] = json!("release-qualification")
+        }),
+        ("builder tag", |value| {
+            value["builder_image_id"] = json!("example/builder:latest");
+        }),
+        ("builder glibc", |value| {
+            value["builder_glibc"] = json!("ldd (GNU libc) 2.39");
+        }),
+        ("startup tag", |value| {
+            value["startup_images"][1]["image_id"] = json!("ubuntu:22.04");
+        }),
+        ("reference drift", |value| {
+            value["startup_images"][2]["reference"] = json!("docker.io/library/debian:13");
+        }),
+        ("order", |value| {
+            value["startup_images"]
+                .as_array_mut()
+                .expect("should hold startup images")
+                .swap(0, 1);
+        }),
+        ("missing distribution", |value| {
+            value["startup_images"]
+                .as_array_mut()
+                .expect("should hold startup images")
+                .pop();
+        }),
+    ];
+    for (label, edit) in cases {
+        let mut value = description();
+        edit(&mut value);
+        assert!(
+            CliFixture::parse(&value).is_err(),
+            "should reject a description with a bad {label}"
+        );
+    }
+}
+
+#[test]
+fn operator_sentinels_are_removed_by_preflight_and_distinctive() {
+    let mut snapshot = vec![(
+        std::ffi::OsString::from("PATH"),
+        std::ffi::OsString::from("/usr/bin:/bin"),
+    )];
+    snapshot.extend(
+        OPERATOR_SENTINELS
+            .iter()
+            .map(|(name, value)| ((*name).into(), (*value).into())),
+    );
+    let audited =
+        crate::preflight::audit_environment(&snapshot).expect("should remove, not reject");
+    let removed: BTreeSet<&str> = audited.removed_names().iter().map(String::as_str).collect();
+    let planted: BTreeSet<&str> = OPERATOR_SENTINELS.iter().map(|(name, _)| *name).collect();
+    assert_eq!(
+        removed, planted,
+        "should remove every planted operator name"
+    );
+    for (_, value) in OPERATOR_SENTINELS {
+        assert!(
+            value.contains("example.com") || value.starts_with("ts-operator-sentinel-"),
+            "should plant only fictional values"
+        );
+    }
+}
+
+fn image(digit: char) -> String {
+    format!("sha256:{}", digit.to_string().repeat(64))
+}
+
+fn description() -> Value {
+    let startup: Vec<Value> = StartupDistribution::ALL
+        .iter()
+        .zip(['d', 'e', 'f'])
+        .map(|(distribution, digit)| {
+            json!({
+                "distribution": distribution.label(),
+                "reference": distribution.reference(),
+                "image_id": image(digit),
+            })
+        })
+        .collect();
+    json!({
+        "schema_version": 1,
+        "kind": "ordinary-ci-cli-fixture",
+        "acquisition": "unauthenticated-ordinary-ci",
+        "builder_image_id": image('c'),
+        "builder_glibc": "ldd (GNU libc) 2.34",
+        "startup_images": startup,
+    })
+}
+
+#[test]
+fn optional_reproduction_setup_failure_preserves_canonical_evidence() {
+    let bytes = elf(&ElfSpec {
+        payload: b"/trusted-server/src/main.rs",
+        debug_sections: vec![
+            (
+                ".debug_info",
+                object::elf::SHT_PROGBITS,
+                b"fictional dwarf info",
+            ),
+            (
+                ".debug_line",
+                object::elf::SHT_PROGBITS,
+                b"fictional dwarf lines",
+            ),
+        ],
+        ..ElfSpec::conforming()
+    });
+    let mut build = built(
+        super::super::startup::LINUX_CLI_ASSET,
+        Role::Canonical,
+        &bytes,
+    );
+    let stdout = build.stdout(|_| {});
+    let canonical = build
+        .finish(stdout)
+        .expect("should complete the canonical fixture");
+
+    let (measured, invariant) = reproduction_result::<(), ()>(
+        Err(recipe_error("reproduction materials unavailable")),
+        |_| panic!("should never pair a failed setup"),
+    );
+    assert!(invariant.is_none(), "should keep setup failure optional");
+    assert!(
+        measured
+            .expect_err("should record unavailable reproduction")
+            .contains("materials unavailable")
+    );
+    let fixture = CliFixture::parse(&description()).expect("should parse the CLI fixture");
+    let elf = inspect_elf(&bytes, &ElfPolicy::linux_x86_64_gnu())
+        .expect("should inspect canonical bytes");
+    let measurement = cli_candidate_measurement(&CliCandidateFacts {
+        canonical: &canonical,
+        builder: &fixture,
+        elf: &elf,
+        remap_found: &[],
+        operator_values_removed: &[],
+        startup: &[],
+        reproduction: ReproductionOutcome::BuildFailed("materials unavailable".to_owned()),
+    });
+    assert_eq!(
+        measurement["canonical"]["artifact"]["sha256"],
+        canonical.artifact().sha256(),
+        "should retain the accepted canonical artifact when reproduction setup fails"
+    );
+    assert_eq!(
+        measurement["reproduction"]["status"], "build-failed",
+        "should record unavailable reproduction"
+    );
+    canonical
+        .rehash_for_handoff()
+        .expect("should preserve the accepted canonical bytes");
+}
+
+#[test]
+fn native_reproduction_selection_accepts_only_exact_modes() {
+    for (value, event, expected) in [
+        ("measure", None, NativeReproduction::Measure),
+        ("defer", None, NativeReproduction::Defer),
+        ("defer", Some("push"), NativeReproduction::Defer),
+        ("defer", Some("pull_request"), NativeReproduction::Defer),
+        ("measure", Some("schedule"), NativeReproduction::Measure),
+        (
+            "measure",
+            Some("workflow_dispatch"),
+            NativeReproduction::Measure,
+        ),
+    ] {
+        assert_eq!(
+            parse_native_reproduction(Some(value), event),
+            Ok(expected),
+            "should accept {value:?} on event {event:?}"
+        );
+    }
+    for value in [
+        None,
+        Some(""),
+        Some("MEASURE"),
+        Some("skip"),
+        Some(" defer"),
+    ] {
+        let error = parse_native_reproduction(value, Some("push"))
+            .expect_err("should reject a missing or unknown mode");
+        assert!(
+            error.contains(NATIVE_REPRODUCTION_VARIABLE),
+            "should name the selection variable: {error}"
+        );
+    }
+}
+
+#[test]
+fn native_reproduction_cannot_be_deferred_by_a_measuring_run() {
+    for event in MEASURING_EVENTS {
+        let error = parse_native_reproduction(Some("defer"), Some(event))
+            .expect_err("should refuse to defer on a scheduled or dispatched run");
+        assert!(
+            error.contains(event),
+            "should name the measuring event: {error}"
+        );
+    }
+}
+
+#[test]
+fn deferred_reproduction_is_recorded_explicitly() {
+    let recorded = reproduction_measurement(&ReproductionOutcome::Deferred);
+    assert_eq!(
+        recorded["status"], "deferred-to-scheduled-run",
+        "should state the deferral rather than omit the reproduction"
+    );
+    assert_eq!(
+        recorded["gate"], "measurement-only",
+        "should keep the reproduction a measurement"
+    );
+    assert_eq!(
+        recorded["selector"], "TS_RELEASE_NATIVE_REPRODUCTION=defer",
+        "should name the selection that deferred it"
+    );
+}
+
+#[test]
+fn optional_reproduction_pairing_failure_remains_fatal() {
+    let (measured, invariant) = reproduction_result(Ok(()), |_| {
+        Err::<(), _>(recipe_error("different source commits"))
+    });
+    assert!(measured.is_err(), "should record the failed pairing");
+    assert!(invariant.is_some(), "should retain the fatal pairing error");
+}
+
+#[test]
+fn reproduction_deadline_expires_before_setup() {
+    let cancellation = Cancellation::default();
+    assert!(
+        check_build_budget(Instant::now(), &cancellation).is_err(),
+        "should return expiration without starting setup"
+    );
+}
+
+#[test]
+fn cleanup_failure_preserves_both_errors() {
+    let result = finish_cleanup::<()>(
+        Err(recipe_error("setup failed")),
+        Err(recipe_error("source cleanup failed")),
+    );
+    let error = format!("{:?}", result.expect_err("should report cleanup failure"));
+    assert!(
+        error.contains("setup failed") && error.contains("source cleanup failed"),
+        "should report setup and cleanup errors: {error}"
+    );
+}
+
+/// Separates optional build availability from fatal comparison invariants.
+pub(super) fn reproduction_result<T, U>(
+    build: Result<T, Report<ReleaseError>>,
+    measure: impl FnOnce(T) -> Result<U, Report<ReleaseError>>,
+) -> (Result<U, String>, Option<Report<ReleaseError>>) {
+    match build {
+        Err(error) => (Err(format!("{error:?}")), None),
+        Ok(build) => match measure(build) {
+            Ok(measured) => (Ok(measured), None),
+            Err(error) => (
+                Err(format!("pairing invariant failed: {error:?}")),
+                Some(error),
+            ),
+        },
+    }
+}
+
+/// Refuses unavailable time or cancellation before optional setup starts.
+pub(super) fn check_build_budget(
+    deadline: Instant,
+    cancellation: &Cancellation,
+) -> Result<(), Report<ReleaseError>> {
+    if Instant::now() >= deadline || cancellation.is_cancelled() {
+        return Err(recipe_error(
+            "CLI build deadline expired or was cancelled before setup",
+        ));
+    }
+    Ok(())
+}
+
+/// Retains a failed operation and every explicit cleanup failure together.
+pub(super) fn finish_cleanup<T>(
+    operation: Result<T, Report<ReleaseError>>,
+    cleanup: Result<(), Report<ReleaseError>>,
+) -> Result<T, Report<ReleaseError>> {
+    match (operation, cleanup) {
+        (result, Ok(())) => result,
+        (Ok(_), Err(cleanup)) => Err(cleanup),
+        (Err(error), Err(cleanup)) => Err(error.attach(format!("cleanup failed: {cleanup:?}"))),
+    }
+}
+
+/// Pins startup host inputs in a separate private root outside the mounted copy.
+pub(super) fn new_startup_client(
+    docker: &Path,
+    copy_directory: &Path,
+) -> Result<(tempfile::TempDir, StartupClient), Report<ReleaseError>> {
+    let state = tempfile::tempdir()
+        .map_err(|error| recipe_error(format!("cannot prepare startup host state: {error}")))?;
+    let parent = fs::canonicalize(state.path())
+        .map_err(|error| recipe_error(format!("cannot prepare startup host state: {error}")))?;
+    let client = StartupClient::new(docker, &parent, &[copy_directory])?;
+    Ok((state, client))
+}
+
+#[test]
+fn startup_host_state_is_disjoint_from_the_mounted_copy() {
+    let scratch = tempfile::tempdir().expect("should create startup scratch space");
+    let base = fs::canonicalize(scratch.path()).expect("should resolve scratch space");
+    let copy_directory = base.join("startup-copy");
+    fs::create_dir(&copy_directory).expect("should create a fictional mount");
+    let docker = base.join("docker");
+    fs::write(&docker, b"fictional Docker client bytes")
+        .expect("should write a client without executing it");
+    assert!(
+        StartupClient::new(&docker, &base, &[&copy_directory]).is_err(),
+        "should reject host state above the mounted copy"
+    );
+    let (state, _client) = new_startup_client(&docker, &copy_directory)
+        .expect("should configure the same disjoint host state used by startup");
+    let state = fs::canonicalize(state.path()).expect("should resolve startup host state");
+    assert!(
+        !state.starts_with(&copy_directory) && !copy_directory.starts_with(&state),
+        "should keep host state and mount pairwise disjoint"
+    );
+}
diff --git a/crates/trusted-server-release/src/recipe/tests/compare.rs b/crates/trusted-server-release/src/recipe/tests/compare.rs
new file mode 100644
index 0000000000..4d47cfc602
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/tests/compare.rs
@@ -0,0 +1,340 @@
+use sha2::Sha256;
+
+use super::super::ambient::AmbientClaim;
+use super::super::compare::{
+    FASTLY_ASSET, check_fastly_equality, describe_mismatch, first_difference,
+};
+use super::super::completed::SuccessFacts;
+use super::complete::{Built, ManifestMarks, built, built_with, wasm_with};
+use super::complete_darwin::darwin_executable;
+use super::fixture::OTHER_COMMIT;
+use super::*;
+
+/// A minimal Wasm module that keeps the debug sections a build must retain.
+fn module(info: &[u8]) -> Vec<u8> {
+    wasm_with(&[(".debug_info", info), (".debug_line", b"line")])
+}
+
+/// A completed fictional build with the fixture roots its output lives in.
+struct Completed {
+    _built: Built,
+    completed: RecipeCompleted,
+}
+
+impl std::ops::Deref for Completed {
+    type Target = RecipeCompleted;
+
+    fn deref(&self) -> &RecipeCompleted {
+        &self.completed
+    }
+}
+
+/// Completes a fictional build of `asset` for `role` with exactly `bytes`.
+fn completed(asset: &'static str, role: Role, bytes: &[u8], marks: ManifestMarks) -> Completed {
+    finish(built_with(asset, role, bytes, marks))
+}
+
+fn finish(mut built: Built) -> Completed {
+    let stdout = built.stdout(|_| {});
+    let completed = built.finish(stdout).expect("should complete the build");
+    Completed {
+        _built: built,
+        completed,
+    }
+}
+
+fn rejection(canonical: &RecipeCompleted, reproduction: &RecipeCompleted) -> String {
+    match check_fastly_equality(canonical, reproduction) {
+        Ok(_) => panic!("should reject the pair"),
+        Err(error) => format!("{error:?}"),
+    }
+}
+
+#[test]
+fn identical_canonical_and_reproduction_fastly_bytes_are_accepted_with_the_standard_claim() {
+    let bytes = module(b"info");
+    let canonical = completed(
+        FASTLY_ASSET,
+        Role::Canonical,
+        &bytes,
+        ManifestMarks::Committed,
+    );
+    let reproduction = completed(
+        FASTLY_ASSET,
+        Role::Reproduction,
+        &bytes,
+        ManifestMarks::Committed,
+    );
+    let checked = check_fastly_equality(&canonical, &reproduction)
+        .expect("should accept identical final bytes");
+    assert_eq!(
+        checked.asset().artifact().name,
+        FASTLY_ASSET,
+        "should name Fastly"
+    );
+    assert_eq!(
+        checked.sha256(),
+        hex::encode(Sha256::digest(&bytes)),
+        "should report the shared digest"
+    );
+    assert_eq!(checked.size(), bytes.len() as u64, "should report the size");
+    assert_eq!(
+        checked.ambient().claim(),
+        &AmbientClaim::standard(),
+        "should bind the honest ambient placement"
+    );
+
+    let measurement = super::candidate::equality_measurement(&canonical, &reproduction, &checked);
+    assert_eq!(
+        (
+            &measurement["kind"],
+            &measurement["equality"],
+            &measurement["release_qualification"],
+        ),
+        (
+            &serde_json::json!("ordinary-ci-fastly-canonical-reproduction-equality"),
+            &serde_json::json!(true),
+            &serde_json::json!(false),
+        ),
+        "should report candidate equality without release qualification"
+    );
+    for (role, umask, jobs) in [("canonical", "022", 4), ("reproduction", "027", 2)] {
+        let build = &measurement["builds"][role];
+        assert_eq!(
+            build["artifact"]["sha256"],
+            checked.sha256(),
+            "should report the {role} digest"
+        );
+        assert_eq!(
+            (&build["ambient"]["umask"], &build["ambient"]["jobs"]),
+            (&serde_json::json!(umask), &serde_json::json!(jobs)),
+            "should report the {role} ambient record"
+        );
+        assert_eq!(
+            (
+                &build["ambient"]["child_locale"],
+                &build["ambient"]["child_timezone"]
+            ),
+            (&serde_json::json!("C"), &serde_json::json!("UTC")),
+            "should report the normalized {role} child locale and timezone"
+        );
+    }
+    assert_eq!(
+        measurement["ambient_claim"]["unsupported"],
+        serde_json::json!(["ExecutionUser"]),
+        "should not claim the execution user varied"
+    );
+}
+
+#[test]
+fn one_byte_difference_reports_sizes_digests_and_first_offset() {
+    let canonical = completed(
+        FASTLY_ASSET,
+        Role::Canonical,
+        &module(b"info"),
+        ManifestMarks::Committed,
+    );
+    let reproduction = completed(
+        FASTLY_ASSET,
+        Role::Reproduction,
+        &module(b"inFo"),
+        ManifestMarks::Committed,
+    );
+    let message = rejection(&canonical, &reproduction);
+    let offset =
+        first_difference(&module(b"info"), &module(b"inFo")).expect("should find the changed byte");
+    for part in [
+        "final Fastly bytes differ".to_owned(),
+        format!("first differing offset {offset}"),
+        format!("canonical size {}", module(b"info").len()),
+        canonical.artifact().sha256().to_owned(),
+        reproduction.artifact().sha256().to_owned(),
+        "custom section \".debug_info\"".to_owned(),
+        "1 differing bytes".to_owned(),
+    ] {
+        assert!(message.contains(&part), "should report {part}: {message}");
+    }
+}
+
+#[test]
+fn first_difference_covers_prefixes_and_equal_inputs() {
+    assert_eq!(first_difference(b"abc", b"abc"), None, "should find none");
+    assert_eq!(
+        first_difference(b"abc", b"abd"),
+        Some(2),
+        "should find byte 2"
+    );
+    assert_eq!(
+        first_difference(b"ab", b"abc"),
+        Some(2),
+        "should report the shorter length for a strict prefix"
+    );
+    let message = describe_mismatch(b"ab", b"abc");
+    assert!(
+        message.contains("canonical size 2") && message.contains("reproduction size 3"),
+        "should report both sizes: {message}"
+    );
+    assert!(
+        message.contains("1 differing bytes") && message.contains("unparsed module"),
+        "should count the extra byte and survive a non-module: {message}"
+    );
+    let long = vec![0_u8; 4096];
+    let mut changed = long.clone();
+    changed[100] = 1;
+    assert!(
+        describe_mismatch(&long, &changed).len() < 600,
+        "should bound the diagnostic window"
+    );
+}
+
+#[test]
+fn same_role_or_swapped_pairs_are_rejected() {
+    let bytes = module(b"info");
+    let canonical = completed(
+        FASTLY_ASSET,
+        Role::Canonical,
+        &bytes,
+        ManifestMarks::Committed,
+    );
+    let other_canonical = completed(
+        FASTLY_ASSET,
+        Role::Canonical,
+        &bytes,
+        ManifestMarks::Committed,
+    );
+    let reproduction = completed(
+        FASTLY_ASSET,
+        Role::Reproduction,
+        &bytes,
+        ManifestMarks::Committed,
+    );
+    for (first, second) in [(&canonical, &other_canonical), (&reproduction, &canonical)] {
+        assert!(
+            rejection(first, second).contains("a canonical then a reproduction build"),
+            "should require exactly the canonical then the reproduction build"
+        );
+    }
+}
+
+#[test]
+fn mismatched_inputs_or_another_asset_are_rejected() {
+    let bytes = module(b"info");
+    let canonical = completed(
+        FASTLY_ASSET,
+        Role::Canonical,
+        &bytes,
+        ManifestMarks::Committed,
+    );
+    let derived = completed(
+        FASTLY_ASSET,
+        Role::Reproduction,
+        &bytes,
+        ManifestMarks::Derived,
+    );
+    assert!(
+        rejection(&canonical, &derived).contains("derived Git manifests"),
+        "should reject builds over different derived manifests"
+    );
+    let normalized = completed(
+        FASTLY_ASSET,
+        Role::Reproduction,
+        &bytes,
+        ManifestMarks::Normalized,
+    );
+    assert!(
+        rejection(&canonical, &normalized).contains("producer-normalized Git manifests"),
+        "should reject builds over different producer-normalized manifests"
+    );
+    let native = finish(built(
+        "ts-aarch64-apple-darwin",
+        Role::Canonical,
+        &darwin_executable(),
+    ));
+    let reproduction = completed(
+        FASTLY_ASSET,
+        Role::Reproduction,
+        &bytes,
+        ManifestMarks::Committed,
+    );
+    assert!(
+        rejection(&native, &reproduction).contains("compares only"),
+        "should compare only the Fastly asset"
+    );
+}
+
+/// One forged input of the reproduction build and the label its rejection must name.
+type Forge = (&'static str, fn(&mut SuccessFacts));
+
+#[test]
+fn each_mismatched_input_is_rejected_by_name() {
+    let bytes = module(b"info");
+    let canonical = completed(
+        FASTLY_ASSET,
+        Role::Canonical,
+        &bytes,
+        ManifestMarks::Committed,
+    );
+    let cases: [Forge; 8] = [
+        ("source commits", |facts| {
+            facts.commit = CommitId::parse(OTHER_COMMIT).expect("should parse commit");
+        }),
+        ("Cargo.lock files", |facts| {
+            facts.cargo_lock_sha256 = "e".repeat(64);
+        }),
+        ("vendored materials", |facts| {
+            facts.materials_digest = "e".repeat(64);
+        }),
+        ("JS handoffs", |facts| {
+            facts.js_inventory_sha256 = "e".repeat(64);
+        }),
+        ("JS handoffs", |facts| {
+            facts.js_settings_sha256 = "e".repeat(64)
+        }),
+        ("JS handoffs", |facts| {
+            facts.js_tools_sha256 = "e".repeat(64)
+        }),
+        ("Rust tools", |facts| {
+            facts.rust_tools_digest = "e".repeat(64);
+        }),
+        ("compares only", |facts| {
+            facts.asset = AssetId::parse("ts-aarch64-apple-darwin").expect("should resolve");
+        }),
+    ];
+    for (label, forge) in cases {
+        let mut reproduction = completed(
+            FASTLY_ASSET,
+            Role::Reproduction,
+            &bytes,
+            ManifestMarks::Committed,
+        );
+        forge(reproduction.completed.facts_mut_for_tests());
+        let message = rejection(&canonical, &reproduction);
+        assert!(
+            message.contains(label),
+            "should reject a reproduction build with mismatched {label}: {message}"
+        );
+    }
+}
+
+#[test]
+fn artifact_changed_after_completion_is_rejected() {
+    let bytes = module(b"info");
+    let canonical = completed(
+        FASTLY_ASSET,
+        Role::Canonical,
+        &bytes,
+        ManifestMarks::Committed,
+    );
+    let reproduction = completed(
+        FASTLY_ASSET,
+        Role::Reproduction,
+        &bytes,
+        ManifestMarks::Committed,
+    );
+    std::fs::write(reproduction.artifact().path(), module(b"inFo"))
+        .expect("should tamper with the reproduction build");
+    assert!(
+        rejection(&canonical, &reproduction).contains("artifact bytes changed"),
+        "should rehash both artifacts before comparing"
+    );
+}
diff --git a/crates/trusted-server-release/src/recipe/tests/complete.rs b/crates/trusted-server-release/src/recipe/tests/complete.rs
new file mode 100644
index 0000000000..c8e507a3ea
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/tests/complete.rs
@@ -0,0 +1,951 @@
+use std::fs;
+use std::os::unix::fs::symlink;
+use std::time::Duration;
+
+use serde_json::{Value, json};
+use sha2::Sha256;
+
+use super::complete_darwin::{darwin_executable, darwin_executable_with, rejects_embedded_path};
+use super::fixture::*;
+use super::*;
+use crate::boundary::DescendantCleanup;
+use crate::inspect::Violation;
+use crate::inspect::tests::builders::{ElfSpec, MachoSpec, elf, macho};
+
+const FINGERPRINT: [u8; 32] = [7; 32];
+
+#[test]
+fn a_completed_candidate_without_complete_composition_cannot_generate_spdx() {
+    let bytes = wasm_with(&[(".debug_info", b"i"), (".debug_line", b"l")]);
+    let mut build = built("trusted-server-fastly.wasm", Role::Canonical, &bytes);
+    let stdout = build.stdout(|_| {});
+    let completed = build
+        .finish(stdout)
+        .expect("should complete the accepted candidate artifact");
+    build
+        .fixture
+        .completed
+        .rehash_for_handoff()
+        .expect("should retain an unchanged owned JS handoff");
+    assert!(
+        crate::spdx::generate_from_completed(&completed, &build.fixture.completed).is_err(),
+        "should reject SPDX generation without complete owning composition inputs"
+    );
+}
+
+#[test]
+fn pure_completion_fixtures_cannot_export_measured_socket_receipts() {
+    let bytes = wasm_with(&[(".debug_info", b"i"), (".debug_line", b"l")]);
+    let mut build = built("trusted-server-fastly.wasm", Role::Canonical, &bytes);
+    let stdout = build.stdout(|_| {});
+    let completed = build
+        .finish(stdout)
+        .expect("should complete the accepted fixture artifact");
+    assert!(
+        completed.denial_receipt().is_err(),
+        "should not export measured socket observations from a pure completion fixture"
+    );
+}
+
+#[test]
+fn pure_completion_fixtures_cannot_export_candidate_transfers() {
+    let bytes = wasm_with(&[(".debug_info", b"i"), (".debug_line", b"l")]);
+    let mut build = built("trusted-server-fastly.wasm", Role::Canonical, &bytes);
+    let stdout = build.stdout(|_| {});
+    let completed = build
+        .finish(stdout)
+        .expect("should complete the accepted fixture artifact");
+    assert!(
+        completed.composition_export().is_err(),
+        "should reject a fixture with no actual retained composition receipts"
+    );
+    assert!(
+        completed.composition_view().is_err(),
+        "should refuse a typed owner view without actual retained composition receipts"
+    );
+    assert!(
+        completed.javascript_contributions().is_err(),
+        "should refuse original JS evidence absent from the owning completion"
+    );
+    assert!(
+        crate::collection::producer::CandidateBuildExport::from_completed(&completed).is_err(),
+        "should not manufacture a measured candidate transfer from a pure fixture"
+    );
+}
+
+// Inject only a checked JS snapshot into an explicitly unmeasured completion
+// fixture. This cannot create composition, socket or workflow authority.
+fn completed_with_js_snapshot() -> (Built, RecipeCompleted, Vec<u8>) {
+    let javascript = JsBuildCompleted::fixture_for_projection(COMMIT);
+    let snapshot = javascript
+        .retained_contributions()
+        .expect("should validate original JS inventory before retaining it");
+    let raw = snapshot.raw_inventory().to_vec();
+    let bytes = wasm_with(&[(".debug_info", b"i"), (".debug_line", b"l")]);
+    let mut build = built("trusted-server-fastly.wasm", Role::Canonical, &bytes);
+    let prepared = build
+        .prepared
+        .as_mut()
+        .expect("should hold prepared fixture");
+    prepared.js.inventory_sha256 = snapshot.inventory_sha256().to_owned();
+    prepared.js.contributions = Some(snapshot);
+    drop(javascript);
+    let stdout = build.stdout(|_| {});
+    let completed = build
+        .finish(stdout)
+        .expect("should retain checked JS snapshot");
+    (build, completed, raw)
+}
+
+#[test]
+fn completion_retains_exact_js_inventory_after_original_owner_disappears() {
+    let (_build, completed, raw) = completed_with_js_snapshot();
+    let snapshot = completed
+        .javascript_contributions()
+        .expect("should retain checked evidence without its preparation owner or lease");
+    assert_eq!(
+        snapshot.raw_inventory(),
+        raw,
+        "should retain original bytes"
+    );
+    assert_eq!(
+        fs::read(completed.retained_inventory_path()).expect("should retain original file"),
+        raw,
+        "should copy original inventory rather than serialize normalized facts"
+    );
+    assert!(
+        completed.denial_receipt().is_err(),
+        "should grant no measured socket authority to a checked JS snapshot"
+    );
+}
+
+#[test]
+fn completion_rejects_changed_retained_js_inventory() {
+    let (_build, completed, _) = completed_with_js_snapshot();
+    fs::write(completed.retained_inventory_path(), b"changed original")
+        .expect("should change retained bytes");
+    assert!(
+        completed.javascript_contributions().is_err(),
+        "should reject a changed original even with unchanged normalized facts"
+    );
+}
+
+#[test]
+fn completion_rejects_aliases_of_unchanged_retained_js_inventory() {
+    for hard_link in [false, true] {
+        let (_build, completed, raw) = completed_with_js_snapshot();
+        let outside = tempfile::tempdir().expect("should create separate inventory storage");
+        let replacement = outside.path().join("inventory.json");
+        fs::write(&replacement, raw).expect("should copy identical original inventory");
+        let retained = completed.retained_inventory_path();
+        fs::remove_file(&retained).expect("should replace retained inventory");
+        if hard_link {
+            fs::hard_link(&replacement, &retained).expect("should install matching hardlink");
+        } else {
+            symlink(&replacement, &retained).expect("should install matching alias");
+        }
+        assert!(
+            completed.javascript_contributions().is_err(),
+            "should reject aliases even when original JS inventory bytes match"
+        );
+    }
+}
+
+#[test]
+fn completion_rejects_another_js_snapshot_source_or_digest() {
+    for change in [
+        (|facts: &mut super::super::completed::SuccessFacts| {
+            facts.commit = crate::source::CommitId::parse(&"b".repeat(40))
+                .expect("should parse fictional commit")
+        }) as fn(&mut super::super::completed::SuccessFacts),
+        |facts| facts.js_inventory_sha256 = "c".repeat(64),
+    ] {
+        let (_build, mut completed, _) = completed_with_js_snapshot();
+        change(completed.facts_mut_for_tests());
+        assert!(
+            completed.javascript_contributions().is_err(),
+            "should reject snapshot binding to another completed build"
+        );
+    }
+}
+
+pub(super) fn wasm_with(customs: &[(&str, &[u8])]) -> Vec<u8> {
+    let mut out = b"\0asm\x01\0\0\0".to_vec();
+    for (name, data) in customs
+        .iter()
+        .copied()
+        .chain([("remapped-source", b"/trusted-server/src/main.rs".as_slice())])
+    {
+        let mut body = vec![u8::try_from(name.len()).expect("should fit")];
+        body.extend_from_slice(name.as_bytes());
+        body.extend_from_slice(data);
+        out.push(0);
+        out.push(u8::try_from(body.len()).expect("should fit"));
+        out.extend_from_slice(&body);
+    }
+    out
+}
+
+/// Cargo's executable file name for `asset`.
+fn executable_name(asset: &str) -> String {
+    let artifact = AssetId::parse(asset)
+        .expect("should resolve asset")
+        .artifact();
+    if artifact.target == ReleaseTarget::Wasm32Wasip1 {
+        format!("{}.wasm", artifact.bin)
+    } else {
+        artifact.bin.to_owned()
+    }
+}
+
+pub(super) struct Built {
+    fixture: Fixture,
+    prepared: Option<PreparedRecipe>,
+    asset: &'static str,
+    role: Role,
+    cleanup: DescendantCleanup,
+}
+
+/// Which Git manifest digests the fictional materials token records.
+#[derive(Clone, Copy, Debug)]
+pub(super) enum ManifestMarks {
+    /// Only committed manifests: nothing normalized or derived.
+    Committed,
+    /// One producer-normalized manifest.
+    Normalized,
+    /// One caller-derived manifest.
+    Derived,
+}
+
+pub(super) fn built(asset: &'static str, role: Role, bytes: &[u8]) -> Built {
+    built_with(asset, role, bytes, ManifestMarks::Committed)
+}
+
+/// Builds a bound recipe over materials carrying the given manifest marks.
+pub(super) fn built_with(
+    asset: &'static str,
+    role: Role,
+    bytes: &[u8],
+    marks: ManifestMarks,
+) -> Built {
+    let fixture = Fixture::new(COMMIT);
+    let marked = |materials: PreparedCargoMaterials| match marks {
+        ManifestMarks::Committed => materials,
+        ManifestMarks::Normalized => {
+            materials.with_normalized_for_tests("example-git", &"e".repeat(64))
+        }
+        ManifestMarks::Derived => {
+            materials.with_derived_for_tests("example-1.0.0", &"d".repeat(64))
+        }
+    };
+    let prepared = match marks {
+        ManifestMarks::Committed => fixture.bind(asset, role),
+        ManifestMarks::Normalized | ManifestMarks::Derived => {
+            let request = fixture.request(asset, role.spec_label(), COMMIT);
+            let tools = fixture.tools_for(request.asset.artifact().target);
+            let materials = marked(fixture.materials(COMMIT));
+            fixture.bind_parts(request, role, COMMIT, tools, materials)
+        }
+    }
+    .expect("should bind the recipe");
+    let artifact = AssetId::parse(asset)
+        .expect("should resolve asset")
+        .artifact();
+    let release = fixture
+        .base
+        .join("target")
+        .join(artifact.target.triple())
+        .join("release");
+    fs::create_dir_all(&release).expect("should create the release directory");
+    fs::write(release.join(executable_name(asset)), bytes).expect("should write the executable");
+    let cleanup = if artifact.target.is_darwin() {
+        DescendantCleanup::ReapedAfterRun
+    } else {
+        DescendantCleanup::OwnedByContainer
+    };
+    Built {
+        fixture,
+        prepared: Some(prepared),
+        asset,
+        role,
+        cleanup,
+    }
+}
+
+impl Built {
+    fn prepared(&self) -> &PreparedRecipe {
+        self.prepared
+            .as_ref()
+            .expect("should hold the prepared recipe")
+    }
+
+    pub(super) fn stdout(&self, edit: impl FnOnce(&mut Value)) -> Vec<u8> {
+        let artifact = AssetId::parse(self.asset)
+            .expect("should resolve asset")
+            .artifact();
+        let release = format!("/boundary/writable/1/{}/release", artifact.target.triple());
+        let mut message = json!({
+            "reason": "compiler-artifact",
+            "manifest_path": format!("/boundary/immutable/0/crates/{}/Cargo.toml", artifact.package),
+            "target": {"kind": ["bin"], "crate_types": ["bin"], "name": artifact.bin},
+            "profile": {"opt_level": "3", "debuginfo": 1},
+            "executable": format!("{release}/{}", executable_name(self.asset)),
+            "fresh": false
+        });
+        edit(&mut message);
+        let mut out = Vec::new();
+        for line in [
+            json!({"reason": "build-script-executed", "env": []}),
+            message,
+            json!({"reason": "build-finished", "success": true}),
+        ] {
+            out.extend_from_slice(line.to_string().as_bytes());
+            out.push(b'\n');
+        }
+        out
+    }
+
+    fn run(&self, stdout: Vec<u8>) -> RunOutput {
+        RunOutput {
+            gnu: None,
+            stdout,
+            stderr_sha256: hex::encode(Sha256::digest(b"fictional diagnostics")),
+            started_at_seconds: 1_700_000_000,
+            elapsed: Duration::from_secs(42),
+            cleanup: self.cleanup,
+            queries: super::super::execute::CargoQueryOutput::Fixture,
+        }
+    }
+
+    pub(super) fn finish(
+        &mut self,
+        stdout: Vec<u8>,
+    ) -> Result<RecipeCompleted, Report<ReleaseError>> {
+        let paths = self.fixture.paths(self.role);
+        let run = self.run(stdout);
+        self.prepared
+            .take()
+            .expect("should hold the prepared recipe")
+            .complete(run, FINGERPRINT, &paths)
+    }
+}
+
+fn rejection(result: Result<RecipeCompleted, Report<ReleaseError>>) -> String {
+    match result {
+        Ok(_) => panic!("should reject the completion"),
+        Err(error) => format!("{error:?}"),
+    }
+}
+
+#[test]
+fn successful_run_binds_every_input_and_copies_the_artifact() {
+    let bytes = darwin_executable();
+    let mut built = built("ts-aarch64-apple-darwin", Role::Canonical, &bytes);
+    let stdout = built.stdout(|_| {});
+    let expected_plan = built
+        .prepared()
+        .plan(&built.fixture.paths(Role::Canonical))
+        .expect("should derive the plan")
+        .digest()
+        .expect("should digest the plan");
+    let materials_digest = built.prepared().materials.digest().to_owned();
+    let tools_digest = built.prepared().tools_digest.clone();
+    let js = [
+        built.fixture.completed.inventory_sha256().to_owned(),
+        built.fixture.completed.settings_sha256().to_owned(),
+        built.fixture.completed.tools_sha256().to_owned(),
+    ];
+    let output = built.fixture.base.join("output");
+    let completed = built
+        .finish(stdout.clone())
+        .expect("should complete the run");
+
+    assert_eq!(
+        completed.asset().artifact().name,
+        "ts-aarch64-apple-darwin",
+        "should bind the asset"
+    );
+    assert_eq!(completed.role(), Role::Canonical, "should bind the role");
+    assert_eq!(
+        completed.commit().as_str(),
+        COMMIT,
+        "should bind the commit"
+    );
+    assert_eq!(
+        completed.cargo_lock_sha256(),
+        "b".repeat(64),
+        "should bind the lock digest"
+    );
+    assert_eq!(
+        completed.materials_digest(),
+        materials_digest,
+        "should bind the materials digest"
+    );
+    assert_eq!(
+        completed.js_digests(),
+        js.each_ref().map(String::as_str),
+        "should bind the JS handoff"
+    );
+    assert_eq!(
+        completed.rust_tools_digest(),
+        tools_digest,
+        "should bind the Rust tools digest"
+    );
+    assert_eq!(
+        completed.boundary_fingerprint(),
+        FINGERPRINT,
+        "should bind the boundary instance"
+    );
+    assert_eq!(
+        completed.plan_digest(),
+        expected_plan,
+        "should bind the exact plan"
+    );
+    assert_eq!(
+        completed.ambient().role(),
+        Role::Canonical,
+        "should bind the ambient"
+    );
+    assert_eq!(
+        completed.started_at_seconds(),
+        1_700_000_000,
+        "should bind the start time"
+    );
+    assert_eq!(
+        completed.elapsed(),
+        Duration::from_secs(42),
+        "should bind the elapsed time"
+    );
+    assert_eq!(
+        completed.stdout_sha256(),
+        hex::encode(Sha256::digest(&stdout)),
+        "should bind the Cargo stream"
+    );
+    assert_eq!(
+        completed.stderr_sha256(),
+        hex::encode(Sha256::digest(b"fictional diagnostics")),
+        "should bind the diagnostics digest"
+    );
+    assert_eq!(
+        completed.artifact().name(),
+        "ts-aarch64-apple-darwin",
+        "should name the artifact"
+    );
+    assert_eq!(
+        completed.artifact().size(),
+        bytes.len() as u64,
+        "should record the size"
+    );
+    assert_eq!(
+        completed.artifact().sha256(),
+        hex::encode(Sha256::digest(&bytes)),
+        "should record the digest"
+    );
+    assert_eq!(
+        fs::read(output.join("ts-aarch64-apple-darwin")).expect("should read output"),
+        bytes,
+        "should copy the bytes"
+    );
+    assert_eq!(
+        completed
+            .rehash_for_handoff()
+            .expect("should rehash the untouched output"),
+        output,
+        "should return the output directory"
+    );
+}
+
+#[test]
+fn rehash_rejects_changed_output_and_retained_stream() {
+    type Tamper = fn(&std::path::Path, &RecipeCompleted);
+    let tampers: [(&str, Tamper); 6] = [
+        ("edit", |output, _| {
+            fs::write(
+                output.join("ts-aarch64-apple-darwin"),
+                b"tampered executable",
+            )
+            .expect("should edit");
+        }),
+        ("extra entry", |output, _| {
+            fs::write(output.join("extra"), b"x").expect("should add an entry");
+        }),
+        ("hard link", |output, _| {
+            fs::hard_link(
+                output.join("ts-aarch64-apple-darwin"),
+                output.join("..").join("link"),
+            )
+            .expect("should link");
+        }),
+        ("removal", |output, _| {
+            fs::remove_file(output.join("ts-aarch64-apple-darwin")).expect("should remove");
+        }),
+        ("symlink swap", |output, _| {
+            let path = output.join("ts-aarch64-apple-darwin");
+            fs::remove_file(&path).expect("should remove");
+            fs::write(output.join("..").join("elsewhere"), darwin_executable())
+                .expect("should write target");
+            symlink(output.join("..").join("elsewhere"), path).expect("should swap in a symlink");
+        }),
+        ("retained stream", |_, completed| {
+            fs::write(completed.retained_stdout_path(), b"tampered stream").expect("should edit");
+        }),
+    ];
+    for (label, tamper) in tampers {
+        let mut built = built(
+            "ts-aarch64-apple-darwin",
+            Role::Canonical,
+            &darwin_executable(),
+        );
+        let stdout = built.stdout(|_| {});
+        let output = built.fixture.base.join("output");
+        let completed = built.finish(stdout).expect("should complete the run");
+        completed
+            .rehash_for_handoff()
+            .expect("should rehash before tampering");
+        tamper(&output, &completed);
+        assert!(
+            completed.rehash_for_handoff().is_err(),
+            "should reject {label} before handoff"
+        );
+    }
+}
+
+#[test]
+fn malformed_streams_complete_nothing_and_copy_nothing() {
+    type Edit = fn(&mut Value);
+    let edits: [(&str, Edit); 5] = [
+        ("fresh", |m| m["fresh"] = json!(true)),
+        ("debuginfo", |m| m["profile"]["debuginfo"] = json!(0)),
+        ("name", |m| m["target"]["name"] = json!("other")),
+        ("outside executable", |m| {
+            m["executable"] = json!("/boundary/immutable/0/ts");
+        }),
+        ("executable in a read-only root", |m| {
+            m["executable"] = json!("/boundary/immutable/0/target/release/ts");
+        }),
+    ];
+    for (label, edit) in edits {
+        let mut built = built(
+            "ts-aarch64-apple-darwin",
+            Role::Canonical,
+            &darwin_executable(),
+        );
+        let stdout = built.stdout(edit);
+        let output = built.fixture.base.join("output");
+        assert!(
+            built.finish(stdout).is_err(),
+            "should reject a stream with {label}"
+        );
+        assert_eq!(
+            fs::read_dir(output).expect("should list output").count(),
+            0,
+            "should copy nothing after a {label} rejection"
+        );
+    }
+}
+
+#[test]
+fn changed_tools_or_materials_or_existing_output_reject_completion() {
+    let mut built_tools = built(
+        "ts-aarch64-apple-darwin",
+        Role::Canonical,
+        &darwin_executable(),
+    );
+    let stdout = built_tools.stdout(|_| {});
+    fs::write(built_tools.fixture.base.join("tools/bin/cargo"), b"swapped")
+        .expect("should swap cargo");
+    assert!(
+        rejection(built_tools.finish(stdout)).contains("Rust tools changed"),
+        "should reject tools changed after the run"
+    );
+
+    let mut built_materials = built(
+        "ts-aarch64-apple-darwin",
+        Role::Canonical,
+        &darwin_executable(),
+    );
+    let stdout = built_materials.stdout(|_| {});
+    fs::write(
+        built_materials
+            .fixture
+            .base
+            .join("materials/vendor/example-1.0.0/Cargo.toml"),
+        b"swapped",
+    )
+    .expect("should swap a dependency");
+    assert!(
+        rejection(built_materials.finish(stdout)).contains("changed after binding"),
+        "should reject materials changed after the run"
+    );
+
+    let mut built_output = built(
+        "ts-aarch64-apple-darwin",
+        Role::Canonical,
+        &darwin_executable(),
+    );
+    let stdout = built_output.stdout(|_| {});
+    fs::write(
+        built_output
+            .fixture
+            .base
+            .join("output/ts-aarch64-apple-darwin"),
+        b"planted",
+    )
+    .expect("should plant an output");
+    assert!(
+        rejection(built_output.finish(stdout)).contains("exclusively"),
+        "should reject an output that exists already"
+    );
+}
+
+#[test]
+fn wasm_artifacts_must_keep_debug_sections() {
+    let asset = "trusted-server-fastly.wasm";
+    let stripped = wasm_with(&[("name", b"n")]);
+    let mut built_stripped = built(asset, Role::Canonical, &stripped);
+    let stdout = built_stripped.stdout(|_| {});
+    let message = rejection(built_stripped.finish(stdout));
+    assert!(
+        message.contains("debug section") || message.contains("WasmDebugInfo"),
+        "should reject a stripped module: {message}"
+    );
+
+    let kept = wasm_with(&[(".debug_info", b"i"), (".debug_line", b"l")]);
+    let mut built_kept = built(asset, Role::Canonical, &kept);
+    let stdout = built_kept.stdout(|_| {});
+    let completed = built_kept
+        .finish(stdout)
+        .expect("should accept a module with debug sections");
+    assert_eq!(
+        completed.artifact().name(),
+        asset,
+        "should publish under the asset name"
+    );
+
+    let mut built_text = built(asset, Role::Canonical, b"not wasm at all");
+    let stdout = built_text.stdout(|_| {});
+    assert!(
+        built_text.finish(stdout).is_err(),
+        "should reject bytes that are not a module"
+    );
+}
+
+/// Completes a Linux `ts` run whose executable holds `bytes`.
+fn finish_linux(bytes: &[u8]) -> Result<RecipeCompleted, Report<ReleaseError>> {
+    let mut built = built("ts-x86_64-unknown-linux-gnu", Role::Canonical, bytes);
+    let stdout = built.stdout(|_| {});
+    built.finish(stdout)
+}
+
+#[test]
+fn linux_executables_must_pass_elf_inspection_and_keep_debug_info() {
+    let completed = finish_linux(&elf(&ElfSpec {
+        payload: b"/trusted-server/src/main.rs",
+        ..ElfSpec::conforming()
+    }))
+    .expect("should accept a conforming executable with debug info");
+    assert_eq!(
+        completed.artifact().name(),
+        "ts-x86_64-unknown-linux-gnu",
+        "should publish under the asset name"
+    );
+    let cases: [(&str, ElfSpec, Violation); 3] = [
+        (
+            "stripped",
+            ElfSpec {
+                debug_sections: Vec::new(),
+                ..ElfSpec::conforming()
+            },
+            Violation::ElfDebugInfo,
+        ),
+        (
+            "above the glibc ceiling",
+            ElfSpec {
+                requirements: vec![("libc.so.6", vec!["GLIBC_2.35"])],
+                ..ElfSpec::conforming()
+            },
+            Violation::SymbolVersion,
+        ),
+        (
+            "runner path",
+            ElfSpec {
+                payload: b"panic at /home/runner/work/example/src/main.rs",
+                ..ElfSpec::conforming()
+            },
+            Violation::EmbeddedPath,
+        ),
+    ];
+    for (label, spec, expected) in cases {
+        let error = finish_linux(&elf(&spec)).expect_err("should reject the executable");
+        assert_eq!(
+            error.downcast_ref::<Violation>(),
+            Some(&expected),
+            "should reject the {label} executable by its rule: {error:?}"
+        );
+    }
+    assert!(
+        finish_linux(b"fictional text, not an executable").is_err(),
+        "should reject bytes that are not ELF"
+    );
+}
+
+#[test]
+fn execute_stays_closed_for_an_ordinary_ci_selection() {
+    let built = built(
+        "ts-aarch64-apple-darwin",
+        Role::Canonical,
+        &darwin_executable(),
+    );
+    assert_eq!(
+        built.prepared().tools.authority(),
+        Authority::Unqualified,
+        "should carry no release authority into the execute gate"
+    );
+}
+
+#[test]
+fn manifest_digests_are_carried_into_the_completion() {
+    let finish = |marks: ManifestMarks| {
+        let mut built = built_with(
+            "ts-aarch64-apple-darwin",
+            Role::Canonical,
+            &darwin_executable(),
+            marks,
+        );
+        let stdout = built.stdout(|_| {});
+        let completed = built.finish(stdout).expect("should complete the run");
+        (built, completed)
+    };
+    let (_plain, completed) = finish(ManifestMarks::Committed);
+    assert!(
+        completed.derived_manifest_digests().is_empty()
+            && completed.normalized_manifest_digests().is_empty(),
+        "should carry no normalized or derived manifest when none was used"
+    );
+
+    let (_normalized, completed) = finish(ManifestMarks::Normalized);
+    assert_eq!(
+        completed.normalized_manifest_digests().get("example-git"),
+        Some(&"e".repeat(64)),
+        "should carry the producer-normalized manifest digest"
+    );
+    assert!(
+        completed.derived_manifest_digests().is_empty(),
+        "should not treat a producer-normalized manifest as derived"
+    );
+
+    let (_derived, completed) = finish(ManifestMarks::Derived);
+    assert_eq!(
+        completed.derived_manifest_digests().get("example-1.0.0"),
+        Some(&"d".repeat(64)),
+        "should carry the derived manifest digest so the build stays marked unqualified"
+    );
+}
+
+#[test]
+fn candidate_measurements_report_no_release_qualification() {
+    let asset = "trusted-server-fastly.wasm";
+    let kept = wasm_with(&[(".debug_info", b"i"), (".debug_line", b"l")]);
+    let mut built = built_with(asset, Role::Canonical, &kept, ManifestMarks::Normalized);
+    let stdout = built.stdout(|_| {});
+    let completed = built.finish(stdout).expect("should complete the run");
+
+    let measurement = super::candidate::cargo_measurement(&completed);
+    assert_eq!(
+        measurement["kind"], "ordinary-ci-confined-cargo-build",
+        "should name the candidate kind"
+    );
+    assert_eq!(
+        measurement["release_qualification"], false,
+        "should never claim release qualification"
+    );
+    assert_eq!(measurement["asset"], asset, "should name the asset");
+    assert_eq!(measurement["role"], "canonical", "should name the role");
+    assert_eq!(
+        measurement["source_commit"], COMMIT,
+        "should bind the commit"
+    );
+    assert_eq!(
+        measurement["artifact"]["sha256"],
+        hex::encode(Sha256::digest(&kept)),
+        "should report the copied artifact digest"
+    );
+    assert_eq!(
+        measurement["artifact"]["size"],
+        kept.len(),
+        "should report the copied artifact size"
+    );
+    assert_eq!(
+        measurement["normalized_manifest_count"], 1,
+        "should count the producer-normalized manifests"
+    );
+    assert_eq!(
+        measurement["normalized_manifest_digests"]["example-git"],
+        "e".repeat(64),
+        "should report each producer-normalized manifest digest"
+    );
+    assert_eq!(
+        measurement["derived_manifest_digests"], 0,
+        "should report that no caller-derived manifest was consumed"
+    );
+    for field in ["rust_tools_digest", "materials_digest", "plan_digest"] {
+        assert_eq!(
+            measurement[field].as_str().map(str::len),
+            Some(64),
+            "should report the {field}"
+        );
+    }
+
+    let observed = std::collections::BTreeMap::from([("build-direct".to_owned(), libc::EPERM)]);
+    let denial = super::candidate::denial_measurement(libc::EPERM, &observed, &completed);
+    assert_eq!(
+        denial["attempts"]["build-direct"]["errno"],
+        libc::EPERM,
+        "should report each observed errno"
+    );
+    assert_eq!(
+        denial["release_qualification"], false,
+        "should never claim release qualification"
+    );
+}
+
+/// Maps the bound roots into an innocuous namespace without `/boundary/`.
+fn innocuous_paths(built: &Built) -> super::super::paths::PrefixPaths {
+    let prepared = built.prepared();
+    super::super::paths::PrefixPaths::new()
+        .with(prepared.ambient.checkout_root(), "/work/source", false)
+        .with(&prepared.retained_root, "/work/scripts", false)
+        .with(&prepared.request.materials, "/work/dependencies", false)
+        .with(prepared.tools.root(), "/work/compiler", false)
+        .with(&prepared.request.cargo_state, "/work/state", true)
+        .with(&prepared.request.target_dir, "/work/products", true)
+        .with(&built.fixture.developer_dir(), "/work/developer", false)
+}
+
+#[test]
+fn completion_rejects_every_bound_host_and_execution_root() {
+    for index in 0..15 {
+        let mut build = built(
+            "ts-aarch64-apple-darwin",
+            Role::Canonical,
+            &darwin_executable(),
+        );
+        let paths = innocuous_paths(&build);
+        let prepared = build.prepared();
+        let host = [
+            prepared.ambient.checkout_root().to_owned(),
+            prepared.retained_root.clone(),
+            prepared.request.materials.clone(),
+            prepared.tools.root().to_owned(),
+            prepared.request.cargo_state.clone(),
+            prepared.request.target_dir.clone(),
+            build.fixture.developer_dir(),
+        ];
+        let mut denied = host.to_vec();
+        denied.extend(host.iter().map(|root| {
+            paths
+                .execution_path(root)
+                .expect("should translate a bound root")
+        }));
+        denied.push(prepared.request.output.clone());
+        let leaked = denied[index].join("generated/source.rs");
+        let payload = format!(
+            "/trusted-server/src/main.rs env!(CARGO_MANIFEST_DIR)={}",
+            leaked.display()
+        );
+        let target = prepared
+            .request
+            .target_dir
+            .join("aarch64-apple-darwin/release/ts");
+        fs::write(&target, darwin_executable_with(payload.as_bytes()))
+            .expect("should plant the literal in the executable");
+        let stdout = build.stdout(|message| {
+            message["manifest_path"] = json!("/work/source/crates/trusted-server-cli/Cargo.toml");
+            message["executable"] = json!("/work/products/aarch64-apple-darwin/release/ts");
+        });
+        let run = build.run(stdout);
+        let result = build
+            .prepared
+            .take()
+            .expect("should retain the prepared recipe")
+            .complete(run, FINGERPRINT, &paths);
+        let error = rejection(result);
+        assert!(
+            rejects_embedded_path(&error),
+            "should reject bound root {} by final-path gate: {error}",
+            denied[index].display()
+        );
+    }
+}
+
+#[test]
+fn completion_rejects_cargo_state_home_and_temporary_literals() {
+    for child in ["home", "tmp", "cargo-home"] {
+        let mut build = built(
+            "ts-aarch64-apple-darwin",
+            Role::Canonical,
+            &darwin_executable(),
+        );
+        let paths = innocuous_paths(&build);
+        let payload = format!(" env!(OUT_DIR)=/work/state/{child}/generated.rs");
+        fs::write(
+            build
+                .prepared()
+                .request
+                .target_dir
+                .join("aarch64-apple-darwin/release/ts"),
+            darwin_executable_with(payload.as_bytes()),
+        )
+        .expect("should plant cargo-state descendant");
+        let stdout = build.stdout(|message| {
+            message["manifest_path"] = json!("/work/source/crates/trusted-server-cli/Cargo.toml");
+            message["executable"] = json!("/work/products/aarch64-apple-darwin/release/ts");
+        });
+        let run = build.run(stdout);
+        let result = build
+            .prepared
+            .take()
+            .expect("should retain the prepared recipe")
+            .complete(run, FINGERPRINT, &paths);
+        let error = rejection(result);
+        assert!(
+            rejects_embedded_path(&error),
+            "should reject {child} outside remapped Cargo home too: {error}"
+        );
+    }
+}
+
+#[test]
+fn completion_requires_a_fixed_remapped_prefix() {
+    let mut build = built(
+        "ts-aarch64-apple-darwin",
+        Role::Canonical,
+        &macho(&MachoSpec::conforming()),
+    );
+    let stdout = build.stdout(|_| {});
+    assert!(
+        rejection(build.finish(stdout)).contains("no remapped path prefix"),
+        "should require proof of remapping before recording completion"
+    );
+}
+
+#[test]
+fn completion_accepts_fixed_prefixes_in_an_innocuous_execution_namespace() {
+    let mut build = built(
+        "ts-aarch64-apple-darwin",
+        Role::Canonical,
+        &darwin_executable_with(b" /cargo-target/generated/file.rs"),
+    );
+    let paths = innocuous_paths(&build);
+    let stdout = build.stdout(|message| {
+        message["manifest_path"] = json!("/work/source/crates/trusted-server-cli/Cargo.toml");
+        message["executable"] = json!("/work/products/aarch64-apple-darwin/release/ts");
+    });
+    let run = build.run(stdout);
+    build
+        .prepared
+        .take()
+        .expect("should retain prepared recipe")
+        .complete(run, FINGERPRINT, &paths)
+        .expect("should complete only remapped final bytes without requiring Linux mount names");
+}
diff --git a/crates/trusted-server-release/src/recipe/tests/complete_darwin.rs b/crates/trusted-server-release/src/recipe/tests/complete_darwin.rs
new file mode 100644
index 0000000000..36f97fd1a3
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/tests/complete_darwin.rs
@@ -0,0 +1,173 @@
+//! Completion of synthetic Darwin builds: Mach-O acceptance, the measured
+//! SDK and the recorded descendant cleanup.
+
+use object::macho as macho_format;
+
+use super::complete::built;
+use super::*;
+use crate::boundary::DescendantCleanup;
+use crate::inspect::Violation;
+use crate::inspect::tests::builders::{
+    Command, MachoSpec, Symbol, debug_map_symbols, macho, macos,
+};
+
+/// A conforming linked arm64 `ts` whose payload holds the remapped source
+/// prefix the final-path gate requires.
+pub(super) fn darwin_executable() -> Vec<u8> {
+    darwin_executable_with(b"")
+}
+
+/// The same executable with `extra` bytes appended after its signature.
+pub(super) fn darwin_executable_with(extra: &[u8]) -> Vec<u8> {
+    let mut bytes = macho(&darwin_spec());
+    bytes.extend_from_slice(extra);
+    bytes
+}
+
+/// Reports whether a completion error rejected an embedded path: by the
+/// final-path gate, or first by the Mach-O inspector, whose runner-path rule
+/// also matches temporary host roots and any `/home/` segment.
+pub(super) fn rejects_embedded_path(error: &str) -> bool {
+    error.contains("unremapped path prefix") || error.contains("runner-only path")
+}
+
+fn darwin_spec() -> MachoSpec {
+    MachoSpec {
+        payload: b"/trusted-server/src/main.rs",
+        ..MachoSpec::conforming()
+    }
+}
+
+/// Completes a synthetic build of `asset` holding exactly `bytes`.
+fn finish(asset: &'static str, bytes: &[u8]) -> Result<RecipeCompleted, Report<ReleaseError>> {
+    let mut built = built(asset, Role::Canonical, bytes);
+    let stdout = built.stdout(|_| {});
+    built.finish(stdout)
+}
+
+fn replaced(index: usize, command: Command) -> Vec<u8> {
+    let mut spec = darwin_spec();
+    spec.commands[index] = command;
+    macho(&spec)
+}
+
+fn position(matches: impl Fn(&Command) -> bool) -> usize {
+    darwin_spec().position(matches)
+}
+
+#[test]
+fn conforming_darwin_executables_complete_with_post_run_reaped_cleanup() {
+    let completed = finish("ts-aarch64-apple-darwin", &darwin_executable())
+        .expect("should accept a conforming arm64 executable");
+    assert_eq!(
+        completed.descendant_cleanup(),
+        DescendantCleanup::ReapedAfterRun,
+        "should record that macOS survivors are reaped after the run"
+    );
+    let measurement = super::candidate::cargo_measurement(&completed);
+    assert_eq!(
+        measurement["descendant_cleanup"], "post-run-reaped",
+        "should report the cleanup mode in the candidate measurement"
+    );
+
+    let mut x86_64 = darwin_spec();
+    x86_64.cputype = macho_format::CPU_TYPE_X86_64;
+    x86_64.cpusubtype = macho_format::CPU_SUBTYPE_X86_64_ALL;
+    finish("ts-x86_64-apple-darwin", &macho(&x86_64))
+        .expect("should accept a conforming x86_64 executable");
+}
+
+#[test]
+fn linux_completion_records_container_owned_cleanup() {
+    let wasm = super::complete::wasm_with(&[(".debug_info", b"i"), (".debug_line", b"l")]);
+    let completed =
+        finish("trusted-server-fastly.wasm", &wasm).expect("should accept the Wasm module");
+    assert_eq!(
+        super::candidate::cargo_measurement(&completed)["descendant_cleanup"],
+        "owned-by-container",
+        "should report container-owned cleanup"
+    );
+}
+
+#[test]
+fn darwin_executables_outside_the_policy_are_rejected_by_rule() {
+    let build_version = position(|command| matches!(command, Command::BuildVersion { .. }));
+    let symtab = position(|command| matches!(command, Command::Symtab(_)));
+    let mut absolute = debug_map_symbols();
+    absolute.push(Symbol {
+        n_type: macho_format::N_OSO,
+        name: "/opt/example/cargo-target/release/deps/ts.o",
+        value: 0,
+    });
+    let mut unsigned = darwin_spec();
+    unsigned
+        .commands
+        .retain(|command| !matches!(command, Command::CodeSignature(_)));
+    let cases: [(&str, &'static str, Vec<u8>, Violation); 5] = [
+        (
+            "minimum macOS 11",
+            "ts-aarch64-apple-darwin",
+            replaced(
+                build_version,
+                Command::BuildVersion {
+                    platform: macho_format::PLATFORM_MACOS,
+                    minos: macos(11, 0),
+                },
+            ),
+            Violation::DeploymentTarget,
+        ),
+        (
+            "an absolute debug-map object",
+            "ts-aarch64-apple-darwin",
+            replaced(symtab, Command::Symtab(absolute)),
+            Violation::MachoDebugMap,
+        ),
+        (
+            "a stripped debug map",
+            "ts-aarch64-apple-darwin",
+            replaced(symtab, Command::Symtab(Vec::new())),
+            Violation::MachoDebugMap,
+        ),
+        (
+            "an unsigned arm64 executable",
+            "ts-aarch64-apple-darwin",
+            macho(&unsigned),
+            Violation::CodeSignature,
+        ),
+        (
+            "an arm64 executable for the x86_64 asset",
+            "ts-x86_64-apple-darwin",
+            darwin_executable(),
+            Violation::Architecture,
+        ),
+    ];
+    for (label, asset, bytes, expected) in cases {
+        let error = finish(asset, &bytes).expect_err("should reject the executable");
+        assert_eq!(
+            error.downcast_ref::<Violation>(),
+            Some(&expected),
+            "should reject {label} by its rule: {error:?}"
+        );
+    }
+}
+
+#[test]
+fn darwin_executables_must_record_the_measured_sdk() {
+    let build_version = position(|command| matches!(command, Command::BuildVersion { .. }));
+    let other_sdk = replaced(
+        build_version,
+        Command::BuildVersionSdk {
+            platform: macho_format::PLATFORM_MACOS,
+            minos: macos(13, 0),
+            sdk: macos(26, 1),
+        },
+    );
+
+    let error = finish("ts-aarch64-apple-darwin", &other_sdk)
+        .expect_err("should reject an executable linked against another SDK");
+
+    assert!(
+        format!("{error:?}").contains("but the bound Apple SDK is 15.5.0"),
+        "should name the measured SDK: {error:?}"
+    );
+}
diff --git a/crates/trusted-server-release/src/recipe/tests/darwin.rs b/crates/trusted-server-release/src/recipe/tests/darwin.rs
new file mode 100644
index 0000000000..6a7d24a330
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/tests/darwin.rs
@@ -0,0 +1,679 @@
+//! Apple developer tool records, Darwin binding and the exact Darwin plan.
+
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::time::{Duration, Instant};
+
+use super::super::apple::{plist_string, sdk_settings_version};
+use super::super::paths::PrefixPaths;
+use super::fixture::*;
+use super::*;
+use crate::process::Cancellation;
+
+fn detached_apple(fixture: &Fixture) -> AppleDeveloperTools {
+    AppleDeveloperTools::with_detached_sdk_for_tests(
+        fixture.apple_facts(),
+        Instant::now() + Duration::from_secs(60),
+        &Cancellation::default(),
+    )
+    .expect("should stage selected SDK")
+}
+
+#[test]
+fn owned_sdk_identity_is_path_independent_and_binds_the_selected_tree() {
+    let fixture = Fixture::new(COMMIT);
+    let first = detached_apple(&fixture);
+    let second = detached_apple(&fixture);
+    assert_ne!(
+        first.sdk_root(),
+        second.sdk_root(),
+        "should use independent private roots"
+    );
+    assert_eq!(
+        first.identity_sha256().expect("should identify first SDK"),
+        second
+            .identity_sha256()
+            .expect("should identify second SDK"),
+        "should not bind random snapshot paths"
+    );
+    fs::write(
+        fixture.apple_facts().sdk_root.join("example.h"),
+        b"new selected SDK input",
+    )
+    .expect("should add SDK header");
+    let changed = detached_apple(&fixture);
+    assert_ne!(
+        first.identity_sha256().expect("should identify first SDK"),
+        changed
+            .identity_sha256()
+            .expect("should identify changed SDK"),
+        "should bind complete tree digest into Apple identity"
+    );
+    first
+        .verify()
+        .expect("should independently retain original selected SDK");
+}
+
+#[test]
+fn owned_sdk_closure_rechecks_headers_stubs_and_frameworks_and_retains_clone_lifetime() {
+    for relative in [
+        "usr/include/example.h",
+        "usr/lib/libExample.tbd",
+        "System/Library/Frameworks/Example.framework/Example",
+    ] {
+        let fixture = Fixture::new(COMMIT);
+        let source = fixture.apple_facts().sdk_root.join(relative);
+        fs::create_dir_all(source.parent().expect("should have parent"))
+            .expect("should create SDK directories");
+        fs::write(source, b"selected SDK input").expect("should write SDK input");
+        let apple = detached_apple(&fixture);
+        let clone = apple.clone();
+        let root = apple.sdk_root().to_owned();
+        let identity = apple.identity_sha256().expect("should measure identity");
+        drop(apple);
+        clone
+            .verify()
+            .expect("should retain SDK while clone exists");
+        let value =
+            serde_json::to_value(clone.candidate_measurement().expect("should measure SDK"))
+                .expect("should serialize SDK");
+        assert!(
+            value["sdk_tree"]["tree_sha256"]
+                .as_str()
+                .is_some_and(|digest| digest.len() == 64),
+            "should bind typed SDK receipt"
+        );
+        assert_eq!(
+            value["coverage_exclusions"],
+            serde_json::json!([
+                "tool_helpers",
+                "liblto",
+                "clang_resource_directory",
+                "toolchain_libraries"
+            ]),
+            "should remove only covered SDK exclusions"
+        );
+        fs::write(root.join(relative), b"changed SDK input").expect("should mutate owned input");
+        assert_eq!(
+            clone
+                .identity_sha256()
+                .expect("should retain original identity"),
+            identity,
+            "should retain original digest for comparison"
+        );
+        assert!(
+            clone.verify().is_err(),
+            "should detect changed {relative} while four existing file hashes remain unchanged"
+        );
+        drop(clone);
+        assert!(!root.exists(), "should remove SDK after last clone");
+    }
+}
+
+#[test]
+fn detached_sdk_is_the_actual_readonly_plan_sysroot_and_has_stable_remaps() {
+    let fixture = Fixture::new(COMMIT);
+    let apple = detached_apple(&fixture);
+    let root = apple.sdk_root().to_owned();
+    let tools = fixture
+        .rust_tools_for(ReleaseTarget::Aarch64AppleDarwin)
+        .with_apple_developer_tools(apple);
+    let prepared = fixture
+        .bind_parts(
+            fixture.request("ts-aarch64-apple-darwin", "A", COMMIT),
+            Role::Canonical,
+            COMMIT,
+            tools,
+            fixture.materials(COMMIT),
+        )
+        .expect("should bind detached SDK");
+    assert!(
+        prepared
+            .boundary_roots()
+            .expect("should bind roots")
+            .immutable()
+            .contains(&root),
+        "should scan SDK as readonly owned root"
+    );
+    let plan = prepared
+        .plan(&mac_paths(&fixture).with(&root, root.to_str().expect("should be UTF-8"), false))
+        .expect("should plan selected SDK");
+    assert_eq!(
+        plan.environment["SDKROOT"],
+        text(&root),
+        "should select copy as SDKROOT"
+    );
+    let cflags = &plan.environment["CFLAGS_aarch64_apple_darwin"];
+    for flag in [
+        format!("-isysroot {}", text(&root)),
+        format!("-ffile-prefix-map={}=/apple-sdk", text(&root)),
+        format!("-fdebug-prefix-map={}=/apple-sdk", text(&root)),
+    ] {
+        assert!(
+            cflags.contains(&flag),
+            "should use selected SDK C flag {flag}"
+        );
+    }
+    let flags = plan.arguments.join(" ");
+    assert!(
+        flags.contains(&format!("--remap-path-prefix={}=/apple-sdk", text(&root))),
+        "should remap selected SDK in Rust"
+    );
+    assert!(
+        flags.contains("-Clink-arg=-isysroot")
+            && flags.contains(&format!("-Clink-arg={}", text(&root))),
+        "should explicitly select linker SDK"
+    );
+    let paths = mac_paths(&fixture).with(&root, "/selected-sdk", false);
+    for prefix in [text(&root), "/selected-sdk".to_owned()] {
+        let bytes = format!("/trusted-server/src/main.rs {prefix}/usr/include/example.h");
+        assert!(
+            prepared
+                .check_final_paths(bytes.as_bytes(), &paths)
+                .is_err(),
+            "should reject literal SDK path {prefix} in final bytes"
+        );
+    }
+}
+
+#[test]
+fn candidate_apple_evidence_records_only_measured_files_and_explicit_exclusions() {
+    let fixture = Fixture::new(COMMIT);
+    let apple = fixture.apple_tools();
+    let evidence = apple
+        .candidate_measurement()
+        .expect("should export checked Apple candidate evidence");
+    let value = serde_json::to_value(evidence).expect("should serialize Apple candidate evidence");
+    assert_eq!(
+        value["identity_sha256"],
+        apple.identity_sha256().expect("should bind Apple identity"),
+        "should preserve the bound identity record"
+    );
+    assert_eq!(
+        value["tools"][0]["sha256"],
+        fixture.apple_facts().clang_sha256,
+        "should retain actual clang bytes identity"
+    );
+    assert_eq!(
+        value["sdk_settings"]["sha256"],
+        fixture.apple_facts().sdk_settings_sha256,
+        "should retain SDK settings bytes identity"
+    );
+    assert_eq!(
+        value["xcode_version"], "16.4",
+        "should retain measured Xcode version"
+    );
+    assert_eq!(
+        value["sdk_version"], "15.5.0",
+        "should retain measured SDK version"
+    );
+    assert_eq!(
+        value["origin"], "candidate_measurement",
+        "should not authenticate original acquisitions"
+    );
+    assert_eq!(
+        value["qualification"], "unqualified",
+        "should not grant release authority"
+    );
+    assert_eq!(
+        value["coverage_exclusions"],
+        serde_json::json!([
+            "sdk_headers",
+            "sdk_stubs",
+            "sdk_frameworks",
+            "tool_helpers",
+            "liblto",
+            "clang_resource_directory",
+            "toolchain_libraries"
+        ]),
+        "should explicitly retain every unmeasured SDK/tool closure class"
+    );
+    let serialized = serde_json::to_string(&value).expect("should serialize measurement");
+    assert!(
+        !serialized.contains(fixture.base.to_str().expect("should have UTF-8 root")),
+        "should serialize relative component roles without host roots"
+    );
+}
+
+#[test]
+fn candidate_apple_evidence_rechecks_every_owned_measured_file() {
+    for relative in [
+        "Toolchains/XcodeDefault.xctoolchain/usr/bin/clang",
+        "Toolchains/XcodeDefault.xctoolchain/usr/bin/ar",
+        "Toolchains/XcodeDefault.xctoolchain/usr/bin/ld",
+        "Platforms/MacOSX.platform/Developer/SDKs/MacOSX15.5.sdk/SDKSettings.json",
+    ] {
+        let fixture = Fixture::new(COMMIT);
+        let apple = fixture.apple_tools();
+        fs::write(
+            fixture.developer_dir().join(relative),
+            b"changed measured input",
+        )
+        .expect("should alter selected Apple input");
+        assert!(
+            apple.candidate_measurement().is_err(),
+            "should reject changed {relative}"
+        );
+    }
+}
+
+/// The macOS boundary namespace: every root keeps its host path.
+fn mac_paths(fixture: &Fixture) -> PrefixPaths {
+    let identity = |paths: PrefixPaths, root: &Path, writable: bool| {
+        paths.with(root, root.to_str().expect("should be UTF-8"), writable)
+    };
+    let mut paths = PrefixPaths::new();
+    for root in [
+        fixture.base.join("checkout-canonical"),
+        fixture.retained(),
+        fixture.base.join("materials"),
+        fixture.base.join("tools"),
+        fixture.developer_dir(),
+    ] {
+        paths = identity(paths, &root, false);
+    }
+    for root in [
+        fixture.base.join("cargo-state"),
+        fixture.base.join("target"),
+    ] {
+        paths = identity(paths, &root, true);
+    }
+    paths
+}
+
+fn text(path: &Path) -> String {
+    path.to_str().expect("should be UTF-8").to_owned()
+}
+
+#[test]
+fn apple_tool_facts_are_checked_before_any_use() {
+    let fixture = Fixture::new(COMMIT);
+    AppleDeveloperTools::from_facts_for_tests(fixture.apple_facts())
+        .expect("should accept the fictional developer directory");
+    type Edit = fn(&mut AppleToolFacts, &Path);
+    let edits: [(&str, Edit); 10] = [
+        ("a relative developer directory", |facts, _| {
+            facts.developer_dir = PathBuf::from("apple-developer");
+        }),
+        ("clang outside the developer directory", |facts, base| {
+            facts.clang = base.join("tools/bin/clang");
+        }),
+        ("an SDK outside the developer directory", |facts, base| {
+            facts.sdk_root = base.join("other-source");
+        }),
+        ("the developer directory as its own SDK", |facts, _| {
+            facts.sdk_root = facts.developer_dir.clone();
+        }),
+        ("a misnamed archiver", |facts, _| {
+            facts.ar = facts.clang.with_file_name("llvm-ar");
+        }),
+        ("a linker beside another directory", |facts, _| {
+            facts.ld = facts.developer_dir.join("usr/bin/ld");
+        }),
+        ("whitespace in a path", |facts, _| {
+            facts.developer_dir = facts.developer_dir.join("Xcode 16.app");
+        }),
+        ("a non-decimal Xcode version", |facts, _| {
+            facts.xcode_version = "16.4 beta".to_owned();
+        }),
+        ("an uppercase digest", |facts, _| {
+            facts.clang_sha256 = facts.clang_sha256.to_ascii_uppercase();
+        }),
+        ("a short digest", |facts, _| {
+            facts.sdk_settings_sha256.truncate(63);
+        }),
+    ];
+    for (label, edit) in edits {
+        let mut facts = fixture.apple_facts();
+        edit(&mut facts, &fixture.base);
+        assert!(
+            AppleDeveloperTools::from_facts_for_tests(facts).is_err(),
+            "should reject {label}"
+        );
+    }
+}
+
+#[test]
+fn qualified_apple_tools_stay_closed_and_ordinary_ci_is_unqualified() {
+    let never: fn(QualifiedAppleTools) -> ! = |qualification| match qualification {};
+    let _constructor: fn(AppleToolFacts, QualifiedAppleTools) -> AppleDeveloperTools =
+        AppleDeveloperTools::qualified;
+    let _ = never;
+    let fixture = Fixture::new(COMMIT);
+    assert_eq!(
+        fixture.apple_tools().authority(),
+        Authority::Unqualified,
+        "should carry no release authority"
+    );
+}
+
+#[test]
+fn sdk_settings_and_bundle_versions_are_read_strictly() {
+    assert_eq!(
+        sdk_settings_version(br#"{"Version":"15.5","DisplayName":"macOS 15.5"}"#)
+            .expect("should read the SDK version"),
+        crate::inspect::MacosVersion::new(15, 5)
+    );
+    for settings in [
+        &br#"{"Version":"15"}"#[..],
+        br#"{"Version":15.5}"#,
+        b"not json",
+    ] {
+        assert!(
+            sdk_settings_version(settings).is_err(),
+            "should reject {}",
+            String::from_utf8_lossy(settings)
+        );
+    }
+    let plist =
+        b"<dict>\n\t<key>CFBundleShortVersionString</key>\n\t<string>16.4</string>\n</dict>";
+    assert_eq!(
+        plist_string(plist, "CFBundleShortVersionString").expect("should read the version"),
+        "16.4"
+    );
+    assert!(
+        plist_string(plist, "CFBundleVersion").is_err(),
+        "should reject an absent key"
+    );
+}
+
+#[test]
+fn apple_tools_rehash_against_their_record() {
+    let fixture = Fixture::new(COMMIT);
+    let tools = fixture.apple_tools();
+    tools.verify().expect("should accept the untouched record");
+    let clang = fixture.developer_dir().join(TOOLCHAIN_BIN).join("clang");
+    fs::write(&clang, b"swapped compiler").expect("should swap clang");
+    assert!(
+        format!(
+            "{:?}",
+            tools.verify().expect_err("should reject a swapped clang")
+        )
+        .contains("Apple clang changed"),
+        "should name the swapped tool"
+    );
+    fs::write(&clang, b"fictional Apple clang").expect("should restore clang");
+    tools.verify().expect("should accept the restored clang");
+    let settings = fixture
+        .developer_dir()
+        .join(SDK_ROOT)
+        .join("SDKSettings.json");
+    fs::write(&settings, br#"{"Version":"26.1"}"#).expect("should swap the SDK settings");
+    assert!(
+        tools.verify().is_err(),
+        "should reject changed SDK settings"
+    );
+}
+
+#[test]
+fn darwin_binding_requires_apple_tools_and_others_refuse_them() {
+    let fixture = Fixture::new(COMMIT);
+    let darwin = fixture.request("ts-aarch64-apple-darwin", "A", COMMIT);
+    let bare = fixture.rust_tools_for(ReleaseTarget::Aarch64AppleDarwin);
+    let message = bind_error(fixture.bind_parts(
+        darwin,
+        Role::Canonical,
+        COMMIT,
+        bare,
+        fixture.materials(COMMIT),
+    ));
+    assert!(
+        message.contains("Darwin assets require Apple developer tools"),
+        "should require Apple tools for Darwin: {message}"
+    );
+
+    let fixture = Fixture::new(COMMIT);
+    let linux = fixture.request("ts-x86_64-unknown-linux-gnu", "A", COMMIT);
+    let with_apple = fixture
+        .rust_tools_for(ReleaseTarget::X86_64UnknownLinuxGnu)
+        .with_apple_developer_tools(fixture.apple_tools());
+    let message = bind_error(fixture.bind_parts(
+        linux,
+        Role::Canonical,
+        COMMIT,
+        with_apple,
+        fixture.materials(COMMIT),
+    ));
+    assert!(
+        message.contains("only Darwin assets take Apple developer tools"),
+        "should refuse Apple tools for Linux: {message}"
+    );
+}
+
+#[test]
+fn apple_tools_changed_before_binding_are_rejected() {
+    let fixture = Fixture::new(COMMIT);
+    let tools = fixture.tools_for(ReleaseTarget::Aarch64AppleDarwin);
+    fs::write(
+        fixture.developer_dir().join(TOOLCHAIN_BIN).join("ld"),
+        b"swapped linker",
+    )
+    .expect("should swap ld");
+    let request = fixture.request("ts-aarch64-apple-darwin", "A", COMMIT);
+    let message = bind_error(fixture.bind_parts(
+        request,
+        Role::Canonical,
+        COMMIT,
+        tools,
+        fixture.materials(COMMIT),
+    ));
+    assert!(
+        message.contains("Apple ld changed"),
+        "should reject a linker changed after measurement: {message}"
+    );
+}
+
+#[test]
+fn darwin_tool_root_and_target_must_share_one_parent() {
+    let fixture = Fixture::new(COMMIT);
+    let nested = fixture.base.join("other-work/target");
+    let request = fixture.request_at("ts-aarch64-apple-darwin", "A", COMMIT, &nested);
+    let message = bind_error(fixture.bind_with(request, Role::Canonical, COMMIT));
+    assert!(
+        message.contains("direct children of one recipe-owned parent"),
+        "should require one recipe-owned parent: {message}"
+    );
+    assert!(
+        !nested.exists(),
+        "should create nothing after the rejection"
+    );
+
+    let fixture = Fixture::new(COMMIT);
+    let request = fixture.request_at(
+        "ts-x86_64-unknown-linux-gnu",
+        "A",
+        COMMIT,
+        &fixture.base.join("other-work/target"),
+    );
+    fixture
+        .bind_with(request, Role::Canonical, COMMIT)
+        .expect("should not constrain a Linux target directory");
+}
+
+#[test]
+fn exact_darwin_plan_binds_the_linker_debug_map_and_apple_tools() {
+    let fixture = Fixture::new(COMMIT);
+    let prepared = fixture
+        .bind("ts-aarch64-apple-darwin", Role::Canonical)
+        .expect("should bind the Darwin recipe");
+    let plan = prepared
+        .plan(&mac_paths(&fixture))
+        .expect("should derive the plan in the macOS namespace");
+    let base = text(&fixture.base);
+    let developer = text(&fixture.developer_dir());
+    let clang = format!("{developer}/{TOOLCHAIN_BIN}/clang");
+    let flags = [
+        format!("\"--remap-path-prefix={base}/checkout-canonical=/trusted-server\""),
+        format!("\"--remap-path-prefix={base}/materials/vendor=/cargo-vendor\""),
+        format!("\"--remap-path-prefix={base}/cargo-state/cargo-home=/cargo-home\""),
+        format!("\"--remap-path-prefix={base}/tools=/rust-tools\""),
+        format!("\"--remap-path-prefix={base}/target=/cargo-target\""),
+        format!("\"-Clink-arg=-Wl,-oso_prefix,{base}/\""),
+    ];
+    let remap = format!(
+        "target.\"aarch64-apple-darwin\".rustflags=[{}]",
+        flags.join(",")
+    );
+    let linker = format!("target.\"aarch64-apple-darwin\".linker=\"{clang}\"");
+    let remap_at = plan
+        .arguments
+        .iter()
+        .position(|argument| *argument == remap)
+        .expect("should carry the debug-map prefix inside the one target rustflags entry");
+    assert_eq!(
+        plan.arguments.get(remap_at + 1..remap_at + 3),
+        Some(["--config".to_owned(), linker].as_slice()),
+        "should select clang as the target linker right after the remap"
+    );
+    let expected = [
+        ("DEVELOPER_DIR", developer.clone()),
+        ("SDKROOT", format!("{developer}/{SDK_ROOT}")),
+        ("CC_aarch64_apple_darwin", clang),
+        (
+            "AR_aarch64_apple_darwin",
+            format!("{developer}/{TOOLCHAIN_BIN}/ar"),
+        ),
+        ("ZERO_AR_DATE", "1".to_owned()),
+        ("OPENSSL_CONF", "/dev/null".to_owned()),
+    ];
+    for (name, value) in expected {
+        assert_eq!(
+            plan.environment.get(name),
+            Some(&value),
+            "should set {name} exactly"
+        );
+    }
+    let cflags = &plan.environment["CFLAGS_aarch64_apple_darwin"];
+    assert!(
+        cflags.contains(&format!("-ffile-prefix-map={developer}=/apple-developer"))
+            && cflags.contains(&format!("-fdebug-prefix-map={developer}=/apple-developer")),
+        "should remap the developer directory for C code: {cflags}"
+    );
+    for denied in ["CARGO_TARGET_AARCH64_APPLE_DARWIN_LINKER", "LD", "CC", "AR"] {
+        assert!(
+            !plan.environment.contains_key(denied),
+            "should never select a tool through {denied}"
+        );
+    }
+    assert!(
+        !plan
+            .arguments
+            .iter()
+            .any(|argument| argument.contains("xcrun")),
+        "should never route through xcrun"
+    );
+}
+
+#[test]
+fn darwin_plan_digest_binds_the_apple_tool_record() {
+    let fixture = Fixture::new(COMMIT);
+    let digest = |tools: SelectedRustTools| {
+        let request = fixture.request("ts-aarch64-apple-darwin", "A", COMMIT);
+        let prepared = fixture
+            .bind_parts(
+                request,
+                Role::Canonical,
+                COMMIT,
+                tools,
+                fixture.materials(COMMIT),
+            )
+            .expect("should bind the Darwin recipe");
+        let digest = prepared
+            .plan(&mac_paths(&fixture))
+            .expect("should derive the plan")
+            .digest()
+            .expect("should digest the plan");
+        fs::remove_dir(fixture.base.join("target")).expect("should free the target");
+        for state in ["home", "cargo-home", "tmp"] {
+            fs::remove_dir(fixture.base.join("cargo-state").join(state))
+                .expect("should free the cargo state");
+        }
+        digest
+    };
+    let measured = digest(fixture.tools_for(ReleaseTarget::Aarch64AppleDarwin));
+    assert_eq!(
+        measured,
+        digest(fixture.tools_for(ReleaseTarget::Aarch64AppleDarwin)),
+        "should derive the same digest from the same record"
+    );
+    let mut facts = fixture.apple_facts();
+    facts.xcode_version = "16.3".to_owned();
+    let relabelled = fixture
+        .rust_tools_for(ReleaseTarget::Aarch64AppleDarwin)
+        .with_apple_developer_tools(
+            AppleDeveloperTools::from_facts_for_tests(facts).expect("should record the facts"),
+        );
+    assert_ne!(
+        measured,
+        digest(relabelled),
+        "should bind the Apple tool record into the plan digest"
+    );
+}
+
+#[test]
+fn darwin_final_paths_forbid_every_root_and_the_developer_directory() {
+    let fixture = Fixture::new(COMMIT);
+    let prepared = fixture
+        .bind("ts-aarch64-apple-darwin", Role::Canonical)
+        .expect("should bind the Darwin recipe");
+    let roots = [
+        (
+            fixture.base.join("checkout-canonical"),
+            "/work/source",
+            false,
+        ),
+        (fixture.retained(), "/work/scripts", false),
+        (fixture.base.join("materials"), "/work/dependencies", false),
+        (fixture.base.join("tools"), "/work/compiler", false),
+        (fixture.base.join("cargo-state"), "/work/state", true),
+        (fixture.base.join("target"), "/work/products", true),
+        (fixture.developer_dir(), "/work/developer", false),
+    ];
+    let paths = roots
+        .iter()
+        .fold(PrefixPaths::new(), |paths, (host, execution, writable)| {
+            paths.with(host, execution, *writable)
+        });
+    prepared
+        .check_final_paths(b"/trusted-server/src/main.rs", &paths)
+        .expect("should accept remapped bytes");
+    let mut denied: Vec<String> = roots
+        .iter()
+        .flat_map(|(host, execution, _)| [text(host), (*execution).to_owned()])
+        .collect();
+    denied.push(text(&fixture.base.join("output")));
+    for prefix in denied {
+        let bytes = format!("/trusted-server/src/main.rs {prefix}/leaked.h");
+        let error = prepared
+            .check_final_paths(bytes.as_bytes(), &paths)
+            .expect_err("should reject a bound root in final bytes");
+        assert!(
+            format!("{error:?}").contains("unremapped path prefix"),
+            "should reject {prefix} by the final-path gate: {error:?}"
+        );
+    }
+}
+
+#[test]
+fn darwin_plan_requires_the_developer_directory_in_the_namespace() {
+    let fixture = Fixture::new(COMMIT);
+    let prepared = fixture
+        .bind("ts-aarch64-apple-darwin", Role::Canonical)
+        .expect("should bind the Darwin recipe");
+    let without_developer = PrefixPaths::new()
+        .with(
+            &fixture.base.join("checkout-canonical"),
+            "/m/checkout",
+            false,
+        )
+        .with(&fixture.retained(), "/m/retained", false)
+        .with(&fixture.base.join("materials"), "/m/materials", false)
+        .with(&fixture.base.join("tools"), "/m/tools", false)
+        .with(&fixture.base.join("cargo-state"), "/m/state", true)
+        .with(&fixture.base.join("target"), "/m/target", true);
+    let message = plan_error(&prepared, &without_developer);
+    assert!(
+        message.contains("Apple developer directory is outside the boundary roots"),
+        "should name the unmapped developer directory: {message}"
+    );
+}
diff --git a/crates/trusted-server-release/src/recipe/tests/darwin_toolchain.rs b/crates/trusted-server-release/src/recipe/tests/darwin_toolchain.rs
new file mode 100644
index 0000000000..9823e3bfbe
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/tests/darwin_toolchain.rs
@@ -0,0 +1,181 @@
+//! In-place Apple toolchain identity: helpers, `libLTO` and the clang
+//! resource directory bound into the Apple record and its exclusions.
+
+use std::fs;
+use std::os::unix::fs::symlink;
+use std::path::PathBuf;
+use std::time::{Duration, Instant};
+
+use super::fixture::*;
+use super::*;
+use crate::process::Cancellation;
+
+/// The fictional toolchain `usr` directory, with its resources and `libLTO`.
+fn write_fictional_toolchain(fixture: &Fixture) -> PathBuf {
+    let usr = fixture
+        .developer_dir()
+        .join(TOOLCHAIN_BIN)
+        .parent()
+        .expect("should have a toolchain usr directory")
+        .to_owned();
+    fs::create_dir_all(usr.join("lib/clang/17/include"))
+        .expect("should create fictional resource directory");
+    fs::write(
+        usr.join("lib/clang/17/include/stddef.h"),
+        b"fictional header",
+    )
+    .expect("should write fictional resource header");
+    symlink("17", usr.join("lib/clang/17.0.0")).expect("should alias resource version");
+    fs::write(usr.join("lib/libLTO.dylib"), b"fictional libLTO")
+        .expect("should write fictional libLTO");
+    symlink("clang", usr.join("bin/clang++")).expect("should alias clang++");
+    usr
+}
+
+fn with_toolchain(apple: AppleDeveloperTools) -> Result<AppleDeveloperTools, Report<ReleaseError>> {
+    apple.with_measured_toolchain_for_tests(
+        Instant::now() + Duration::from_secs(60),
+        &Cancellation::default(),
+    )
+}
+
+fn exclusions(apple: &AppleDeveloperTools) -> Vec<&'static str> {
+    apple
+        .candidate_measurement()
+        .expect("should export Apple evidence")
+        .coverage_exclusions()
+        .to_vec()
+}
+
+#[test]
+fn measured_toolchain_removes_exactly_its_exclusions_and_keeps_honest_gaps() {
+    let fixture = Fixture::new(COMMIT);
+    write_fictional_toolchain(&fixture);
+    let lexical = fixture.apple_tools();
+    let measured = with_toolchain(fixture.apple_tools()).expect("should measure toolchain");
+    assert_eq!(
+        exclusions(&measured),
+        [
+            "sdk_headers",
+            "sdk_stubs",
+            "sdk_frameworks",
+            "toolchain_libraries"
+        ],
+        "should drop only helper, libLTO and resource exclusions"
+    );
+    let detached = AppleDeveloperTools::with_detached_sdk_for_tests(
+        fixture.apple_facts(),
+        Instant::now() + Duration::from_secs(60),
+        &Cancellation::default(),
+    )
+    .expect("should stage selected SDK");
+    let complete = with_toolchain(detached).expect("should measure toolchain with SDK");
+    assert_eq!(
+        exclusions(&complete),
+        ["toolchain_libraries"],
+        "should keep unmeasured toolchain libraries excluded"
+    );
+    let evidence = measured
+        .candidate_measurement()
+        .expect("should export measured toolchain evidence");
+    assert_eq!(
+        evidence.liblto_sha256(),
+        Some(hex::encode(Sha256::digest(b"fictional libLTO")).as_str()),
+        "should export the libLTO digest"
+    );
+    assert!(
+        evidence.clang_resource_tree_sha256().is_some() && evidence.helper_tree_sha256().is_some(),
+        "should export both tree digests"
+    );
+    let lexical_evidence = lexical
+        .candidate_measurement()
+        .expect("should export lexical evidence");
+    assert!(
+        lexical_evidence.liblto_sha256().is_none()
+            && lexical_evidence.clang_resource_tree_sha256().is_none()
+            && lexical_evidence.helper_tree_sha256().is_none(),
+        "should never claim toolchain coverage for lexical facts"
+    );
+    assert_ne!(
+        lexical.identity_sha256().expect("should identify lexical"),
+        measured
+            .identity_sha256()
+            .expect("should identify measured"),
+        "should bind the toolchain receipt into the identity record"
+    );
+    assert_eq!(
+        measured.measurement()["toolchain"]["clang_resource_version"],
+        "17",
+        "should record the selected resource version"
+    );
+}
+
+#[test]
+fn identity_changes_and_verify_fails_when_any_toolchain_input_changes() {
+    type Mutation = fn(&std::path::Path);
+    let mutations: [(&str, Mutation); 4] = [
+        ("resource header", |usr| {
+            fs::write(usr.join("lib/clang/17/include/stddef.h"), b"edited")
+                .expect("should edit resource header");
+        }),
+        ("libLTO", |usr| {
+            fs::write(usr.join("lib/libLTO.dylib"), b"edited").expect("should edit libLTO");
+        }),
+        ("added helper", |usr| {
+            fs::write(usr.join("bin/dsymutil"), b"fictional helper").expect("should add helper");
+        }),
+        ("retargeted helper alias", |usr| {
+            fs::remove_file(usr.join("bin/clang++")).expect("should remove alias");
+            symlink("ld", usr.join("bin/clang++")).expect("should retarget alias");
+        }),
+    ];
+    for (label, mutate) in mutations {
+        let fixture = Fixture::new(COMMIT);
+        let usr = write_fictional_toolchain(&fixture);
+        let original = with_toolchain(fixture.apple_tools()).expect("should measure toolchain");
+        let identity = original
+            .identity_sha256()
+            .expect("should identify original");
+        mutate(&usr);
+        assert!(
+            original.verify().is_err(),
+            "should reject changed {label} at verification"
+        );
+        assert!(
+            original.candidate_measurement().is_err(),
+            "should reject changed {label} at evidence sealing"
+        );
+        let remeasured =
+            with_toolchain(fixture.apple_tools()).expect("should remeasure changed toolchain");
+        assert_ne!(
+            remeasured
+                .identity_sha256()
+                .expect("should identify changed"),
+            identity,
+            "should change Apple identity when {label} changes"
+        );
+    }
+}
+
+#[test]
+fn toolchain_selection_fails_closed_without_liblto_or_with_ambiguous_resources() {
+    let fixture = Fixture::new(COMMIT);
+    let usr = write_fictional_toolchain(&fixture);
+    fs::remove_file(usr.join("lib/libLTO.dylib")).expect("should remove libLTO");
+    assert!(
+        with_toolchain(fixture.apple_tools()).is_err(),
+        "should reject a toolchain without libLTO"
+    );
+    let fixture = Fixture::new(COMMIT);
+    let usr = write_fictional_toolchain(&fixture);
+    fs::create_dir(usr.join("lib/clang/18")).expect("should add second resource version");
+    assert!(
+        with_toolchain(fixture.apple_tools()).is_err(),
+        "should reject two clang resource versions"
+    );
+    let fixture = Fixture::new(COMMIT);
+    assert!(
+        with_toolchain(fixture.apple_tools()).is_err(),
+        "should reject a toolchain without measured resources"
+    );
+}
diff --git a/crates/trusted-server-release/src/recipe/tests/fixture.rs b/crates/trusted-server-release/src/recipe/tests/fixture.rs
new file mode 100644
index 0000000000..a95096d69a
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/tests/fixture.rs
@@ -0,0 +1,309 @@
+//! A fictional layout with a completed JS handoff and every recipe root.
+
+use std::ffi::OsString;
+use std::fs;
+use std::path::{Path, PathBuf};
+
+use super::super::ambient::ObservedAmbient;
+use super::super::paths::PrefixPaths;
+use super::*;
+use crate::boundary::Umask;
+use crate::materials::PreparedCargoMaterials;
+use crate::policy::{FIXED_ARTIFACTS, ReleaseTarget};
+use crate::preflight::audit_environment;
+use crate::preflight::child::build_child_for_tests;
+use crate::process::ProcessLimits;
+
+pub(super) const OTHER_COMMIT: &str = "fedcba9876543210fedcba9876543210fedcba98";
+pub(super) const GIT_SELECTOR: &str = "git+https://example.com/org/workspace?tag=v1";
+
+pub(super) fn audited() -> AuditedEnvironment {
+    let snapshot: Vec<(OsString, OsString)> = [
+        ("PATH", "/usr/bin"),
+        ("TRUSTED_SERVER__PROXY__SECRET", "fictional"),
+        ("LANG", "en_US.UTF-8"),
+    ]
+    .into_iter()
+    .map(|(name, value)| (OsString::from(name), OsString::from(value)))
+    .collect();
+    audit_environment(&snapshot).expect("should audit benign environment")
+}
+
+pub(super) struct Fixture {
+    pub(super) _directory: tempfile::TempDir,
+    pub(super) base: PathBuf,
+    pub(super) completed: JsBuildCompleted,
+}
+
+impl Fixture {
+    pub(super) fn new(js_commit: &str) -> Self {
+        let directory = tempfile::tempdir().expect("should create fixture directory");
+        let base = fs::canonicalize(directory.path()).expect("should canonicalize fixture");
+        for relative in [
+            "materials/vendor/example-1.0.0",
+            "cargo-state",
+            "output",
+            "checkout-canonical",
+            "checkout-reproduction",
+            "tools/bin",
+            "other-source",
+            "other-work",
+        ] {
+            fs::create_dir_all(base.join(relative)).expect("should create fixture directory");
+        }
+        fs::write(
+            base.join("materials/vendor/example-1.0.0/Cargo.toml"),
+            b"fictional package",
+        )
+        .expect("should write fictional vendored package");
+        for tool in ["tools/bin/cargo", "tools/bin/rustc"] {
+            fs::write(base.join(tool), b"fictional tool").expect("should write fictional tool");
+        }
+        for artifact in &FIXED_ARTIFACTS {
+            let standard = base
+                .join("tools/lib/rustlib")
+                .join(artifact.target.triple())
+                .join("lib");
+            fs::create_dir_all(&standard).expect("should create target standard library");
+            fs::write(
+                standard.join("libstd-0123456789abcdef.rlib"),
+                b"fictional std",
+            )
+            .expect("should write fictional libstd");
+        }
+        write_fictional_developer_dir(&base.join(APPLE_DEVELOPER));
+        Self {
+            _directory: directory,
+            base,
+            completed: JsBuildCompleted::fixture_for_tests(js_commit),
+        }
+    }
+
+    /// The fictional Apple developer directory.
+    pub(super) fn developer_dir(&self) -> PathBuf {
+        self.base.join(APPLE_DEVELOPER)
+    }
+
+    /// Facts measured from the fictional developer directory.
+    pub(super) fn apple_facts(&self) -> AppleToolFacts {
+        let developer_dir = self.developer_dir();
+        let bin = developer_dir.join(TOOLCHAIN_BIN);
+        let sdk_root = developer_dir.join(SDK_ROOT);
+        let digest = |path: &Path| {
+            hex::encode(Sha256::digest(
+                fs::read(path).expect("should read a fictional Apple file"),
+            ))
+        };
+        AppleToolFacts {
+            clang_sha256: digest(&bin.join("clang")),
+            ar_sha256: digest(&bin.join("ar")),
+            ld_sha256: digest(&bin.join("ld")),
+            sdk_settings_sha256: digest(&sdk_root.join("SDKSettings.json")),
+            clang: bin.join("clang"),
+            ar: bin.join("ar"),
+            ld: bin.join("ld"),
+            developer_dir,
+            sdk_root,
+            xcode_version: "16.4".to_owned(),
+            sdk_version: crate::inspect::MacosVersion::new(15, 5),
+        }
+    }
+
+    /// The fictional Apple developer tools as an ordinary CI selection.
+    pub(super) fn apple_tools(&self) -> AppleDeveloperTools {
+        AppleDeveloperTools::from_facts_for_tests(self.apple_facts())
+            .expect("should record the fictional Apple tools")
+    }
+
+    pub(super) fn retained(&self) -> PathBuf {
+        fs::canonicalize(
+            self.completed
+                .rehash_for_handoff()
+                .expect("should rehash the fixture handoff"),
+        )
+        .expect("should canonicalize the retained root")
+    }
+
+    pub(super) fn request(&self, asset: &str, role: &str, commit: &str) -> RecipeRequest {
+        self.request_at(asset, role, commit, &self.base.join("target"))
+    }
+
+    pub(super) fn request_at(
+        &self,
+        asset: &str,
+        role: &str,
+        commit: &str,
+        target_dir: &Path,
+    ) -> RecipeRequest {
+        let retained = self.retained();
+        let js_dir = retained.join("bundles");
+        let js_inventory = retained.join("tsjs-inventory.json");
+        RecipeRequest::parse(&RecipeInput {
+            asset,
+            variant: "default",
+            role,
+            commit,
+            js_dir: &js_dir,
+            js_inventory: &js_inventory,
+            materials: &self.base.join("materials"),
+            cargo_state: &self.base.join("cargo-state"),
+            output: &self.base.join("output"),
+            target_dir,
+        })
+        .expect("should parse the fixture request")
+    }
+
+    pub(super) fn ambient(&self, role: Role) -> CheckedAmbient {
+        match role {
+            Role::Canonical => CheckedAmbient::check(
+                Role::Canonical,
+                &AmbientProfile::CANONICAL,
+                ObservedAmbient {
+                    checkout_root: self.base.join("checkout-canonical"),
+                    ..observed_canonical()
+                },
+            ),
+            Role::Reproduction => CheckedAmbient::check(
+                Role::Reproduction,
+                &AmbientProfile::alternate_for_tests(),
+                ObservedAmbient {
+                    checkout_root: self.base.join("checkout-reproduction"),
+                    ..observed_reproduction()
+                },
+            ),
+        }
+        .expect("should check the fixture ambient")
+    }
+
+    /// Ordinary CI tools for `target`, with the fictional Apple developer
+    /// tools for a Darwin target.
+    pub(super) fn tools_for(&self, target: ReleaseTarget) -> SelectedRustTools {
+        let tools = self.rust_tools_for(target);
+        if target.is_darwin() {
+            tools.with_apple_developer_tools(self.apple_tools())
+        } else {
+            tools
+        }
+    }
+
+    /// Ordinary CI Rust tools for `target` without Apple developer tools.
+    pub(super) fn rust_tools_for(&self, target: ReleaseTarget) -> SelectedRustTools {
+        SelectedRustTools::for_tests(&self.base.join("tools"), target)
+            .expect("should select fixture tools")
+    }
+
+    pub(super) fn materials(&self, commit: &str) -> PreparedCargoMaterials {
+        PreparedCargoMaterials::for_tests(&self.base.join("materials"), commit, &[GIT_SELECTOR])
+            .expect("should describe fixture materials")
+    }
+
+    /// Binds with explicit tools and materials.
+    pub(super) fn bind_parts(
+        &self,
+        request: RecipeRequest,
+        role: Role,
+        commit: &str,
+        tools: SelectedRustTools,
+        materials: PreparedCargoMaterials,
+    ) -> Result<PreparedRecipe, Report<ReleaseError>> {
+        let commit = CommitId::parse(commit).expect("should parse fixture commit");
+        let child =
+            build_child_for_tests(&audited(), &commit, 1_700_000_000, &child_request(&request))
+                .expect("should build the fixture child environment");
+        PreparedRecipe::bind(BindInputs {
+            workspace: WorkspaceSelection::Fixture,
+            commit: &commit,
+            child,
+            completed: &self.completed,
+            tools,
+            materials,
+            ambient: self.ambient(role),
+            request,
+        })
+    }
+
+    pub(super) fn bind_with(
+        &self,
+        request: RecipeRequest,
+        role: Role,
+        commit: &str,
+    ) -> Result<PreparedRecipe, Report<ReleaseError>> {
+        let tools = self.tools_for(request.asset.artifact().target);
+        let materials = self.materials(commit);
+        self.bind_parts(request, role, commit, tools, materials)
+    }
+
+    pub(super) fn bind(
+        &self,
+        asset: &str,
+        role: Role,
+    ) -> Result<PreparedRecipe, Report<ReleaseError>> {
+        let text = role.spec_label();
+        self.bind_with(self.request(asset, text, COMMIT), role, COMMIT)
+    }
+
+    /// The fake namespace mirroring the boundary's mount layout for `role`.
+    pub(super) fn paths(&self, role: Role) -> PrefixPaths {
+        let checkout = if role == Role::Canonical {
+            "checkout-canonical"
+        } else {
+            "checkout-reproduction"
+        };
+        PrefixPaths::new()
+            .with(&self.base.join(checkout), "/boundary/immutable/0", false)
+            .with(&self.retained(), "/boundary/immutable/1", false)
+            .with(&self.base.join("materials"), "/boundary/immutable/2", false)
+            .with(&self.base.join("tools"), "/boundary/tool/0", false)
+            .with(&self.base.join("cargo-state"), "/boundary/writable/0", true)
+            .with(&self.base.join("target"), "/boundary/writable/1", true)
+            .with(&self.developer_dir(), "/boundary/system/0", false)
+    }
+}
+
+/// Fictional developer directory below the fixture base.
+pub(super) const APPLE_DEVELOPER: &str = "apple-developer";
+/// Default toolchain binaries below the developer directory.
+pub(super) const TOOLCHAIN_BIN: &str = "Toolchains/XcodeDefault.xctoolchain/usr/bin";
+/// Fictional SDK root below the developer directory.
+pub(super) const SDK_ROOT: &str = "Platforms/MacOSX.platform/Developer/SDKs/MacOSX15.5.sdk";
+
+/// Writes fictional `clang`, `ar`, `ld` and SDK settings below `developer`.
+fn write_fictional_developer_dir(developer: &Path) {
+    let bin = developer.join(TOOLCHAIN_BIN);
+    let sdk = developer.join(SDK_ROOT);
+    for directory in [&bin, &sdk] {
+        fs::create_dir_all(directory).expect("should create a fictional Apple directory");
+    }
+    for tool in ["clang", "ar", "ld"] {
+        fs::write(bin.join(tool), format!("fictional Apple {tool}"))
+            .expect("should write a fictional Apple tool");
+    }
+    fs::write(sdk.join("SDKSettings.json"), br#"{"Version":"15.5"}"#)
+        .expect("should write fictional SDK settings");
+}
+
+pub(super) fn plan_error(prepared: &PreparedRecipe, paths: &PrefixPaths) -> String {
+    match prepared.plan(paths) {
+        Ok(_) => panic!("should reject the plan"),
+        Err(error) => format!("{error:?}"),
+    }
+}
+
+pub(super) fn bind_error(result: Result<PreparedRecipe, Report<ReleaseError>>) -> String {
+    match result {
+        Ok(_) => panic!("should reject the binding"),
+        Err(error) => format!("{error:?}"),
+    }
+}
+
+pub(super) fn confinement_limits() -> ProcessLimits {
+    ProcessLimits {
+        wall: std::time::Duration::from_secs(60),
+        stdout_max: 1024,
+        stderr_max: 1024,
+    }
+}
+
+pub(super) fn umask(mask: u32) -> Umask {
+    Umask::new(mask).expect("should accept mask")
+}
diff --git a/crates/trusted-server-release/src/recipe/tests/full.rs b/crates/trusted-server-release/src/recipe/tests/full.rs
new file mode 100644
index 0000000000..2379aef48c
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/tests/full.rs
@@ -0,0 +1,614 @@
+//! Explicit real Linux Cargo fixtures; never selected by a normal focused unit run.
+//!
+//! Both runs are ordinary CI candidate evidence (`release_qualification:
+//! false`): the toolchain, container image and fixture acquisition are
+//! unqualified and unauthenticated, so nothing here qualifies a release.
+
+use std::collections::BTreeMap;
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::time::{Duration, Instant};
+
+use super::super::compare::{FASTLY_ASSET, check_fastly_equality};
+use super::super::compare::{FastlyEqualityChecked, read_artifact};
+use super::super::remap::{RemapScan, scan_remapped_bytes};
+use super::super::runtime::{
+    FastlyRuntimeAccepted, HealthOnlySuccess, OriginPresence, RuntimeRejection, SelectedViceroy,
+    accept_fastly_runtime, run_gate,
+};
+use super::candidate::{
+    CargoFixture, SCHEMA_VERSION, cargo_docker_settings, cargo_measurement, ci_build_provenance,
+    denial_measurement, equality_measurement, reported_errno,
+};
+use super::candidate_entry::{EntryExport, check_real_entry, js_inventory_sha256};
+use super::real_fixture::{
+    ATTEMPTS, DenialCase, DenialSelection, bind_denial_case, cargo_fixture, ordinary_ci_ambient,
+    path_text, try_prepare_vendor,
+};
+use super::spdx_candidate::{candidate_spdx_measurement, check_real_candidate};
+use super::*;
+use crate::boundary::{Boundary, DenialProof, ImageSelection, ProbeProgram};
+use crate::distribution::CandidateAcceptance;
+use crate::materials::{LockedMaterials, resolution_differences};
+use crate::preparation::tests::full::{JsFixtureRun, run_two_fresh_js_builds};
+use crate::process::{Cancellation, ProcessLimits};
+
+/// A configured container boundary with its proof for this instance.
+pub(super) struct Proven {
+    _state: tempfile::TempDir,
+    pub(super) boundary: Boundary,
+    pub(super) proof: DenialProof,
+}
+
+/// The builder image ID a Linux container fixture names.
+fn linux_image(fixture: &CargoFixture) -> &str {
+    fixture
+        .container_image_id()
+        .expect("should name the Linux builder image")
+}
+
+/// Configures the exact recipe boundary in the image `image_id` and proves
+/// its denial.
+pub(super) fn proven_boundary(
+    prepared: &PreparedRecipe,
+    fixture: &CargoFixture,
+    image_id: &str,
+) -> Proven {
+    try_proven_boundary(prepared, fixture, image_id)
+        .expect("should prove the exact recipe boundary")
+}
+
+pub(super) fn try_proven_boundary(
+    prepared: &PreparedRecipe,
+    fixture: &CargoFixture,
+    image_id: &str,
+) -> Result<Proven, Report<ReleaseError>> {
+    let state = tempfile::tempdir()
+        .map_err(|error| recipe_error(format!("cannot create boundary state: {error}")))?;
+
+    // These IDs only select the existing unprivileged CI worker account.
+    let user = unsafe { (libc::getuid(), libc::getgid()) };
+    let parallelism = std::thread::available_parallelism()
+        .map_or(1, |count| u32::try_from(count.get()).unwrap_or(u32::MAX));
+    let boundary = Boundary::linux_container(
+        prepared.boundary_roots()?,
+        cargo_docker_settings(user, parallelism),
+        ImageSelection::Test {
+            id: image_id.to_owned(),
+        },
+        state.path(),
+    )?;
+    let probe = ProbeProgram::from_staged_release_binary(&fixture.probe())?;
+    let limits = ProcessLimits {
+        wall: Duration::from_secs(60),
+        stdout_max: 4096,
+        stderr_max: 4096,
+    };
+    let proof = boundary.establish_denial(&probe, limits)?;
+    if !matches!(proof.denied_errno(), libc::EPERM | libc::EACCES) {
+        return Err(recipe_error(
+            "denial proof does not establish seccomp denial",
+        ));
+    }
+    Ok(Proven {
+        _state: state,
+        boundary,
+        proof,
+    })
+}
+
+/// Binds one Wasm denial fixture member over fresh private roots.
+fn bind_wasm_denial_case(fixture: &CargoFixture, member: &str) -> DenialCase {
+    bind_denial_case(
+        fixture,
+        member,
+        DenialSelection {
+            asset: AssetId::denial_fixture(member).expect("should resolve the fixture member"),
+            tools: SelectedRustTools::for_tests(&fixture.tools(), ReleaseTarget::Wasm32Wasip1)
+                .expect("should select the ordinary CI Rust tools"),
+            target_dir: None,
+        },
+    )
+}
+
+#[test]
+#[ignore = "requires the explicit ordinary CI Cargo fixture and Linux Docker; run separately in producer CI"]
+fn cargo_children_inherit_denial() {
+    let fixture = cargo_fixture();
+    let mut observed = BTreeMap::new();
+    let mut proof_errno = None;
+    for case in ATTEMPTS {
+        let bound = bind_wasm_denial_case(&fixture, case);
+        let proven = proven_boundary(&bound.prepared, &fixture, linux_image(&fixture));
+        let errno = proven.proof.denied_errno();
+        let error = bound
+            .prepared
+            .execute(&proven.boundary, &proven.proof)
+            .expect_err("should fail a build that attempts a connection");
+        let text = format!("{error:?}");
+        let reported = reported_errno(case, &text)
+            .unwrap_or_else(|| panic!("should report the {case} attempt errno: {text}"));
+        assert_eq!(
+            reported, errno,
+            "should deny the {case} attempt with the proven seccomp errno: {text}"
+        );
+        assert_ne!(
+            reported,
+            libc::ECONNREFUSED,
+            "should deny {case} before the empty network namespace refuses it"
+        );
+        observed.insert(case.to_owned(), reported);
+        proof_errno = Some(errno);
+    }
+    let bound = bind_wasm_denial_case(&fixture, "control");
+    let proven = proven_boundary(&bound.prepared, &fixture, linux_image(&fixture));
+    let control = bound
+        .prepared
+        .execute(&proven.boundary, &proven.proof)
+        .expect("should build the control through the confined recipe");
+    control
+        .rehash_for_handoff()
+        .expect("should rehash the control artifact before reporting it");
+    assert_eq!(
+        control.asset().artifact().name,
+        "denial-control.wasm",
+        "should copy the control under its asset name"
+    );
+    let mut measurement = denial_measurement(
+        proof_errno.expect("should observe every attempt"),
+        &observed,
+        &control,
+    );
+    measurement["ci_build_provenance"] = ci_build_provenance(&fixture);
+    let text = serde_json::to_string_pretty(&measurement).expect("should encode the measurement");
+    println!("{text}");
+    fs::write(fixture.root.join("cargo-denial-measurement.json"), text)
+        .expect("should retain the denial measurement");
+}
+
+/// Prepares the vendor tree from the fixture's retained originals.
+///
+/// The fixture's `cargo vendor` manifests only name which locked Git packages
+/// to supply closures for; the producer normalizes every inheriting manifest
+/// itself from the verified tree.
+fn prepare_vendor(
+    fixture: &CargoFixture,
+    locked: &LockedMaterials,
+    root: &Path,
+    deadline: Instant,
+    cancellation: &Cancellation,
+) -> PreparedCargoMaterials {
+    try_prepare_vendor(fixture, locked, root, deadline, cancellation)
+        .expect("should vendor every locked original")
+}
+
+/// Compares every producer-normalized manifest with the one `cargo vendor`
+/// wrote, before anything is built, and requires equal resolution facts.
+///
+/// This is ordinary CI differential evidence, not authority: the comparison
+/// manifests are unauthenticated and never reach the vendor tree.
+fn normalized_manifest_differential(
+    fixture: &CargoFixture,
+    materials: &PreparedCargoMaterials,
+) -> serde_json::Value {
+    let mut packages = serde_json::Map::new();
+    let mut differing = 0_usize;
+    for package in &fixture.comparison_manifests {
+        let directory = materials.vendor_dir().join(&package.name);
+        let producer =
+            fs::read(directory.join("Cargo.toml")).expect("should read the producer manifest");
+        let cargo_vendor = fs::read(&package.cargo_vendor_manifest)
+            .expect("should read the cargo vendor comparison manifest");
+        let build_rs_present = directory.join("build.rs").is_file();
+        let differences = resolution_differences(&producer, &cargo_vendor, build_rs_present)
+            .expect("should compare the producer and cargo vendor manifests");
+        differing += usize::from(!differences.is_empty());
+        packages.insert(
+            package.name.clone(),
+            serde_json::json!({
+                "producer_normalized": materials
+                    .normalized_manifest_digests()
+                    .contains_key(&package.name),
+                "differences": differences,
+            }),
+        );
+    }
+    let measurement = serde_json::json!({
+        "schema_version": SCHEMA_VERSION,
+        "kind": "ordinary-ci-normalized-manifest-differential",
+        "compared": packages.len(),
+        "normalized_manifest_count": materials.normalized_manifest_digests().len(),
+        "derived_manifest_digests": materials.derived_manifest_digests().len(),
+        "differing": differing,
+        "packages": packages,
+        "authority": "evidence-only",
+        "release_qualification": false,
+    });
+    println!(
+        "{}",
+        serde_json::to_string_pretty(&measurement).expect("should encode the differential")
+    );
+    assert_eq!(
+        differing, 0,
+        "should resolve every Git manifest as cargo vendor does: {measurement}"
+    );
+    measurement
+}
+
+/// One confined Fastly build with the private roots its output lives in.
+struct FastlyBuild {
+    _materials: tempfile::TempDir,
+    _work: tempfile::TempDir,
+    completed: RecipeCompleted,
+    /// Host roots of this build that must not appear in the final bytes.
+    host_roots: Vec<String>,
+    /// The checkout root as the confined build saw it.
+    execution_checkout: String,
+    /// The producer-normalized versus `cargo vendor` manifest comparison.
+    differential: serde_json::Value,
+}
+
+/// Builds the Fastly Wasm for `role` from the shared JS handoff.
+///
+/// Each role gets its own fresh source copy (a distinct checkout root), its
+/// own freshly prepared vendor tree, fresh state, output and target roots,
+/// and its own boundary with its own denial proof. The target directory and
+/// source copy are removed after the build; only the copied output remains.
+fn build_fastly(
+    js: &JsFixtureRun,
+    fixture: &CargoFixture,
+    role: Role,
+    deadline: Instant,
+    cancellation: &Cancellation,
+) -> FastlyBuild {
+    let fresh = js
+        .source
+        .materialize(deadline, cancellation)
+        .expect("should materialize a fresh tracked source for this role");
+    let materials_directory = tempfile::tempdir().expect("should create the materials root");
+    let materials_root =
+        fs::canonicalize(materials_directory.path()).expect("should resolve the materials root");
+    let materials = prepare_vendor(fixture, &js.locked, &materials_root, deadline, cancellation);
+    assert_eq!(
+        materials.cargo_lock_sha256(),
+        fixture.cargo_lock_sha256,
+        "should vendor from the fixture's Cargo.lock"
+    );
+    let differential = normalized_manifest_differential(fixture, &materials);
+    let work = tempfile::tempdir().expect("should create the build roots");
+    let base = fs::canonicalize(work.path()).expect("should resolve the build roots");
+    for directory in ["cargo-state", "output"] {
+        fs::create_dir(base.join(directory)).expect("should create a build root");
+    }
+    let retained = fs::canonicalize(
+        js.completed
+            .rehash_for_handoff()
+            .expect("should rehash the JS handoff"),
+    )
+    .expect("should resolve the retained root");
+    let request = RecipeRequest::parse(&RecipeInput {
+        asset: FASTLY_ASSET,
+        variant: "default",
+        role: role.spec_label(),
+        commit: &fixture.source_commit,
+        js_dir: &retained.join("bundles"),
+        js_inventory: &retained.join("tsjs-inventory.json"),
+        materials: &materials_root,
+        cargo_state: &base.join("cargo-state"),
+        output: &base.join("output"),
+        target_dir: &base.join("target"),
+    })
+    .expect("should accept the Fastly request");
+    let prepared = PreparedRecipe::new(
+        &js.source,
+        &fresh,
+        &js.audited,
+        &js.completed,
+        SelectedRustTools::for_tests(&fixture.tools(), ReleaseTarget::Wasm32Wasip1)
+            .expect("should select the ordinary CI Rust tools"),
+        materials,
+        ordinary_ci_ambient(role, fresh.root()),
+        request,
+    )
+    .expect("should bind the real source, handoff, tools and materials");
+    let proven = proven_boundary(&prepared, fixture, linux_image(fixture));
+    let execution_checkout = path_text(
+        &proven
+            .boundary
+            .execution_path(fresh.root())
+            .expect("should translate the checkout root"),
+    );
+    let host_roots = [
+        fresh.root(),
+        materials_root.as_path(),
+        base.as_path(),
+        retained.as_path(),
+    ]
+    .map(path_text)
+    .to_vec();
+    let completed = prepared
+        .execute(&proven.boundary, &proven.proof)
+        .unwrap_or_else(|error| {
+            panic!(
+                "should build the role {role:?} Fastly Wasm through the confined recipe: {error:?}"
+            )
+        });
+    completed
+        .rehash_for_handoff()
+        .expect("should rehash the artifact before reporting it");
+    assert!(
+        completed.derived_manifest_digests().is_empty()
+            && !completed.normalized_manifest_digests().is_empty(),
+        "should build from producer-normalized Git manifests and no caller-derived one"
+    );
+    println!(
+        "{}",
+        serde_json::to_string_pretty(&cargo_measurement(&completed))
+            .expect("should encode the build measurement")
+    );
+    fs::remove_dir_all(base.join("target")).expect("should remove the spent target directory");
+    fresh.close().expect("should remove the fresh source copy");
+    completed
+        .denial_receipt()
+        .expect("should retain measured socket observations after working-root cleanup");
+    completed
+        .recipe_definition()
+        .expect("should retain the approved recipe definition after working-root cleanup");
+    FastlyBuild {
+        _materials: materials_directory,
+        _work: work,
+        completed,
+        host_roots,
+        execution_checkout,
+        differential,
+    }
+}
+
+/// Scans the final bytes for every host root and the container prefix, and
+/// requires at least one fixed remapped prefix.
+fn scan_final_bytes(fixture: &CargoFixture, builds: [&FastlyBuild; 2]) -> RemapScan {
+    let mut forbidden: Vec<String> = builds
+        .iter()
+        .flat_map(|build| build.host_roots.iter().cloned())
+        .collect();
+    forbidden.push(path_text(&fixture.root));
+    if let Some(runner_temp) = std::env::var_os("RUNNER_TEMP") {
+        forbidden.push(
+            runner_temp
+                .into_string()
+                .expect("should name RUNNER_TEMP in UTF-8"),
+        );
+    }
+    let forbidden: Vec<&str> = forbidden.iter().map(String::as_str).collect();
+    let bytes = fs::read(builds[0].completed.artifact().path())
+        .expect("should read the compared final bytes");
+    scan_remapped_bytes(&bytes, &forbidden)
+        .unwrap_or_else(|error| panic!("should prove remapping in the final bytes: {error:?}"))
+}
+
+#[test]
+#[ignore = "requires explicit JS and Cargo ordinary CI fixtures, Linux Docker and the pinned Viceroy; run separately in producer CI"]
+fn fastly_canonical_and_reproduction_builds_are_byte_identical() {
+    let fixture = cargo_fixture();
+    let js = run_two_fresh_js_builds();
+    assert_eq!(
+        js.source.commit().as_str(),
+        fixture.source_commit,
+        "should build the Cargo fixture's source commit"
+    );
+    println!(
+        "{}",
+        serde_json::to_string_pretty(&js.measurement).expect("should encode the JS measurement")
+    );
+    let cancellation = Cancellation::default();
+    let deadline = Instant::now() + Duration::from_secs(40 * 60);
+    let canonical = build_fastly(&js, &fixture, Role::Canonical, deadline, &cancellation);
+    let reproduction = build_fastly(&js, &fixture, Role::Reproduction, deadline, &cancellation);
+    let checked = check_fastly_equality(&canonical.completed, &reproduction.completed)
+        .unwrap_or_else(|error| {
+            panic!(
+                "should build byte-identical canonical and reproduction Fastly outputs: {error:?}"
+            )
+        });
+    let scan = scan_final_bytes(&fixture, [&canonical, &reproduction]);
+    let mut measurement =
+        equality_measurement(&canonical.completed, &reproduction.completed, &checked);
+    for (role, build) in [("canonical", &canonical), ("reproduction", &reproduction)] {
+        // Container paths are identical, so checkout variation is host-only on Linux.
+        measurement["builds"][role]["ambient"]["execution_checkout_root"] =
+            serde_json::json!(build.execution_checkout);
+    }
+    let differential = serde_json::json!({
+        "canonical": canonical.differential,
+        "reproduction": reproduction.differential,
+    });
+    fs::write(
+        fixture
+            .root
+            .join("normalized-manifest-differential-measurement.json"),
+        serde_json::to_string_pretty(&differential).expect("should encode the differential"),
+    )
+    .expect("should retain the normalized manifest differential");
+    measurement["remap_scan"] = serde_json::json!({
+        "forbidden": ["/boundary/", "host build roots", "fixture root", "RUNNER_TEMP"],
+        "found": scan.found(),
+    });
+    let canonical_candidate = check_real_candidate(&canonical.completed, &js.source);
+    let reproduction_candidate = check_real_candidate(&reproduction.completed, &js.source);
+    measurement["candidate_spdx"] =
+        candidate_spdx_measurement(&canonical_candidate, Some(&reproduction_candidate));
+    measurement["js_inventory_sha256"] =
+        serde_json::json!(js_inventory_sha256(&canonical.completed));
+    measurement["ci_build_provenance"] = ci_build_provenance(&fixture);
+    retain_equality_measurement(&fixture, &measurement);
+    let [canonical_runtime, reproduction_runtime] = run_runtime_gate(&RuntimeGateInputs {
+        fixture: &fixture,
+        source: &js.source,
+        canonical: &canonical,
+        reproduction: &reproduction,
+        checked: &checked,
+    });
+    assert!(
+        canonical_runtime
+            .diagnostic_for(&reproduction.completed)
+            .is_err(),
+        "should reject attaching canonical acceptance to the equal-byte reproduction role"
+    );
+    assert!(
+        reproduction_runtime
+            .diagnostic_for(&canonical.completed)
+            .is_err(),
+        "should reject attaching reproduction acceptance to the equal-byte canonical role"
+    );
+    let upload_directory = fixture.root.join("candidate-entry");
+    let transfer_file = fixture.root.join("candidate-entry-transfer.json");
+    measurement["candidate_entry"] = check_real_entry(
+        &canonical.completed,
+        &js.source,
+        &CandidateAcceptance::Fastly {
+            runtime: &canonical_runtime,
+            equality: &checked,
+        },
+        &EntryExport {
+            upload_directory: &upload_directory,
+            transfer_file: &transfer_file,
+        },
+    );
+    retain_equality_measurement(&fixture, &measurement);
+    super::candidate::check_fastly_export_after_cleanup(
+        canonical,
+        |build| &build.completed,
+        &canonical_runtime,
+    );
+    super::candidate::check_fastly_export_after_cleanup(
+        reproduction,
+        |build| &build.completed,
+        &reproduction_runtime,
+    );
+}
+
+/// Prints and retains `measurement` as the canonical/reproduction equality
+/// measurement.
+fn retain_equality_measurement(fixture: &CargoFixture, measurement: &serde_json::Value) {
+    let text = serde_json::to_string_pretty(measurement).expect("should encode the measurement");
+    println!("{text}");
+    fs::write(
+        fixture
+            .root
+            .join("cargo-canonical-reproduction-equality-measurement.json"),
+        text,
+    )
+    .expect("should retain the canonical/reproduction equality measurement");
+}
+
+/// Everything the chained runtime gate needs from the equality run.
+struct RuntimeGateInputs<'a> {
+    fixture: &'a CargoFixture,
+    source: &'a ApprovedSource,
+    canonical: &'a FastlyBuild,
+    reproduction: &'a FastlyBuild,
+    checked: &'a FastlyEqualityChecked,
+}
+
+/// Selects the pinned Viceroy named by `TS_RELEASE_VICEROY`.
+fn pinned_viceroy() -> SelectedViceroy {
+    let path = std::env::var_os("TS_RELEASE_VICEROY")
+        .map(PathBuf::from)
+        .expect("should explicitly supply the pinned Viceroy executable");
+    SelectedViceroy::select(&path).expect("should select the pinned Viceroy 0.21.0")
+}
+
+/// The ordinary CI measurement of one accepted runtime gate run.
+fn accepted_measurement(accepted: &FastlyRuntimeAccepted) -> serde_json::Value {
+    let source_commit = accepted.source_commit().as_str();
+    let accepted = accepted.observed();
+    let publisher = accepted.publisher();
+    let output = accepted.viceroy_output();
+    serde_json::json!({
+        "source_commit": source_commit,
+        "viceroy_output": {
+            "stdout_sha256": output.stdout_sha256,
+            "stderr_sha256": output.stderr_sha256,
+            "stderr_tail": output.stderr_tail,
+        },
+        "artifact": {
+            "sha256": accepted.artifact_sha256(),
+            "size": accepted.artifact_size(),
+        },
+        "fixture_sha256": accepted.fixture_sha256(),
+        "config_sha256": accepted.config_sha256(),
+        "health_status": accepted.health_status(),
+        "publisher": {
+            "status": publisher.status,
+            "body_size": publisher.body_size,
+            "body_sha256": publisher.body_sha256,
+            "script_src": publisher.script_src,
+        },
+        "origin_requests": accepted.origin_requests(),
+        "startup_seconds": accepted.startup().as_secs_f64(),
+        "viceroy_outcome": accepted.viceroy_outcome().to_string(),
+    })
+}
+
+/// Runs the final-byte runtime gate on both equal outputs, then proves that
+/// a run with a closed origin is rejected although its health check passes.
+fn run_runtime_gate(inputs: &RuntimeGateInputs<'_>) -> [FastlyRuntimeAccepted; 2] {
+    let RuntimeGateInputs {
+        fixture,
+        source,
+        canonical,
+        reproduction,
+        checked,
+    } = *inputs;
+    let viceroy = pinned_viceroy();
+    let mut builds = serde_json::Map::new();
+    let mut accepted_runs = Vec::new();
+    for (role, build) in [("canonical", canonical), ("reproduction", reproduction)] {
+        let accepted = accept_fastly_runtime(source, &build.completed, checked, &viceroy)
+            .unwrap_or_else(|error| {
+                panic!("should accept the {role} final bytes through Viceroy: {error:?}")
+            });
+        assert_eq!(
+            accepted.observed().artifact_sha256(),
+            checked.sha256(),
+            "should execute the exact accepted {role} bytes"
+        );
+        builds.insert(role.to_owned(), accepted_measurement(&accepted));
+        accepted_runs.push(accepted);
+    }
+    let bytes = read_artifact(&canonical.completed).expect("should reread the canonical bytes");
+    let rejected = run_gate(&bytes, &viceroy, OriginPresence::Closed)
+        .expect_err("should reject a run whose origin is unreachable");
+    assert!(
+        rejected.downcast_ref::<HealthOnlySuccess>().is_some(),
+        "should reject a health-only success: {rejected:?}"
+    );
+    canonical
+        .completed
+        .rehash_for_handoff()
+        .expect("should leave the canonical artifact unchanged");
+    let measurement = serde_json::json!({
+        "schema_version": SCHEMA_VERSION,
+        "kind": "ordinary-ci-fastly-runtime-gate",
+        "asset": checked.asset().artifact().name,
+        "viceroy": {
+            "version": viceroy.version(),
+            "sha256": viceroy.sha256(),
+        },
+        "builds": builds,
+        "health_only_rejection": rejected
+            .downcast_ref::<RuntimeRejection>()
+            .map(ToString::to_string),
+        "release_qualification": false,
+    });
+    let text = serde_json::to_string_pretty(&measurement).expect("should encode the measurement");
+    println!("{text}");
+    fs::write(
+        fixture.root.join("fastly-runtime-gate-measurement.json"),
+        text,
+    )
+    .expect("should retain the runtime gate measurement");
+    accepted_runs
+        .try_into()
+        .expect("should retain exactly the canonical and reproduction runtime owners")
+}
diff --git a/crates/trusted-server-release/src/recipe/tests/full_macos.rs b/crates/trusted-server-release/src/recipe/tests/full_macos.rs
new file mode 100644
index 0000000000..d12198e2d1
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/tests/full_macos.rs
@@ -0,0 +1,206 @@
+//! Explicit real macOS Cargo fixtures; never selected by a normal focused
+//! unit run.
+//!
+//! Both runs are ordinary CI candidate evidence (`release_qualification:
+//! false`): the Xcode, toolchain and fixture acquisition are unqualified and
+//! unauthenticated, and the unqualified `sandbox-exec` boundary only reaps
+//! descendants after each run (`post-run-reaped`), which only the test-only
+//! ordinary CI tool selection admits. Nothing here qualifies a release.
+//!
+//! A Darwin build's Rust tool root and target directory must be direct
+//! children of one parent, which the linker strips from every debug-map
+//! object path. These fixtures use the Cargo fixture root as that parent:
+//! the target directory is `<fixture>/target`, beside `<fixture>/tools`, so
+//! builds run one at a time and remove it afterwards.
+
+use std::collections::BTreeMap;
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::time::{Duration, Instant};
+
+use serde_json::json;
+
+use super::candidate::{
+    CargoFixture, FixtureHost, ci_build_provenance, denial_measurement, reported_errno,
+};
+use super::macos_candidate::darwin_cli_asset;
+use super::real_fixture::{ATTEMPTS, DenialCase, DenialSelection, bind_denial_case, cargo_fixture};
+use super::*;
+use crate::boundary::{Boundary, DenialProof, DescendantCleanup, ProbeProgram};
+use crate::process::{Cancellation, ProcessLimits};
+
+/// Reads the ordinary CI Cargo fixture and requires its macOS kind.
+pub(super) fn macos_cargo_fixture() -> CargoFixture {
+    let fixture = cargo_fixture();
+    assert_eq!(
+        fixture.host,
+        FixtureHost::MacosSandbox,
+        "should run on a macOS Cargo fixture that names no image"
+    );
+    fixture
+}
+
+/// The Darwin `ts` asset of the running producer's architecture, which must
+/// build for the `HOST_TARGET` the CI job asserted.
+pub(super) fn job_host_asset() -> AssetId {
+    let host_target =
+        std::env::var("HOST_TARGET").expect("should name the HOST_TARGET the job asserted");
+    darwin_cli_asset(std::env::consts::ARCH, &host_target)
+        .expect("should select the Darwin ts asset of the host architecture")
+}
+
+/// The target directory beside the fixture's tool root.
+pub(super) fn darwin_target_dir(fixture: &CargoFixture) -> PathBuf {
+    fixture.root.join("target")
+}
+
+/// Removes a spent Darwin target directory; an absent one is already gone.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Recipe`] when the directory cannot be removed.
+pub(super) fn remove_target_dir(target: &Path) -> Result<(), Report<ReleaseError>> {
+    match fs::remove_dir_all(target) {
+        Ok(()) => Ok(()),
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(()),
+        Err(error) => Err(recipe_error(format!(
+            "cannot remove the Darwin target directory: {error}"
+        ))),
+    }
+}
+
+/// A configured macOS sandbox boundary with its proof for this instance.
+pub(super) struct ProvenSandbox {
+    pub(super) boundary: Boundary,
+    pub(super) proof: DenialProof,
+}
+
+/// Configures the exact recipe boundary as an unqualified macOS sandbox and
+/// proves its denial with the staged producer probe.
+///
+/// # Errors
+///
+/// Returns an error when the boundary cannot be configured or proven, the
+/// proof does not report the sandbox `EPERM`, or the boundary does not
+/// report post-run-reaped descendant cleanup.
+pub(super) fn try_proven_sandbox(
+    prepared: &PreparedRecipe,
+    fixture: &CargoFixture,
+) -> Result<ProvenSandbox, Report<ReleaseError>> {
+    let boundary = Boundary::mac_sandbox_for_tests(prepared.boundary_roots()?)?;
+    if boundary.descendant_cleanup() != DescendantCleanup::ReapedAfterRun {
+        return Err(recipe_error(
+            "the macOS sandbox does not report post-run-reaped cleanup",
+        ));
+    }
+    let probe = ProbeProgram::from_staged_release_binary(&fixture.probe())?;
+    let limits = ProcessLimits {
+        wall: Duration::from_secs(60),
+        stdout_max: 4096,
+        stderr_max: 4096,
+    };
+    let proof = boundary.establish_denial(&probe, limits)?;
+    if proof.denied_errno() != libc::EPERM {
+        return Err(recipe_error(
+            "denial proof does not establish the sandbox EPERM denial",
+        ));
+    }
+    Ok(ProvenSandbox { boundary, proof })
+}
+
+/// Binds one Darwin denial fixture member for `target` with the Xcode tools.
+fn bind_darwin_denial_case(
+    fixture: &CargoFixture,
+    member: &str,
+    target: ReleaseTarget,
+    apple: &AppleDeveloperTools,
+) -> DenialCase {
+    bind_denial_case(
+        fixture,
+        member,
+        DenialSelection {
+            asset: AssetId::darwin_denial_fixture(member, target)
+                .expect("should resolve the Darwin fixture member"),
+            tools: SelectedRustTools::for_tests(&fixture.tools(), target)
+                .expect("should select the ordinary CI Rust tools")
+                .with_apple_developer_tools(apple.clone()),
+            target_dir: Some(darwin_target_dir(fixture)),
+        },
+    )
+}
+
+#[test]
+#[ignore = "requires the explicit ordinary CI macOS Cargo fixture, Xcode and the macOS sandbox; run separately in producer CI"]
+fn cargo_children_inherit_denial_macos() {
+    let fixture = macos_cargo_fixture();
+    let target = job_host_asset().artifact().target;
+    let cancellation = Cancellation::default();
+    let apple = AppleDeveloperTools::for_ordinary_ci(
+        Instant::now() + Duration::from_secs(60 * 60),
+        &cancellation,
+    )
+    .expect("should measure the selected Xcode");
+    let target_dir = darwin_target_dir(&fixture);
+    let mut observed = BTreeMap::new();
+    for case in ATTEMPTS {
+        let bound = bind_darwin_denial_case(&fixture, case, target, &apple);
+        let proven = try_proven_sandbox(&bound.prepared, &fixture)
+            .unwrap_or_else(|error| panic!("should prove the {case} sandbox: {error:?}"));
+        let error = bound
+            .prepared
+            .execute(&proven.boundary, &proven.proof)
+            .expect_err("should fail a build that attempts a connection");
+        remove_target_dir(&target_dir).expect("should remove the failed case's target");
+        let text = format!("{error:?}");
+        let reported = reported_errno(case, &text)
+            .unwrap_or_else(|| panic!("should report the {case} attempt errno: {text}"));
+        assert_eq!(
+            reported,
+            proven.proof.denied_errno(),
+            "should deny the {case} attempt with the proven sandbox errno: {text}"
+        );
+        assert_eq!(
+            reported,
+            libc::EPERM,
+            "should deny {case} with the sandbox EPERM: {text}"
+        );
+        assert_ne!(
+            reported,
+            libc::ECONNREFUSED,
+            "should deny {case} before any listener refuses it"
+        );
+        observed.insert(case.to_owned(), reported);
+    }
+    let bound = bind_darwin_denial_case(&fixture, "control", target, &apple);
+    let proven = try_proven_sandbox(&bound.prepared, &fixture)
+        .unwrap_or_else(|error| panic!("should prove the control sandbox: {error:?}"));
+    let control = bound.prepared.execute(&proven.boundary, &proven.proof);
+    remove_target_dir(&target_dir).expect("should remove the control target");
+    let control = control.unwrap_or_else(|error| {
+        panic!("should build and accept the Darwin control through the confined recipe: {error:?}")
+    });
+    control
+        .rehash_for_handoff()
+        .expect("should rehash the control artifact before reporting it");
+    assert_eq!(
+        control.asset().artifact().name,
+        format!("denial-control-{}", target.triple()),
+        "should copy the control under its Darwin row name"
+    );
+    assert_eq!(
+        control.descendant_cleanup(),
+        DescendantCleanup::ReapedAfterRun,
+        "should record the post-run-reaped cleanup"
+    );
+    let mut measurement = denial_measurement(libc::EPERM, &observed, &control);
+    measurement["kind"] = json!("ordinary-ci-macos-cargo-denial");
+    measurement["target"] = json!(target.triple());
+    measurement["boundary"] = json!("macos-sandbox-exec");
+    measurement["descendant_cleanup"] = json!(control.descendant_cleanup().to_string());
+    measurement["apple_developer_tools"] = apple.measurement();
+    measurement["ci_build_provenance"] = ci_build_provenance(&fixture);
+    let text = serde_json::to_string_pretty(&measurement).expect("should encode the measurement");
+    println!("{text}");
+    fs::write(fixture.root.join("cargo-denial-measurement.json"), text)
+        .expect("should retain the macOS denial measurement");
+}
diff --git a/crates/trusted-server-release/src/recipe/tests/macos_candidate.rs b/crates/trusted-server-release/src/recipe/tests/macos_candidate.rs
new file mode 100644
index 0000000000..c2bc532d3e
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/tests/macos_candidate.rs
@@ -0,0 +1,278 @@
+//! Ordinary CI macOS CLI candidate support: the host asset selection and the
+//! measurement the real macOS fixture prints.
+//!
+//! Pure and compiled everywhere. Nothing here is release qualification: the
+//! Xcode, toolchain and adopted JS handoff are unqualified and
+//! unauthenticated, descendants are only reaped after each run, and the
+//! measurement says so.
+
+use serde_json::{Value, json};
+
+use super::super::startup::native::HostIdentity;
+use super::candidate::{SCHEMA_VERSION, cargo_measurement};
+use super::cli_candidate::{ReproductionOutcome, reproduction_measurement};
+use super::complete::built;
+use super::complete_darwin::darwin_executable;
+use super::fixture::Fixture;
+use super::*;
+use crate::inspect::{MachoCpu, MachoFacts, MachoPolicy, inspect_macho};
+
+/// File the macOS CLI candidate measurement is written to.
+pub(super) const MEASUREMENT_FILE: &str = "macos-cli-candidate-measurement.json";
+/// Kind of the macOS CLI candidate measurement.
+const MEASUREMENT_KIND: &str = "ordinary-ci-macos-cli-candidate";
+/// The fixed environment names of the native startup child.
+const STARTUP_ENVIRONMENT: [&str; 4] = ["HOME", "LC_ALL", "PATH", "TMPDIR"];
+
+/// Selects the Darwin `ts` asset of the running `architecture` and requires
+/// it to build for `host_target`, the triple the CI job asserted.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Recipe`] for an architecture with no Darwin `ts`
+/// asset, or an asset whose target is not `host_target` (such as an arm64
+/// producer on a job that asserted an Intel host).
+pub(super) fn darwin_cli_asset(
+    architecture: &str,
+    host_target: &str,
+) -> Result<AssetId, Report<ReleaseError>> {
+    let name = match architecture {
+        "aarch64" => "ts-aarch64-apple-darwin",
+        "x86_64" => "ts-x86_64-apple-darwin",
+        other => {
+            return Err(recipe_error(format!(
+                "no Darwin ts asset for architecture {other:?}"
+            )));
+        }
+    };
+    let asset = AssetId::parse(name)?;
+    if asset.artifact().target.triple() != host_target {
+        return Err(recipe_error(format!(
+            "Darwin ts asset {name} does not build for the host target {host_target:?}"
+        )));
+    }
+    Ok(asset)
+}
+
+/// The Mach-O facts the measurement records.
+fn macho_measurement(facts: &MachoFacts) -> Value {
+    json!({
+        "sha256": facts.sha256(),
+        "cpu": facts.cpu().to_string(),
+        "minos": facts.minos().to_string(),
+        "sdk": facts.sdk().to_string(),
+        "dylibs": facts.dylibs(),
+        "uuid": hex::encode(facts.uuid()),
+        "symbol_count": facts.symbol_count(),
+        "debug_map_objects": facts.debug_map_objects(),
+        "signature": facts.signature().to_string(),
+    })
+}
+
+/// The host identity the measurement records.
+fn host_measurement(host: &HostIdentity) -> Value {
+    json!({
+        "product_version": host.product_version,
+        "architecture": host.architecture,
+        "proc_translated": host.proc_translated,
+        "hw_optional_arm64": host.hw_optional_arm64,
+    })
+}
+
+/// Everything the macOS CLI candidate measurement states.
+pub(super) struct MacosCliCandidateFacts<'a> {
+    pub(super) canonical: &'a RecipeCompleted,
+    pub(super) macho: &'a MachoFacts,
+    pub(super) apple: &'a AppleDeveloperTools,
+    pub(super) host: &'a HostIdentity,
+    /// The adoption label of the Linux job's JS handoff.
+    pub(super) js_handoff: &'a Value,
+    pub(super) remap_found: &'a [&'static str],
+    pub(super) operator_values_removed: &'a [String],
+    /// The accepted `ts --version` output, once the native startup ran.
+    pub(super) startup_stdout: Option<&'a str>,
+    pub(super) reproduction: ReproductionOutcome<'a>,
+}
+
+/// The ordinary CI measurement of the macOS CLI candidate.
+pub(super) fn macos_cli_candidate_measurement(facts: &MacosCliCandidateFacts<'_>) -> Value {
+    let startup = facts.startup_stdout.map_or_else(
+        || json!({"status": "not-run"}),
+        |stdout| {
+            json!({
+                "status": "accepted",
+                "exit_code": 0,
+                "stdout": stdout,
+                "environment": STARTUP_ENVIRONMENT,
+            })
+        },
+    );
+    json!({
+        "schema_version": SCHEMA_VERSION,
+        "kind": MEASUREMENT_KIND,
+        "asset": facts.canonical.asset().artifact().name,
+        "source_commit": facts.canonical.commit().as_str(),
+        "host": host_measurement(facts.host),
+        "apple_developer_tools": facts.apple.measurement(),
+        "js_handoff": facts.js_handoff["js_handoff"],
+        "boundary": "macos-sandbox-exec",
+        "descendant_cleanup": facts.canonical.descendant_cleanup().to_string(),
+        "canonical": cargo_measurement(facts.canonical),
+        "macho": macho_measurement(facts.macho),
+        "remap_scan": {
+            "forbidden": ["host build roots", "fixture root", "RUNNER_TEMP"],
+            "found": facts.remap_found,
+        },
+        "operator_values": {
+            "removed_by_preflight": facts.operator_values_removed,
+            "found_in_final_bytes": 0,
+        },
+        "startup": startup,
+        "reproduction": reproduction_measurement(&facts.reproduction),
+        "release_qualification": false,
+    })
+}
+
+#[test]
+fn darwin_cli_asset_follows_the_host_architecture_and_target() {
+    for (architecture, triple) in [
+        ("aarch64", "aarch64-apple-darwin"),
+        ("x86_64", "x86_64-apple-darwin"),
+    ] {
+        let asset = darwin_cli_asset(architecture, triple).expect("should select the host asset");
+        assert_eq!(
+            asset.artifact().target.triple(),
+            triple,
+            "should build the asset for the host target"
+        );
+        assert_eq!(asset.artifact().bin, "ts", "should select the ts binary");
+    }
+    for (architecture, triple) in [
+        ("aarch64", "x86_64-apple-darwin"),
+        ("x86_64", "aarch64-apple-darwin"),
+        ("x86_64", "x86_64-unknown-linux-gnu"),
+        ("riscv64", "riscv64-example-darwin"),
+    ] {
+        assert!(
+            darwin_cli_asset(architecture, triple).is_err(),
+            "should reject {architecture} on a job asserting {triple}"
+        );
+    }
+}
+
+#[test]
+fn macos_measurement_states_unqualified_reaped_unauthenticated_evidence() {
+    let bytes = darwin_executable();
+    let mut build = built("ts-aarch64-apple-darwin", Role::Canonical, &bytes);
+    let stdout = build.stdout(|_| {});
+    let canonical = build
+        .finish(stdout)
+        .expect("should complete the Darwin fixture");
+    let macho = inspect_macho(&bytes, &MachoPolicy::macos(MachoCpu::Arm64))
+        .expect("should inspect the canonical bytes");
+    let apple = Fixture::new(COMMIT).apple_tools();
+    let host = HostIdentity {
+        product_version: "15.5".to_owned(),
+        architecture: "aarch64".to_owned(),
+        proc_translated: Some(0),
+        hw_optional_arm64: Some(1),
+    };
+    let js_handoff = json!({
+        "js_handoff": {
+            "origin": "linux-ordinary-ci-artifact",
+            "authenticated": false,
+            "source_commit": COMMIT,
+        }
+    });
+    let removed = vec!["TRUSTED_SERVER__PUBLISHER__DOMAIN".to_owned()];
+
+    let measurement = macos_cli_candidate_measurement(&MacosCliCandidateFacts {
+        canonical: &canonical,
+        macho: &macho,
+        apple: &apple,
+        host: &host,
+        js_handoff: &js_handoff,
+        remap_found: &["/trusted-server"],
+        operator_values_removed: &removed,
+        startup_stdout: Some("ts example\n"),
+        reproduction: ReproductionOutcome::BuildFailed("reproduction unavailable".to_owned()),
+    });
+
+    assert_eq!(measurement["kind"], "ordinary-ci-macos-cli-candidate");
+    assert_eq!(
+        measurement["release_qualification"], false,
+        "should never claim release qualification"
+    );
+    assert_eq!(
+        measurement["descendant_cleanup"], "post-run-reaped",
+        "should state the weaker macOS cleanup"
+    );
+    assert_eq!(measurement["asset"], "ts-aarch64-apple-darwin");
+    assert_eq!(measurement["js_handoff"]["authenticated"], false);
+    assert_eq!(
+        measurement["js_handoff"]["origin"],
+        "linux-ordinary-ci-artifact"
+    );
+    assert_eq!(measurement["host"]["architecture"], "aarch64");
+    assert_eq!(measurement["host"]["proc_translated"], 0);
+    assert_eq!(
+        measurement["apple_developer_tools"]["xcode_version"],
+        apple.measurement()["xcode_version"],
+        "should record the measured Xcode"
+    );
+    assert_eq!(
+        measurement["apple_developer_tools"]["clang_sha256"],
+        apple.measurement()["clang_sha256"],
+        "should record the tool hashes"
+    );
+    assert_eq!(measurement["macho"]["signature"], "linker-signed-ad-hoc");
+    assert_eq!(
+        measurement["canonical"]["artifact"]["sha256"],
+        canonical.artifact().sha256(),
+        "should record the accepted canonical artifact"
+    );
+    assert_eq!(measurement["startup"]["status"], "accepted");
+    assert_eq!(measurement["startup"]["stdout"], "ts example\n");
+    assert_eq!(
+        measurement["reproduction"]["status"], "build-failed",
+        "should record an unavailable reproduction as a measurement"
+    );
+
+    let pending = macos_cli_candidate_measurement(&MacosCliCandidateFacts {
+        startup_stdout: None,
+        reproduction: ReproductionOutcome::NotAttempted,
+        canonical: &canonical,
+        macho: &macho,
+        apple: &apple,
+        host: &host,
+        js_handoff: &js_handoff,
+        remap_found: &[],
+        operator_values_removed: &removed,
+    });
+    assert_eq!(pending["startup"]["status"], "not-run");
+    assert_eq!(pending["reproduction"]["status"], "not-attempted");
+
+    let deferred = macos_cli_candidate_measurement(&MacosCliCandidateFacts {
+        startup_stdout: Some("ts example\n"),
+        reproduction: ReproductionOutcome::Deferred,
+        canonical: &canonical,
+        macho: &macho,
+        apple: &apple,
+        host: &host,
+        js_handoff: &js_handoff,
+        remap_found: &[],
+        operator_values_removed: &removed,
+    });
+    assert_eq!(
+        deferred["reproduction"]["status"], "deferred-to-scheduled-run",
+        "should record a deferred reproduction explicitly"
+    );
+    assert_eq!(
+        deferred["reproduction"]["gate"], "measurement-only",
+        "should keep a deferred reproduction a measurement"
+    );
+    assert_eq!(
+        deferred["release_qualification"], false,
+        "should never claim release qualification when deferring"
+    );
+}
diff --git a/crates/trusted-server-release/src/recipe/tests/macos_cli.rs b/crates/trusted-server-release/src/recipe/tests/macos_cli.rs
new file mode 100644
index 0000000000..ff806cb860
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/tests/macos_cli.rs
@@ -0,0 +1,406 @@
+//! Explicit real macOS CLI candidate fixture; never selected by a normal
+//! focused unit run.
+//!
+//! The run is ordinary CI candidate evidence (`release_qualification:
+//! false`): the Xcode, toolchain, fixture acquisition and the JS handoff
+//! adopted from the Linux job are unqualified and unauthenticated, and the
+//! macOS sandbox only reaps descendants after each run. The canonical build
+//! is gated (Mach-O acceptance in completion, the debug map and measured
+//! SDK, the remap and final-path scans, planted operator values, native
+//! startup); the reproduction build is a recorded measurement only, and
+//! runs only when `TS_RELEASE_NATIVE_REPRODUCTION=measure` (otherwise the
+//! measurement records it as deferred to the scheduled run).
+
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::time::{Duration, Instant};
+
+use super::super::compare::read_artifact;
+use super::super::native::{check_operator_values_absent, measure_native_repeatability};
+use super::super::remap::scan_remapped_bytes;
+use super::super::startup::native::{NativeStartupLayout, measure_host_identity};
+use super::super::startup::{NativeStartupAccepted, StartupCopy};
+use super::candidate::{CargoFixture, ci_build_provenance};
+use super::candidate_entry::{EntryExport, check_real_entry, js_inventory_sha256};
+use super::cli_candidate::{
+    NativeReproduction, OPERATOR_SENTINELS, ReproductionOutcome, check_build_budget,
+    finish_cleanup, native_reproduction_from_env, reproduction_result,
+};
+use super::full_macos::{
+    darwin_target_dir, job_host_asset, macos_cargo_fixture, remove_target_dir, try_proven_sandbox,
+};
+use super::macos_candidate::{
+    MEASUREMENT_FILE, MacosCliCandidateFacts, macos_cli_candidate_measurement,
+};
+use super::real_fixture::{
+    environment_with_operator_values, minimal_environment, path_text, try_ordinary_ci_ambient,
+    try_prepare_vendor,
+};
+use super::spdx_candidate::{candidate_spdx_measurement, check_real_candidate};
+use super::*;
+use crate::boundary::DescendantCleanup;
+use crate::distribution::CandidateAcceptance;
+use crate::inspect::{MachoCpu, MachoPolicy, inspect_macho};
+use crate::materials::LockedMaterials;
+use crate::preflight::AuditedEnvironment;
+use crate::process::Cancellation;
+use crate::source::authenticate;
+
+/// Everything shared by both macOS CLI builds.
+struct MacosInputs<'a> {
+    fixture: &'a CargoFixture,
+    source: &'a ApprovedSource,
+    locked: &'a LockedMaterials,
+    js: &'a JsBuildCompleted,
+    apple: &'a AppleDeveloperTools,
+    asset: AssetId,
+    audited: &'a AuditedEnvironment,
+    deadline: Instant,
+    cancellation: &'a Cancellation,
+}
+
+/// One confined macOS CLI build with the private roots its output lives in.
+struct MacosBuild {
+    _materials: tempfile::TempDir,
+    _work: tempfile::TempDir,
+    completed: RecipeCompleted,
+    /// Host roots of this build that must not appear in the final bytes.
+    host_roots: Vec<String>,
+}
+
+fn fixture_io(error: std::io::Error) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Recipe)
+        .attach("macOS CLI fixture filesystem operation failed")
+        .attach(error)
+}
+
+fn close_directory(directory: Option<tempfile::TempDir>) -> Result<(), Report<ReleaseError>> {
+    directory.map_or(Ok(()), |directory| directory.close().map_err(fixture_io))
+}
+
+/// Builds the Darwin `ts` for `role` from the adopted JS handoff.
+///
+/// Each role gets its own fresh source copy, vendor tree, state and output
+/// roots and its own proven sandbox; both share the target directory beside
+/// the tool root, which is removed after each build. Setup, execution and
+/// cleanup failures are returned so reproduction stays optional.
+fn build_macos_cli(
+    inputs: &MacosInputs<'_>,
+    role: Role,
+) -> Result<MacosBuild, Report<ReleaseError>> {
+    check_build_budget(inputs.deadline, inputs.cancellation)?;
+    let target_dir = darwin_target_dir(inputs.fixture);
+    let fresh = inputs
+        .source
+        .materialize(inputs.deadline, inputs.cancellation)?;
+    let mut materials_directory = None;
+    let mut work = None;
+    let built = (|| {
+        let materials_owner = tempfile::tempdir().map_err(fixture_io)?;
+        let materials_root = fs::canonicalize(materials_owner.path()).map_err(fixture_io)?;
+        materials_directory = Some(materials_owner);
+        let materials = try_prepare_vendor(
+            inputs.fixture,
+            inputs.locked,
+            &materials_root,
+            inputs.deadline,
+            inputs.cancellation,
+        )?;
+        let work_owner = tempfile::tempdir().map_err(fixture_io)?;
+        let base = fs::canonicalize(work_owner.path()).map_err(fixture_io)?;
+        work = Some(work_owner);
+        for directory in ["cargo-state", "output"] {
+            fs::create_dir(base.join(directory)).map_err(fixture_io)?;
+        }
+        let retained = fs::canonicalize(inputs.js.rehash_for_handoff()?).map_err(fixture_io)?;
+        let artifact = inputs.asset.artifact();
+        let request = RecipeRequest::parse(&RecipeInput {
+            asset: artifact.name,
+            variant: "default",
+            role: role.spec_label(),
+            commit: inputs.source.commit().as_str(),
+            js_dir: &retained.join("bundles"),
+            js_inventory: &retained.join("tsjs-inventory.json"),
+            materials: &materials_root,
+            cargo_state: &base.join("cargo-state"),
+            output: &base.join("output"),
+            target_dir: &target_dir,
+        })?;
+        let tools = SelectedRustTools::for_tests(&inputs.fixture.tools(), artifact.target)?
+            .with_apple_developer_tools(inputs.apple.clone());
+        let prepared = PreparedRecipe::new(
+            inputs.source,
+            &fresh,
+            inputs.audited,
+            inputs.js,
+            tools,
+            materials,
+            try_ordinary_ci_ambient(role, fresh.root())?,
+            request,
+        )?;
+        let proven = try_proven_sandbox(&prepared, inputs.fixture)?;
+        let host_roots = [
+            fresh.root(),
+            materials_root.as_path(),
+            base.as_path(),
+            retained.as_path(),
+            target_dir.as_path(),
+        ]
+        .map(path_text)
+        .to_vec();
+        let completed = prepared.execute(&proven.boundary, &proven.proof)?;
+        completed.rehash_for_handoff()?;
+        Ok((completed, host_roots))
+    })();
+    // Attempt every cleanup even when setup, execution, or another cleanup fails.
+    let built = finish_cleanup(built, fresh.close());
+    let built = finish_cleanup(built, remove_target_dir(&target_dir));
+    let built = built.and_then(|(completed, host_roots)| {
+        completed.denial_receipt()?;
+        completed.recipe_definition()?;
+        Ok((completed, host_roots))
+    });
+    match built {
+        Ok((completed, host_roots)) => Ok(MacosBuild {
+            _materials: materials_directory
+                .ok_or_else(|| recipe_error("missing materials root"))?,
+            _work: work.ok_or_else(|| recipe_error("missing work root"))?,
+            completed,
+            host_roots,
+        }),
+        Err(error) => {
+            let result = finish_cleanup::<()>(Err(error), close_directory(materials_directory));
+            Err(finish_cleanup(result, close_directory(work))
+                .expect_err("should retain the failed build and cleanup errors"))
+        }
+    }
+}
+
+/// Scans the final bytes for every host and fixture root and `RUNNER_TEMP`,
+/// and returns the fixed remapped prefixes found.
+fn scan_final_bytes(bytes: &[u8], build: &MacosBuild, fixture_root: &Path) -> Vec<&'static str> {
+    let mut forbidden = build.host_roots.clone();
+    forbidden.push(path_text(fixture_root));
+    if let Some(runner_temp) = std::env::var_os("RUNNER_TEMP") {
+        forbidden.push(
+            runner_temp
+                .into_string()
+                .expect("should name RUNNER_TEMP in UTF-8"),
+        );
+    }
+    let forbidden: Vec<&str> = forbidden.iter().map(String::as_str).collect();
+    scan_remapped_bytes(bytes, &forbidden)
+        .unwrap_or_else(|error| panic!("should prove remapping in the final bytes: {error:?}"))
+        .found()
+        .to_vec()
+}
+
+/// Starts a read-only copy of the exact final bytes natively as
+/// `ts --version`, outside every build root, and removes the copy.
+fn start_natively(build: &MacosBuild) -> NativeStartupAccepted {
+    let scratch = tempfile::tempdir().expect("should create startup scratch space");
+    let base = fs::canonicalize(scratch.path()).expect("should resolve startup scratch space");
+    let copy_directory = base.join("startup-copy");
+    let home = base.join("home");
+    let tmpdir = base.join("tmp");
+    for directory in [&home, &tmpdir] {
+        fs::create_dir(directory).expect("should create private startup state");
+    }
+    let copy = StartupCopy::create_native(&build.completed, &copy_directory)
+        .expect("should copy the final bytes read-only");
+    let build_roots: Vec<&Path> = build.host_roots.iter().map(Path::new).collect();
+    let started = NativeStartupAccepted::accept_macos(
+        &build.completed,
+        copy,
+        &NativeStartupLayout {
+            copy_directory: &copy_directory,
+            home: &home,
+            tmpdir: &tmpdir,
+            build_roots: &build_roots,
+        },
+    );
+    let started =
+        started.expect("should start the copy natively on the reviewed host and remove it");
+    build
+        .completed
+        .rehash_for_handoff()
+        .expect("should leave the accepted artifact unchanged");
+    started
+}
+
+/// Encodes, prints and retains the measurement beside the Cargo fixture.
+/// Writes and prints the measurement; `candidate_spdx` is null until rendered.
+/// Returns the retained measurement so a later check can extend it.
+fn retain_measurement(
+    fixture: &CargoFixture,
+    facts: &MacosCliCandidateFacts<'_>,
+    candidate_spdx: serde_json::Value,
+    provenance: &serde_json::Value,
+) -> serde_json::Value {
+    let mut measurement = macos_cli_candidate_measurement(facts);
+    measurement["candidate_spdx"] = candidate_spdx;
+    measurement["js_inventory_sha256"] = serde_json::json!(js_inventory_sha256(facts.canonical));
+    measurement["ci_build_provenance"] = provenance.clone();
+    write_measurement(fixture, &measurement);
+    measurement
+}
+
+/// Prints and retains `measurement` as the macOS CLI candidate measurement.
+fn write_measurement(fixture: &CargoFixture, measurement: &serde_json::Value) {
+    let text = serde_json::to_string_pretty(measurement).expect("should encode the measurement");
+    println!("{text}");
+    fs::write(fixture.root.join(MEASUREMENT_FILE), text)
+        .expect("should retain the macOS CLI candidate measurement");
+}
+
+#[test]
+#[ignore = "requires the explicit macOS Cargo fixture, the exported Linux JS handoff, Xcode and a native macOS 15 runner; run separately in producer CI"]
+fn macos_cli_candidate_builds_inspects_and_starts_cleanly() {
+    // Read before measuring Xcode so a missing selection fails in seconds.
+    let native_reproduction = native_reproduction_from_env();
+    let asset = job_host_asset();
+    let target = asset.artifact().target;
+    let fixture = macos_cargo_fixture();
+    let provenance = ci_build_provenance(&fixture);
+    let commit = CommitId::parse(&fixture.source_commit).expect("should parse the fixture commit");
+    let source = authenticate(
+        &fixture.root.join("source"),
+        &commit,
+        &minimal_environment(),
+    )
+    .expect("should authenticate the fixture's tracked source");
+    let locked = LockedMaterials::from_source(&source).expect("should derive the locked materials");
+    let exported = std::env::var_os("TS_RELEASE_JS_HANDOFF_ROOT")
+        .map(PathBuf::from)
+        .expect("should explicitly supply the downloaded JS handoff root");
+    let exported = fs::canonicalize(exported).expect("should resolve the JS handoff root");
+    let (handoff, js_measurement) =
+        JsBuildCompleted::read_exported_ordinary_ci_handoff_for_tests(&exported)
+            .expect("should read exactly the exported handoff and measurement");
+    let (js, js_handoff) =
+        JsBuildCompleted::adopt_ordinary_ci_handoff_for_tests(&source, &handoff, &js_measurement)
+            .expect("should adopt the Linux job's handoff for this source");
+    // One attempt covers the canonical build, the measured reproduction and
+    // the later Apple re-verification, SPDX and index-entry checks. On
+    // macos-15-intel the canonical build alone measured 24 minutes and the
+    // two-job reproduction is slower, so 60 minutes left no margin.
+    let deadline = Instant::now() + Duration::from_secs(120 * 60);
+    let cancellation = Cancellation::default();
+    let apple = AppleDeveloperTools::for_ordinary_ci(deadline, &cancellation)
+        .expect("should measure the selected Xcode");
+    let host = measure_host_identity().expect("should measure the macOS host");
+    let (audited, removed) = environment_with_operator_values();
+    let inputs = MacosInputs {
+        fixture: &fixture,
+        source: &source,
+        locked: &locked,
+        js: &js,
+        apple: &apple,
+        asset,
+        audited: &audited,
+        deadline,
+        cancellation: &cancellation,
+    };
+
+    let canonical = build_macos_cli(&inputs, Role::Canonical).unwrap_or_else(|error| {
+        panic!("should build the canonical Darwin ts through the confined recipe: {error:?}")
+    });
+    assert_eq!(
+        canonical.completed.descendant_cleanup(),
+        DescendantCleanup::ReapedAfterRun,
+        "should record the post-run-reaped cleanup"
+    );
+    let bytes = read_artifact(&canonical.completed).expect("should reread the final bytes");
+    let cpu = match target {
+        ReleaseTarget::Aarch64AppleDarwin => MachoCpu::Arm64,
+        ReleaseTarget::X86_64AppleDarwin => MachoCpu::X86_64,
+        other => panic!("should build a Darwin asset, not {}", other.triple()),
+    };
+    let macho = inspect_macho(&bytes, &MachoPolicy::macos(cpu))
+        .expect("should accept the final bytes under the reviewed Mach-O policy");
+    macho
+        .require_debug_map()
+        .expect("should keep the relative debug map");
+    assert_eq!(
+        macho.sdk(),
+        apple.sdk_version(),
+        "should record the measured SDK"
+    );
+    let remap_found = scan_final_bytes(&bytes, &canonical, &fixture.root);
+    let planted: Vec<&str> = OPERATOR_SENTINELS.iter().map(|(_, value)| *value).collect();
+    check_operator_values_absent(&bytes, &planted)
+        .expect("should embed none of the planted operator values");
+    let startup = start_natively(&canonical);
+    let facts = |reproduction| MacosCliCandidateFacts {
+        canonical: &canonical.completed,
+        macho: &macho,
+        apple: &apple,
+        host: &host,
+        js_handoff: &js_handoff,
+        remap_found: &remap_found,
+        operator_values_removed: &removed,
+        startup_stdout: startup.macos_stdout(),
+        reproduction,
+    };
+    retain_measurement(
+        &fixture,
+        &facts(ReproductionOutcome::NotAttempted),
+        serde_json::Value::Null,
+        &provenance,
+    );
+    let canonical_candidate = check_real_candidate(&canonical.completed, &source);
+
+    let reproduction_build = match native_reproduction {
+        NativeReproduction::Measure => Some(build_macos_cli(&inputs, Role::Reproduction)),
+        NativeReproduction::Defer => None,
+    };
+    let reproduction_candidate = reproduction_build
+        .as_ref()
+        .and_then(|build| build.as_ref().ok())
+        .map(|reproduction| check_real_candidate(&reproduction.completed, &source));
+    let paired = reproduction_build.as_ref().map(|build| {
+        reproduction_result(
+            build
+                .as_ref()
+                .map_err(|error| recipe_error(format!("{error:?}"))),
+            |reproduction| {
+                measure_native_repeatability(&canonical.completed, &reproduction.completed)
+            },
+        )
+    });
+    let reproduction = match &paired {
+        None => ReproductionOutcome::Deferred,
+        Some((Ok(measured), _)) => ReproductionOutcome::Measured(measured),
+        Some((Err(error), Some(_))) => ReproductionOutcome::InvariantFailed(error.clone()),
+        Some((Err(error), None)) => ReproductionOutcome::BuildFailed(error.clone()),
+    };
+    let mut measurement = retain_measurement(
+        &fixture,
+        &facts(reproduction),
+        candidate_spdx_measurement(&canonical_candidate, reproduction_candidate.as_ref()),
+        &provenance,
+    );
+    if let Some((_, Some(error))) = &paired {
+        panic!("should pair builds over identical inputs: {error:?}");
+    }
+    let upload_directory = fixture.root.join("candidate-entry");
+    let transfer_file = fixture.root.join("candidate-entry-transfer.json");
+    measurement["candidate_entry"] = check_real_entry(
+        &canonical.completed,
+        &source,
+        &CandidateAcceptance::Native(&startup),
+        &EntryExport {
+            upload_directory: &upload_directory,
+            transfer_file: &transfer_file,
+        },
+    );
+    write_measurement(&fixture, &measurement);
+    super::candidate::check_native_export_after_cleanup(
+        canonical,
+        |build| &build.completed,
+        &startup,
+    );
+    if let Some(Ok(reproduction)) = reproduction_build {
+        super::candidate::check_export_after_cleanup(reproduction, |build| &build.completed);
+    }
+}
diff --git a/crates/trusted-server-release/src/recipe/tests/native.rs b/crates/trusted-server-release/src/recipe/tests/native.rs
new file mode 100644
index 0000000000..e097c0fe33
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/tests/native.rs
@@ -0,0 +1,477 @@
+//! Native repeatability measurement, operator value scan and Linux startup
+//! acceptance, over fictional builds and outputs.
+
+use std::fs;
+use std::os::unix::fs::PermissionsExt as _;
+
+use object::elf as elf_format;
+
+use super::super::native::{
+    check_operator_values_absent, elf_section_at, measure_native_repeatability,
+};
+use super::super::startup::{
+    LINUX_CLI_ASSET, StartupCopy, StartupDistribution, StartupImage, check_startup_output,
+    expected_version_output, startup_arguments,
+};
+use super::complete::{Built, built};
+use super::complete_darwin::darwin_executable;
+use super::*;
+use crate::inspect::tests::builders::{ElfSpec, elf};
+use crate::process::{ProcessOutcome, Stream};
+
+const CLI_MANIFEST: &str = include_str!(concat!(
+    env!("CARGO_MANIFEST_DIR"),
+    "/../trusted-server-cli/Cargo.toml"
+));
+const RELEASE_MANIFEST: &str = include_str!(concat!(env!("CARGO_MANIFEST_DIR"), "/Cargo.toml"));
+
+/// A completed fictional build with the fixture roots its output lives in.
+struct NativeBuild {
+    _built: Built,
+    completed: RecipeCompleted,
+}
+
+/// Completes a fictional build of `asset` for `role` with exactly `bytes`.
+fn native_build(asset: &'static str, role: Role, bytes: &[u8]) -> NativeBuild {
+    let mut built = built(asset, role, bytes);
+    let stdout = built.stdout(|_| {});
+    let completed = built.finish(stdout).expect("should complete the build");
+    NativeBuild {
+        _built: built,
+        completed,
+    }
+}
+
+/// A conforming Linux executable whose `.debug_info` holds `info`.
+fn linux_executable(info: &'static [u8]) -> Vec<u8> {
+    elf(&ElfSpec {
+        payload: b"/trusted-server/src/main.rs",
+        debug_sections: vec![
+            (".debug_info", elf_format::SHT_PROGBITS, info),
+            (
+                ".debug_line",
+                elf_format::SHT_PROGBITS,
+                b"fictional dwarf lines",
+            ),
+        ],
+        ..ElfSpec::conforming()
+    })
+}
+
+#[test]
+fn identical_native_pair_is_measured_as_identical() {
+    let bytes = linux_executable(b"fictional dwarf info");
+    let canonical = native_build(LINUX_CLI_ASSET, Role::Canonical, &bytes);
+    let reproduction = native_build(LINUX_CLI_ASSET, Role::Reproduction, &bytes);
+
+    let measured = measure_native_repeatability(&canonical.completed, &reproduction.completed)
+        .expect("should measure the pair");
+
+    assert!(measured.identical(), "should record identical final bytes");
+    assert_eq!(
+        measured.canonical(),
+        measured.reproduction(),
+        "should report one identity for identical bytes"
+    );
+    assert_eq!(
+        measured.asset().artifact().name,
+        LINUX_CLI_ASSET,
+        "should name the measured asset"
+    );
+}
+
+#[test]
+fn differing_native_pair_is_recorded_not_rejected() {
+    let canonical = native_build(
+        LINUX_CLI_ASSET,
+        Role::Canonical,
+        &linux_executable(b"fictional dwarf info"),
+    );
+    let reproduction = native_build(
+        LINUX_CLI_ASSET,
+        Role::Reproduction,
+        &linux_executable(b"fictional dwarf inf0"),
+    );
+
+    let measured = measure_native_repeatability(&canonical.completed, &reproduction.completed)
+        .expect("should record a nonmatching native pair as a measurement");
+
+    assert!(!measured.identical(), "should record the difference");
+    let difference = measured.difference().expect("should locate the difference");
+    assert_eq!(difference.differing_bytes, 1, "should count one byte");
+    assert_eq!(
+        difference.canonical_section.as_deref(),
+        Some(".debug_info"),
+        "should name the section holding the first difference"
+    );
+    assert_ne!(
+        measured.canonical().sha256,
+        measured.reproduction().sha256,
+        "should report both digests"
+    );
+}
+
+#[test]
+fn native_measurement_rejects_fastly_and_mismatched_pairs() {
+    let bytes = linux_executable(b"fictional dwarf info");
+    let canonical = native_build(LINUX_CLI_ASSET, Role::Canonical, &bytes);
+    let second_canonical = native_build(LINUX_CLI_ASSET, Role::Canonical, &bytes);
+    assert!(
+        measure_native_repeatability(&canonical.completed, &second_canonical.completed).is_err(),
+        "should require a canonical then a reproduction build"
+    );
+    let other = native_build(
+        "ts-aarch64-apple-darwin",
+        Role::Reproduction,
+        &darwin_executable(),
+    );
+    assert!(
+        measure_native_repeatability(&canonical.completed, &other.completed).is_err(),
+        "should compare one asset only"
+    );
+    let module = super::complete::wasm_with(&[(".debug_info", b"i"), (".debug_line", b"l")]);
+    let fastly = native_build("trusted-server-fastly.wasm", Role::Canonical, &module);
+    let fastly_reproduction =
+        native_build("trusted-server-fastly.wasm", Role::Reproduction, &module);
+    assert!(
+        measure_native_repeatability(&fastly.completed, &fastly_reproduction.completed).is_err(),
+        "should leave Fastly to the equality gate"
+    );
+}
+
+#[test]
+fn elf_sections_are_named_only_inside_file_bytes() {
+    let bytes = linux_executable(b"fictional dwarf info");
+    assert_eq!(
+        elf_section_at(b"fictional text, not an executable", 3),
+        None,
+        "should name nothing in non-ELF bytes"
+    );
+    assert_eq!(
+        elf_section_at(&bytes, bytes.len() + 10),
+        None,
+        "should name nothing past the end"
+    );
+}
+
+#[test]
+fn planted_operator_values_must_be_absent() {
+    let bytes = b"fictional rodata publisher.example.com";
+    check_operator_values_absent(bytes, &["ts-operator-sentinel-0001.example"])
+        .expect("should accept bytes without the planted value");
+    for (label, values) in [
+        ("present", vec!["publisher.example.com"]),
+        ("too short", vec!["example"]),
+        ("empty list", Vec::new()),
+    ] {
+        assert!(
+            check_operator_values_absent(bytes, &values).is_err(),
+            "should reject a {label} scan"
+        );
+    }
+}
+
+#[test]
+fn startup_distributions_are_the_reviewed_tag_pinned_set() {
+    let labels: Vec<&str> = StartupDistribution::ALL
+        .iter()
+        .map(|distribution| distribution.label())
+        .collect();
+    assert_eq!(labels, ["ubi9", "ubuntu-22.04", "debian-12"]);
+    for distribution in StartupDistribution::ALL {
+        assert_eq!(
+            StartupDistribution::parse(distribution.label()).expect("should parse its label"),
+            distribution,
+            "should round-trip {}",
+            distribution.label()
+        );
+        let tag = distribution
+            .reference()
+            .rsplit_once('/')
+            .and_then(|(_, name)| name.split_once(':'))
+            .map(|(_, tag)| tag);
+        assert!(
+            tag.is_some_and(|tag| tag != "latest" && !tag.is_empty()),
+            "should pin {} by an explicit tag",
+            distribution.label()
+        );
+    }
+    assert!(StartupDistribution::parse("alpine-3").is_err());
+}
+
+#[test]
+fn startup_images_are_selected_by_local_image_id_only() {
+    let id = format!("sha256:{}", "a".repeat(64));
+    let image = StartupImage::new(StartupDistribution::Debian12, &id).expect("should accept");
+    assert_eq!(image.id(), id, "should keep the image ID");
+    for rejected in [
+        "docker.io/library/debian:12".to_owned(),
+        format!("sha256:{}", "A".repeat(64)),
+        format!("sha256:{}", "a".repeat(63)),
+    ] {
+        assert!(
+            StartupImage::new(StartupDistribution::Debian12, &rejected).is_err(),
+            "should reject {rejected:?}"
+        );
+    }
+}
+
+#[test]
+fn startup_container_is_offline_read_only_unprivileged_and_bounded() {
+    let config = Path::new("/example/docker-config");
+    let id = format!("sha256:{}", "b".repeat(64));
+    let image = StartupImage::new(StartupDistribution::Ubi9, &id).expect("should accept");
+
+    let arguments: Vec<String> = startup_arguments(
+        config,
+        &image,
+        Path::new("/example/startup-copy"),
+        "ts-release-startup-example",
+    )
+    .into_iter()
+    .map(|argument| argument.into_string().expect("should be UTF-8"))
+    .collect();
+
+    assert!(
+        arguments.iter().any(|argument| argument == "--init"),
+        "should reap container descendants"
+    );
+    assert!(
+        arguments
+            .iter()
+            .any(|argument| argument.starts_with("--name=")),
+        "should own a named container for cleanup"
+    );
+    assert!(
+        arguments.iter().any(|argument| argument == "create"),
+        "should acknowledge creation before starting guest code"
+    );
+    assert!(
+        !arguments
+            .iter()
+            .any(|argument| argument == "run" || argument == "--rm"),
+        "should retain the created identity through explicit cleanup"
+    );
+    let expected: Vec<String> = [
+        "--config",
+        "/example/docker-config",
+        "--host",
+        "unix:///var/run/docker.sock",
+        "create",
+        "--init",
+        "--name=ts-release-startup-example",
+        "--pull=never",
+        "--network=none",
+        "--read-only",
+        "--user=65534:65534",
+        "--cap-drop=ALL",
+        "--security-opt=no-new-privileges",
+        "--pids-limit=64",
+        "--memory=268435456",
+        "--cpus=1",
+        "--ulimit=cpu=30:30",
+        "--workdir=/",
+        "--mount=type=bind,source=/example/startup-copy,target=/opt/ts,readonly",
+        "--entrypoint=/opt/ts/ts",
+        id.as_str(),
+        "--version",
+    ]
+    .into_iter()
+    .map(str::to_owned)
+    .collect();
+    assert_eq!(
+        arguments, expected,
+        "should run exactly the bounded container"
+    );
+}
+
+#[test]
+fn startup_output_must_be_exactly_the_build_facts_with_exit_zero() {
+    let commit = CommitId::parse(COMMIT).expect("should parse the commit");
+    let expected = expected_version_output(&commit, ReleaseTarget::X86_64UnknownLinuxGnu);
+    assert_eq!(
+        expected,
+        format!(
+            "ts package={} source={COMMIT} target=x86_64-unknown-linux-gnu variant=default\n",
+            env!("CARGO_PKG_VERSION")
+        ),
+        "should print the four labeled owning build facts"
+    );
+    let distribution = StartupDistribution::Ubuntu2204;
+    let success = ProcessOutcome::Exited { code: 0 };
+    check_startup_output(distribution, success, expected.as_bytes(), &expected)
+        .expect("should accept the exact version line");
+    let without_newline = expected.trim_end();
+    let with_fallback = format!("{expected}loaded fallback configuration\n");
+    let cases: [(&str, ProcessOutcome, &[u8]); 5] = [
+        ("loader failure", ProcessOutcome::Exited { code: 127 }, b""),
+        ("timeout", ProcessOutcome::TimedOut, expected.as_bytes()),
+        (
+            "output cap",
+            ProcessOutcome::OutputLimit {
+                stream: Stream::Stdout,
+            },
+            expected.as_bytes(),
+        ),
+        ("truncated line", success, without_newline.as_bytes()),
+        ("configuration fallback", success, with_fallback.as_bytes()),
+    ];
+    for (label, outcome, stdout) in cases {
+        assert!(
+            check_startup_output(distribution, outcome, stdout, &expected).is_err(),
+            "should reject a {label}"
+        );
+    }
+}
+
+#[test]
+fn cli_and_producer_share_the_workspace_package_version() {
+    assert!(
+        CLI_MANIFEST.contains("version = { workspace = true }"),
+        "should inherit the CLI version from the workspace"
+    );
+    assert!(
+        RELEASE_MANIFEST.contains("version.workspace = true"),
+        "should inherit the producer version from the workspace"
+    );
+}
+
+#[test]
+fn startup_copy_is_read_only_rehashed_and_linux_only() {
+    let bytes = linux_executable(b"fictional dwarf info");
+    let build = native_build(LINUX_CLI_ASSET, Role::Canonical, &bytes);
+    let scratch = tempfile::tempdir().expect("should create scratch space");
+    let base = fs::canonicalize(scratch.path()).expect("should resolve scratch space");
+    let directory = base.join("startup-copy");
+
+    let copy = StartupCopy::create(&build.completed, &directory).expect("should copy");
+
+    let mode = |path: &Path| {
+        fs::metadata(path)
+            .expect("should inspect the copy")
+            .permissions()
+            .mode()
+            & 0o777
+    };
+    assert_eq!(mode(&directory), 0o555, "should seal the copy directory");
+    assert_eq!(mode(&directory.join("ts")), 0o555, "should seal the copy");
+    fs::set_permissions(directory.join("ts"), fs::Permissions::from_mode(0o644))
+        .expect("should reopen the fictional copy for the tamper case");
+    fs::write(directory.join("ts"), b"tampered").expect("should tamper with the copy");
+    assert!(copy.verify().is_err(), "should detect a changed copy");
+    copy.remove().expect("should remove the copy");
+    assert!(!directory.exists(), "should leave nothing behind");
+
+    assert!(
+        StartupCopy::create(&build.completed, &base.join("startup,copy")).is_err(),
+        "should refuse a directory that would split the bind mount"
+    );
+    let other = native_build(
+        "ts-aarch64-apple-darwin",
+        Role::Canonical,
+        &darwin_executable(),
+    );
+    assert!(
+        StartupCopy::create(&other.completed, &base.join("other-copy")).is_err(),
+        "should start only the Linux executable"
+    );
+}
+
+#[test]
+fn native_startup_copy_is_sealed_and_darwin_only() {
+    let darwin = native_build(
+        "ts-aarch64-apple-darwin",
+        Role::Canonical,
+        &darwin_executable(),
+    );
+    let scratch = tempfile::tempdir().expect("should create scratch space");
+    let base = fs::canonicalize(scratch.path()).expect("should resolve scratch space");
+    let directory = base.join("native-copy");
+
+    let copy = StartupCopy::create_native(&darwin.completed, &directory).expect("should copy");
+
+    let mode = |path: &Path| {
+        fs::metadata(path)
+            .expect("should inspect the copy")
+            .permissions()
+            .mode()
+            & 0o777
+    };
+    assert_eq!(mode(&directory), 0o555, "should seal the copy directory");
+    assert_eq!(mode(&directory.join("ts")), 0o555, "should seal the copy");
+    copy.verify().expect("should rehash the untouched copy");
+    copy.remove().expect("should remove the copy");
+
+    let linux = native_build(
+        LINUX_CLI_ASSET,
+        Role::Canonical,
+        &linux_executable(b"fictional dwarf info"),
+    );
+    assert!(
+        StartupCopy::create_native(&linux.completed, &base.join("linux-copy")).is_err(),
+        "should start only Darwin executables natively"
+    );
+    assert!(
+        StartupCopy::create_native(&darwin.completed, Path::new("relative-copy")).is_err(),
+        "should refuse a relative copy directory"
+    );
+}
+
+#[test]
+fn startup_copy_rejects_aliases_links_and_extra_entries() {
+    for change in ["symlink", "hardlink", "extra", "oversize"] {
+        let bytes = linux_executable(b"fictional dwarf info");
+        let build = native_build(LINUX_CLI_ASSET, Role::Canonical, &bytes);
+        let scratch = tempfile::tempdir().expect("should create scratch space");
+        let base = fs::canonicalize(scratch.path()).expect("should resolve scratch space");
+        let directory = base.join("startup-copy");
+        let copy = StartupCopy::create(&build.completed, &directory).expect("should create copy");
+        fs::set_permissions(&directory, fs::Permissions::from_mode(0o700))
+            .expect("should reopen directory");
+        let executable = directory.join("ts");
+        match change {
+            "symlink" => {
+                let outside = base.join("outside");
+                fs::write(&outside, &bytes).expect("should write same bytes");
+                fs::remove_file(&executable).expect("should unlink original");
+                symlink(&outside, &executable).expect("should replace with alias");
+            }
+            "hardlink" => {
+                fs::hard_link(&executable, base.join("second-link")).expect("should add link")
+            }
+            "extra" => {
+                fs::write(directory.join("extra"), b"extra").expect("should add extra entry")
+            }
+            "oversize" => {
+                fs::set_permissions(&executable, fs::Permissions::from_mode(0o600))
+                    .expect("should reopen copy");
+                fs::OpenOptions::new()
+                    .write(true)
+                    .open(&executable)
+                    .expect("should open copy")
+                    .set_len(super::super::artifact::EXECUTABLE_LIMIT + 1)
+                    .expect("should grow sparse file");
+            }
+            _ => unreachable!(),
+        }
+        assert!(copy.verify().is_err(), "should reject {change}");
+        copy.remove().expect("should remove rejected copy");
+    }
+}
+
+#[test]
+fn startup_copy_drop_removes_copy_after_an_abandoned_run() {
+    let bytes = linux_executable(b"fictional dwarf info");
+    let build = native_build(LINUX_CLI_ASSET, Role::Canonical, &bytes);
+    let scratch = tempfile::tempdir().expect("should create scratch space");
+    let directory = fs::canonicalize(scratch.path())
+        .expect("should resolve scratch space")
+        .join("startup-copy");
+    {
+        let _copy = StartupCopy::create(&build.completed, &directory).expect("should copy");
+    }
+    assert!(
+        !directory.exists(),
+        "should attempt cleanup when explicit removal is skipped"
+    );
+}
diff --git a/crates/trusted-server-release/src/recipe/tests/plan.rs b/crates/trusted-server-release/src/recipe/tests/plan.rs
new file mode 100644
index 0000000000..ab0cced30a
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/tests/plan.rs
@@ -0,0 +1,772 @@
+use std::collections::BTreeMap;
+use std::ffi::OsString;
+use std::path::PathBuf;
+
+use super::super::paths::PrefixPaths;
+use super::super::plan::CargoQuery;
+use super::complete::{built, wasm_with};
+use super::fixture::*;
+use super::*;
+use crate::policy::FIXED_ARTIFACTS;
+use crate::preflight::audit_environment;
+
+/// The exact source-replacement pairs for the fixture's fictional Git source.
+fn expected_replacement() -> Vec<String> {
+    [
+        "--config",
+        "source.crates-io.replace-with=\"ts-vendor\"",
+        "--config",
+        "source.\"git+https://example.com/org/workspace?tag=v1\".git=\"https://example.com/org/workspace\"",
+        "--config",
+        "source.\"git+https://example.com/org/workspace?tag=v1\".tag=\"v1\"",
+        "--config",
+        "source.\"git+https://example.com/org/workspace?tag=v1\".replace-with=\"ts-vendor\"",
+        "--config",
+        "source.ts-vendor.directory=\"/boundary/immutable/2/vendor\"",
+    ]
+    .into_iter()
+    .map(str::to_owned)
+    .collect()
+}
+
+/// Execution path of the fictional Apple clang in the fixture layout.
+const FIXTURE_CLANG: &str = "/boundary/system/0/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang";
+
+#[test]
+fn gnu_plan_pins_native_tools_and_rejects_backend_fallback() {
+    let fixture = Fixture::new(COMMIT);
+    let prepared = fixture
+        .bind("ts-x86_64-unknown-linux-gnu", Role::Canonical)
+        .expect("should bind GNU recipe");
+    let plan = prepared
+        .plan(&fixture.paths(Role::Canonical))
+        .expect("should derive GNU plan");
+    for (name, expected) in [
+        ("CC_x86_64_unknown_linux_gnu", "/usr/bin/gcc"),
+        ("AR_x86_64_unknown_linux_gnu", "/usr/bin/ar"),
+        ("HOST_CC", "/usr/bin/gcc"),
+        ("HOST_AR", "/usr/bin/ar"),
+        ("AWS_LC_SYS_CMAKE_BUILDER", "0"),
+        ("AWS_LC_SYS_CMAKE_BUILDER_x86_64_unknown_linux_gnu", "0"),
+    ] {
+        assert_eq!(
+            plan.environment.get(name).map(String::as_str),
+            Some(expected),
+            "should enforce {name}"
+        );
+    }
+    assert!(
+        plan.arguments
+            .iter()
+            .any(|argument| argument
+                == "target.\"x86_64-unknown-linux-gnu\".linker=\"/usr/bin/gcc\""),
+        "should select the reviewed linker driver"
+    );
+    plan.confined_command(crate::process::ProcessLimits {
+        wall: std::time::Duration::from_secs(1),
+        stdout_max: 1024,
+        stderr_max: 1024,
+    })
+    .expect("should accept reviewed backend controls");
+}
+
+#[test]
+fn pure_completion_fixture_cannot_export_a_source_owned_recipe_definition() {
+    let bytes = wasm_with(&[(".debug_info", b"i"), (".debug_line", b"l")]);
+    let mut build = built("trusted-server-fastly.wasm", Role::Canonical, &bytes);
+    let stdout = build.stdout(|_| {});
+    let completed = build
+        .finish(stdout)
+        .expect("should complete the accepted pure fixture");
+    assert!(
+        completed.recipe_definition().is_err(),
+        "should require the actual approved source binding to export a shared recipe definition"
+    );
+}
+
+#[test]
+fn recipe_binding_keeps_checked_module_facts_and_explicit_fixture_source() {
+    let fixture = Fixture::new(COMMIT);
+    let prepared = fixture
+        .bind(FIXED_ARTIFACTS[0].name, Role::Canonical)
+        .expect("should bind pure recipe fixture");
+    assert!(
+        matches!(prepared.workspace, WorkspaceSelection::Fixture),
+        "should label the source authority bypass as test-only"
+    );
+    assert_eq!(
+        prepared.js.modules.len(),
+        1,
+        "should bind the exact prepared JS module facts"
+    );
+    assert_eq!(
+        prepared.js.modules[0].id(),
+        "core",
+        "should derive module identity from the owned handoff"
+    );
+}
+
+#[test]
+fn composition_queries_keep_selected_tools_environment_and_source_replacement() {
+    for artifact in FIXED_ARTIFACTS {
+        let fixture = Fixture::new(COMMIT);
+        let prepared = fixture
+            .bind(artifact.name, Role::Canonical)
+            .expect("should bind the selected recipe");
+        let plan = prepared
+            .plan(&fixture.paths(Role::Canonical))
+            .expect("should derive the selected plan");
+        for kind in [CargoQuery::Metadata, CargoQuery::Tree] {
+            let query = plan
+                .observation_query(kind)
+                .expect("should derive the bounded query");
+            assert_eq!(query.program, plan.program, "should use the selected Cargo");
+            assert_eq!(
+                query.environment, plan.environment,
+                "should retain the sanitized build environment"
+            );
+            assert_eq!(
+                query.working_directory, plan.working_directory,
+                "should retain the source root"
+            );
+            assert_eq!(query.umask, plan.umask, "should retain the selected umask");
+            let configs = |arguments: &[String]| {
+                arguments
+                    .windows(2)
+                    .filter(|pair| pair[0] == "--config")
+                    .map(|pair| pair[1].clone())
+                    .collect::<Vec<_>>()
+            };
+            assert_eq!(
+                configs(&query.arguments),
+                configs(&plan.arguments),
+                "should retain every source/tool/remap config"
+            );
+            assert!(
+                query.arguments.iter().any(|value| value == "--frozen"),
+                "should prohibit new resolution"
+            );
+            match kind {
+                CargoQuery::Metadata => assert!(
+                    !query
+                        .arguments
+                        .iter()
+                        .any(|value| value == "--filter-platform" || value == "--target"),
+                    "should retain host-only package identities in the metadata catalog"
+                ),
+                CargoQuery::Tree => assert!(
+                    query
+                        .arguments
+                        .windows(2)
+                        .any(|pair| pair == ["--target", artifact.target.triple()]),
+                    "should select the exact target for graph observations"
+                ),
+            }
+            assert_ne!(
+                query.digest().expect("should hash the query"),
+                plan.digest().expect("should hash the build")
+            );
+        }
+    }
+}
+
+/// The exact target path remap for the fixture's mount layout, with the
+/// Darwin debug-map prefix and target linker for a Darwin target.
+fn expected_remap(target: ReleaseTarget) -> Vec<String> {
+    let triple = target.triple();
+    let mut flags = vec![
+        "\"--remap-path-prefix=/boundary/immutable/0=/trusted-server\"",
+        "\"--remap-path-prefix=/boundary/immutable/2/vendor=/cargo-vendor\"",
+        "\"--remap-path-prefix=/boundary/writable/0/cargo-home=/cargo-home\"",
+        "\"--remap-path-prefix=/boundary/tool/0=/rust-tools\"",
+        "\"--remap-path-prefix=/boundary/writable/1=/cargo-target\"",
+    ];
+    if target.is_darwin() {
+        flags.push("\"-Clink-arg=-Wl,-oso_prefix,/boundary/tool/\"");
+    }
+    let mut arguments = vec![
+        "--config".to_owned(),
+        format!("target.\"{triple}\".rustflags=[{}]", flags.join(",")),
+    ];
+    if target.is_darwin() {
+        arguments.push("--config".to_owned());
+        arguments.push(format!("target.\"{triple}\".linker=\"{FIXTURE_CLANG}\""));
+    }
+    if target == ReleaseTarget::X86_64UnknownLinuxGnu {
+        arguments.extend([
+            "--config".to_owned(),
+            "target.\"x86_64-unknown-linux-gnu\".linker=\"/usr/bin/gcc\"".to_owned(),
+        ]);
+    }
+    if target == ReleaseTarget::Wasm32Wasip1
+        && cfg!(all(target_os = "linux", target_arch = "x86_64"))
+    {
+        arguments.extend([
+            "--config".to_owned(),
+            "target.\"x86_64-unknown-linux-gnu\".linker=\"/usr/bin/cc\"".to_owned(),
+            "--config".to_owned(),
+            "target.\"wasm32-wasip1\".linker=\"/boundary/tool/0/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld\"".to_owned(),
+        ]);
+    }
+    arguments
+}
+
+/// The exact C path remap a native asset's plan sets for the fixture layout.
+fn expected_c_prefix_map(target: ReleaseTarget) -> String {
+    let developer = [("/boundary/system/0", "/apple-developer")];
+    [
+        ("/boundary/immutable/0", "/trusted-server"),
+        ("/boundary/immutable/2/vendor", "/cargo-vendor"),
+        ("/boundary/writable/0/cargo-home", "/cargo-home"),
+        ("/boundary/tool/0", "/rust-tools"),
+        ("/boundary/writable/1", "/cargo-target"),
+    ]
+    .iter()
+    .chain(developer.iter().filter(|_| target.is_darwin()))
+    .flat_map(|(from, to)| {
+        [
+            format!("-ffile-prefix-map={from}={to}"),
+            format!("-fdebug-prefix-map={from}={to}"),
+        ]
+    })
+    .collect::<Vec<_>>()
+    .join(" ")
+}
+
+#[test]
+fn cargo_plan_has_fixed_release_frozen_json_flags_and_exact_source_replacement() {
+    assert!(
+        !FIXED_ARTIFACTS.is_empty(),
+        "should select a nonzero number of assets"
+    );
+    for (index, artifact) in FIXED_ARTIFACTS.iter().enumerate() {
+        let role = if index % 2 == 0 {
+            Role::Canonical
+        } else {
+            Role::Reproduction
+        };
+        let jobs = if role == Role::Canonical { "4" } else { "2" };
+        let fixture = Fixture::new(COMMIT);
+        let prepared = fixture
+            .bind(artifact.name, role)
+            .expect("should bind every fixed asset");
+        let plan = prepared
+            .plan(&fixture.paths(role))
+            .expect("should derive the plan");
+        let mut expected_arguments: Vec<String> = [
+            "build",
+            "--package",
+            artifact.package,
+            "--bin",
+            artifact.bin,
+            "--target",
+            artifact.target.triple(),
+            "--release",
+            "--frozen",
+        ]
+        .into_iter()
+        .map(str::to_owned)
+        .collect();
+        expected_arguments.extend(expected_replacement());
+        expected_arguments.extend(expected_remap(artifact.target));
+        expected_arguments.extend(
+            ["--message-format=json-render-diagnostics", "--jobs", jobs]
+                .into_iter()
+                .map(str::to_owned),
+        );
+        assert_eq!(
+            plan.arguments, expected_arguments,
+            "should use the exact fixed arguments for {}",
+            artifact.name
+        );
+        assert_eq!(
+            plan.program,
+            fixture.base.join("tools/bin/cargo"),
+            "should run the selected Cargo by its host path"
+        );
+        let checkout = if role == Role::Canonical {
+            "checkout-canonical"
+        } else {
+            "checkout-reproduction"
+        };
+        assert_eq!(
+            plan.working_directory,
+            fixture.base.join(checkout),
+            "should run in the role checkout by its host path"
+        );
+        assert_environment(&plan.environment, &fixture, artifact.target);
+        prepared
+            .plan(&fixture.paths(role))
+            .expect("should derive the plan again");
+    }
+}
+
+fn assert_environment(actual: &BTreeMap<String, String>, fixture: &Fixture, target: ReleaseTarget) {
+    let mut expected: BTreeMap<String, String> = [
+        ("AWS_LC_SYS_USE_SYSTEM", "0"),
+        ("CARGO_HOME", "/boundary/writable/0/cargo-home"),
+        ("CARGO_TARGET_DIR", "/boundary/writable/1"),
+        ("HOME", "/boundary/writable/0/home"),
+        ("LC_ALL", "C"),
+        ("LIBSQLITE3_SYS_USE_PKG_CONFIG", "0"),
+        ("PATH", "/boundary/tool/0/bin:/usr/bin:/bin"),
+        ("RUSTC", "/boundary/tool/0/bin/rustc"),
+        ("SOURCE_DATE_EPOCH", "1700000000"),
+        ("TMPDIR", "/boundary/writable/0/tmp"),
+        ("TRUSTED_SERVER__GIT_VERSION", COMMIT),
+        ("TRUSTED_SERVER__RELEASE_BUILD", "1"),
+        (
+            "TRUSTED_SERVER__TSJS_PREBUILT_INVENTORY",
+            "/boundary/immutable/1/tsjs-inventory.json",
+        ),
+        ("TSJS_PREBUILT_DIR", "/boundary/immutable/1/bundles"),
+        ("TZ", "UTC"),
+    ]
+    .into_iter()
+    .map(|(name, value)| (name.to_owned(), value.to_owned()))
+    .collect();
+    expected.insert(
+        format!(
+            "AWS_LC_SYS_USE_SYSTEM_{}",
+            target.triple().replace('-', "_")
+        ),
+        "0".to_owned(),
+    );
+    let underscored = target.triple().replace('-', "_");
+    if target == ReleaseTarget::X86_64UnknownLinuxGnu {
+        for (name, value) in [
+            ("CC_x86_64_unknown_linux_gnu", "/usr/bin/gcc"),
+            ("AR_x86_64_unknown_linux_gnu", "/usr/bin/ar"),
+            ("HOST_CC", "/usr/bin/gcc"),
+            ("HOST_AR", "/usr/bin/ar"),
+            ("AWS_LC_SYS_CMAKE_BUILDER", "0"),
+            ("AWS_LC_SYS_CMAKE_BUILDER_x86_64_unknown_linux_gnu", "0"),
+        ] {
+            expected.insert(name.to_owned(), value.to_owned());
+        }
+    }
+    if target == ReleaseTarget::Wasm32Wasip1
+        && cfg!(all(target_os = "linux", target_arch = "x86_64"))
+    {
+        expected.insert("HOST_CC".to_owned(), "/usr/bin/cc".to_owned());
+        expected.insert("HOST_AR".to_owned(), "/usr/bin/ar".to_owned());
+    }
+    if target.is_darwin() {
+        let bin = "/boundary/system/0/Toolchains/XcodeDefault.xctoolchain/usr/bin";
+        for (name, value) in [
+            ("MACOSX_DEPLOYMENT_TARGET".to_owned(), "13.0".to_owned()),
+            ("DEVELOPER_DIR".to_owned(), "/boundary/system/0".to_owned()),
+            (
+                "SDKROOT".to_owned(),
+                format!("/boundary/system/0/{SDK_ROOT}"),
+            ),
+            (format!("CC_{underscored}"), FIXTURE_CLANG.to_owned()),
+            (format!("AR_{underscored}"), format!("{bin}/ar")),
+            ("ZERO_AR_DATE".to_owned(), "1".to_owned()),
+            ("OPENSSL_CONF".to_owned(), "/dev/null".to_owned()),
+        ] {
+            expected.insert(name, value);
+        }
+    }
+    if target != ReleaseTarget::Wasm32Wasip1 {
+        expected.insert(
+            format!("CFLAGS_{underscored}"),
+            expected_c_prefix_map(target),
+        );
+    }
+    assert_eq!(
+        actual, &expected,
+        "should hold exactly the child environment with every path in the execution namespace"
+    );
+    for (name, value) in actual {
+        assert!(
+            !value.contains(fixture.base.to_str().expect("should be UTF-8")),
+            "should not leak a host path into {name}"
+        );
+    }
+}
+
+/// One mapped location per path-carrying variable, so each can be omitted alone.
+fn granular(fixture: &Fixture, omit: &[&str]) -> PrefixPaths {
+    let retained = fixture.retained();
+    let all: [(&str, PathBuf, &str, bool); 12] = [
+        ("developer", fixture.developer_dir(), "/c/developer", false),
+        ("target", fixture.base.join("target"), "/c/target", true),
+        (
+            "cargo-home",
+            fixture.base.join("cargo-state/cargo-home"),
+            "/c/cargo-home",
+            true,
+        ),
+        (
+            "home",
+            fixture.base.join("cargo-state/home"),
+            "/c/home",
+            true,
+        ),
+        ("tmp", fixture.base.join("cargo-state/tmp"), "/c/tmp", true),
+        ("bundles", retained.join("bundles"), "/c/bundles", false),
+        (
+            "inventory",
+            retained.join("tsjs-inventory.json"),
+            "/c/inventory.json",
+            false,
+        ),
+        (
+            "rustc",
+            fixture.base.join("tools/bin/rustc"),
+            "/c/rustc",
+            false,
+        ),
+        ("bin", fixture.base.join("tools/bin"), "/c/bin", false),
+        (
+            "vendor",
+            fixture.base.join("materials/vendor"),
+            "/c/vendor",
+            false,
+        ),
+        (
+            "checkout",
+            fixture.base.join("checkout-canonical"),
+            "/c/checkout",
+            false,
+        ),
+        ("tools", fixture.base.join("tools"), "/c/tools", false),
+    ];
+    all.iter().filter(|(name, ..)| !omit.contains(name)).fold(
+        PrefixPaths::new(),
+        |paths, (_, host, execution, writable)| paths.with(host, execution, *writable),
+    )
+}
+
+#[test]
+fn path_variables_outside_every_root_are_rejected() {
+    let fixture = Fixture::new(COMMIT);
+    let prepared = fixture
+        .bind("ts-aarch64-apple-darwin", Role::Canonical)
+        .expect("should bind the recipe");
+    prepared
+        .plan(&granular(&fixture, &[]))
+        .expect("should derive the plan when every location is mapped");
+    let cases: [(&str, &[&str]); 11] = [
+        ("Apple developer directory", &["developer"]),
+        ("CARGO_TARGET_DIR", &["target"]),
+        ("CARGO_HOME", &["cargo-home"]),
+        ("HOME", &["home"]),
+        ("TMPDIR", &["tmp"]),
+        ("TSJS_PREBUILT_DIR", &["bundles"]),
+        ("TRUSTED_SERVER__TSJS_PREBUILT_INVENTORY", &["inventory"]),
+        ("RUSTC", &["rustc", "bin", "tools"]),
+        ("vendor directory", &["vendor"]),
+        ("checkout root", &["checkout"]),
+        ("Rust tools root", &["tools"]),
+    ];
+    for (label, omit) in cases {
+        let message = plan_error(&prepared, &granular(&fixture, omit));
+        assert!(
+            message.contains(label) && message.contains("outside the boundary roots"),
+            "should reject {label} outside the roots: {message}"
+        );
+    }
+    let message = plan_error(&prepared, &granular(&fixture, &["bin", "tools"]));
+    assert!(
+        message.contains("PATH") && message.contains("outside the boundary roots"),
+        "should reject the tool directory in PATH outside the roots: {message}"
+    );
+}
+
+#[test]
+fn child_home_and_cargo_home_must_be_the_request_state() {
+    let fixture = Fixture::new(COMMIT);
+    let request = fixture.request(
+        "ts-aarch64-apple-darwin",
+        Role::Canonical.spec_label(),
+        COMMIT,
+    );
+    let commit = CommitId::parse(COMMIT).expect("should parse commit");
+    let mut forged = child_request(&request);
+    forged.home = fixture.base.join("other-work/home");
+    let child =
+        crate::preflight::child::build_child_for_tests(&audited(), &commit, 1_700_000_000, &forged)
+            .expect("should build a child with another HOME");
+    let error = PreparedRecipe::bind(BindInputs {
+        workspace: WorkspaceSelection::Fixture,
+        commit: &commit,
+        child,
+        completed: &fixture.completed,
+        tools: fixture.tools_for(ReleaseTarget::Aarch64AppleDarwin),
+        materials: fixture.materials(COMMIT),
+        ambient: fixture.ambient(Role::Canonical),
+        request,
+    });
+    assert!(
+        bind_error(error).contains("HOME is not the request's private cargo state"),
+        "should reject a child HOME outside the request state"
+    );
+}
+
+#[test]
+fn cargo_plan_rejects_inherited_rustflags_and_selectors() {
+    for name in [
+        "RUSTFLAGS",
+        "CARGO_ENCODED_RUSTFLAGS",
+        "CARGO_BUILD_TARGET",
+        "RUSTUP_TOOLCHAIN",
+        "CC",
+        "TSJS_SKIP_BUILD",
+    ] {
+        let snapshot = [(OsString::from(name), OsString::from("fictional"))];
+        let rejection = match audit_environment(&snapshot) {
+            Ok(_) => panic!("should reject inherited {name}"),
+            Err(error) => format!("{error:?}"),
+        };
+        assert!(
+            rejection.contains(name),
+            "should reject inherited {name} before any plan exists"
+        );
+    }
+    let fixture = Fixture::new(COMMIT);
+    let prepared = fixture
+        .bind("ts-x86_64-unknown-linux-gnu", Role::Canonical)
+        .expect("should bind from a benign environment");
+    let plan = prepared
+        .plan(&fixture.paths(Role::Canonical))
+        .expect("should derive the plan");
+    for name in plan.environment.keys() {
+        assert!(
+            name == "RUSTC" || (!name.starts_with("RUST") && !name.starts_with("CARGO_BUILD")),
+            "should carry no selector besides the explicit RUSTC: {name}"
+        );
+    }
+    let configs: Vec<&String> = plan
+        .arguments
+        .iter()
+        .enumerate()
+        .filter(|(_, argument)| *argument == "--config")
+        .filter_map(|(index, _)| plan.arguments.get(index + 1))
+        .collect();
+    assert_eq!(
+        configs.len(),
+        expected_replacement().len() / 2 + 2,
+        "should carry the exact source replacements, path remap and reviewed GNU linker"
+    );
+    assert_eq!(
+        configs.last().map(|config| config.as_str()),
+        expected_remap(ReleaseTarget::X86_64UnknownLinuxGnu)
+            .last()
+            .map(String::as_str),
+        "should select the reviewed GNU linker after target path remapping"
+    );
+    for argument in &plan.arguments {
+        assert!(
+            ![
+                "--features",
+                "--all-features",
+                "--no-default-features",
+                "--manifest-path",
+                "--config=",
+            ]
+            .iter()
+            .any(|selector| argument.starts_with(selector))
+                && !argument.starts_with('+'),
+            "should not carry selector argument {argument}"
+        );
+    }
+    assert!(
+        plan.arguments
+            .iter()
+            .any(|argument| argument == "--release")
+            && plan.arguments.iter().any(|argument| argument == "--frozen"),
+        "should keep the release and frozen flags"
+    );
+}
+
+#[test]
+fn plan_digest_binds_every_part_of_the_plan() {
+    let fixture = Fixture::new(COMMIT);
+    let prepared = fixture
+        .bind("ts-aarch64-apple-darwin", Role::Canonical)
+        .expect("should bind the recipe");
+    let paths = fixture.paths(Role::Canonical);
+    let plan = prepared.plan(&paths).expect("should derive the plan");
+    let digest = plan.digest().expect("should digest the plan");
+    assert_eq!(digest.len(), 64, "should be a SHA-256 hex digest");
+    assert_eq!(
+        digest,
+        prepared
+            .plan(&paths)
+            .expect("should derive the plan again")
+            .digest()
+            .expect("should digest again"),
+        "should be a pure function of the bound inputs"
+    );
+    type Edit = fn(&mut CargoPlan);
+    let edits: [(&str, Edit); 6] = [
+        ("argument", |p| p.arguments.push("--offline".to_owned())),
+        ("dropped argument", |p| {
+            p.arguments.retain(|argument| argument != "--release");
+        }),
+        ("environment value", |p| {
+            p.environment
+                .insert("RUSTC".to_owned(), "/other/rustc".to_owned());
+        }),
+        ("injected variable", |p| {
+            p.environment
+                .insert("RUSTFLAGS".to_owned(), "--cfg x".to_owned());
+        }),
+        ("program", |p| p.program = PathBuf::from("/other/cargo")),
+        ("umask", |p| p.umask = umask(0o000)),
+    ];
+    for (label, edit) in edits {
+        let mut changed = prepared.plan(&paths).expect("should derive the plan");
+        edit(&mut changed);
+        assert_ne!(
+            changed.digest().expect("should digest the edited plan"),
+            digest,
+            "should change the digest for an edited {label}"
+        );
+    }
+    let mut moved = prepared.plan(&paths).expect("should derive the plan");
+    moved.working_directory = fixture.base.join("checkout-reproduction");
+    assert_ne!(
+        moved.digest().expect("should digest the moved plan"),
+        digest,
+        "should change the digest for another working directory"
+    );
+}
+
+#[test]
+fn plan_carries_the_role_umask() {
+    for (role, expected) in [(Role::Canonical, 0o022), (Role::Reproduction, 0o027)] {
+        let fixture = Fixture::new(COMMIT);
+        let prepared = fixture
+            .bind("ts-aarch64-apple-darwin", role)
+            .expect("should bind the recipe");
+        assert_eq!(
+            prepared
+                .plan(&fixture.paths(role))
+                .expect("should derive the plan")
+                .umask,
+            umask(expected),
+            "should derive the umask of role {role:?} from its ambient profile"
+        );
+    }
+}
+
+#[test]
+fn confined_command_applies_the_role_umask_and_keeps_host_program_paths() {
+    for (role, expected) in [(Role::Canonical, "022"), (Role::Reproduction, "027")] {
+        let fixture = Fixture::new(COMMIT);
+        let prepared = fixture
+            .bind("ts-aarch64-apple-darwin", role)
+            .expect("should bind the recipe");
+        let plan = prepared
+            .plan(&fixture.paths(role))
+            .expect("should derive the plan");
+        let command = plan
+            .confined_command(confinement_limits())
+            .expect("should describe the confined command");
+        assert_eq!(
+            command
+                .requested_umask()
+                .map(|umask| umask.to_string())
+                .as_deref(),
+            Some(expected),
+            "should set the umask of role {role:?} on the confined command"
+        );
+        let described = format!("{command:?}");
+        for part in [
+            format!("{:?}", plan.program),
+            format!("{:?}", plan.working_directory),
+            format!(
+                "{:?}",
+                plan.arguments
+                    .iter()
+                    .map(OsString::from)
+                    .collect::<Vec<_>>()
+            ),
+        ] {
+            assert!(
+                described.contains(&part),
+                "should describe {part} in {described}"
+            );
+        }
+    }
+}
+
+#[cfg(target_os = "macos")]
+#[test]
+fn real_boundary_translates_every_plan_path() {
+    use crate::boundary::Boundary;
+    let fixture = Fixture::new(COMMIT);
+    let prepared = fixture
+        .bind("ts-aarch64-apple-darwin", Role::Canonical)
+        .expect("should bind the recipe");
+    let roots = prepared.boundary_roots().expect("should derive roots");
+    let boundary = Boundary::mac_sandbox_for_tests(roots).expect("should configure, not run");
+    let plan = prepared
+        .plan(&boundary)
+        .expect("should derive the plan through the boundary");
+    assert_eq!(
+        plan.environment.get("CARGO_TARGET_DIR").map(String::as_str),
+        fixture.base.join("target").to_str(),
+        "should map writable roots to themselves on macOS"
+    );
+    assert!(
+        plan.environment["PATH"].starts_with(
+            fixture
+                .base
+                .join("tools/bin")
+                .to_str()
+                .expect("should be UTF-8")
+        ),
+        "should put the selected tool directory first in PATH"
+    );
+}
+
+#[test]
+fn execution_paths_with_control_characters_or_separators_are_rejected() {
+    let fixture = Fixture::new(COMMIT);
+    let prepared = fixture
+        .bind("ts-aarch64-apple-darwin", Role::Canonical)
+        .expect("should bind the recipe");
+    for bad in [
+        "/c/bin\nx",
+        "/c/bin\tx",
+        "/c/bin\u{7f}x",
+        "/c/bi:n",
+        "/c/bi\"n",
+        "/c/bi\\n",
+    ] {
+        let paths = PrefixPaths::new()
+            .with(&fixture.base.join("tools"), bad, false)
+            .with(&fixture.retained(), "/c/retained", false)
+            .with(&fixture.base, "/c/base", true);
+        let message = plan_error(&prepared, &paths);
+        assert!(
+            message.contains("not plain absolute UTF-8"),
+            "should reject execution path {bad:?}: {message}"
+        );
+    }
+}
+
+#[test]
+fn fake_host_path_rejects_non_normal_components_like_the_real_inverse() {
+    let paths = PrefixPaths::new().with(std::path::Path::new("/host/target"), "/c/target", true);
+    assert!(
+        paths
+            .host_path(std::path::Path::new("/c/target/release/ts"))
+            .is_ok()
+    );
+    for bad in [
+        "/c/target/../target/ts",
+        "/c/target/./ts",
+        "/c/target//ts",
+        "/c/target/ts/",
+    ] {
+        assert!(
+            paths.host_path(std::path::Path::new(bad)).is_err(),
+            "should reject {bad}"
+        );
+    }
+}
diff --git a/crates/trusted-server-release/src/recipe/tests/real_fixture.rs b/crates/trusted-server-release/src/recipe/tests/real_fixture.rs
new file mode 100644
index 0000000000..5926e0a6ff
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/tests/real_fixture.rs
@@ -0,0 +1,253 @@
+//! Helpers shared by the explicit real ordinary CI fixtures on both the
+//! Linux container and the macOS sandbox hosts; never selected by a normal
+//! focused unit run.
+//!
+//! Every run that uses them is ordinary CI candidate evidence
+//! (`release_qualification: false`): the toolchain and fixture acquisition
+//! are unqualified and unauthenticated, so nothing here qualifies a release.
+
+use std::ffi::OsString;
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::time::Instant;
+
+use super::candidate::CargoFixture;
+use super::cli_candidate::OPERATOR_SENTINELS;
+use super::*;
+use crate::documents::{parse_json, read_bounded};
+use crate::materials::{GitVendorInput, LockedMaterials, VendorInputs};
+use crate::preflight::child::build_child_for_tests;
+use crate::preflight::{AuditedEnvironment, audit_environment};
+use crate::process::Cancellation;
+
+/// The committed denial fixture workspace.
+const DENIAL_FIXTURE: &str = concat!(env!("CARGO_MANIFEST_DIR"), "/tests/fixtures/cargo-denial");
+/// Fictional committer epoch of the denial fixture child environment.
+const DENIAL_EPOCH: u64 = 1_700_000_000;
+/// Members that attempt a connection while Cargo builds them.
+pub(super) const ATTEMPTS: [&str; 3] = ["build-direct", "build-grandchild", "macro-attempt"];
+
+/// Reads the ordinary CI Cargo fixture named by `TS_RELEASE_CARGO_FIXTURE_ROOT`.
+pub(super) fn cargo_fixture() -> CargoFixture {
+    let root = std::env::var_os("TS_RELEASE_CARGO_FIXTURE_ROOT")
+        .map(PathBuf::from)
+        .expect("should explicitly supply the ordinary CI Cargo fixture root");
+    let root = fs::canonicalize(root).expect("should resolve the Cargo fixture root");
+    let raw = read_bounded(&root.join("fixture.json"), DocumentRole::Metadata)
+        .expect("should read the Cargo fixture description");
+    let document =
+        parse_json(&raw.bytes, DocumentRole::Metadata).expect("should parse the description");
+    CargoFixture::parse(&root, &document).expect("should accept the Cargo fixture description")
+}
+
+/// Audits the minimal source environment.
+pub(super) fn minimal_environment() -> AuditedEnvironment {
+    audit_environment(&[(OsString::from("PATH"), OsString::from("/usr/bin:/bin"))])
+        .expect("should audit the minimal environment")
+}
+
+/// Audits an inherited environment carrying the planted operator values and
+/// requires preflight to remove every one of them.
+pub(super) fn environment_with_operator_values() -> (AuditedEnvironment, Vec<String>) {
+    let mut snapshot = vec![(OsString::from("PATH"), OsString::from("/usr/bin:/bin"))];
+    snapshot.extend(
+        OPERATOR_SENTINELS
+            .iter()
+            .map(|(name, value)| (OsString::from(name), OsString::from(value))),
+    );
+    let audited = audit_environment(&snapshot).expect("should remove, not reject, operator values");
+    let removed = audited.removed_names().to_vec();
+    assert_eq!(
+        removed.len(),
+        OPERATOR_SENTINELS.len(),
+        "should remove every planted operator variable"
+    );
+    (audited, removed)
+}
+
+/// Conditions of an ordinary CI build of `role`.
+///
+/// The umask and jobs are the profile values the plan enforces on the child.
+/// The reproduction build uses the test-only alternate profile: its host locale and timezone
+/// are profile labels, while the child runs with the normalized `C` locale
+/// and `UTC` timezone either way. This is not an independent qualified
+/// observation, and the production reproduction build stays unqualified.
+pub(super) fn ordinary_ci_ambient(role: Role, checkout: &Path) -> CheckedAmbient {
+    try_ordinary_ci_ambient(role, checkout).expect("should match the role profile")
+}
+
+pub(super) fn try_ordinary_ci_ambient(
+    role: Role,
+    checkout: &Path,
+) -> Result<CheckedAmbient, Report<ReleaseError>> {
+    let (profile, base) = match role {
+        Role::Canonical => (AmbientProfile::CANONICAL, observed_canonical()),
+        Role::Reproduction => (
+            AmbientProfile::alternate_for_tests(),
+            observed_reproduction(),
+        ),
+    };
+    // Reading the real user ID has no preconditions.
+    let execution_uid = unsafe { libc::getuid() };
+    let started_at_seconds = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map_err(|error| recipe_error(format!("cannot read ambient clock: {error}")))?
+        .as_secs();
+    CheckedAmbient::check(
+        role,
+        &profile,
+        ObservedAmbient {
+            execution_uid,
+            checkout_root: checkout.to_owned(),
+            started_at_seconds,
+            ..base
+        },
+    )
+}
+
+/// Copies a tree of directories and regular files into a new directory.
+fn copy_tree(source: &Path, destination: &Path) {
+    fs::create_dir(destination).expect("should create the copied directory");
+    for entry in fs::read_dir(source).expect("should list the fixture directory") {
+        let entry = entry.expect("should read the fixture entry");
+        let kind = entry.file_type().expect("should inspect the fixture entry");
+        let target = destination.join(entry.file_name());
+        if kind.is_dir() {
+            copy_tree(&entry.path(), &target);
+        } else if kind.is_file() {
+            fs::copy(entry.path(), &target).expect("should copy the fixture file");
+        } else {
+            panic!("should hold only directories and regular files");
+        }
+    }
+}
+
+/// One bound denial fixture member with the roots it owns.
+pub(super) struct DenialCase {
+    _work: tempfile::TempDir,
+    _completed: JsBuildCompleted,
+    pub(super) prepared: PreparedRecipe,
+}
+
+/// What one host builds a denial fixture member as.
+pub(super) struct DenialSelection {
+    /// The test-only fixture row of the member for the host's target.
+    pub(super) asset: AssetId,
+    /// The ordinary CI Rust tools, with Apple developer tools on macOS.
+    pub(super) tools: SelectedRustTools,
+    /// A fixed target directory, or `None` for one inside the case roots.
+    pub(super) target_dir: Option<PathBuf>,
+}
+
+/// Binds one denial fixture member over fresh private roots.
+pub(super) fn bind_denial_case(
+    fixture: &CargoFixture,
+    member: &str,
+    selection: DenialSelection,
+) -> DenialCase {
+    let work = tempfile::tempdir().expect("should create the case roots");
+    let base = fs::canonicalize(work.path()).expect("should resolve the case roots");
+    let checkout = base.join("checkout");
+    copy_tree(Path::new(DENIAL_FIXTURE), &checkout);
+    for directory in ["materials/vendor", "cargo-state", "output"] {
+        fs::create_dir_all(base.join(directory)).expect("should create a case root");
+    }
+    let completed = JsBuildCompleted::fixture_for_tests(&fixture.source_commit);
+    let retained = fs::canonicalize(
+        completed
+            .rehash_for_handoff()
+            .expect("should rehash the fixture handoff"),
+    )
+    .expect("should resolve the retained root");
+    let target_dir = selection.target_dir.unwrap_or_else(|| base.join("target"));
+    let request = RecipeRequest::parse_for_asset(
+        selection.asset,
+        &RecipeInput {
+            asset: member,
+            variant: "default",
+            role: Role::Canonical.spec_label(),
+            commit: &fixture.source_commit,
+            js_dir: &retained.join("bundles"),
+            js_inventory: &retained.join("tsjs-inventory.json"),
+            materials: &base.join("materials"),
+            cargo_state: &base.join("cargo-state"),
+            output: &base.join("output"),
+            target_dir: &target_dir,
+        },
+    )
+    .expect("should accept the case request");
+    let commit = CommitId::parse(&fixture.source_commit).expect("should parse the commit");
+    let child = build_child_for_tests(
+        &minimal_environment(),
+        &commit,
+        DENIAL_EPOCH,
+        &child_request(&request),
+    )
+    .expect("should build the child environment");
+    let prepared = PreparedRecipe::bind(BindInputs {
+        workspace: WorkspaceSelection::Fixture,
+        commit: &commit,
+        child,
+        completed: &completed,
+        tools: selection.tools,
+        materials: PreparedCargoMaterials::for_tests(&base.join("materials"), commit.as_str(), &[])
+            .expect("should describe the empty vendor directory"),
+        ambient: ordinary_ci_ambient(Role::Canonical, &checkout),
+        request,
+    })
+    .expect("should bind the denial case");
+    DenialCase {
+        _work: work,
+        _completed: completed,
+        prepared,
+    }
+}
+
+/// Prepares the vendor tree from the fixture's retained originals.
+///
+/// The fixture's `cargo vendor` manifests only name which locked Git packages
+/// to supply closures for; the producer normalizes every inheriting manifest
+/// itself from the verified tree.
+pub(super) fn try_prepare_vendor(
+    fixture: &CargoFixture,
+    locked: &LockedMaterials,
+    root: &Path,
+    deadline: Instant,
+    cancellation: &Cancellation,
+) -> Result<PreparedCargoMaterials, Report<ReleaseError>> {
+    let collection = locked.git_collection(Path::new("/usr/bin/git"), deadline, cancellation)?;
+    let verified: Vec<_> = fixture
+        .git
+        .iter()
+        .map(|source| collection.verify(&source.selector, &source.revision, &source.objects))
+        .collect::<Result<_, _>>()?;
+    let inputs: Vec<GitVendorInput<'_>> = fixture
+        .comparison_manifests
+        .iter()
+        .map(|package| {
+            let index = fixture
+                .git
+                .iter()
+                .position(|source| source.selector == package.selector)
+                .ok_or_else(|| recipe_error("comparison manifest names no retained Git source"))?;
+            Ok(GitVendorInput {
+                material: &verified[index],
+                name: &package.name,
+                version: &package.version,
+            })
+        })
+        .collect::<Result<_, Report<ReleaseError>>>()?;
+    locked.prepare_cargo_vendor(
+        &VendorInputs {
+            registry_archives: &fixture.registry,
+            git: &inputs,
+        },
+        root,
+        deadline,
+        cancellation,
+    )
+}
+
+pub(super) fn path_text(path: &Path) -> String {
+    path.to_str().expect("should be a UTF-8 path").to_owned()
+}
diff --git a/crates/trusted-server-release/src/recipe/tests/remap.rs b/crates/trusted-server-release/src/recipe/tests/remap.rs
new file mode 100644
index 0000000000..f5bba8c316
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/tests/remap.rs
@@ -0,0 +1,321 @@
+use super::super::paths::PrefixPaths;
+use super::super::remap::{
+    REMAPPED_PREFIXES, RemapSources, c_prefix_map_environment, check_cargo_config,
+    check_no_extensionless_config, remap_arguments, scan_remapped_bytes,
+};
+use super::fixture::*;
+use super::*;
+
+const TRACKED_CARGO_CONFIG: &str = include_str!(concat!(
+    env!("CARGO_MANIFEST_DIR"),
+    "/../../.cargo/config.toml"
+));
+
+/// The `--config` value of `plan`'s remap entry.
+fn remap_config(plan: &CargoPlan) -> &str {
+    plan.arguments
+        .iter()
+        .rfind(|argument| argument.contains(".rustflags="))
+        .expect("should carry the remap config")
+}
+
+fn sources<'a>(checkout: &'a str, vendor: &'a str) -> RemapSources<'a> {
+    RemapSources {
+        checkout,
+        vendor,
+        cargo_home: "/x/state/cargo-home",
+        tools: "/x/tools",
+        target: "/x/target",
+    }
+}
+
+#[test]
+fn remap_maps_every_source_root_to_a_fixed_prefix_in_a_fixed_order() {
+    let arguments = remap_arguments("wasm32-wasip1", &sources("/x/checkout", "/x/vendor"))
+        .expect("should remap disjoint roots");
+    assert_eq!(
+        arguments,
+        [
+            "--config".to_owned(),
+            [
+                "target.\"wasm32-wasip1\".rustflags=[",
+                "\"--remap-path-prefix=/x/checkout=/trusted-server\",",
+                "\"--remap-path-prefix=/x/vendor=/cargo-vendor\",",
+                "\"--remap-path-prefix=/x/state/cargo-home=/cargo-home\",",
+                "\"--remap-path-prefix=/x/tools=/rust-tools\",",
+                "\"--remap-path-prefix=/x/target=/cargo-target\"]",
+            ]
+            .concat(),
+        ],
+        "should emit checkout, vendor, Cargo home, tools, target in that order \
+         through one quoted target rustflags entry"
+    );
+    assert_eq!(
+        REMAPPED_PREFIXES,
+        [
+            "/trusted-server",
+            "/cargo-vendor",
+            "/cargo-home",
+            "/rust-tools",
+            "/cargo-target"
+        ],
+        "should keep the fixed prefixes in emitted order"
+    );
+}
+
+#[test]
+fn nested_or_equal_remapped_roots_are_rejected() {
+    for (checkout, vendor) in [
+        ("/x/checkout", "/x/checkout/vendor"),
+        ("/x/vendor/inner", "/x/vendor"),
+        ("/x/same", "/x/same"),
+        ("/x/checkout", "/x/tools"),
+    ] {
+        let error = remap_arguments("wasm32-wasip1", &sources(checkout, vendor))
+            .expect_err("should reject overlapping roots whose order would decide the path");
+        assert!(
+            format!("{error:?}").contains("overlap"),
+            "should name the overlap for {checkout} and {vendor}"
+        );
+    }
+}
+
+#[test]
+fn plan_rejects_remapped_roots_that_overlap_in_the_execution_namespace() {
+    let fixture = Fixture::new(COMMIT);
+    let prepared = fixture
+        .bind("trusted-server-fastly.wasm", Role::Canonical)
+        .expect("should bind the recipe");
+    let nested = PrefixPaths::new()
+        .with(
+            &fixture.base.join("materials"),
+            "/boundary/immutable/0/materials",
+            false,
+        )
+        .with(
+            &fixture.base.join("checkout-canonical"),
+            "/boundary/immutable/0",
+            false,
+        )
+        .with(&fixture.retained(), "/boundary/immutable/1", false)
+        .with(&fixture.base.join("tools"), "/boundary/tool/0", false)
+        .with(
+            &fixture.base.join("cargo-state"),
+            "/boundary/writable/0",
+            true,
+        )
+        .with(&fixture.base.join("target"), "/boundary/writable/1", true);
+    assert!(
+        plan_error(&prepared, &nested).contains("overlap"),
+        "should reject a vendor tree mounted inside the checkout"
+    );
+}
+
+#[test]
+fn remap_is_identical_for_both_roles_in_the_same_mount_layout() {
+    let fixture = Fixture::new(COMMIT);
+    let canonical = fixture
+        .bind("trusted-server-fastly.wasm", Role::Canonical)
+        .expect("should bind the canonical build")
+        .plan(&fixture.paths(Role::Canonical))
+        .expect("should plan the canonical build");
+    let other = Fixture::new(COMMIT);
+    let reproduction = other
+        .bind("trusted-server-fastly.wasm", Role::Reproduction)
+        .expect("should bind the reproduction build")
+        .plan(&other.paths(Role::Reproduction))
+        .expect("should plan the reproduction build");
+    assert_ne!(
+        canonical.working_directory, reproduction.working_directory,
+        "should run from distinct host checkouts"
+    );
+    assert_eq!(
+        remap_config(&canonical),
+        remap_config(&reproduction),
+        "should hand both roles the same remap in the same execution layout"
+    );
+    for plan in [&canonical, &reproduction] {
+        assert_eq!(
+            (
+                plan.environment.get("LC_ALL").map(String::as_str),
+                plan.environment.get("TZ").map(String::as_str),
+            ),
+            (Some("C"), Some("UTC")),
+            "should keep the compiler locale and timezone normalized for each role"
+        );
+    }
+}
+
+#[test]
+fn remap_follows_identity_paths_to_the_same_fixed_prefixes() {
+    let fixture = Fixture::new(COMMIT);
+    let prepared = fixture
+        .bind("trusted-server-fastly.wasm", Role::Canonical)
+        .expect("should bind the recipe");
+    let base = fixture.base.to_str().expect("should be UTF-8");
+    let retained = fixture.retained();
+    let identity = PrefixPaths::new().with(&fixture.base, base, true).with(
+        &retained,
+        retained.to_str().expect("should be UTF-8"),
+        false,
+    );
+    let plan = prepared
+        .plan(&identity)
+        .expect("should plan with host paths");
+    assert_eq!(
+        remap_config(&plan),
+        format!(
+            "target.\"wasm32-wasip1\".rustflags=[\
+             \"--remap-path-prefix={base}/checkout-canonical=/trusted-server\",\
+             \"--remap-path-prefix={base}/materials/vendor=/cargo-vendor\",\
+             \"--remap-path-prefix={base}/cargo-state/cargo-home=/cargo-home\",\
+             \"--remap-path-prefix={base}/tools=/rust-tools\",\
+             \"--remap-path-prefix={base}/target=/cargo-target\"]"
+        ),
+        "should remap host-identical execution paths, as on macOS, to the fixed prefixes"
+    );
+}
+
+#[test]
+fn tracked_cargo_config_keeps_target_rustflags_reviewable() {
+    check_cargo_config(TRACKED_CARGO_CONFIG.as_bytes())
+        .expect("should accept the tracked Cargo configuration");
+    check_cargo_config(b"[target.wasm32-wasip1]\nrustflags = [\"--cfg\", \"example\"]\n")
+        .expect("should accept target rustflags, which the remap extends");
+    check_cargo_config(b"[build]\njobs = 2\n").expect("should accept other build keys");
+}
+
+#[test]
+fn cargo_config_that_the_remap_would_supersede_is_rejected() {
+    for (label, bytes) in [
+        (
+            "build rustflags",
+            &b"[build]\nrustflags = [\"--cfg\", \"example\"]\n"[..],
+        ),
+        (
+            "dotted build rustflags",
+            b"build.rustflags = \"--cfg example\"\n",
+        ),
+        ("non-UTF-8", b"\xff\xfe"),
+        ("non-TOML", b"[build\n"),
+    ] {
+        assert!(
+            check_cargo_config(bytes).is_err(),
+            "should reject a Cargo configuration with {label}"
+        );
+    }
+}
+
+#[test]
+fn extensionless_cargo_config_is_rejected_tracked_or_on_disk() {
+    let directory = tempfile::tempdir().expect("should create a checkout");
+    let checkout = directory.path();
+    std::fs::create_dir(checkout.join(".cargo")).expect("should create .cargo");
+    std::fs::write(checkout.join(".cargo/config.toml"), b"[alias]\n")
+        .expect("should write the reviewed configuration");
+    check_no_extensionless_config(checkout, false)
+        .expect("should accept a checkout with only config.toml");
+    assert!(
+        format!(
+            "{:?}",
+            check_no_extensionless_config(checkout, true).expect_err("should reject tracked")
+        )
+        .contains("tracks .cargo/config"),
+        "should reject a tracked extensionless configuration"
+    );
+    std::os::unix::fs::symlink("config.toml", checkout.join(".cargo/config"))
+        .expect("should alias the legacy name");
+    assert!(
+        format!(
+            "{:?}",
+            check_no_extensionless_config(checkout, false).expect_err("should reject on disk")
+        )
+        .contains("holds .cargo/config"),
+        "should reject an extensionless configuration present on disk, even as a link"
+    );
+}
+
+#[test]
+fn remap_scan_requires_a_fixed_prefix_and_no_unremapped_path() {
+    let clean = b"\0asm../trusted-server/crates/core/src/lib.rs\0/rustc/abc/library";
+    let scan = scan_remapped_bytes(clean, &["/tmp/fixture-root", "/home/runner/work/_temp"])
+        .expect("should accept remapped bytes");
+    assert_eq!(
+        scan.found(),
+        ["/trusted-server"],
+        "should list found prefixes"
+    );
+    for (label, bytes) in [
+        ("container mount", &b"x/boundary/immutable/0/src/lib.rs"[..]),
+        (
+            "host fixture root",
+            b"/trusted-server/a /tmp/fixture-root/x",
+        ),
+        (
+            "host runner temp",
+            b"/cargo-vendor/a /home/runner/work/_temp/y",
+        ),
+        ("no fixed prefix", b"/rustc/abc/library/core/src/lib.rs"),
+        ("prefix without separator", b"/trusted-server-core"),
+    ] {
+        assert!(
+            scan_remapped_bytes(bytes, &["/tmp/fixture-root", "/home/runner/work/_temp"]).is_err(),
+            "should reject bytes with {label}"
+        );
+    }
+    let too_many = vec!["/x"; 65];
+    for forbidden in [&too_many[..], &[""][..]] {
+        assert!(
+            scan_remapped_bytes(clean, forbidden).is_err(),
+            "should bound the forbidden prefixes"
+        );
+    }
+}
+
+#[test]
+fn native_c_code_gets_the_same_remap_and_wasm_gets_none() {
+    let roots = sources("/x/checkout", "/x/vendor");
+    assert_eq!(
+        c_prefix_map_environment(ReleaseTarget::Wasm32Wasip1, &roots)
+            .expect("should accept disjoint roots"),
+        None,
+        "should leave the Fastly plan without C flags"
+    );
+    let (name, value) = c_prefix_map_environment(ReleaseTarget::X86_64UnknownLinuxGnu, &roots)
+        .expect("should accept disjoint roots")
+        .expect("should remap C code of a native asset");
+    assert_eq!(
+        name, "CFLAGS_x86_64_unknown_linux_gnu",
+        "should use the target-scoped name cc reads first"
+    );
+    assert_eq!(
+        value,
+        [
+            "-ffile-prefix-map=/x/checkout=/trusted-server",
+            "-fdebug-prefix-map=/x/checkout=/trusted-server",
+            "-ffile-prefix-map=/x/vendor=/cargo-vendor",
+            "-fdebug-prefix-map=/x/vendor=/cargo-vendor",
+            "-ffile-prefix-map=/x/state/cargo-home=/cargo-home",
+            "-fdebug-prefix-map=/x/state/cargo-home=/cargo-home",
+            "-ffile-prefix-map=/x/tools=/rust-tools",
+            "-fdebug-prefix-map=/x/tools=/rust-tools",
+            "-ffile-prefix-map=/x/target=/cargo-target",
+            "-fdebug-prefix-map=/x/target=/cargo-target",
+        ]
+        .join(" "),
+        "should map every root to the same fixed prefix rustc uses"
+    );
+}
+
+#[test]
+fn native_c_remap_rejects_split_or_overlapping_roots() {
+    for (label, roots) in [
+        ("whitespace", sources("/x/check out", "/x/vendor")),
+        ("nested", sources("/x/checkout", "/x/checkout/vendor")),
+    ] {
+        assert!(
+            c_prefix_map_environment(ReleaseTarget::X86_64UnknownLinuxGnu, &roots).is_err(),
+            "should reject a {label} root"
+        );
+    }
+}
diff --git a/crates/trusted-server-release/src/recipe/tests/runtime.rs b/crates/trusted-server-release/src/recipe/tests/runtime.rs
new file mode 100644
index 0000000000..28582798e6
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/tests/runtime.rs
@@ -0,0 +1,620 @@
+//! Pure tests of the final-byte Fastly runtime gate.
+//!
+//! None of these start Viceroy. The real gate runs only in the ordinary CI
+//! canonical and reproduction job (see `full.rs`).
+
+use std::net::SocketAddr;
+use std::time::Duration;
+
+use error_stack::Report;
+use serde_json::{Value, json};
+use sha2::{Digest as _, Sha256};
+
+use super::super::runtime::tests_support::{
+    HttpResponse, OriginFixture, app_config_data, canonical, check_publisher_response,
+    config_store_id, envelope_json, get, is_health_ok, origin_page, parse_response,
+    parse_version_output, require_built_source_fixtures, sanitized_tail, scan_viceroy_output,
+    viceroy_config,
+};
+use super::super::runtime::{
+    OriginPresence, PINNED_VICEROY_VERSION, RuntimeRejection, SelectedViceroy, run_gate,
+};
+use crate::error::ReleaseError;
+use crate::inspect::Violation;
+use crate::inspect::tests::builders::{Entry, append_customs, command_module};
+
+const TOOL_VERSIONS: &str =
+    include_str!(concat!(env!("CARGO_MANIFEST_DIR"), "/../../.tool-versions"));
+const FASTLY_TOML: &str = include_str!(concat!(env!("CARGO_MANIFEST_DIR"), "/../../fastly.toml"));
+const ORIGIN: &str = "http://127.0.0.1:9999";
+const MARKER: &str = "trusted-server-release-origin-0123456789abcdef01234567";
+const SCRIPT: &str =
+    "<script src=\"/static/tsjs=tsjs-unified.min.js?v=0123abcd\" id=\"trustedserver-js\"></script>";
+
+/// Returns the attached [`RuntimeRejection`] of a runtime rejection.
+fn rejection<T: std::fmt::Debug>(result: Result<T, Report<ReleaseError>>) -> RuntimeRejection {
+    let report = result.expect_err("should reject");
+    assert!(
+        matches!(report.current_context(), ReleaseError::Runtime),
+        "should report a runtime rejection: {report:?}"
+    );
+    *report
+        .downcast_ref::<RuntimeRejection>()
+        .expect("should attach the runtime rejection")
+}
+
+/// Returns the attached inspection [`Violation`].
+fn violation<T: std::fmt::Debug>(result: Result<T, Report<ReleaseError>>) -> Violation {
+    let report = result.expect_err("should reject");
+    assert!(
+        matches!(report.current_context(), ReleaseError::Inspect),
+        "should report an inspection rejection: {report:?}"
+    );
+    *report
+        .downcast_ref::<Violation>()
+        .expect("should attach the violated rule")
+}
+
+#[test]
+fn pinned_viceroy_version_matches_tool_versions() {
+    let pinned = TOOL_VERSIONS
+        .lines()
+        .find_map(|line| line.strip_prefix("viceroy"))
+        .map(str::trim)
+        .expect("should pin Viceroy in .tool-versions");
+    assert_eq!(
+        pinned, PINNED_VICEROY_VERSION,
+        "should gate on the tracked pin"
+    );
+}
+
+#[test]
+fn viceroy_version_output_must_be_exactly_the_pin() {
+    assert_eq!(
+        parse_version_output(b"viceroy 0.21.0\n").expect("should accept the pinned output"),
+        "0.21.0"
+    );
+    for output in [
+        &b""[..],
+        b"viceroy 0.21.0",
+        b"viceroy 0.21.1\n",
+        b"viceroy 0.17.0\n",
+        b"viceroy 0.16.0\n",
+        b"viceroy 0.21.0-rc.1\n",
+        b"Viceroy 0.21.0\n",
+        b"viceroy  0.21.0\n",
+        b"viceroy 0.21.0\nextra\n",
+        b"fastly 0.21.0\n",
+        b"viceroy \xff\n",
+    ] {
+        assert_eq!(
+            rejection(parse_version_output(output)),
+            RuntimeRejection::Viceroy,
+            "should reject version output {:?}",
+            String::from_utf8_lossy(output)
+        );
+    }
+}
+
+#[test]
+fn viceroy_selection_requires_an_absolute_regular_file() {
+    let directory = tempfile::tempdir().expect("should create a directory");
+    for path in [
+        std::path::Path::new("viceroy"),
+        directory.path(),
+        &directory.path().join("missing"),
+    ] {
+        assert_eq!(
+            rejection(SelectedViceroy::select(path)),
+            RuntimeRejection::Viceroy,
+            "should reject Viceroy at {path:?} without running it"
+        );
+    }
+}
+
+#[test]
+fn viceroy_selection_rejects_a_symlink() {
+    let directory = tempfile::tempdir().expect("should create a directory");
+    let target = directory.path().join("viceroy-target");
+    std::fs::write(&target, b"example executable").expect("should write a stand-in");
+    let link = directory.path().join("viceroy");
+    std::os::unix::fs::symlink(&target, &link).expect("should create a symlink");
+
+    assert_eq!(
+        rejection(SelectedViceroy::select(&link)),
+        RuntimeRejection::Viceroy,
+        "should reject a symlinked Viceroy without following or running it"
+    );
+}
+
+/// Returns the SHA-256 of a repository file, as the built source tracks it.
+fn repository_sha256(path: &str) -> Option<String> {
+    let bytes = std::fs::read(format!("{}/../../{path}", env!("CARGO_MANIFEST_DIR"))).ok()?;
+    Some(hex::encode(Sha256::digest(bytes)))
+}
+
+#[test]
+fn embedded_fixtures_must_match_the_built_source() {
+    require_built_source_fixtures(&repository_sha256)
+        .expect("should accept a built source tracking the embedded fixtures");
+
+    let changed = |path: &str| {
+        if path == "edgezero.toml" {
+            Some("0".repeat(64))
+        } else {
+            repository_sha256(path)
+        }
+    };
+    let untracked = |path: &str| {
+        if path.ends_with("viceroy-template.toml") {
+            None
+        } else {
+            repository_sha256(path)
+        }
+    };
+    for (label, tracked) in [
+        (
+            "changed manifest",
+            &changed as &dyn Fn(&str) -> Option<String>,
+        ),
+        ("untracked template", &untracked),
+    ] {
+        let report = require_built_source_fixtures(tracked).expect_err("should fail closed");
+        assert_eq!(
+            report.downcast_ref::<RuntimeRejection>().copied(),
+            Some(RuntimeRejection::Fixture),
+            "should reject a {label}"
+        );
+        assert!(
+            format!("{report:?}").contains("built source"),
+            "should name the built source difference for a {label}: {report:?}"
+        );
+    }
+}
+
+#[test]
+fn clean_viceroy_output_is_summarized() {
+    let output = scan_viceroy_output(b"Listening on http://127.0.0.1:7676\n", b"")
+        .expect("should accept clean output");
+    assert_eq!(
+        output.stderr_sha256,
+        hex::encode(Sha256::digest(b"")),
+        "should digest the empty stderr"
+    );
+    assert_eq!(output.stderr_tail, "");
+}
+
+#[test]
+fn guest_failures_in_viceroy_output_are_rejected() {
+    let cases: [(&str, &[u8], &[u8]); 5] = [
+        (
+            "wasm trap",
+            b"",
+            b"2026-10-16T00:00:00Z ERROR request failed: wasm trap: wasm `unreachable` instruction executed\n",
+        ),
+        (
+            "guest panic",
+            b"thread '<unnamed>' panicked at src/example.rs:1:1:\nexample\n",
+            b"",
+        ),
+        (
+            "error line",
+            b"",
+            b"Error: hyper::Error(Connect, \"example\")\n",
+        ),
+        (
+            "request handling error",
+            b"",
+            b"WARN There was an error handling the request: example\n",
+        ),
+        ("backtrace", b"wasm backtrace:\n    0: example\n", b""),
+    ];
+    for (label, stdout, stderr) in cases {
+        assert_eq!(
+            rejection(scan_viceroy_output(stdout, stderr)),
+            RuntimeRejection::GuestFailure,
+            "should reject a {label}"
+        );
+    }
+}
+
+#[test]
+fn stderr_tail_is_bounded_and_printable() {
+    let mut stderr = vec![b'x'; 4096];
+    stderr.extend_from_slice(b"\x1b[31mred\x07\nend");
+    let tail = sanitized_tail(&stderr);
+    assert!(tail.len() <= 1024, "should keep a bounded tail");
+    assert!(
+        tail.ends_with("?[31mred?\nend"),
+        "should replace control characters but keep newlines: {tail:?}"
+    );
+}
+
+#[test]
+fn config_store_id_matches_the_fastly_local_store() {
+    let id = config_store_id().expect("should read the default config store");
+    let fastly: toml::Table = toml::from_str(FASTLY_TOML).expect("should parse fastly.toml");
+    assert!(
+        fastly["local_server"]["config_stores"].get(&id).is_some(),
+        "should name a config store the Fastly local server declares: {id}"
+    );
+}
+
+#[test]
+fn canonical_form_sorts_keys_escapes_and_rejects_floats() {
+    let value = json!({"b": 1, "a": [true, null, "x\n\"\u{1}"], "B": {"z": -2, "y": {}}});
+    assert_eq!(
+        canonical(&value).expect("should encode integers"),
+        r#"{"B":{"y":{},"z":-2},"a":[true,null,"x\n\"\u0001"],"b":1}"#,
+        "should sort keys by bytes and use the fixed escape table"
+    );
+    assert_eq!(
+        rejection(canonical(&json!({"ratio": 1.5}))),
+        RuntimeRejection::Fixture,
+        "should reject floats"
+    );
+}
+
+#[test]
+fn app_config_keeps_secret_names_and_replaces_only_the_origin() {
+    let data = app_config_data(ORIGIN).expect("should convert the integration fixture");
+    assert_eq!(
+        data["publisher"]["origin_url"], ORIGIN,
+        "should override the origin"
+    );
+    assert_eq!(
+        data["publisher"]["proxy_secret"], "integration_proxy_secret",
+        "should keep secret store key names, not values"
+    );
+    assert_eq!(data["publisher"]["domain"], "localhost");
+}
+
+#[test]
+fn envelope_binds_the_canonical_data_digest() {
+    let data = app_config_data(ORIGIN).expect("should convert the fixture");
+    let envelope: Value = serde_json::from_str(&envelope_json(&data).expect("should wrap"))
+        .expect("should parse the envelope");
+    let expected = hex::encode(Sha256::digest(
+        canonical(&data).expect("should encode").as_bytes(),
+    ));
+    assert_eq!(envelope["sha256"], Value::String(expected));
+    assert_eq!(envelope["version"], 1);
+    assert_eq!(envelope["generated_at"], "2026-06-23T00:00:00Z");
+    assert_eq!(envelope["data"], data, "should carry the data unchanged");
+}
+
+#[test]
+fn viceroy_config_is_exact_and_deterministic() {
+    let generated = viceroy_config(ORIGIN).expect("should generate the config");
+    let again = viceroy_config(ORIGIN).expect("should generate the config again");
+    assert_eq!(generated, again, "should be deterministic");
+    assert_eq!(
+        generated.sha256,
+        hex::encode(Sha256::digest(generated.text.as_bytes())),
+        "should digest the exact text"
+    );
+    let parsed: toml::Table = toml::from_str(&generated.text).expect("should parse as TOML");
+    let id = config_store_id().expect("should read the store ID");
+    let store = &parsed["local_server"]["config_stores"][id.as_str()];
+    assert_eq!(store["format"].as_str(), Some("inline-toml"));
+    let envelope: Value = serde_json::from_str(
+        store["contents"][id.as_str()]
+            .as_str()
+            .expect("should store the envelope under the store ID"),
+    )
+    .expect("should parse the stored envelope");
+    assert_eq!(envelope["data"]["publisher"]["origin_url"], ORIGIN);
+    assert!(
+        parsed["local_server"]["config_stores"]
+            .get("jwks_store")
+            .is_some()
+            && parsed["local_server"]["secret_stores"]
+                .get("trusted_server_secrets")
+                .is_some(),
+        "should keep the rest of the integration template"
+    );
+    assert!(
+        !generated
+            .text
+            .contains("GENERATED_TRUSTED_SERVER_CONFIG_STORES"),
+        "should replace the marker"
+    );
+
+    let other = viceroy_config("http://127.0.0.1:9998").expect("should generate another");
+    assert_ne!(other.sha256, generated.sha256, "should bind the origin");
+    assert_eq!(
+        other.fixture_sha256, generated.fixture_sha256,
+        "should identify the same fixed fixture"
+    );
+}
+
+fn html_response(status: u16, body: &str) -> HttpResponse {
+    HttpResponse {
+        status,
+        headers: vec![(
+            "content-type".to_owned(),
+            "text/html; charset=utf-8".to_owned(),
+        )],
+        body: body.as_bytes().to_vec(),
+    }
+}
+
+fn injected_page() -> String {
+    origin_page(MARKER).replacen("<head>", &format!("<head>{SCRIPT}"), 1)
+}
+
+#[test]
+fn injected_origin_page_is_accepted() {
+    let page = injected_page();
+    let observed =
+        check_publisher_response(&html_response(200, &page), MARKER).expect("should accept");
+    assert_eq!(
+        observed.script_src,
+        "/static/tsjs=tsjs-unified.min.js?v=0123abcd"
+    );
+    assert_eq!(observed.body_size, page.len());
+    assert_eq!(observed.status, 200);
+}
+
+#[test]
+fn publisher_response_negatives_are_rejected() {
+    let page = injected_page();
+    let health = HttpResponse {
+        status: 200,
+        headers: vec![("content-type".to_owned(), "text/plain".to_owned())],
+        body: b"ok".to_vec(),
+    };
+    let cases: [(&str, HttpResponse, RuntimeRejection); 9] = [
+        (
+            "bad gateway",
+            html_response(502, &page),
+            RuntimeRejection::Status,
+        ),
+        ("health-only answer", health, RuntimeRejection::Injection),
+        (
+            "uninjected origin page",
+            html_response(200, &origin_page(MARKER)),
+            RuntimeRejection::Injection,
+        ),
+        (
+            "duplicated script",
+            html_response(200, &page.replacen("<body>", &format!("<body>{SCRIPT}"), 1)),
+            RuntimeRejection::Injection,
+        ),
+        (
+            "wrong script source",
+            html_response(200, &page.replace("/static/tsjs=", "/static/other=")),
+            RuntimeRejection::Injection,
+        ),
+        (
+            "id on a non-script element",
+            html_response(200, &page.replace("<script src", "<div src")),
+            RuntimeRejection::Injection,
+        ),
+        (
+            "script after the origin content",
+            html_response(
+                200,
+                &origin_page(MARKER).replacen("</main>", &format!("</main>{SCRIPT}"), 1),
+            ),
+            RuntimeRejection::Injection,
+        ),
+        (
+            "foreign origin page",
+            html_response(200, &page.replace(MARKER, "another-origin")),
+            RuntimeRejection::OriginMarker,
+        ),
+        (
+            "repeated origin marker",
+            html_response(
+                200,
+                &page.replacen("</main>", &format!("{MARKER}</main>"), 1),
+            ),
+            RuntimeRejection::OriginMarker,
+        ),
+    ];
+    for (label, response, expected) in cases {
+        assert_eq!(
+            rejection(check_publisher_response(&response, MARKER)),
+            expected,
+            "should reject the {label}"
+        );
+    }
+}
+
+#[test]
+fn health_answer_is_recognized_only_as_health() {
+    let ok = HttpResponse {
+        status: 200,
+        headers: Vec::new(),
+        body: b"ok".to_vec(),
+    };
+    assert!(is_health_ok(&ok), "should recognize the health answer");
+    assert!(!is_health_ok(&html_response(200, "ready")));
+    assert!(!is_health_ok(&HttpResponse { status: 503, ..ok }));
+}
+
+#[test]
+fn responses_parse_strictly() {
+    let fixed =
+        parse_response(b"HTTP/1.1 200 OK\r\nContent-Length: 5\r\nX-Example: a:b\r\n\r\nhello")
+            .expect("should parse a content-length body");
+    assert_eq!((fixed.status, fixed.body.as_slice()), (200, &b"hello"[..]));
+    assert_eq!(fixed.header("X-EXAMPLE"), Some("a:b"));
+    let chunked = parse_response(
+        b"HTTP/1.1 502 Bad Gateway\r\nTransfer-Encoding: chunked\r\n\r\n3;ext=1\r\nabc\r\n2\r\nde\r\n0\r\n\r\n",
+    )
+    .expect("should parse a chunked body");
+    assert_eq!(
+        (chunked.status, chunked.body.as_slice()),
+        (502, &b"abcde"[..])
+    );
+    for raw in [
+        &b"HTTP/1.1 200 OK\r\nContent-Length: 5\r\n"[..],
+        b"HTTP/2 200 OK\r\n\r\n",
+        b"HTTP/1.1 2000 OK\r\n\r\n",
+        b"HTTP/1.1 200 OK\r\nContent-Length: 9\r\n\r\nshort",
+        b"HTTP/1.1 200 OK\r\nContent-Encoding: gzip\r\n\r\nzz",
+        b"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nab",
+        b"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\nzz\r\n",
+        b"HTTP/1.1 200 OK\r\nbad header\r\n\r\n",
+        b"HTTP/1.1 200 OK\r\nX-Ex\tample: a\r\n\r\n",
+        b"HTTP/1.1 200 OK\r\nX(Example): a\r\n\r\n",
+        b"HTTP/1.1 200 OK\r\nTransfer-Encoding: gzip, chunked\r\n\r\n0\r\n\r\n",
+        b"HTTP/1.1 200 OK\r\nTransfer-Encoding: identity\r\n\r\nab",
+        b"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Length: 5\r\n\r\n0\r\n\r\n",
+        b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\nContent-Length: 2\r\n\r\nab",
+        b"HTTP/1.1 200 OK\r\nContent-Length: +2\r\n\r\nab",
+        b"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n",
+        b"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nab\r\n0\r\n",
+        b"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nab\r\n0\r\n\r\nextra",
+        b"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n0\r\nX-Trailer: a\r\n\r\n",
+        b"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n+2\r\nab\r\n0\r\n\r\n",
+    ] {
+        assert_eq!(
+            rejection(parse_response(raw)),
+            RuntimeRejection::Exchange,
+            "should reject {:?}",
+            String::from_utf8_lossy(raw)
+        );
+    }
+}
+
+#[test]
+fn origin_fixture_serves_its_page_and_records_requests() {
+    let origin = OriginFixture::start(MARKER).expect("should start the loopback origin");
+    let timeout = Duration::from_secs(10);
+    let page = get(
+        origin.address(),
+        "/",
+        &[("Sec-Fetch-Mode", "navigate")],
+        timeout,
+    )
+    .expect("should fetch the origin page");
+    let missing = get(origin.address(), "/missing", &[], timeout).expect("should fetch a 404");
+    let requests = origin.stop();
+
+    assert_eq!(page.status, 200);
+    assert_eq!(
+        page.body,
+        origin_page(MARKER).into_bytes(),
+        "should serve the fixed page"
+    );
+    assert_eq!(missing.status, 404, "should serve only the publisher page");
+    assert_eq!(
+        requests,
+        ["GET / HTTP/1.1", "GET /missing HTTP/1.1"],
+        "should record every request line in order"
+    );
+}
+
+#[test]
+fn client_refuses_non_loopback_addresses() {
+    let documentation: SocketAddr = "192.0.2.1:80".parse().expect("should parse");
+    assert_eq!(
+        rejection(get(documentation, "/", &[], Duration::from_secs(1))),
+        RuntimeRejection::Exchange,
+        "should refuse before connecting"
+    );
+}
+
+/// A minimal valid Fastly command with nonempty debug sections.
+fn fastly_command() -> Vec<u8> {
+    append_customs(
+        command_module(
+            &[
+                ("wasi_snapshot_preview1", "fd_write"),
+                ("fastly_http_req", "body_downstream_get"),
+                ("fastly_http_resp", "send_downstream"),
+            ],
+            Entry::Nullary,
+            true,
+        ),
+        &[(".debug_info", b"i"), (".debug_line", b"l")],
+    )
+}
+
+#[test]
+fn gate_validates_core_format_before_running_viceroy() {
+    let never_run = SelectedViceroy::unverified_for_tests(
+        std::path::Path::new("/nonexistent/viceroy"),
+        "0000000000000000000000000000000000000000000000000000000000000000",
+    );
+    let stripped = command_module(
+        &[
+            ("fastly_http_req", "body_downstream_get"),
+            ("fastly_http_resp", "send_downstream"),
+        ],
+        Entry::Nullary,
+        true,
+    );
+    let cases: [(&str, Vec<u8>, Violation); 6] = [
+        (
+            "non-Wasm bytes",
+            b"#!/bin/sh\n".to_vec(),
+            Violation::WasmEncoding,
+        ),
+        (
+            "component",
+            b"\0asm\x0d\0\x01\0".to_vec(),
+            Violation::WasmEncoding,
+        ),
+        (
+            "missing entry export",
+            append_customs(
+                command_module(
+                    &[
+                        ("fastly_http_req", "body_downstream_get"),
+                        ("fastly_http_resp", "send_downstream"),
+                    ],
+                    Entry::Renamed,
+                    true,
+                ),
+                &[(".debug_info", b"i"), (".debug_line", b"l")],
+            ),
+            Violation::WasmAbi,
+        ),
+        (
+            "plain WASI command",
+            append_customs(
+                command_module(
+                    &[("wasi_snapshot_preview1", "fd_write")],
+                    Entry::Nullary,
+                    true,
+                ),
+                &[(".debug_info", b"i"), (".debug_line", b"l")],
+            ),
+            Violation::WasmAbi,
+        ),
+        (
+            "foreign host import",
+            command_module(&[("env", "call")], Entry::Nullary, true),
+            Violation::WasmImport,
+        ),
+        ("stripped module", stripped, Violation::WasmDebugInfo),
+    ];
+    for (label, bytes, expected) in cases {
+        assert_eq!(
+            violation(run_gate(&bytes, &never_run, OriginPresence::Served)),
+            expected,
+            "should reject a {label} before running Viceroy"
+        );
+    }
+}
+
+#[test]
+fn gate_rejects_a_changed_viceroy_before_running_it() {
+    let directory = tempfile::tempdir().expect("should create a directory");
+    let path = directory.path().join("viceroy");
+    std::fs::write(&path, b"example replaced executable").expect("should write a stand-in");
+    let stale = SelectedViceroy::unverified_for_tests(
+        &path,
+        "0000000000000000000000000000000000000000000000000000000000000000",
+    );
+
+    assert_eq!(
+        rejection(run_gate(&fastly_command(), &stale, OriginPresence::Served)),
+        RuntimeRejection::Viceroy,
+        "should rehash Viceroy before spawning it"
+    );
+}
diff --git a/crates/trusted-server-release/src/recipe/tests/sources.rs b/crates/trusted-server-release/src/recipe/tests/sources.rs
new file mode 100644
index 0000000000..97b0ebe04d
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/tests/sources.rs
@@ -0,0 +1,126 @@
+use super::super::sources::source_replacement_arguments;
+use crate::materials::GitSourceConfig;
+
+fn parse(selector: &str) -> GitSourceConfig {
+    GitSourceConfig::parse(selector).expect("should parse the fictional selector")
+}
+
+#[test]
+fn replacement_argv_is_exact_for_registry_only() {
+    assert_eq!(
+        source_replacement_arguments("/boundary/immutable/2/vendor", &[]),
+        [
+            "--config",
+            "source.crates-io.replace-with=\"ts-vendor\"",
+            "--config",
+            "source.ts-vendor.directory=\"/boundary/immutable/2/vendor\"",
+        ],
+        "should replace only crates.io when no Git source is locked"
+    );
+}
+
+#[test]
+fn replacement_argv_is_exact_for_every_git_reference_kind() {
+    let sources = [
+        parse("git+https://example.com/org/tagged?tag=v1.2.3"),
+        parse("git+https://example.com/org/branched?branch=release-1"),
+        parse("git+https://example.com/org/pinned?rev=abc123"),
+        parse("git+https://example.com/org/default"),
+    ];
+    let expected = [
+        "--config",
+        "source.crates-io.replace-with=\"ts-vendor\"",
+        "--config",
+        "source.\"git+https://example.com/org/tagged?tag=v1.2.3\".git=\"https://example.com/org/tagged\"",
+        "--config",
+        "source.\"git+https://example.com/org/tagged?tag=v1.2.3\".tag=\"v1.2.3\"",
+        "--config",
+        "source.\"git+https://example.com/org/tagged?tag=v1.2.3\".replace-with=\"ts-vendor\"",
+        "--config",
+        "source.\"git+https://example.com/org/branched?branch=release-1\".git=\"https://example.com/org/branched\"",
+        "--config",
+        "source.\"git+https://example.com/org/branched?branch=release-1\".branch=\"release-1\"",
+        "--config",
+        "source.\"git+https://example.com/org/branched?branch=release-1\".replace-with=\"ts-vendor\"",
+        "--config",
+        "source.\"git+https://example.com/org/pinned?rev=abc123\".git=\"https://example.com/org/pinned\"",
+        "--config",
+        "source.\"git+https://example.com/org/pinned?rev=abc123\".rev=\"abc123\"",
+        "--config",
+        "source.\"git+https://example.com/org/pinned?rev=abc123\".replace-with=\"ts-vendor\"",
+        "--config",
+        "source.\"git+https://example.com/org/default\".git=\"https://example.com/org/default\"",
+        "--config",
+        "source.\"git+https://example.com/org/default\".replace-with=\"ts-vendor\"",
+        "--config",
+        "source.ts-vendor.directory=\"/boundary/immutable/2/vendor\"",
+    ];
+    assert_eq!(
+        source_replacement_arguments("/boundary/immutable/2/vendor", &sources),
+        expected,
+        "should spell a complete source table for every Git reference kind"
+    );
+}
+
+#[test]
+fn every_config_value_parses_as_a_toml_assignment() {
+    let sources = [parse("git+https://example.com/org/tagged?tag=v1.2.3")];
+    let arguments = source_replacement_arguments("/boundary/immutable/2/vendor", &sources);
+    let entries: Vec<&String> = arguments
+        .iter()
+        .enumerate()
+        .filter(|(index, _)| index % 2 == 1)
+        .map(|(_, entry)| entry)
+        .collect();
+    assert_eq!(
+        entries.len() * 2,
+        arguments.len(),
+        "should pair every value with --config"
+    );
+    for (index, entry) in entries.iter().enumerate() {
+        assert_eq!(
+            arguments[index * 2],
+            "--config",
+            "should lead every value with --config"
+        );
+        let table: toml::Table = toml::from_str(entry).expect("should parse as a TOML assignment");
+        assert_eq!(table.len(), 1, "should assign one top-level table");
+        assert!(
+            table.contains_key("source"),
+            "should configure only the source table: {entry}"
+        );
+    }
+}
+
+#[test]
+fn tracked_lockfile_sources_yield_complete_tables() {
+    let lock = std::fs::read(concat!(env!("CARGO_MANIFEST_DIR"), "/../../Cargo.lock"))
+        .expect("should read the tracked Cargo.lock");
+    let text = std::str::from_utf8(&lock).expect("should be UTF-8");
+    let selectors: std::collections::BTreeSet<String> = text
+        .lines()
+        .filter_map(|line| line.strip_prefix("source = \"git+"))
+        .filter_map(|rest| rest.strip_suffix('"'))
+        .filter_map(|rest| {
+            rest.rsplit_once('#')
+                .map(|(selector, _)| format!("git+{selector}"))
+        })
+        .collect();
+    assert!(
+        !selectors.is_empty(),
+        "should find a nonzero number of locked Git sources"
+    );
+    let sources: Vec<GitSourceConfig> = selectors.iter().map(|selector| parse(selector)).collect();
+    let arguments = source_replacement_arguments("/boundary/immutable/2/vendor", &sources);
+    for source in &sources {
+        for needle in [
+            format!("source.\"{}\".git=\"{}\"", source.key(), source.url()),
+            format!("source.\"{}\".replace-with=\"ts-vendor\"", source.key()),
+        ] {
+            assert!(
+                arguments.contains(&needle),
+                "should spell {needle} for the tracked lock"
+            );
+        }
+    }
+}
diff --git a/crates/trusted-server-release/src/recipe/tests/spdx_candidate.rs b/crates/trusted-server-release/src/recipe/tests/spdx_candidate.rs
new file mode 100644
index 0000000000..0522ed9167
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/tests/spdx_candidate.rs
@@ -0,0 +1,406 @@
+//! Checks of the unqualified candidate whole-document SPDX: the assertions the
+//! real CI builds run on every completed artifact, the measurement they print,
+//! and the wiring rejections a pure completion fixture can reach.
+//!
+//! Byte identity of the canonical and reproduction candidates is recorded as a
+//! measurement only; it is not a gate.
+
+use serde_json::{Value, json};
+use sha2::Sha256;
+
+use super::complete::{Built, built, wasm_with};
+use super::fixture::OTHER_COMMIT;
+use super::*;
+use crate::policy::ReleaseTarget;
+use crate::recipe::AppleToolEvidence;
+use crate::spdx::candidate::{CandidateSpdx, candidate_from_completed};
+
+/// SPDX identifier of the executable root package.
+const ROOT_SPDX_ID: &str = "SPDXRef-Artifact";
+/// Gap stated when GNU privileged helper contents stay unmeasured.
+const GNU_PRIVILEGED_HELPER_GAP: &str = "gnu-privileged-helper-content-unmeasured";
+/// Gap stated when the Apple tool closure is not fully measured.
+const APPLE_TOOL_CLOSURE_GAP: &str = "apple-tool-closure-unmeasured";
+
+/// Renders and checks the candidate SPDX of one real completed build.
+///
+/// # Panics
+///
+/// Panics when the candidate cannot be rendered, does not validate, binds
+/// another root digest, omits or invents a projected package, or misses a
+/// coverage gap its target family must state.
+pub(super) fn check_real_candidate(
+    completed: &RecipeCompleted,
+    source: &ApprovedSource,
+) -> CandidateSpdx {
+    let candidate = candidate_from_completed(completed, source).unwrap_or_else(|error| {
+        panic!("should render a candidate SPDX for the real completed build: {error:?}")
+    });
+    assert!(
+        !candidate.gaps().is_empty(),
+        "should state at least one coverage gap"
+    );
+    assert_eq!(
+        candidate.sha256(),
+        hex::encode(Sha256::digest(candidate.bytes())),
+        "should hash the exact candidate document bytes"
+    );
+    let document: Value =
+        serde_json::from_slice(candidate.bytes()).expect("should parse the candidate document");
+    crate::documents::validate_spdx(&document).expect("should satisfy the pinned SPDX schema");
+    let packages = document["packages"]
+        .as_array()
+        .expect("should list candidate packages");
+    let root = packages
+        .iter()
+        .find(|package| package["SPDXID"] == ROOT_SPDX_ID)
+        .expect("should contain the executable root package");
+    assert_eq!(
+        root["checksums"],
+        json!([{"algorithm": "SHA256", "checksumValue": completed.artifact().sha256()}]),
+        "should bind the root package to the completed artifact SHA-256"
+    );
+    assert_eq!(
+        packages.len(),
+        1 + projected_component_count(completed),
+        "should contain the root plus exactly the four projections' components"
+    );
+    let comment = document["creationInfo"]["comment"]
+        .as_str()
+        .expect("should carry a creation comment");
+    assert!(
+        comment.contains("candidate"),
+        "should name the document a candidate"
+    );
+    for gap in candidate.gaps() {
+        assert!(
+            comment.contains(gap.as_str()),
+            "should state gap {gap} in the creation comment"
+        );
+    }
+    check_platform_gaps(completed, candidate.gaps());
+    candidate
+}
+
+/// Sums the component counts of the four projections of one completed build.
+fn projected_component_count(completed: &RecipeCompleted) -> usize {
+    let rust = crate::spdx::cargo::CargoProjection::from_completed(completed)
+        .expect("should project the real Rust packages");
+    let native = crate::spdx::native::NativeProjection::from_completed(completed)
+        .expect("should project the real native contributors");
+    let javascript = crate::spdx::javascript::JavascriptProjection::from_completed(completed)
+        .expect("should project the real JavaScript modules");
+    let platform = crate::spdx::platform::PlatformProjection::from_completed(completed)
+        .expect("should project the real platform facts");
+    rust.component_count()
+        + native.component_count()
+        + javascript.component_count()
+        + platform.component_count()
+}
+
+/// Requires the target family's platform gaps and no Apple gap elsewhere.
+pub(super) fn check_platform_gaps(completed: &RecipeCompleted, gaps: &[String]) {
+    let view = completed
+        .composition_view()
+        .expect("should expose the sealed composition view");
+    let platform = view.platform();
+    let target = completed.asset().artifact().target;
+    let facts = PlatformGapFacts {
+        unresolved_tool_roles: platform.unresolved_native_tool_roles(),
+        apple_exclusions: platform.apple().map(AppleToolEvidence::coverage_exclusions),
+        apple_closure_unmeasured: platform.apple_tool_closure_unmeasured(),
+    };
+    let required = required_platform_gaps(target, &facts).unwrap_or_else(|reason| {
+        panic!("should fit {} platform evidence: {reason}", target.triple())
+    });
+    for gap in &required {
+        assert!(
+            gaps.contains(gap),
+            "should state the {} platform gap {gap}",
+            target.triple()
+        );
+    }
+    if !target.is_darwin() {
+        assert!(
+            !gaps.iter().any(|gap| gap.starts_with("apple-")),
+            "should state no Apple gap for {}",
+            target.triple()
+        );
+    }
+}
+
+/// The platform facts a real candidate's gaps must restate.
+struct PlatformGapFacts<'a> {
+    unresolved_tool_roles: &'a [&'static str],
+    apple_exclusions: Option<&'a [&'static str]>,
+    apple_closure_unmeasured: bool,
+}
+
+/// Names the gaps one target family's candidate must state.
+///
+/// Fastly Wasm must state every unresolved native tool host path, the Linux
+/// GNU CLI its unmeasured privileged helper contents, and Apple targets every
+/// reviewed exclusion plus an unmeasured tool closure.
+///
+/// # Errors
+///
+/// Returns the reason when the facts lack what the target family records:
+/// Fastly with no unresolved tool role, or Apple with no Apple evidence or no
+/// Apple gap at all.
+fn required_platform_gaps(
+    target: ReleaseTarget,
+    facts: &PlatformGapFacts<'_>,
+) -> Result<Vec<String>, String> {
+    match target {
+        ReleaseTarget::Wasm32Wasip1 => {
+            if facts.unresolved_tool_roles.is_empty() {
+                return Err("Fastly evidence records no unresolved native tool role".to_owned());
+            }
+            Ok(facts
+                .unresolved_tool_roles
+                .iter()
+                .map(|role| format!("native-tool-host-path-unresolved:{role}"))
+                .collect())
+        }
+        ReleaseTarget::X86_64UnknownLinuxGnu => Ok(vec![GNU_PRIVILEGED_HELPER_GAP.to_owned()]),
+        ReleaseTarget::Aarch64AppleDarwin | ReleaseTarget::X86_64AppleDarwin => {
+            let exclusions = facts
+                .apple_exclusions
+                .ok_or_else(|| "Apple target records no Apple tool evidence".to_owned())?;
+            let mut required = exclusions
+                .iter()
+                .map(|exclusion| format!("apple-coverage-excluded:{exclusion}"))
+                .collect::<Vec<_>>();
+            if facts.apple_closure_unmeasured {
+                required.push(APPLE_TOOL_CLOSURE_GAP.to_owned());
+            }
+            if required.is_empty() {
+                return Err(
+                    "Apple evidence records neither exclusions nor an unmeasured closure"
+                        .to_owned(),
+                );
+            }
+            Ok(required)
+        }
+    }
+}
+
+/// The measured identity of one candidate document.
+struct CandidateDocument<'a> {
+    sha256: &'a str,
+    bytes: &'a [u8],
+    gaps: &'a [String],
+}
+
+impl<'a> From<&'a CandidateSpdx> for CandidateDocument<'a> {
+    fn from(candidate: &'a CandidateSpdx) -> Self {
+        Self {
+            sha256: candidate.sha256(),
+            bytes: candidate.bytes(),
+            gaps: candidate.gaps(),
+        }
+    }
+}
+
+/// The printed measurement of a build's candidate SPDX documents.
+pub(super) fn candidate_spdx_measurement(
+    canonical: &CandidateSpdx,
+    reproduction: Option<&CandidateSpdx>,
+) -> Value {
+    candidate_pair_measurement(
+        &CandidateDocument::from(canonical),
+        reproduction.map(CandidateDocument::from).as_ref(),
+    )
+}
+
+/// Records both documents and whether their bytes match, without gating on it.
+fn candidate_pair_measurement(
+    canonical: &CandidateDocument<'_>,
+    reproduction: Option<&CandidateDocument<'_>>,
+) -> Value {
+    let document = |candidate: &CandidateDocument<'_>| {
+        json!({
+            "sha256": candidate.sha256,
+            "size": candidate.bytes.len(),
+            "gaps": candidate.gaps,
+        })
+    };
+    json!({
+        "kind": "ordinary-ci-candidate-spdx",
+        "canonical": document(canonical),
+        "reproduction": reproduction.map(document),
+        "byte_identical": reproduction.map(|reproduction| reproduction.bytes == canonical.bytes),
+        "byte_identity_gate": false,
+        "release_qualification": false,
+    })
+}
+
+/// Completes the pure Fastly fixture build at the fixture commit.
+fn completed_fixture() -> (Built, RecipeCompleted) {
+    let bytes = wasm_with(&[(".debug_info", b"i"), (".debug_line", b"l")]);
+    let mut build = built("trusted-server-fastly.wasm", Role::Canonical, &bytes);
+    let stdout = build.stdout(|_| {});
+    let completed = build
+        .finish(stdout)
+        .expect("should complete the accepted fixture artifact");
+    (build, completed)
+}
+
+fn rejection(result: Result<CandidateSpdx, Report<ReleaseError>>) -> String {
+    match result {
+        Ok(_) => panic!("should reject the candidate"),
+        Err(error) => format!("{error:?}"),
+    }
+}
+
+#[test]
+fn candidate_rejects_an_approved_source_at_another_commit() {
+    let (_build, completed) = completed_fixture();
+    let other = CommitId::parse(OTHER_COMMIT).expect("should parse the other commit");
+    let source = ApprovedSource::in_memory_for_tests(&other, &[]);
+    let error = rejection(candidate_from_completed(&completed, &source));
+    assert!(
+        error.contains("approved source differs from the completed build commit"),
+        "should reject the source commit mismatch: {error}"
+    );
+}
+
+#[test]
+fn candidate_rejects_a_completion_without_retained_composition() {
+    let (_build, completed) = completed_fixture();
+    let commit = CommitId::parse(COMMIT).expect("should parse the fixture commit");
+    let source = ApprovedSource::in_memory_for_tests(&commit, &[]);
+    let error = rejection(candidate_from_completed(&completed, &source));
+    assert!(
+        !error.contains("approved source differs")
+            && error.contains("completed build has no retained composition"),
+        "should pass the commit check before rejecting the missing receipts: {error}"
+    );
+}
+
+fn facts<'a>(
+    unresolved_tool_roles: &'a [&'static str],
+    apple_exclusions: Option<&'a [&'static str]>,
+    apple_closure_unmeasured: bool,
+) -> PlatformGapFacts<'a> {
+    PlatformGapFacts {
+        unresolved_tool_roles,
+        apple_exclusions,
+        apple_closure_unmeasured,
+    }
+}
+
+#[test]
+fn fastly_requires_every_unresolved_tool_role() {
+    let required = required_platform_gaps(
+        ReleaseTarget::Wasm32Wasip1,
+        &facts(&["compiler", "linker"], None, false),
+    )
+    .expect("should accept unresolved Fastly tool roles");
+    assert_eq!(
+        required,
+        [
+            "native-tool-host-path-unresolved:compiler",
+            "native-tool-host-path-unresolved:linker",
+        ],
+        "should require one gap per unresolved role"
+    );
+    assert!(
+        required_platform_gaps(ReleaseTarget::Wasm32Wasip1, &facts(&[], None, false)).is_err(),
+        "should reject Fastly evidence with no unresolved role"
+    );
+}
+
+#[test]
+fn linux_requires_the_gnu_privileged_helper_gap() {
+    let required = required_platform_gaps(
+        ReleaseTarget::X86_64UnknownLinuxGnu,
+        &facts(&[], None, false),
+    )
+    .expect("should name the GNU gap");
+    assert_eq!(
+        required,
+        [GNU_PRIVILEGED_HELPER_GAP],
+        "should require the privileged helper gap"
+    );
+}
+
+#[test]
+fn apple_requires_exclusions_and_the_unmeasured_closure() {
+    let required = required_platform_gaps(
+        ReleaseTarget::Aarch64AppleDarwin,
+        &facts(&[], Some(&["example-exclusion"]), true),
+    )
+    .expect("should accept Apple evidence");
+    assert_eq!(
+        required,
+        [
+            "apple-coverage-excluded:example-exclusion",
+            APPLE_TOOL_CLOSURE_GAP
+        ],
+        "should require every exclusion and the closure gap"
+    );
+    assert!(
+        required_platform_gaps(ReleaseTarget::X86_64AppleDarwin, &facts(&[], None, true)).is_err(),
+        "should reject an Apple target without Apple evidence"
+    );
+    assert!(
+        required_platform_gaps(
+            ReleaseTarget::X86_64AppleDarwin,
+            &facts(&[], Some(&[]), false)
+        )
+        .is_err(),
+        "should reject Apple evidence that states no gap"
+    );
+}
+
+#[test]
+fn candidate_measurement_records_identity_without_gating() {
+    let gaps = vec!["example-gap".to_owned()];
+    let canonical = CandidateDocument {
+        sha256: "a",
+        bytes: b"{}",
+        gaps: &gaps,
+    };
+    let differing = CandidateDocument {
+        sha256: "b",
+        bytes: b"{ }",
+        gaps: &gaps,
+    };
+    let identical = candidate_pair_measurement(&canonical, Some(&canonical));
+    assert_eq!(
+        identical["byte_identical"],
+        json!(true),
+        "should record identical bytes"
+    );
+    assert_eq!(
+        identical["canonical"],
+        json!({"sha256": "a", "size": 2, "gaps": ["example-gap"]}),
+        "should record digest, size and gaps"
+    );
+    let differs = candidate_pair_measurement(&canonical, Some(&differing));
+    assert_eq!(
+        differs["byte_identical"],
+        json!(false),
+        "should record differing bytes"
+    );
+    assert_eq!(
+        differs["byte_identity_gate"],
+        json!(false),
+        "should not gate on byte identity"
+    );
+    let alone = candidate_pair_measurement(&canonical, None);
+    assert_eq!(
+        (
+            alone["reproduction"].clone(),
+            alone["byte_identical"].clone()
+        ),
+        (Value::Null, Value::Null),
+        "should record no comparison without a reproduction"
+    );
+    assert_eq!(
+        alone["release_qualification"],
+        json!(false),
+        "should grant no qualification"
+    );
+}
diff --git a/crates/trusted-server-release/src/recipe/tests/tools.rs b/crates/trusted-server-release/src/recipe/tests/tools.rs
new file mode 100644
index 0000000000..42ccbbb18c
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/tests/tools.rs
@@ -0,0 +1,381 @@
+use std::fs;
+use std::os::unix::fs::{PermissionsExt as _, symlink};
+
+use super::fixture::*;
+use super::*;
+use crate::boundary::DescendantCleanup;
+use crate::policy::FIXED_ARTIFACTS;
+
+#[test]
+fn candidate_tool_evidence_records_measured_tree_and_selected_relative_roles() {
+    let fixture = Fixture::new(COMMIT);
+    let tools = fixture.tools_for(ReleaseTarget::Wasm32Wasip1);
+    let evidence = tools
+        .candidate_measurement()
+        .expect("should measure selected tools without granting release authority");
+    let value = serde_json::to_value(evidence).expect("should serialize candidate tool evidence");
+    assert_eq!(
+        value["tree_sha256"],
+        tools.digest().expect("should hash tools"),
+        "should bind the whole selected Rust tree"
+    );
+    assert_eq!(
+        value["cargo"], "bin/cargo",
+        "should identify the selected Cargo role"
+    );
+    assert_eq!(
+        value["rustc"], "bin/rustc",
+        "should identify the selected compiler role"
+    );
+    assert_eq!(
+        value["target_standard_library"], "lib/rustlib/wasm32-wasip1/lib",
+        "should identify the selected target sysroot libraries"
+    );
+    assert_eq!(
+        value["identity_scope"], "selected_tool_tree",
+        "should state measured identity scope"
+    );
+    assert_eq!(
+        value["origin"], "candidate_measurement",
+        "should not claim original acquisition provenance"
+    );
+    assert_eq!(
+        value["qualification"], "unqualified",
+        "should preserve candidate authority"
+    );
+}
+
+#[test]
+fn candidate_tool_measurement_rechecks_selected_layout() {
+    let fixture = Fixture::new(COMMIT);
+    let tools = fixture.tools_for(ReleaseTarget::Wasm32Wasip1);
+    fs::remove_file(fixture.base.join("tools/bin/rustc")).expect("should remove selected compiler");
+    assert!(
+        tools.candidate_measurement().is_err(),
+        "should reject a missing selected compiler"
+    );
+}
+
+fn rejection(fixture: &Fixture, target: ReleaseTarget) -> String {
+    match SelectedRustTools::for_tests(&fixture.base.join("tools"), target) {
+        Ok(_) => panic!("should reject the tools"),
+        Err(error) => format!("{error:?}"),
+    }
+}
+
+#[test]
+fn every_asset_target_needs_its_own_standard_library_directory() {
+    assert!(
+        !FIXED_ARTIFACTS.is_empty(),
+        "should select a nonzero number of targets"
+    );
+    for artifact in &FIXED_ARTIFACTS {
+        let fixture = Fixture::new(COMMIT);
+        let tools = fixture.tools_for(artifact.target);
+        assert_eq!(
+            tools.target(),
+            artifact.target,
+            "should record the checked target"
+        );
+        let standard = fixture
+            .base
+            .join("tools/lib/rustlib")
+            .join(artifact.target.triple())
+            .join("lib");
+        fs::remove_dir_all(&standard).expect("should remove the target standard library");
+        assert!(
+            rejection(&fixture, artifact.target).contains("standard library"),
+            "should reject {} without its standard library directory",
+            artifact.target.triple()
+        );
+    }
+}
+
+#[test]
+fn other_targets_standard_library_does_not_satisfy_the_asset_target() {
+    let fixture = Fixture::new(COMMIT);
+    fs::remove_dir_all(
+        fixture
+            .base
+            .join("tools/lib/rustlib/aarch64-apple-darwin/lib"),
+    )
+    .expect("should remove one target");
+    SelectedRustTools::for_tests(
+        &fixture.base.join("tools"),
+        ReleaseTarget::X86_64UnknownLinuxGnu,
+    )
+    .expect("should accept a target whose library is present");
+    assert!(
+        rejection(&fixture, ReleaseTarget::Aarch64AppleDarwin).contains("standard library"),
+        "should reject the target whose library is absent although others are present"
+    );
+}
+
+#[test]
+fn standard_library_directory_must_hold_a_libstd_file() {
+    let fixture = Fixture::new(COMMIT);
+    let standard = fixture.base.join("tools/lib/rustlib/wasm32-wasip1/lib");
+    fs::remove_file(standard.join("libstd-0123456789abcdef.rlib")).expect("should remove libstd");
+    assert!(
+        rejection(&fixture, ReleaseTarget::Wasm32Wasip1).contains("libstd"),
+        "should reject an empty standard library directory"
+    );
+    fs::create_dir(standard.join("libstd-subdirectory")).expect("should add a directory");
+    assert!(
+        rejection(&fixture, ReleaseTarget::Wasm32Wasip1).contains("libstd"),
+        "should reject a libstd-named directory"
+    );
+    fs::write(standard.join("libcore-0123.rlib"), b"fictional").expect("should add libcore");
+    assert!(
+        rejection(&fixture, ReleaseTarget::Wasm32Wasip1).contains("libstd"),
+        "should reject a directory with only other libraries"
+    );
+}
+
+#[test]
+fn symlinked_or_missing_tool_layout_is_rejected() {
+    let fixture = Fixture::new(COMMIT);
+    let standard = fixture.base.join("tools/lib/rustlib/wasm32-wasip1/lib");
+    fs::rename(&standard, fixture.base.join("real-std")).expect("should move the directory");
+    symlink(fixture.base.join("real-std"), &standard).expect("should alias the directory");
+    assert!(
+        rejection(&fixture, ReleaseTarget::Wasm32Wasip1).contains("symlink"),
+        "should reject a symlinked standard library directory"
+    );
+    let fixture = Fixture::new(COMMIT);
+    fs::remove_file(fixture.base.join("tools/bin/rustc")).expect("should remove rustc");
+    assert!(
+        rejection(&fixture, ReleaseTarget::Wasm32Wasip1).contains("Rust tool"),
+        "should reject missing rustc"
+    );
+}
+
+#[test]
+fn tool_digest_detects_edits_hard_links_and_escaping_aliases() {
+    let fixture = Fixture::new(COMMIT);
+    let tools = fixture.tools_for(ReleaseTarget::Aarch64AppleDarwin);
+    let baseline = tools.digest().expect("should digest the tools");
+    assert_eq!(
+        baseline,
+        tools.digest().expect("should digest again"),
+        "should be stable"
+    );
+
+    fs::write(
+        fixture.base.join("tools/bin/cargo"),
+        b"fictional tool, edited",
+    )
+    .expect("should edit cargo");
+    let edited = tools.digest().expect("should digest the edited tools");
+    assert_ne!(baseline, edited, "should detect an edited tool");
+    fs::write(fixture.base.join("tools/bin/cargo"), b"fictional tool")
+        .expect("should restore cargo");
+    assert_eq!(
+        baseline,
+        tools.digest().expect("should digest restored tools"),
+        "should return to the baseline"
+    );
+
+    fs::set_permissions(
+        fixture.base.join("tools/bin/rustc"),
+        fs::Permissions::from_mode(0o700),
+    )
+    .expect("should chmod rustc");
+    assert_ne!(
+        baseline,
+        tools.digest().expect("should digest chmod tools"),
+        "should detect a mode change"
+    );
+    fs::set_permissions(
+        fixture.base.join("tools/bin/rustc"),
+        fs::Permissions::from_mode(0o644),
+    )
+    .expect("should restore mode");
+
+    fs::hard_link(
+        fixture.base.join("tools/bin/cargo"),
+        fixture.base.join("tools/bin/cargo-link"),
+    )
+    .expect("should hard-link cargo");
+    assert!(tools.digest().is_err(), "should reject a hard-linked tool");
+    fs::remove_file(fixture.base.join("tools/bin/cargo-link")).expect("should remove the link");
+
+    symlink("../../other-work", fixture.base.join("tools/escape"))
+        .expect("should add escaping alias");
+    assert!(
+        tools.digest().is_err(),
+        "should reject an alias escaping the tool root"
+    );
+}
+
+#[test]
+fn tools_edited_after_binding_are_rejected_at_the_execute_gate() {
+    let fixture = Fixture::new(COMMIT);
+    let prepared = fixture
+        .bind("ts-aarch64-apple-darwin", Role::Canonical)
+        .expect("should bind the recipe");
+    prepared
+        .check_tools()
+        .expect("should accept the untouched tools");
+    prepared
+        .check_materials()
+        .expect("should accept the untouched materials");
+    fs::write(fixture.base.join("tools/bin/rustc"), b"swapped compiler")
+        .expect("should swap rustc");
+    let error = prepared
+        .check_tools()
+        .expect_err("should reject the swapped tools");
+    assert!(
+        format!("{error:?}").contains("Rust tools changed"),
+        "should name the changed tools"
+    );
+    fs::write(fixture.base.join("tools/bin/rustc"), b"fictional tool")
+        .expect("should restore rustc");
+    prepared
+        .check_tools()
+        .expect("should accept the restored tools");
+    fs::write(
+        fixture
+            .base
+            .join("materials/vendor/example-1.0.0/Cargo.toml"),
+        b"swapped dependency",
+    )
+    .expect("should swap a vendored file");
+    assert!(
+        format!(
+            "{:?}",
+            prepared
+                .check_materials()
+                .expect_err("should reject swapped materials")
+        )
+        .contains("changed after binding"),
+        "should name the changed materials"
+    );
+}
+
+#[test]
+fn cargo_registry_bookkeeping_directory_is_not_a_fetched_source_cache() {
+    let fixture = Fixture::new(COMMIT);
+    let prepared = fixture
+        .bind("ts-aarch64-apple-darwin", Role::Canonical)
+        .expect("should bind the recipe");
+    fs::create_dir(fixture.base.join("cargo-state/cargo-home/registry"))
+        .expect("should create the registry bookkeeping directory");
+    prepared
+        .check_no_fetched_sources()
+        .expect("should accept the empty registry directory created before source replacement");
+}
+
+#[test]
+fn handoff_edits_and_cargo_home_caches_are_rejected_around_the_run() {
+    let fixture = Fixture::new(COMMIT);
+    let retained = fixture.retained();
+    let prepared = fixture
+        .bind("ts-aarch64-apple-darwin", Role::Canonical)
+        .expect("should bind the recipe");
+    prepared
+        .check_inputs()
+        .expect("should accept the untouched handoff, tools and materials");
+    fs::write(retained.join("bundles/tsjs-core.js"), b"tampered")
+        .expect("should edit a retained module");
+    assert!(
+        format!(
+            "{:?}",
+            prepared
+                .check_inputs()
+                .expect_err("should reject the edited handoff")
+        )
+        .contains("retained JS handoff changed"),
+        "should name the changed handoff"
+    );
+    fs::write(retained.join("bundles/tsjs-core.js"), b"fictional module")
+        .expect("should restore the retained module");
+    prepared
+        .check_inputs()
+        .expect("should accept the restored handoff");
+
+    prepared
+        .check_no_fetched_sources()
+        .expect("should accept a Cargo home without caches");
+    for cache in ["registry", "git"] {
+        let path = fixture.base.join("cargo-state/cargo-home").join(cache);
+        fs::create_dir(&path).expect("should create a Cargo cache");
+        if cache == "registry" {
+            fs::create_dir(path.join("index")).expect("should create fetched registry state");
+        }
+        assert!(
+            format!(
+                "{:?}",
+                prepared
+                    .check_no_fetched_sources()
+                    .expect_err("should reject a Cargo cache")
+            )
+            .contains(&format!("holds a {cache} cache")),
+            "should name the {cache} cache"
+        );
+        fs::remove_dir_all(&path).expect("should remove the Cargo cache");
+    }
+}
+
+#[test]
+fn only_the_ordinary_ci_selection_permits_a_candidate_run() {
+    let fixture = Fixture::new(COMMIT);
+    let tools = fixture.tools_for(ReleaseTarget::Wasm32Wasip1);
+    assert!(
+        tools.permits_candidate_run(),
+        "should let the ordinary CI selection start a candidate run"
+    );
+    assert_eq!(
+        tools.authority(),
+        Authority::Unqualified,
+        "should still carry no release authority"
+    );
+}
+
+#[test]
+fn cleanup_gate_admits_reaped_cleanup_only_with_the_allowance() {
+    let cases = [
+        (DescendantCleanup::OwnedByContainer, false, true),
+        (DescendantCleanup::OwnedByContainer, true, true),
+        (DescendantCleanup::ReapedAfterRun, true, true),
+        (DescendantCleanup::ReapedAfterRun, false, false),
+    ];
+    for (cleanup, allowance, admitted) in cases {
+        let result = super::super::execute::cleanup_gate(cleanup, allowance);
+        assert_eq!(
+            result.is_ok(),
+            admitted,
+            "should decide {cleanup} with allowance {allowance}"
+        );
+        if let Err(error) = result {
+            assert!(
+                format!("{error:?}")
+                    .contains("post-run-reaped cleanup is not permitted for this selection"),
+                "should name the refused cleanup: {error:?}"
+            );
+        }
+    }
+}
+
+#[test]
+fn only_the_ordinary_ci_selection_permits_post_run_reaped_cleanup() {
+    let fixture = Fixture::new(COMMIT);
+    for artifact in &FIXED_ARTIFACTS {
+        assert!(
+            fixture
+                .tools_for(artifact.target)
+                .permits_post_run_reaped_cleanup(),
+            "should let the ordinary CI selection accept reaped cleanup for {}",
+            artifact.name
+        );
+    }
+    assert!(
+        ToolSelection::OrdinaryCi.permits_post_run_reaped_cleanup(),
+        "should allow the cfg(test) ordinary CI selection"
+    );
+    // The qualified arm cannot be reached: no qualified selection exists, so
+    // Task 8 must add an explicit decision before production can pass.
+    let never: fn(QualifiedRustTools) -> ! = |qualification| match qualification {};
+    let qualified: fn(QualifiedRustTools) -> ToolSelection = ToolSelection::Qualified;
+    let _ = (never, qualified);
+}
diff --git a/crates/trusted-server-release/src/recipe/tools.rs b/crates/trusted-server-release/src/recipe/tools.rs
new file mode 100644
index 0000000000..5c9e3eb050
--- /dev/null
+++ b/crates/trusted-server-release/src/recipe/tools.rs
@@ -0,0 +1,292 @@
+//! The Rust toolchain a recipe builds with, and how its selection is gated.
+
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::time::Duration;
+
+use error_stack::Report;
+use serde::Serialize;
+
+use super::apple::AppleDeveloperTools;
+use super::fresh::{real_directory, real_file};
+use super::recipe_error;
+use crate::error::ReleaseError;
+use crate::policy::ReleaseTarget;
+use crate::tool_tree::tool_tree_digest;
+
+/// Wall limit of one confined Cargo build for the ordinary CI selection.
+///
+/// The hosted `macos-15-intel` canonical CLI build took 1,193 s and its
+/// reproduction exceeded the former 25-minute wall while still compiling
+/// (run 39540057202), so the candidate wall allows roughly twice the measured
+/// canonical time. It stays inside the macOS CLI test's 120-minute deadline.
+#[cfg(test)]
+const ORDINARY_CI_BUILD_WALL: Duration = Duration::from_secs(45 * 60);
+
+/// A Rust toolchain that passed Task 8 qualification.
+///
+/// None has, so this type is uninhabited and production selection stays closed.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum QualifiedRustTools {}
+
+/// Whether a selection carries release authority.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum Authority {
+    /// A qualified toolchain; cannot be constructed while none is qualified.
+    Qualified,
+    /// An ordinary CI toolchain that proves nothing about release provenance.
+    Unqualified,
+}
+
+/// How a toolchain was selected.
+///
+/// Production builds can only name [`QualifiedRustTools`], which is
+/// uninhabited, so no production value exists until a toolchain is qualified.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum ToolSelection {
+    /// A qualified production selection.
+    Qualified(QualifiedRustTools),
+    /// An ordinary CI toolchain; test builds only.
+    #[cfg(test)]
+    OrdinaryCi,
+}
+
+impl ToolSelection {
+    /// Returns the authority this selection carries.
+    pub(crate) fn authority(&self) -> Authority {
+        match self {
+            Self::Qualified(qualification) => match *qualification {},
+            #[cfg(test)]
+            Self::OrdinaryCi => Authority::Unqualified,
+        }
+    }
+
+    /// Reports whether this selection may start an unqualified candidate run.
+    ///
+    /// Only the test-only ordinary CI selection may, so a candidate run is
+    /// evidence for CI and never release qualification. A production build
+    /// can name no selection at all, so its execute gate stays closed.
+    pub(crate) fn permits_candidate_run(&self) -> bool {
+        match self {
+            Self::Qualified(qualification) => match *qualification {},
+            #[cfg(test)]
+            Self::OrdinaryCi => true,
+        }
+    }
+
+    /// Reports whether this selection accepts a boundary whose descendants
+    /// are only reaped after the run instead of owned by a container.
+    ///
+    /// Only the test-only ordinary CI selection does, so macOS candidate runs
+    /// can produce the evidence Task 8 needs. A qualified selection must
+    /// decide this explicitly when one exists.
+    pub(crate) fn permits_post_run_reaped_cleanup(&self) -> bool {
+        match self {
+            Self::Qualified(qualification) => match *qualification {},
+            #[cfg(test)]
+            Self::OrdinaryCi => true,
+        }
+    }
+
+    /// Returns the wall limit of one confined Cargo build.
+    ///
+    /// Only the test-only ordinary CI selection has one, sized from hosted
+    /// runner measurements. A qualified selection must decide its own wall
+    /// explicitly when one exists.
+    pub(crate) fn build_wall(&self) -> Duration {
+        match self {
+            Self::Qualified(qualification) => match *qualification {},
+            #[cfg(test)]
+            Self::OrdinaryCi => ORDINARY_CI_BUILD_WALL,
+        }
+    }
+}
+
+/// Fixed `bin/cargo`, `bin/rustc` and target standard-library layout, retained
+/// as a measured candidate.
+pub(crate) struct SelectedRustTools {
+    root: PathBuf,
+    target: ReleaseTarget,
+    selection: ToolSelection,
+    apple: Option<AppleDeveloperTools>,
+}
+
+/// Candidate identity of the measured Rust tree and its selected component roles.
+///
+/// This covers the installed tree, not original acquisition or qualification.
+#[derive(Debug, Serialize)]
+pub(crate) struct RustToolEvidence {
+    tree_sha256: String,
+    target: &'static str,
+    cargo: &'static str,
+    rustc: &'static str,
+    target_standard_library: PathBuf,
+    identity_scope: &'static str,
+    origin: &'static str,
+    qualification: &'static str,
+}
+
+impl RustToolEvidence {
+    /// Returns the selected standard-library target.
+    pub(crate) fn target(&self) -> &str {
+        self.target
+    }
+    /// Returns the measured installed-tree digest retained in this receipt.
+    pub(crate) fn tree_sha256(&self) -> &str {
+        &self.tree_sha256
+    }
+}
+
+/// Requires the fixed layout for `target` below the canonical `root`.
+///
+/// The target's `lib/rustlib/<triple>/lib` directory must hold a `libstd-*`
+/// file, so a toolchain installed without the target's standard library is
+/// rejected before any build starts.
+fn check_layout(root: &Path, target: ReleaseTarget) -> Result<(), Report<ReleaseError>> {
+    for relative in ["bin/cargo", "bin/rustc"] {
+        real_file("Rust tool", &root.join(relative))?;
+    }
+    let standard = root.join("lib/rustlib").join(target.triple()).join("lib");
+    real_directory("Rust target standard library directory", &standard)?;
+    let list_error = |error: std::io::Error| {
+        recipe_error(format!("cannot list the target standard library: {error}"))
+    };
+    let mut has_std = false;
+    for entry in fs::read_dir(&standard).map_err(list_error)? {
+        let entry = entry.map_err(list_error)?;
+        let kind = entry.file_type().map_err(list_error)?;
+        has_std |= kind.is_file() && entry.file_name().to_string_lossy().starts_with("libstd-");
+    }
+    if !has_std {
+        return Err(recipe_error(format!(
+            "Rust tools hold no libstd file for target {}",
+            target.triple()
+        )));
+    }
+    Ok(())
+}
+
+impl SelectedRustTools {
+    /// Measures the owned installed tree and identifies the selected Rust roles.
+    ///
+    /// # Errors
+    ///
+    /// Rejects a changed tool layout or a tree that cannot be safely measured.
+    pub(crate) fn candidate_measurement(&self) -> Result<RustToolEvidence, Report<ReleaseError>> {
+        check_layout(&self.root, self.target)?;
+        Ok(RustToolEvidence {
+            tree_sha256: self.digest()?,
+            target: self.target.triple(),
+            cargo: "bin/cargo",
+            rustc: "bin/rustc",
+            target_standard_library: Path::new("lib/rustlib")
+                .join(self.target.triple())
+                .join("lib"),
+            identity_scope: "selected_tool_tree",
+            origin: "candidate_measurement",
+            qualification: "unqualified",
+        })
+    }
+
+    /// Accepts only a qualified selection; production construction stays closed.
+    pub(crate) fn qualified(_root: &Path, qualification: QualifiedRustTools) -> Self {
+        match qualification {}
+    }
+
+    /// Selects ordinary CI tools without asserting release qualification.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] unless `bin/cargo` and `bin/rustc`
+    /// are regular files and `lib/rustlib/<triple>/lib` holds a `libstd-*`
+    /// file, all below the canonical `root`.
+    #[cfg(test)]
+    pub(crate) fn for_tests(
+        root: &Path,
+        target: ReleaseTarget,
+    ) -> Result<Self, Report<ReleaseError>> {
+        let root = fs::canonicalize(root)
+            .map_err(|error| recipe_error(format!("cannot resolve Rust tools: {error}")))?;
+        check_layout(&root, target)?;
+        Ok(Self {
+            root,
+            target,
+            selection: ToolSelection::OrdinaryCi,
+            apple: None,
+        })
+    }
+
+    /// Adds the Apple developer tools a Darwin build compiles and links with.
+    ///
+    /// Binding requires them for exactly the Darwin targets.
+    #[cfg(test)]
+    #[must_use]
+    pub(crate) fn with_apple_developer_tools(mut self, apple: AppleDeveloperTools) -> Self {
+        self.apple = Some(apple);
+        self
+    }
+
+    /// The Apple developer tools, present only for a Darwin build.
+    pub(crate) fn apple(&self) -> Option<&AppleDeveloperTools> {
+        self.apple.as_ref()
+    }
+
+    /// The canonical tool root.
+    pub(crate) fn root(&self) -> &Path {
+        &self.root
+    }
+
+    /// The target whose standard library the layout was checked for.
+    pub(crate) fn target(&self) -> ReleaseTarget {
+        self.target
+    }
+
+    /// The authority of this selection.
+    pub(crate) fn authority(&self) -> Authority {
+        self.selection.authority()
+    }
+
+    /// Whether this selection may start an unqualified candidate run.
+    pub(crate) fn permits_candidate_run(&self) -> bool {
+        self.selection.permits_candidate_run()
+    }
+
+    /// Whether this selection accepts post-run-reaped descendant cleanup.
+    pub(crate) fn permits_post_run_reaped_cleanup(&self) -> bool {
+        self.selection.permits_post_run_reaped_cleanup()
+    }
+
+    /// The wall limit of one confined Cargo build for this selection.
+    pub(crate) fn build_wall(&self) -> Duration {
+        self.selection.build_wall()
+    }
+
+    /// Host path of the selected Cargo.
+    pub(crate) fn cargo(&self) -> PathBuf {
+        self.root.join("bin/cargo")
+    }
+
+    /// Host path of the selected compiler.
+    pub(crate) fn rustc(&self) -> PathBuf {
+        self.root.join("bin/rustc")
+    }
+
+    /// Host path of the directory holding both tools.
+    pub(crate) fn bin_dir(&self) -> PathBuf {
+        self.root.join("bin")
+    }
+
+    /// Digest of the whole tool tree: contents, modes, names and aliases.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Recipe`] for a hard-linked or special file, an
+    /// alias that escapes the root, or an exceeded limit.
+    pub(crate) fn digest(&self) -> Result<String, Report<ReleaseError>> {
+        tool_tree_digest(&self.root, &|| Ok(())).map_err(|error| {
+            error
+                .change_context(ReleaseError::Recipe)
+                .attach("Rust tool tree cannot be digested")
+        })
+    }
+}
diff --git a/crates/trusted-server-release/src/source.rs b/crates/trusted-server-release/src/source.rs
new file mode 100644
index 0000000000..64147b46e5
--- /dev/null
+++ b/crates/trusted-server-release/src/source.rs
@@ -0,0 +1,534 @@
+//! Local authentication of the approved release source checkout.
+//!
+//! The repository layout and configuration are inspected with bounded direct
+//! reads before Git runs, because Git itself would execute or redirect through
+//! several configuration channels. Only read-only plumbing then runs under a
+//! cleared environment, and every object Git returns is rehashed. Remote
+//! branch-tip ancestry and ruleset validation are hosted operations (Task 14)
+//! and are not established here.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::fs;
+use std::io;
+use std::path::{Path, PathBuf};
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256};
+
+use crate::documents::{Role, lower_hex, parse_json, read_bounded};
+use crate::error::ReleaseError;
+use crate::preflight::AuditedEnvironment;
+use closure::helper_closure;
+use config::check_git_config;
+use git::Git;
+use tree::{TREE_LIMITS, TreeEntry, walk_tree};
+use worktree::compare_worktree;
+
+mod closure;
+mod config;
+mod git;
+mod materialize;
+mod tree;
+mod worktree;
+
+pub(crate) use materialize::{FreshSource, FreshSourceVerification};
+
+/// Repository channels that rewrite history, objects or checkout attributes.
+const FORBIDDEN_GIT_PATHS: [&str; 7] = [
+    "commondir",
+    "objects/info/alternates",
+    "objects/info/http-alternates",
+    "info/grafts",
+    "info/attributes",
+    "shallow",
+    "refs/replace",
+];
+
+/// Tracked symlinks reviewed for release sources, with their exact targets.
+const REVIEWED_SYMLINKS: [(&str, &str); 1] = [("CLAUDE.md", "AGENTS.md")];
+
+fn source_error(message: impl Into<String>) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Source).attach(message.into())
+}
+
+/// A Git SHA-1 commit id: exactly 40 lowercase hexadecimal digits.
+#[derive(Clone, Debug, PartialEq, Eq, derive_more::Display)]
+pub(crate) struct CommitId(String);
+
+impl CommitId {
+    /// Parses an approved commit argument without any normalization.
+    ///
+    /// # Errors
+    ///
+    /// Fails unless `value` is exactly 40 lowercase hexadecimal digits.
+    pub(crate) fn parse(value: &str) -> Result<Self, Report<ReleaseError>> {
+        if !lower_hex(value, 40) {
+            return Err(source_error(
+                "approved source commit must be exactly 40 lowercase hex digits",
+            ));
+        }
+        Ok(Self(value.to_owned()))
+    }
+
+    /// The commit id text.
+    pub(crate) fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Mode {
+    Regular,
+    Executable,
+    Symlink,
+}
+
+impl Mode {
+    fn label(self) -> &'static str {
+        match self {
+            Self::Regular => "100644",
+            Self::Executable => "100755",
+            Self::Symlink => "120000",
+        }
+    }
+}
+
+/// Tracked path records: mode and SHA-256 of content or symlink target.
+type Records = BTreeMap<String, (Mode, String)>;
+
+/// Returns the complete approved JS entry-point set of `records`, sorted.
+fn js_module_ids(records: &Records) -> Vec<String> {
+    let prefix = "crates/trusted-server-js/lib/src/";
+    let mut ids: Vec<_> = records
+        .keys()
+        .filter_map(|path| {
+            let path = path.strip_prefix(prefix)?;
+            if path == "core/index.ts" {
+                return Some("core".to_owned());
+            }
+            let integration = path
+                .strip_prefix("integrations/")?
+                .strip_suffix("/index.ts")?;
+            (!integration.contains('/')).then(|| integration.to_owned())
+        })
+        .collect();
+    ids.sort();
+    ids
+}
+
+/// Fingerprint of every tracked worktree path at the approved commit.
+pub(crate) struct SourceSnapshot {
+    root: PathBuf,
+    records: Records,
+    fingerprint: String,
+}
+
+impl SourceSnapshot {
+    /// SHA-256 over sorted path, mode and content-digest records.
+    pub(crate) fn fingerprint(&self) -> &str {
+        &self.fingerprint
+    }
+
+    /// Rescans the worktree and fails on any tracked or untracked change.
+    ///
+    /// # Errors
+    ///
+    /// Fails on changed content, modes, file types or hard-link counts,
+    /// missing tracked paths, or any new untracked path.
+    pub(crate) fn verify_unchanged(&self) -> Result<(), Report<ReleaseError>> {
+        compare_worktree(&self.root, &self.records)
+    }
+}
+
+/// A locally authenticated source checkout; constructed only by [`authenticate`].
+pub(crate) struct ApprovedSource {
+    commit: CommitId,
+    epoch: u64,
+    snapshot: SourceSnapshot,
+    closure_digest: String,
+    closure_paths: Vec<String>,
+}
+
+impl ApprovedSource {
+    /// The approved source commit.
+    pub(crate) fn commit(&self) -> &CommitId {
+        &self.commit
+    }
+
+    /// `SOURCE_DATE_EPOCH` derived from the approved committer timestamp.
+    pub(crate) fn epoch(&self) -> u64 {
+        self.epoch
+    }
+
+    /// The tracked worktree snapshot for before/after mutation checks.
+    pub(crate) fn snapshot(&self) -> &SourceSnapshot {
+        &self.snapshot
+    }
+
+    /// Audit fingerprint of the helper-source closure. It is not authority.
+    pub(crate) fn closure_digest(&self) -> &str {
+        &self.closure_digest
+    }
+
+    /// Sorted paths covered by [`Self::closure_digest`].
+    pub(crate) fn closure_paths(&self) -> &[String] {
+        &self.closure_paths
+    }
+
+    /// Returns the complete approved JS entry-point set in sorted order.
+    pub(crate) fn module_ids(&self) -> Vec<String> {
+        js_module_ids(&self.snapshot.records)
+    }
+
+    /// Describes an approved source in memory without reading Git, for unit
+    /// tests whose subject consumes only the commit and tracked path names.
+    ///
+    /// Every path is recorded as a regular file with a fictional digest.
+    #[cfg(test)]
+    pub(crate) fn in_memory_for_tests(commit: &CommitId, tracked: &[&str]) -> Self {
+        let records: Records = tracked
+            .iter()
+            .map(|path| ((*path).to_owned(), (Mode::Regular, "0".repeat(64))))
+            .collect();
+        let fingerprint = digest_records(records.iter());
+        Self {
+            commit: commit.clone(),
+            epoch: 1_700_000_000,
+            snapshot: SourceSnapshot {
+                root: PathBuf::from("/example/in-memory-source"),
+                records,
+                fingerprint,
+            },
+            closure_digest: "0".repeat(64),
+            closure_paths: Vec::new(),
+        }
+    }
+
+    /// SHA-256 of a tracked path's content at the approved commit.
+    pub(crate) fn tracked_sha256(&self, path: &str) -> Option<&str> {
+        self.snapshot
+            .records
+            .get(path)
+            .map(|(_, sha256)| sha256.as_str())
+    }
+
+    /// Approved regular Cargo manifests, keyed by source-relative path.
+    ///
+    /// Symlink identities describe link targets rather than manifest bytes and
+    /// therefore cannot authorize a workspace package's composition origin.
+    pub(crate) fn cargo_manifest_digests(&self) -> BTreeMap<PathBuf, String> {
+        self.snapshot
+            .records
+            .iter()
+            .filter(|(path, (mode, _))| {
+                matches!(mode, Mode::Regular | Mode::Executable)
+                    && (path.as_str() == "Cargo.toml" || path.ends_with("/Cargo.toml"))
+            })
+            .map(|(path, (_, digest))| (PathBuf::from(path), digest.clone()))
+            .collect()
+    }
+
+    /// Reads bounded tracked bytes and checks their approved object digest.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ReleaseError::Source`] for an untracked name, changed bytes,
+    /// or an input rejected by the held-descriptor document reader.
+    pub(crate) fn read_tracked(
+        &self,
+        path: &str,
+        role: Role,
+    ) -> Result<Vec<u8>, Report<ReleaseError>> {
+        let expected = self
+            .tracked_sha256(path)
+            .ok_or_else(|| source_error("material input is not an approved tracked file"))?;
+        let raw = read_bounded(&self.snapshot.root.join(path), role)?;
+        if raw.sha256 != expected {
+            return Err(source_error(
+                "tracked material input differs from the approved source",
+            ));
+        }
+        Ok(raw.bytes)
+    }
+}
+
+/// Authenticates the checkout at `root` as exactly the approved commit.
+///
+/// # Errors
+///
+/// Fails on an extensionless `rust-toolchain`, an ancestor Cargo
+/// configuration layer, unsupported repository layout or configuration, a
+/// HEAD other than the commit, any object whose content does not hash to its
+/// id, any tracked-path difference, untracked path, or incomplete closure.
+pub(crate) fn authenticate(
+    root: &Path,
+    commit: &CommitId,
+    audited: &AuditedEnvironment,
+) -> Result<ApprovedSource, Report<ReleaseError>> {
+    if !is_absent(&root.join("rust-toolchain"))? {
+        return Err(source_error(
+            "extensionless rust-toolchain is rejected before toolchain selection",
+        ));
+    }
+    check_ancestor_cargo_config(root)?;
+    check_layout(root)?;
+    let git = Git::locate(root, audited)?;
+    check_head(&git, commit)?;
+    let commit_object = read_single(&git, "commit", commit.as_str())?;
+    let epoch = committer_epoch(&commit_object)?;
+    let entries = walk_tree(&git, &commit_tree(&commit_object)?, &TREE_LIMITS)?;
+    let (records, manifest) = tracked_records(&git, &entries)?;
+    compare_worktree(root, &records)?;
+    let (closure_digest, closure_paths) = helper_closure(&records, &manifest)?;
+    let fingerprint = digest_records(records.iter());
+    Ok(ApprovedSource {
+        commit: commit.clone(),
+        epoch,
+        snapshot: SourceSnapshot {
+            root: root.to_path_buf(),
+            records,
+            fingerprint,
+        },
+        closure_digest,
+        closure_paths,
+    })
+}
+
+/// Returns whether `path` is absent; any inspection error other than
+/// `NotFound` fails closed rather than being treated as absence.
+fn is_absent(path: &Path) -> Result<bool, Report<ReleaseError>> {
+    match fs::symlink_metadata(path) {
+        Ok(_) => Ok(false),
+        Err(error) if error.kind() == io::ErrorKind::NotFound => Ok(true),
+        Err(error) => Err(source_error(format!(
+            "{} cannot be inspected: {error}",
+            path.display()
+        ))),
+    }
+}
+
+/// Cargo merges `.cargo/config(.toml)` from every ancestor of its working
+/// directory, so any such layer above the source root is rejected.
+fn check_ancestor_cargo_config(root: &Path) -> Result<(), Report<ReleaseError>> {
+    let canonical = fs::canonicalize(root)
+        .map_err(|error| source_error(format!("cannot resolve source root: {error}")))?;
+    for ancestor in canonical.ancestors().skip(1) {
+        for name in ["config", "config.toml"] {
+            let candidate = ancestor.join(".cargo").join(name);
+            if !is_absent(&candidate)? {
+                return Err(source_error(format!(
+                    "ancestor Cargo configuration layer {} is rejected",
+                    candidate.display()
+                )));
+            }
+        }
+    }
+    Ok(())
+}
+
+fn check_layout(root: &Path) -> Result<(), Report<ReleaseError>> {
+    let git_dir = root.join(".git");
+    let metadata = fs::symlink_metadata(&git_dir)
+        .map_err(|error| source_error(format!(".git cannot be inspected: {error}")))?;
+    if !metadata.is_dir() {
+        return Err(source_error(
+            ".git must be a real directory; gitfile, symlink and linked-worktree \
+             indirections are unsupported",
+        ));
+    }
+    for relative in FORBIDDEN_GIT_PATHS {
+        if !is_absent(&git_dir.join(relative))? {
+            return Err(source_error(format!(
+                ".git/{relative} is present; repository indirection or rewriting is unsupported"
+            )));
+        }
+    }
+    check_packed_refs(&git_dir.join("packed-refs"))?;
+    let config = read_bounded(&git_dir.join("config"), Role::Metadata)?;
+    let text =
+        std::str::from_utf8(&config.bytes).map_err(|_| source_error("git config must be UTF-8"))?;
+    check_git_config(text)
+}
+
+fn check_packed_refs(packed: &Path) -> Result<(), Report<ReleaseError>> {
+    if is_absent(packed)? {
+        return Ok(());
+    }
+    let bytes = read_bounded(packed, Role::Metadata)
+        .map_err(|report| report.attach(".git/packed-refs cannot be read"))?
+        .bytes;
+    let replaced = bytes.split(|byte| *byte == b'\n').any(|line| {
+        line.splitn(2, |byte| *byte == b' ')
+            .nth(1)
+            .is_some_and(|name| name.starts_with(b"refs/replace/"))
+    });
+    if replaced {
+        return Err(source_error(
+            ".git/packed-refs lists refs/replace references",
+        ));
+    }
+    Ok(())
+}
+
+fn check_head(git: &Git, commit: &CommitId) -> Result<(), Report<ReleaseError>> {
+    let object_type = git.run(&["cat-file", "-t", commit.as_str()], 64)?;
+    if object_type != b"commit\n" {
+        return Err(source_error(format!("{commit} is not a commit object")));
+    }
+    let head = git.run(&["rev-parse", "--verify", "HEAD"], 128)?;
+    if head.strip_suffix(b"\n") != Some(commit.as_str().as_bytes()) {
+        return Err(source_error("HEAD does not resolve to the approved commit"));
+    }
+    Ok(())
+}
+
+/// Parses the committer timestamp from a raw commit object header.
+///
+/// # Errors
+///
+/// Fails unless the header has exactly one well-formed committer line.
+fn committer_epoch(raw: &[u8]) -> Result<u64, Report<ReleaseError>> {
+    let end = raw
+        .windows(2)
+        .position(|window| window == b"\n\n")
+        .unwrap_or(raw.len());
+    let header = std::str::from_utf8(&raw[..end])
+        .map_err(|_| source_error("commit header must be UTF-8"))?;
+    let committers: Vec<&str> = header
+        .lines()
+        .filter_map(|line| line.strip_prefix("committer "))
+        .collect();
+    let [committer] = committers.as_slice() else {
+        return Err(source_error("commit must have exactly one committer line"));
+    };
+    let invalid = || source_error("committer line must end with `> <epoch> <+|-HHMM>`");
+    let (_, stamp) = committer.rsplit_once('>').ok_or_else(invalid)?;
+    let (epoch, zone) = stamp
+        .strip_prefix(' ')
+        .and_then(|stamp| stamp.split_once(' '))
+        .ok_or_else(invalid)?;
+    let zone_valid = zone.len() == 5
+        && zone.starts_with(['+', '-'])
+        && zone[1..].bytes().all(|byte| byte.is_ascii_digit())
+        && zone[3..] <= *"59";
+    if epoch.is_empty() || !epoch.bytes().all(|byte| byte.is_ascii_digit()) || !zone_valid {
+        return Err(invalid());
+    }
+    epoch.parse().map_err(|_| invalid())
+}
+
+/// Reads one object of `kind` whose content must hash to `oid`.
+fn read_single(git: &Git, kind: &'static str, oid: &str) -> Result<Vec<u8>, Report<ReleaseError>> {
+    let mut found = None;
+    git.read_objects(kind, &[oid], |_, bytes| {
+        found = Some(bytes.to_vec());
+        Ok(())
+    })?;
+    found.ok_or_else(|| source_error(format!("{kind} {oid} was not returned")))
+}
+
+/// Returns the root tree id from a verified raw commit object.
+fn commit_tree(raw: &[u8]) -> Result<String, Report<ReleaseError>> {
+    let first = raw.split(|byte| *byte == b'\n').next().unwrap_or_default();
+    std::str::from_utf8(first)
+        .ok()
+        .and_then(|line| line.strip_prefix("tree "))
+        .filter(|oid| lower_hex(oid, 40))
+        .map(str::to_owned)
+        .ok_or_else(|| source_error("commit object must start with a SHA-1 tree line"))
+}
+
+/// Records the verified tracked blob identities and original root manifest.
+fn tracked_records(
+    git: &Git,
+    entries: &[TreeEntry],
+) -> Result<(Records, Vec<u8>), Report<ReleaseError>> {
+    let mut records = Records::new();
+    let mut manifest = None;
+    let oids: Vec<&str> = entries.iter().map(|entry| entry.oid.as_str()).collect();
+    git.read_objects("blob", &oids, |index, bytes| {
+        let entry = &entries[index];
+        if entry.mode == Mode::Symlink {
+            let reviewed = REVIEWED_SYMLINKS
+                .iter()
+                .any(|(link, target)| *link == entry.path && target.as_bytes() == bytes);
+            if !reviewed {
+                return Err(source_error(format!(
+                    "tracked symlink {} has an unreviewed target",
+                    entry.path
+                )));
+            }
+        }
+        if entry.path == "Cargo.toml" {
+            manifest = Some(bytes.to_vec());
+        }
+        records.insert(
+            entry.path.clone(),
+            (entry.mode, hex::encode(Sha256::digest(bytes))),
+        );
+        Ok(())
+    })?;
+    let manifest = manifest.ok_or_else(|| source_error("root Cargo.toml is not tracked"))?;
+    Ok((records, manifest))
+}
+
+fn digest_records<'a>(records: impl Iterator<Item = (&'a String, &'a (Mode, String))>) -> String {
+    let mut hasher = Sha256::new();
+    for (path, (mode, sha256)) in records {
+        hasher.update(path.as_bytes());
+        hasher.update(b"\0");
+        hasher.update(mode.label().as_bytes());
+        hasher.update(b"\0");
+        hasher.update(sha256.as_bytes());
+        hasher.update(b"\n");
+    }
+    hex::encode(hasher.finalize())
+}
+
+/// Joins a JS input inventory to the approved source commit.
+///
+/// # Errors
+///
+/// Fails unless the inventory is strict JSON with the reviewed field set,
+/// schema version 1 and a `source_commit` equal to the approved commit.
+// Prepared-input composition (Task 9) consumes this join.
+#[allow(dead_code)]
+pub(crate) fn join_inventory(
+    source: &ApprovedSource,
+    bytes: &[u8],
+) -> Result<(), Report<ReleaseError>> {
+    let value = parse_json(bytes, Role::Metadata)?;
+    let object = value
+        .as_object()
+        .ok_or_else(|| source_error("inventory must be an object"))?;
+    let keys: BTreeSet<&str> = object.keys().map(String::as_str).collect();
+    let reviewed = BTreeSet::from([
+        "materials",
+        "modules",
+        "schema_version",
+        "source_commit",
+        "tools",
+    ]);
+    if keys != reviewed {
+        return Err(source_error(
+            "inventory must contain exactly the reviewed fields",
+        ));
+    }
+    let arrays = ["materials", "modules", "tools"]
+        .iter()
+        .all(|key| object[*key].is_array());
+    if object["schema_version"] != 1 || !arrays {
+        return Err(source_error(
+            "inventory schema version or field types are invalid",
+        ));
+    }
+    match object["source_commit"].as_str() {
+        Some(commit) if commit == source.commit.as_str() => Ok(()),
+        _ => Err(source_error(
+            "inventory source_commit does not match the approved commit",
+        )),
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/trusted-server-release/src/source/closure.rs b/crates/trusted-server-release/src/source/closure.rs
new file mode 100644
index 0000000000..c6811710fb
--- /dev/null
+++ b/crates/trusted-server-release/src/source/closure.rs
@@ -0,0 +1,112 @@
+//! Audit fingerprint of the helper-source closure at the approved commit.
+
+use std::collections::BTreeSet;
+
+use error_stack::Report;
+
+use super::tree::check_tracked_path;
+use super::{Records, digest_records, source_error};
+use crate::error::ReleaseError;
+
+const RELEASE_CRATE_PREFIX: &str = "crates/trusted-server-release/";
+
+/// Root files always included in the helper-source closure.
+const CLOSURE_FILES: [&str; 10] = [
+    ".cargo/config.toml",
+    ".tool-versions",
+    "Cargo.lock",
+    "Cargo.toml",
+    "rust-toolchain.toml",
+    "scripts/release/bootstrap.sh",
+    "scripts/release/build-js.sh",
+    "scripts/release/build.sh",
+    "scripts/release/collect-js.mjs",
+    "scripts/release/observe-npm.mjs",
+];
+
+/// Path-dependency manifests that must be listed as workspace members.
+const REQUIRED_MEMBER_MANIFESTS: [&str; 1] = ["crates/trusted-server-openrtb/Cargo.toml"];
+
+/// Digests the release crate, root build inputs and every member manifest.
+///
+/// Returns the digest and the sorted covered paths. This is an audit
+/// fingerprint, not authority.
+pub(super) fn helper_closure(
+    records: &Records,
+    manifest: &[u8],
+) -> Result<(String, Vec<String>), Report<ReleaseError>> {
+    let mut paths = member_manifests(records, &workspace_members(manifest)?)?;
+    for path in CLOSURE_FILES {
+        if !records.contains_key(path) {
+            return Err(source_error(format!(
+                "helper closure file {path} is not tracked"
+            )));
+        }
+        paths.insert(path.to_owned());
+    }
+    paths.extend(
+        records
+            .keys()
+            .filter(|path| {
+                path.starts_with(RELEASE_CRATE_PREFIX)
+                    || path.starts_with("crates/trusted-server-js/lib/")
+            })
+            .cloned(),
+    );
+    let digest = digest_records(paths.iter().filter_map(|path| records.get_key_value(path)));
+    Ok((digest, paths.into_iter().collect()))
+}
+
+/// Explicit `[workspace] members` from the tracked root manifest.
+fn workspace_members(manifest: &[u8]) -> Result<Vec<String>, Report<ReleaseError>> {
+    let text =
+        std::str::from_utf8(manifest).map_err(|_| source_error("root Cargo.toml must be UTF-8"))?;
+    let table: toml::Table = toml::from_str(text)
+        .map_err(|error| source_error(format!("root Cargo.toml is invalid: {error}")))?;
+    let members = table
+        .get("workspace")
+        .and_then(|workspace| workspace.get("members"))
+        .and_then(toml::Value::as_array)
+        .ok_or_else(|| source_error("root Cargo.toml must list [workspace] members"))?;
+    members
+        .iter()
+        .map(|member| {
+            let member = member
+                .as_str()
+                .ok_or_else(|| source_error("workspace members must be strings"))?;
+            if member.contains(['*', '?', '[', ']']) {
+                return Err(source_error(format!(
+                    "workspace member {member} uses a glob; the closure requires explicit members"
+                )));
+            }
+            Ok(member.to_owned())
+        })
+        .collect()
+}
+
+/// Tracked manifests for every member, including the required path dependencies.
+fn member_manifests(
+    records: &Records,
+    members: &[String],
+) -> Result<BTreeSet<String>, Report<ReleaseError>> {
+    let mut manifests = BTreeSet::new();
+    for member in members {
+        let manifest = format!("{member}/Cargo.toml");
+        check_tracked_path(&manifest)?;
+        if !records.contains_key(&manifest) {
+            return Err(source_error(format!(
+                "workspace member manifest {manifest} is not tracked"
+            )));
+        }
+        manifests.insert(manifest);
+    }
+    if let Some(required) = REQUIRED_MEMBER_MANIFESTS
+        .iter()
+        .find(|required| !manifests.contains(**required))
+    {
+        return Err(source_error(format!(
+            "{required} must be a listed workspace member manifest"
+        )));
+    }
+    Ok(manifests)
+}
diff --git a/crates/trusted-server-release/src/source/config.rs b/crates/trusted-server-release/src/source/config.rs
new file mode 100644
index 0000000000..4a987f6d89
--- /dev/null
+++ b/crates/trusted-server-release/src/source/config.rs
@@ -0,0 +1,95 @@
+//! Strict allowlist parser for the repository's `.git/config`.
+//!
+//! Git would execute or redirect through many configuration keys, so only a
+//! small set of inert keys and values is accepted. Values are never echoed
+//! because remote URLs may embed credentials.
+
+use error_stack::Report;
+
+use super::source_error;
+use crate::error::ReleaseError;
+
+/// Accepts only allowlisted repository configuration keys and values.
+///
+/// # Errors
+///
+/// Fails on any key outside the allowlist, escapes or continuations, unknown
+/// section syntax, or unreviewed values.
+pub(super) fn check_git_config(text: &str) -> Result<(), Report<ReleaseError>> {
+    let mut section: Option<(String, bool)> = None;
+    for (index, raw) in text.lines().enumerate() {
+        let line = raw.trim();
+        let number = index + 1;
+        if line.is_empty() || line.starts_with(['#', ';']) {
+            continue;
+        }
+        if line.contains('\\') {
+            return Err(source_error(format!(
+                "git config line {number} uses escapes or continuations"
+            )));
+        }
+        if let Some(header) = line.strip_prefix('[') {
+            section = Some(config_section(header, number)?);
+            continue;
+        }
+        let (name, subsection) = section.as_ref().ok_or_else(|| {
+            source_error(format!("git config line {number} is outside a section"))
+        })?;
+        let (key, value) = match line.split_once('=') {
+            Some((key, value)) => (key.trim().to_ascii_lowercase(), Some(value.trim())),
+            None => (line.to_ascii_lowercase(), None),
+        };
+        if !config_value_allowed(name, *subsection, &key, value) {
+            return Err(source_error(format!(
+                "git config key {name}.{key} on line {number} is not allowlisted or has an unreviewed value"
+            )));
+        }
+    }
+    Ok(())
+}
+
+fn config_section(header: &str, number: usize) -> Result<(String, bool), Report<ReleaseError>> {
+    let invalid = || {
+        source_error(format!(
+            "git config line {number} has an unsupported section"
+        ))
+    };
+    let header = header.strip_suffix(']').ok_or_else(invalid)?;
+    let (name, subsection) = match header.split_once(' ') {
+        Some((name, quoted)) => {
+            let inner = quoted
+                .strip_prefix('"')
+                .and_then(|rest| rest.strip_suffix('"'))
+                .ok_or_else(invalid)?;
+            if inner.contains('"') {
+                return Err(invalid());
+            }
+            (name, true)
+        }
+        None => (header, false),
+    };
+    if name.is_empty()
+        || !name
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || byte == b'-')
+    {
+        return Err(invalid());
+    }
+    Ok((name.to_ascii_lowercase(), subsection))
+}
+
+fn config_value_allowed(section: &str, subsection: bool, key: &str, value: Option<&str>) -> bool {
+    let boolean = matches!(value, Some("true" | "false"));
+    let plain = value.is_some_and(|value| !value.is_empty() && !value.contains(['"', '#', ';']));
+    match (section, subsection, key) {
+        ("core", false, "repositoryformatversion") => value == Some("0"),
+        ("core", false, "bare") => value == Some("false"),
+        (
+            "core",
+            false,
+            "filemode" | "logallrefupdates" | "ignorecase" | "precomposeunicode" | "symlinks",
+        ) => boolean,
+        ("remote", true, "url" | "fetch") | ("branch", true, "remote" | "merge") => plain,
+        _ => false,
+    }
+}
diff --git a/crates/trusted-server-release/src/source/git.rs b/crates/trusted-server-release/src/source/git.rs
new file mode 100644
index 0000000000..f98cf57ebd
--- /dev/null
+++ b/crates/trusted-server-release/src/source/git.rs
@@ -0,0 +1,178 @@
+//! Bounded read-only Git plumbing under a cleared, hardened environment.
+
+use std::ffi::OsString;
+use std::fs;
+use std::os::unix::fs::PermissionsExt as _;
+use std::path::{Path, PathBuf};
+use std::time::{Duration, Instant};
+
+use error_stack::Report;
+
+use super::source_error;
+use crate::error::ReleaseError;
+use crate::git_objects::ObjectReader;
+use crate::preflight::AuditedEnvironment;
+use crate::process::{BoundedCommand, ProcessLimits, ProcessResult};
+
+const STDERR_LIMIT: u64 = 64 * 1024;
+/// Read-only Git plumbing under a cleared, hardened environment.
+pub(super) struct Git {
+    program: PathBuf,
+    /// Child `PATH`: only the resolved git executable's own directory.
+    child_path: String,
+    root: PathBuf,
+    home: tempfile::TempDir,
+    /// Remaining bytes of the aggregate object budget.
+    objects: ObjectReader,
+    wall_limit: Duration,
+    attempt_deadline: Instant,
+}
+
+impl Git {
+    pub(super) fn locate(
+        root: &Path,
+        audited: &AuditedEnvironment,
+    ) -> Result<Self, Report<ReleaseError>> {
+        let search_path = audited
+            .search_path()
+            .ok_or_else(|| source_error("PATH is required to locate git"))?;
+        let program = search_path
+            .split(':')
+            .filter(|directory| directory.starts_with('/'))
+            .map(|directory| Path::new(directory).join("git"))
+            .find(|candidate| {
+                fs::metadata(candidate).is_ok_and(|metadata| {
+                    metadata.is_file() && metadata.permissions().mode() & 0o111 != 0
+                })
+            })
+            .ok_or_else(|| source_error("git was not found on an absolute PATH entry"))?;
+        let child_path = program
+            .parent()
+            .and_then(Path::to_str)
+            .ok_or_else(|| source_error("git directory must be UTF-8"))?
+            .to_owned();
+        let home = tempfile::Builder::new()
+            .prefix("release-git-home-")
+            .tempdir()
+            .map_err(|error| source_error(format!("cannot create private git HOME: {error}")))?;
+        Ok(Self {
+            program,
+            child_path,
+            root: root.to_path_buf(),
+            home,
+            objects: ObjectReader::source(),
+            wall_limit: Duration::from_secs(120),
+            attempt_deadline: Instant::now() + Duration::from_secs(900),
+        })
+    }
+
+    #[cfg(test)]
+    pub(super) fn with_wall_limit(mut self, limit: Duration) -> Self {
+        self.wall_limit = limit;
+        self
+    }
+
+    fn command(
+        &self,
+        args: &[&str],
+        stdout_limit: u64,
+    ) -> Result<BoundedCommand, Report<ReleaseError>> {
+        let mut git_dir = OsString::from("--git-dir=");
+        git_dir.push(self.root.join(".git"));
+        let mut work_tree = OsString::from("--work-tree=");
+        work_tree.push(&self.root);
+        let remaining = self
+            .attempt_deadline
+            .checked_duration_since(Instant::now())
+            .ok_or_else(|| source_error("Git authentication attempt exceeded its deadline"))?;
+        let limits = ProcessLimits {
+            wall: self.wall_limit.min(remaining),
+            stdout_max: stdout_limit,
+            stderr_max: STDERR_LIMIT,
+        };
+        let mut arguments = vec![git_dir, work_tree, OsString::from("--no-replace-objects")];
+        arguments.extend(
+            [
+                "-c",
+                "core.hooksPath=/dev/null",
+                "-c",
+                "core.fsmonitor=false",
+                "-c",
+                "core.untrackedCache=false",
+                "-c",
+                "protocol.allow=never",
+            ]
+            .into_iter()
+            .chain(args.iter().copied())
+            .map(OsString::from),
+        );
+        // HOME is fresh and private and XDG_CONFIG_HOME is absent. This
+        // disables user configuration without an arbitrary Git config path.
+        BoundedCommand::new(&self.program, &self.root, limits)?
+            .arguments(arguments)
+            .environment("PATH", &self.child_path)?
+            .environment("HOME", self.home.path())?
+            .environment("GIT_CONFIG_NOSYSTEM", "1")?
+            .environment("GIT_NO_REPLACE_OBJECTS", "1")?
+            .environment("GIT_TERMINAL_PROMPT", "0")?
+            .environment("GIT_OPTIONAL_LOCKS", "0")?
+            .environment("LC_ALL", "C")
+    }
+
+    fn execute(
+        &self,
+        args: &[&str],
+        stdin: Option<Vec<u8>>,
+        stdout_limit: u64,
+    ) -> Result<Vec<u8>, Report<ReleaseError>> {
+        let mut command = self.command(args, stdout_limit)?;
+        if let Some(bytes) = stdin {
+            command = command.stdin_bytes(bytes);
+        }
+        command
+            .run()
+            .and_then(ProcessResult::require_success)
+            .map_err(|report| {
+                report
+                    .change_context(ReleaseError::Source)
+                    .attach(format!("git {}", args.join(" ")))
+            })
+    }
+
+    /// Replaces the aggregate object budget so tests can exercise exhaustion.
+    #[cfg(test)]
+    pub(super) fn with_object_budget(self, bytes: u64) -> Self {
+        self.objects.set_budget_for_tests(bytes);
+        self
+    }
+
+    /// Runs one plumbing command whose stdout must fit `stdout_limit` bytes.
+    pub(super) fn run(
+        &self,
+        args: &[&str],
+        stdout_limit: u64,
+    ) -> Result<Vec<u8>, Report<ReleaseError>> {
+        self.execute(args, None, stdout_limit)
+    }
+
+    /// Reads and collision-checks source objects under the source byte policy.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for failed Git commands or invalid object bytes.
+    pub(super) fn read_objects(
+        &self,
+        kind: &'static str,
+        oids: &[&str],
+        visit: impl FnMut(usize, &[u8]) -> Result<(), Report<ReleaseError>>,
+    ) -> Result<(), Report<ReleaseError>> {
+        self.objects
+            .read_objects(
+                kind,
+                oids,
+                &mut |arguments, input, limit| self.execute(arguments, Some(input), limit),
+                visit,
+            )
+            .map_err(|report| report.change_context(ReleaseError::Source))
+    }
+}
diff --git a/crates/trusted-server-release/src/source/materialize.rs b/crates/trusted-server-release/src/source/materialize.rs
new file mode 100644
index 0000000000..3d9e6c8afb
--- /dev/null
+++ b/crates/trusted-server-release/src/source/materialize.rs
@@ -0,0 +1,259 @@
+//! Fresh owned source copies contain approved tracked bytes only.
+
+use std::fs;
+use std::io::Write as _;
+use std::os::unix::ffi::OsStrExt as _;
+use std::os::unix::fs::{PermissionsExt as _, symlink};
+use std::path::{Path, PathBuf};
+use std::time::Instant;
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256};
+use tempfile::TempDir;
+
+use super::{ApprovedSource, Mode, Records, source_error};
+use crate::documents::{Role, read_bounded_with_check};
+use crate::error::ReleaseError;
+use crate::process::Cancellation;
+
+/// Owns one independent working tree, with no inherited Git configuration.
+pub(crate) struct FreshSource {
+    directory: TempDir,
+    records: Records,
+    commit: String,
+    deadline: Instant,
+    cancellation: Cancellation,
+}
+
+/// A source integrity check that preserves the owning preparation attempt.
+pub(crate) struct FreshSourceVerification {
+    root: PathBuf,
+    records: Records,
+    deadline: Instant,
+    cancellation: Cancellation,
+}
+
+impl FreshSourceVerification {
+    /// Rechecks the complete tracked source and permitted output exclusions.
+    ///
+    /// # Errors
+    /// Rejects changed or unexpected files, aliases and expired attempts.
+    pub(crate) fn verify_unchanged(&self, outputs: &[&str]) -> Result<(), Report<ReleaseError>> {
+        verify_source(
+            &self.root,
+            &self.records,
+            self.deadline,
+            &self.cancellation,
+            outputs,
+        )
+    }
+
+    /// Expires the original attempt without waiting in deadline regression tests.
+    #[cfg(test)]
+    pub(crate) fn expire_for_tests(&mut self) {
+        self.deadline = Instant::now();
+    }
+}
+
+/// Creates an owned checkout whose path agrees with canonical boundary roots.
+///
+/// Resolve the parent before allocation so `TempDir` retains cleanup ownership
+/// under the same path, including on macOS where `/var` aliases `/private/var`.
+///
+/// # Errors
+///
+/// Rejects an inaccessible parent or a failed private directory allocation.
+pub(super) fn fresh_directory(parent: &Path) -> Result<TempDir, Report<ReleaseError>> {
+    let parent = fs::canonicalize(parent).map_err(|error| source_error(error.to_string()))?;
+    tempfile::tempdir_in(parent).map_err(|error| source_error(error.to_string()))
+}
+
+impl FreshSource {
+    /// Captures the original source records and shared preparation controls.
+    pub(crate) fn verification(&self) -> FreshSourceVerification {
+        FreshSourceVerification {
+            root: self.root().to_owned(),
+            records: self.records.clone(),
+            deadline: self.deadline,
+            cancellation: self.cancellation.clone(),
+        }
+    }
+
+    /// Removes the owned tree and reports cleanup failure to the recipe.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the private source copy cannot be removed. Cleanup
+    /// remains available after cancellation or expiration.
+    pub(crate) fn close(self) -> Result<(), Report<ReleaseError>> {
+        self.directory
+            .close()
+            .map_err(|error| source_error(error.to_string()))
+    }
+    /// Returns the private tracked-source root.
+    pub(crate) fn root(&self) -> &Path {
+        self.directory.path()
+    }
+
+    /// Returns the source identity whose bytes were copied.
+    pub(crate) fn commit(&self) -> &str {
+        &self.commit
+    }
+
+    /// Returns the complete approved JS entry-point set in sorted order.
+    pub(crate) fn module_ids(&self) -> Vec<String> {
+        super::js_module_ids(&self.records)
+    }
+
+    /// Rechecks every tracked path and rejects unexpected source files.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for changed source, unexpected files or output roots
+    /// overlapping approved tracked paths. Output trees are checked separately
+    /// by preparation; this method grants no authority to their contents.
+    pub(crate) fn verify_unchanged(&self, outputs: &[&str]) -> Result<(), Report<ReleaseError>> {
+        verify_source(
+            self.root(),
+            &self.records,
+            self.deadline,
+            &self.cancellation,
+            outputs,
+        )
+    }
+}
+
+fn verify_source(
+    root: &Path,
+    records: &Records,
+    deadline: Instant,
+    cancellation: &Cancellation,
+    outputs: &[&str],
+) -> Result<(), Report<ReleaseError>> {
+    let check = || check_attempt(deadline, cancellation);
+    check()?;
+    let metadata = fs::symlink_metadata(root).map_err(|error| source_error(error.to_string()))?;
+    if !metadata.is_dir() {
+        return Err(source_error(
+            "fresh source root changed type or became an alias",
+        ));
+    }
+    if fs::symlink_metadata(root.join(".git")).is_ok() {
+        return Err(source_error(
+            "fresh source must not acquire repository configuration",
+        ));
+    }
+    super::worktree::compare_with_outputs_controlled(root, records, outputs, &check)
+}
+
+impl ApprovedSource {
+    /// Copies approved tracked bytes into a new independently owned directory.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for changed original source, failed private writes or a
+    /// copied path that does not rejoin its approved mode and digest. No cache,
+    /// installed dependencies, generated outputs or Git configuration is copied.
+    pub(crate) fn materialize(
+        &self,
+        deadline: Instant,
+        cancellation: &Cancellation,
+    ) -> Result<FreshSource, Report<ReleaseError>> {
+        self.materialize_with_check(deadline, cancellation, &|| {
+            check_attempt(deadline, cancellation)
+        })
+    }
+
+    /// Copies under the same checked attempt; the callback also supports deterministic cancellation fixtures.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for failed attempt checks, changed source or failed private writes.
+    pub(super) fn materialize_with_check(
+        &self,
+        deadline: Instant,
+        cancellation: &Cancellation,
+        check: &dyn Fn() -> Result<(), Report<ReleaseError>>,
+    ) -> Result<FreshSource, Report<ReleaseError>> {
+        check()?;
+        super::worktree::compare_with_outputs_controlled(
+            &self.snapshot.root,
+            &self.snapshot.records,
+            &[],
+            check,
+        )?;
+        let directory = fresh_directory(&std::env::temp_dir())?;
+        for (relative, (mode, expected)) in &self.snapshot.records {
+            check()?;
+            let destination = directory.path().join(relative);
+            fs::create_dir_all(
+                destination
+                    .parent()
+                    .ok_or_else(|| source_error("missing source parent"))?,
+            )
+            .map_err(|error| source_error(error.to_string()))?;
+            match mode {
+                Mode::Symlink => {
+                    let target = fs::read_link(self.snapshot.root.join(relative))
+                        .map_err(|error| source_error(error.to_string()))?;
+                    if hex::encode(Sha256::digest(target.as_os_str().as_bytes())) != *expected {
+                        return Err(source_error("approved source alias changed during copying"));
+                    }
+                    symlink(target, destination)
+                        .map_err(|error| source_error(error.to_string()))?;
+                }
+                Mode::Regular | Mode::Executable => {
+                    let raw = read_bounded_with_check(
+                        &self.snapshot.root.join(relative),
+                        Role::Source,
+                        check,
+                    )?;
+                    if raw.sha256 != *expected {
+                        return Err(source_error("approved source bytes changed during copying"));
+                    }
+                    let mut output = fs::File::create_new(&destination)
+                        .map_err(|error| source_error(error.to_string()))?;
+                    for chunk in raw.bytes.chunks(64 * 1024) {
+                        check()?;
+                        output
+                            .write_all(chunk)
+                            .map_err(|error| source_error(error.to_string()))?;
+                    }
+                    let permissions = if *mode == Mode::Executable {
+                        0o700
+                    } else {
+                        0o600
+                    };
+                    fs::set_permissions(destination, fs::Permissions::from_mode(permissions))
+                        .map_err(|error| source_error(error.to_string()))?;
+                }
+            }
+        }
+        super::worktree::compare_with_outputs_controlled(
+            &self.snapshot.root,
+            &self.snapshot.records,
+            &[],
+            check,
+        )?;
+        let fresh = FreshSource {
+            directory,
+            records: self.snapshot.records.clone(),
+            commit: self.commit.as_str().to_owned(),
+            deadline,
+            cancellation: cancellation.clone(),
+        };
+        check()?;
+        fresh.verify_unchanged(&[])?;
+        Ok(fresh)
+    }
+}
+
+fn check_attempt(
+    deadline: Instant,
+    cancellation: &Cancellation,
+) -> Result<(), Report<ReleaseError>> {
+    if cancellation.is_cancelled() || Instant::now() >= deadline {
+        return Err(source_error("source preparation cancelled or timed out"));
+    }
+    Ok(())
+}
diff --git a/crates/trusted-server-release/src/source/tests.rs b/crates/trusted-server-release/src/source/tests.rs
new file mode 100644
index 0000000000..04f257b118
--- /dev/null
+++ b/crates/trusted-server-release/src/source/tests.rs
@@ -0,0 +1,544 @@
+use std::cell::Cell;
+use std::ffi::OsString;
+use std::fs;
+use std::os::unix::fs::{PermissionsExt as _, symlink};
+use std::process::Command;
+use std::time::{Duration, Instant};
+
+use serde_json::{Value, json};
+use tempfile::{TempDir, tempdir};
+
+use super::config::check_git_config;
+use super::git::Git;
+use super::tree::{TreeLimits, parse_tree_object};
+use super::*;
+use crate::git_objects::checked_sha1;
+use crate::policy::ReleaseTarget;
+use crate::preflight::audit_environment;
+use crate::preflight::child::{ChildRequest, child_environment};
+use crate::process::Cancellation;
+
+const EPOCH: u64 = 1_700_000_000;
+
+#[test]
+fn bound_workspace_origins_recheck_nonmanifest_source_and_unexpected_files() {
+    for mutation in ["rust", "other", "extra", "git", "cancel"] {
+        let fixture = Fixture::new();
+        let approved = fixture.authenticate().expect("should authenticate source");
+        let cancellation = Cancellation::default();
+        let fresh = approved
+            .materialize(Instant::now() + Duration::from_secs(30), &cancellation)
+            .expect("should materialize source");
+        let origins = crate::composition::origin::WorkspaceOrigins::bind(&approved, &fresh)
+            .expect("should bind source origins");
+        origins
+            .verify_unchanged()
+            .expect("should accept unchanged source");
+        match mutation {
+            "rust" => write(
+                fresh.root(),
+                "crates/trusted-server-release/src/main.rs",
+                b"fn main() { panic!(); }\n",
+            ),
+            "other" => write(fresh.root(), "AGENTS.md", b"changed source\n"),
+            "extra" => write(fresh.root(), "unexpected.txt", b"unexpected\n"),
+            "git" => write(fresh.root(), ".git/config", b"unexpected\n"),
+            "cancel" => cancellation.cancel(),
+            _ => unreachable!(),
+        }
+        assert!(
+            origins.verify_unchanged().is_err(),
+            "should reject {mutation} after binding"
+        );
+    }
+}
+
+#[test]
+fn bound_source_verification_preserves_original_deadline() {
+    let fixture = Fixture::new();
+    let approved = fixture.authenticate().expect("should authenticate source");
+    let fresh = approved
+        .materialize(
+            Instant::now() + Duration::from_secs(30),
+            &Cancellation::default(),
+        )
+        .expect("should materialize source");
+    let mut verification = fresh.verification();
+    verification.expire_for_tests();
+    assert!(
+        verification.verify_unchanged(&[]).is_err(),
+        "should reject an expired source attempt"
+    );
+}
+
+#[test]
+fn workspace_origins_require_an_unchanged_approved_materialization() {
+    let fixture = Fixture::new();
+    let approved = fixture
+        .authenticate()
+        .expect("should authenticate fixture source");
+    let fresh = approved
+        .materialize(
+            Instant::now() + Duration::from_secs(30),
+            &Cancellation::default(),
+        )
+        .expect("should materialize independent source");
+    crate::composition::origin::WorkspaceOrigins::bind(&approved, &fresh)
+        .expect("should bind exact approved checkout and manifest identities");
+    let other = ApprovedSource::in_memory_for_tests(
+        &CommitId::parse(&"b".repeat(40)).expect("should parse different source"),
+        &["Cargo.toml"],
+    );
+    assert!(
+        crate::composition::origin::WorkspaceOrigins::bind(&other, &fresh).is_err(),
+        "should reject another approved source identity"
+    );
+    fs::write(fresh.root().join("AGENTS.md"), b"changed").expect("should change private source");
+    assert!(
+        crate::composition::origin::WorkspaceOrigins::bind(&approved, &fresh).is_err(),
+        "should reject changed checkout before issuing origin authority"
+    );
+}
+
+#[test]
+fn cargo_manifest_catalog_contains_only_approved_regular_manifests() {
+    let commit = CommitId::parse(&"a".repeat(40)).expect("should parse approved commit");
+    let mut approved = ApprovedSource::in_memory_for_tests(
+        &commit,
+        &[
+            "Cargo.toml",
+            "crates/example/Cargo.toml",
+            "README.md",
+            "notCargo.toml",
+        ],
+    );
+    approved.snapshot.records.insert(
+        "crates/alias/Cargo.toml".to_owned(),
+        (Mode::Symlink, "b".repeat(64)),
+    );
+    let manifests = approved.cargo_manifest_digests();
+    assert_eq!(
+        manifests.keys().map(PathBuf::as_path).collect::<Vec<_>>(),
+        [
+            Path::new("Cargo.toml"),
+            Path::new("crates/example/Cargo.toml")
+        ],
+        "should expose only approved regular Cargo manifests for origin joining"
+    );
+    assert!(
+        manifests.values().all(|digest| digest == &"0".repeat(64)),
+        "should preserve approved content identities"
+    );
+}
+
+#[test]
+fn fresh_directory_canonicalizes_an_aliased_parent_and_preserves_cleanup() {
+    let directory = tempdir().expect("should create parent fixture");
+    let base = fs::canonicalize(directory.path()).expect("should canonicalize fixture");
+    let parent = base.join("real-parent");
+    let alias = base.join("alias-parent");
+    fs::create_dir(&parent).expect("should create real parent");
+    symlink(&parent, &alias).expect("should create parent alias");
+    let owned =
+        super::materialize::fresh_directory(&alias).expect("should create private checkout");
+    let path = owned.path().to_owned();
+    assert_eq!(
+        path,
+        fs::canonicalize(&path).expect("should resolve checkout"),
+        "should expose the canonical owning path"
+    );
+    assert_eq!(
+        path.parent(),
+        Some(parent.as_path()),
+        "should allocate under the resolved parent"
+    );
+    owned.close().expect("should remove owned checkout");
+    assert!(
+        !path.exists(),
+        "should clean up the exact canonical checkout"
+    );
+}
+
+#[test]
+fn fresh_source_attempt_controls_reject_cancelled_and_expired_work() {
+    let fixture = Fixture::new();
+    let approved = fixture.authenticate().expect("should authenticate source");
+    let cancellation = Cancellation::default();
+    cancellation.cancel();
+    assert!(
+        approved
+            .materialize(Instant::now() + Duration::from_secs(30), &cancellation)
+            .is_err(),
+        "should reject cancellation before copying"
+    );
+    assert!(
+        approved
+            .materialize(Instant::now(), &Cancellation::default())
+            .is_err(),
+        "should reject expired attempts before copying"
+    );
+    let cancellation = Cancellation::default();
+    let fresh = approved
+        .materialize(Instant::now() + Duration::from_secs(30), &cancellation)
+        .expect("should copy active source");
+    cancellation.cancel();
+    assert!(
+        fresh.verify_unchanged(&[]).is_err(),
+        "should retain attempt cancellation for handoff checks"
+    );
+}
+
+#[test]
+fn fresh_source_copy_and_source_scan_stop_at_the_first_cancelled_check() {
+    let fixture = Fixture::new();
+    let approved = fixture.authenticate().expect("should authenticate source");
+    let baseline = Cell::new(0);
+    super::worktree::compare_with_outputs_controlled(
+        &approved.snapshot.root,
+        &approved.snapshot.records,
+        &[],
+        &|| {
+            baseline.set(baseline.get() + 1);
+            Ok(())
+        },
+    )
+    .expect("should measure deterministic initial scan");
+    let calls = Cell::new(0);
+    let stop = baseline.get() + 12;
+    let result = approved.materialize_with_check(
+        Instant::now() + Duration::from_secs(30),
+        &Cancellation::default(),
+        &|| {
+            calls.set(calls.get() + 1);
+            if calls.get() >= stop {
+                return Err(source_error("cancelled during private copy"));
+            }
+            Ok(())
+        },
+    );
+    assert!(
+        result.is_err(),
+        "should stop copying instead of returning fresh source"
+    );
+    assert_eq!(calls.get(), stop, "should stop exactly at cancellation");
+    let scans = Cell::new(0);
+    let scanned = super::worktree::compare_with_outputs_controlled(
+        &approved.snapshot.root,
+        &approved.snapshot.records,
+        &[],
+        &|| {
+            scans.set(scans.get() + 1);
+            if scans.get() >= 3 {
+                return Err(source_error("cancelled during directory scan"));
+            }
+            Ok(())
+        },
+    );
+    assert!(
+        scanned.is_err(),
+        "should abort source enumeration when cancelled"
+    );
+    assert_eq!(scans.get(), 3, "should not enumerate after cancellation");
+}
+
+struct Fixture {
+    parent: TempDir,
+    root: PathBuf,
+    commit: String,
+}
+
+/// Fixtures fail preflight if any temporary-directory ancestor holds a Cargo
+/// configuration layer, so report that host precondition explicitly.
+fn assert_clean_ancestry(path: &Path) {
+    let canonical = fs::canonicalize(path).expect("should resolve fixture directory");
+    for ancestor in canonical.ancestors() {
+        for name in ["config", "config.toml"] {
+            let layer = ancestor.join(".cargo").join(name);
+            assert!(
+                !layer.exists(),
+                "fixture temporary directory ancestry must not contain {}; set TMPDIR to a clean directory",
+                layer.display()
+            );
+        }
+    }
+}
+
+fn host_path() -> OsString {
+    std::env::var_os("PATH").expect("should have a PATH to locate git")
+}
+
+fn fixture_git(root: &Path, home: &Path, args: &[&str]) -> String {
+    // Keep the duplicated fixture setup free of detached maintenance writes.
+    let output = Command::new("git")
+        .args(["-c", "maintenance.auto=false", "-c", "gc.auto=0"])
+        .args(args)
+        .current_dir(root)
+        .env_clear()
+        .env("PATH", host_path())
+        .env("HOME", home)
+        .env("LC_ALL", "C")
+        .env("GIT_CONFIG_NOSYSTEM", "1")
+        .env("GIT_CONFIG_GLOBAL", "/dev/null")
+        .env("GIT_AUTHOR_NAME", "Fictional Author")
+        .env("GIT_AUTHOR_EMAIL", "author@example.com")
+        .env("GIT_AUTHOR_DATE", format!("{EPOCH} +0000"))
+        .env("GIT_COMMITTER_NAME", "Fictional Committer")
+        .env("GIT_COMMITTER_EMAIL", "committer@example.com")
+        .env("GIT_COMMITTER_DATE", format!("{EPOCH} +0000"))
+        .output()
+        .expect("should run fixture git");
+    assert!(
+        output.status.success(),
+        "should run fixture git {args:?}: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    String::from_utf8(output.stdout)
+        .expect("should emit UTF-8")
+        .trim()
+        .to_owned()
+}
+
+fn write(root: &Path, path: &str, bytes: &[u8]) {
+    let path = root.join(path);
+    fs::create_dir_all(path.parent().expect("should have parent")).expect("should create dirs");
+    fs::write(path, bytes).expect("should write fixture file");
+}
+
+impl Fixture {
+    fn new() -> Self {
+        let parent = tempdir().expect("should create fixture parent");
+        assert_clean_ancestry(parent.path());
+        let root = parent.path().join("source");
+        fs::create_dir(&root).expect("should create fixture root");
+        write(
+            &root,
+            "Cargo.toml",
+            b"[workspace]\nresolver = \"2\"\nmembers = [\n    \"crates/trusted-server-openrtb\",\n    \"crates/trusted-server-release\",\n]\n",
+        );
+        write(&root, "Cargo.lock", b"# fictional lock\nversion = 4\n");
+        write(
+            &root,
+            "rust-toolchain.toml",
+            b"[toolchain]\nchannel = \"1.95.0\"\n",
+        );
+        write(&root, ".cargo/config.toml", b"[alias]\n");
+        write(&root, ".tool-versions", b"rust 1.95.0\n");
+        write(
+            &root,
+            "scripts/release/bootstrap.sh",
+            b"#!/bin/sh\nexit 1\n",
+        );
+        for script in [
+            "build-js.sh",
+            "build.sh",
+            "collect-js.mjs",
+            "observe-npm.mjs",
+        ] {
+            write(
+                &root,
+                &format!("scripts/release/{script}"),
+                b"// fictional driver\n",
+            );
+        }
+        fs::set_permissions(
+            root.join("scripts/release/bootstrap.sh"),
+            fs::Permissions::from_mode(0o755),
+        )
+        .expect("should mark bootstrap executable");
+        write(
+            &root,
+            "crates/trusted-server-openrtb/Cargo.toml",
+            b"[package]\nname = \"fictional-openrtb\"\n",
+        );
+        write(
+            &root,
+            "crates/trusted-server-release/Cargo.toml",
+            b"[package]\nname = \"fictional-release\"\n",
+        );
+        write(
+            &root,
+            "crates/trusted-server-release/src/main.rs",
+            b"fn main() {}\n",
+        );
+        write(&root, "crates/other/src/lib.rs", b"// outside closure\n");
+        write(&root, "AGENTS.md", b"# Fictional agents\n");
+        symlink("AGENTS.md", root.join("CLAUDE.md")).expect("should create reviewed symlink");
+        let mut fixture = Self {
+            parent,
+            root,
+            commit: String::new(),
+        };
+        fixture.git(&["init", "-q"]);
+        fixture.commit_all();
+        fixture
+    }
+
+    fn home(&self) -> PathBuf {
+        let home = self.parent.path().join("fixture-home");
+        fs::create_dir_all(&home).expect("should create fixture home");
+        home
+    }
+
+    fn git(&self, args: &[&str]) -> String {
+        fixture_git(&self.root, &self.home(), args)
+    }
+
+    fn commit_all(&mut self) {
+        self.git(&["add", "-A"]);
+        self.git(&["commit", "-q", "--allow-empty", "-m", "fixture"]);
+        self.commit = self.git(&["rev-parse", "HEAD"]);
+    }
+
+    fn audited(&self) -> AuditedEnvironment {
+        audit_environment(&[(OsString::from("PATH"), host_path())])
+            .expect("should audit fixture environment")
+    }
+
+    fn authenticate(&self) -> Result<ApprovedSource, Report<ReleaseError>> {
+        approve(&self.root, &self.commit, &self.audited())
+    }
+
+    fn rejection(&self) -> String {
+        format!(
+            "{:?}",
+            self.authenticate()
+                .err()
+                .expect("should reject fixture source")
+        )
+    }
+}
+
+/// Parses `commit` like the CLI does, then authenticates `root`.
+fn approve(
+    root: &Path,
+    commit: &str,
+    audited: &AuditedEnvironment,
+) -> Result<ApprovedSource, Report<ReleaseError>> {
+    authenticate(root, &CommitId::parse(commit)?, audited)
+}
+
+fn assert_rejects(fixture: &Fixture, needle: &str) {
+    let text = fixture.rejection();
+    assert!(
+        text.contains(needle),
+        "should explain rejection with `{needle}`, got: {text}"
+    );
+}
+
+mod closure;
+mod layout;
+mod objects;
+mod process;
+mod worktree;
+
+#[test]
+fn fresh_source_copies_share_no_files_and_reject_changed_inputs() {
+    let fixture = Fixture::new();
+    let approved = fixture.authenticate().expect("should authenticate source");
+    let first = approved
+        .materialize(
+            Instant::now() + Duration::from_secs(30),
+            &Cancellation::default(),
+        )
+        .expect("should materialize first source");
+    let second = approved
+        .materialize(
+            Instant::now() + Duration::from_secs(30),
+            &Cancellation::default(),
+        )
+        .expect("should materialize second source");
+    for fresh in [&first, &second] {
+        assert_eq!(
+            fresh.root(),
+            fs::canonicalize(fresh.root()).expect("should resolve materialized checkout"),
+            "should expose the same path that boundary roots bind"
+        );
+    }
+    assert_ne!(
+        first.root(),
+        second.root(),
+        "should own distinct source roots"
+    );
+    assert!(
+        !first.root().join(".git").exists(),
+        "should not inherit repository configuration"
+    );
+    first
+        .verify_unchanged(&[])
+        .expect("should verify pristine copy");
+    fs::write(first.root().join("AGENTS.md"), b"changed").expect("should modify private copy");
+    assert!(
+        first.verify_unchanged(&[]).is_err(),
+        "should reject changed copied source"
+    );
+    second
+        .verify_unchanged(&[])
+        .expect("should preserve independent copy");
+    approved
+        .snapshot()
+        .verify_unchanged()
+        .expect("should preserve original source");
+    fs::write(fixture.root.join("AGENTS.md"), b"changed").expect("should change original");
+    assert!(
+        approved
+            .materialize(
+                Instant::now() + Duration::from_secs(30),
+                &Cancellation::default()
+            )
+            .is_err(),
+        "should reject changed original before copying"
+    );
+}
+
+#[test]
+fn fresh_source_output_exclusions_cannot_hide_approved_files() {
+    let fixture = Fixture::new();
+    let approved = fixture.authenticate().expect("should authenticate source");
+    let fresh = approved
+        .materialize(
+            Instant::now() + Duration::from_secs(30),
+            &Cancellation::default(),
+        )
+        .expect("should copy source");
+    fs::create_dir(fresh.root().join("generated")).expect("should create generated root");
+    fs::write(fresh.root().join("generated/output"), b"output").expect("should write output");
+    assert!(
+        fresh.verify_unchanged(&[]).is_err(),
+        "should reject unapproved output root"
+    );
+    fresh
+        .verify_unchanged(&["generated"])
+        .expect("should allow disjoint generated root");
+    assert!(
+        fresh.verify_unchanged(&["crates"]).is_err(),
+        "should reject exclusion overlapping tracked source"
+    );
+    assert!(
+        fresh.verify_unchanged(&["../source"]).is_err(),
+        "should reject nonnormal exclusions"
+    );
+    fs::write(fresh.root().join("AGENTS.md"), b"changed").expect("should change tracked file");
+    assert!(
+        fresh.verify_unchanged(&["generated"]).is_err(),
+        "should still reject source changes outside generated root"
+    );
+}
+
+#[test]
+fn fresh_source_recheck_rejects_replaced_root_alias() {
+    let fixture = Fixture::new();
+    let approved = fixture.authenticate().expect("should authenticate source");
+    let fresh = approved
+        .materialize(
+            Instant::now() + Duration::from_secs(30),
+            &Cancellation::default(),
+        )
+        .expect("should create source copy");
+    let saved = fixture.parent.path().join("saved-copy");
+    fs::rename(fresh.root(), &saved).expect("should move owned source");
+    symlink(&saved, fresh.root()).expect("should alias identical source");
+    assert!(
+        fresh.verify_unchanged(&[]).is_err(),
+        "should reject source root substitution"
+    );
+}
diff --git a/crates/trusted-server-release/src/source/tests/closure.rs b/crates/trusted-server-release/src/source/tests/closure.rs
new file mode 100644
index 0000000000..4d86b5d6b5
--- /dev/null
+++ b/crates/trusted-server-release/src/source/tests/closure.rs
@@ -0,0 +1,292 @@
+//! Helper closure, inventory join and child-environment checks.
+
+use super::*;
+
+#[test]
+fn root_lifecycle_review_reads_only_the_approved_manifest() {
+    let mut fixture = Fixture::new();
+    let manifest = serde_json::to_vec(
+        &json!({"name":"fictional-project", "scripts":{"build":"node build.mjs"}}),
+    )
+    .expect("should encode root manifest");
+    write(&fixture.root, "Cargo.lock", b"version = 4\npackage = []\n");
+    write(
+        &fixture.root,
+        "crates/trusted-server-js/lib/package-lock.json",
+        &serde_json::to_vec(&json!({"lockfileVersion":3,"packages":{}}))
+            .expect("should encode empty lock"),
+    );
+    write(
+        &fixture.root,
+        "crates/trusted-server-js/lib/package.json",
+        &manifest,
+    );
+    fixture.commit_all();
+    let source = fixture
+        .authenticate()
+        .expect("should authenticate root source");
+    let materials = crate::materials::LockedMaterials::from_source(&source)
+        .expect("should read approved locks");
+    let review = materials
+        .review_root(&source)
+        .expect("should review hook-free approved root");
+    assert_eq!(
+        review.source_commit(),
+        fixture.commit,
+        "should bind declarations to approved source"
+    );
+    write(
+        &fixture.root,
+        "crates/trusted-server-js/lib/package.json",
+        b"{}",
+    );
+    assert!(
+        materials.review_root(&source).is_err(),
+        "should reject root manifest changed after approval"
+    );
+    write(
+        &fixture.root,
+        "crates/trusted-server-js/lib/package.json",
+        &manifest,
+    );
+    write(
+        &fixture.root,
+        "crates/trusted-server-js/lib/binding.gyp",
+        b"fictional implicit binding",
+    );
+    fixture.commit_all();
+    let source = fixture
+        .authenticate()
+        .expect("should authenticate changed source");
+    let current = crate::materials::LockedMaterials::from_source(&source)
+        .expect("should read current approved locks");
+    assert!(
+        current.review_root(&source).is_err(),
+        "should reject approved root implicit install"
+    );
+    assert!(
+        materials.review_root(&source).is_err(),
+        "should reject another approved source identity"
+    );
+}
+
+#[test]
+fn material_lockfiles_are_read_only_as_approved_tracked_bytes() {
+    let mut fixture = Fixture::new();
+    let original_bytes = b"fictional original registry distribution";
+    let checksum = hex::encode(Sha256::digest(original_bytes));
+    let registry_line = include_str!("../../../../../Cargo.lock")
+        .lines()
+        .find(|line| line.starts_with("source = \"registry+"))
+        .expect("should derive the reviewed registry identity from the source lock");
+    let lock = format!(
+        "version = 4\n[[package]]\nname = \"fictional\"\nversion = \"1.0.0\"\n{registry_line}\nchecksum = \"{checksum}\"\n"
+    );
+    write(&fixture.root, "Cargo.lock", lock.as_bytes());
+    write(
+        &fixture.root,
+        "crates/trusted-server-js/lib/package-lock.json",
+        br#"{"lockfileVersion":3,"packages":{}}"#,
+    );
+    fixture.commit_all();
+    let source = fixture
+        .authenticate()
+        .expect("should authenticate fixture source");
+    let materials = crate::materials::LockedMaterials::from_source(&source)
+        .expect("should read approved lockfiles");
+    let original = fixture.parent.path().join("fictional.crate");
+    fs::write(&original, original_bytes).expect("should create original outside source roots");
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(5);
+    let cancellation = crate::process::Cancellation::default();
+    let retained = materials
+        .verify_registry("fictional", "1.0.0", &original, deadline, &cancellation)
+        .expect("should authenticate original from the approved lockfile");
+    assert_eq!(
+        retained.source_commit(),
+        fixture.commit,
+        "should bind the original to approved source"
+    );
+    assert_eq!(
+        retained.identity(),
+        "crate:fictional@1.0.0",
+        "should retain locked package identity"
+    );
+    assert_eq!(
+        retained.sha256(),
+        checksum,
+        "should retain exact original archive bytes"
+    );
+    assert!(
+        materials
+            .verify_registry("unknown", "1.0.0", &original, deadline, &cancellation)
+            .is_err(),
+        "should reject an archive absent from approved registry materials"
+    );
+    assert!(
+        materials
+            .verify_npm("node_modules/unknown", &original, deadline, &cancellation)
+            .is_err(),
+        "should reject an archive absent from approved npm locations"
+    );
+    assert!(
+        source
+            .read_tracked("../Cargo.lock", Role::Metadata)
+            .is_err(),
+        "should reject paths outside the approved tracked names"
+    );
+    write(&fixture.root, "Cargo.lock", b"version = 4\n");
+    assert!(
+        crate::materials::LockedMaterials::from_source(&source).is_err(),
+        "should reject lockfile changes after source authentication"
+    );
+}
+
+#[test]
+fn closure_requires_every_listed_member_manifest() {
+    let mut fixture = Fixture::new();
+    write(
+        &fixture.root,
+        "Cargo.toml",
+        b"[workspace]\nmembers = [\"crates/trusted-server-openrtb\", \"crates/missing\"]\n",
+    );
+    fixture.commit_all();
+    assert_rejects(&fixture, "crates/missing/Cargo.toml");
+    write(
+        &fixture.root,
+        "Cargo.toml",
+        b"[workspace]\nmembers = [\"crates/trusted-server-release\"]\n",
+    );
+    fixture.commit_all();
+    assert_rejects(&fixture, "crates/trusted-server-openrtb/Cargo.toml");
+    write(
+        &fixture.root,
+        "Cargo.toml",
+        b"[workspace]\nmembers = [\"crates/*\"]\n",
+    );
+    fixture.commit_all();
+    assert_rejects(&fixture, "glob");
+}
+
+#[test]
+fn closure_digest_changes_with_helper_sources() {
+    let mut fixture = Fixture::new();
+    let before = fixture.authenticate().expect("should authenticate");
+    write(
+        &fixture.root,
+        "crates/trusted-server-release/src/main.rs",
+        b"fn main() { }\n",
+    );
+    fixture.commit_all();
+    let after = fixture
+        .authenticate()
+        .expect("should authenticate changed helper");
+    assert_ne!(
+        before.closure_digest(),
+        after.closure_digest(),
+        "should invalidate the closure when helper source changes"
+    );
+    write(
+        &fixture.root,
+        "crates/other/src/lib.rs",
+        b"// changed outside closure\n",
+    );
+    fixture.commit_all();
+    let outside = fixture
+        .authenticate()
+        .expect("should authenticate outside change");
+    assert_eq!(
+        after.closure_digest(),
+        outside.closure_digest(),
+        "should ignore sources outside the helper closure"
+    );
+}
+
+#[test]
+fn joins_inventory_only_to_the_approved_commit() {
+    let fixture = Fixture::new();
+    let source = fixture.authenticate().expect("should authenticate");
+    let inventory = |commit: &str| {
+        serde_json::to_vec(&json!({
+            "materials": [],
+            "modules": [],
+            "schema_version": 1,
+            "source_commit": commit,
+            "tools": [],
+        }))
+        .expect("should encode inventory")
+    };
+    join_inventory(&source, &inventory(&fixture.commit)).expect("should join matching inventory");
+    assert!(
+        join_inventory(&source, &inventory(&"a".repeat(40))).is_err(),
+        "should reject a different inventory commit"
+    );
+    let mut extra: Value =
+        serde_json::from_slice(&inventory(&fixture.commit)).expect("should decode inventory");
+    extra["approved"] = json!(true);
+    assert!(
+        join_inventory(&source, &serde_json::to_vec(&extra).expect("should encode")).is_err(),
+        "should reject unknown inventory fields"
+    );
+}
+
+#[test]
+fn child_environment_takes_commit_and_epoch_from_approved_source() {
+    let fixture = Fixture::new();
+    let audited = fixture.audited();
+    let source = fixture.authenticate().expect("should authenticate");
+    let child = child_environment(
+        &audited,
+        &source,
+        &ChildRequest {
+            target: ReleaseTarget::Wasm32Wasip1,
+            home: PathBuf::from("/private/release/home"),
+            cargo_home: PathBuf::from("/private/release/cargo-home"),
+            tool_directories: Vec::new(),
+        },
+    )
+    .expect("should build child environment");
+    assert_eq!(
+        child.variables().get("TRUSTED_SERVER__GIT_VERSION"),
+        Some(&fixture.commit),
+        "should inject the approved commit"
+    );
+    assert_eq!(
+        child
+            .variables()
+            .get("SOURCE_DATE_EPOCH")
+            .map(String::as_str),
+        Some("1700000000"),
+        "should inject the approved committer epoch"
+    );
+}
+
+#[test]
+fn helper_closure_includes_the_actual_npm_observer() {
+    let mut fixture = Fixture::new();
+    write(
+        &fixture.root,
+        "scripts/release/observe-npm.mjs",
+        b"// first observer\n",
+    );
+    fixture.commit_all();
+    let first = fixture
+        .authenticate()
+        .expect("should authenticate observer source")
+        .closure_digest()
+        .to_owned();
+    write(
+        &fixture.root,
+        "scripts/release/observe-npm.mjs",
+        b"// changed observer\n",
+    );
+    fixture.commit_all();
+    let second = fixture
+        .authenticate()
+        .expect("should authenticate changed observer source")
+        .closure_digest()
+        .to_owned();
+    assert_ne!(
+        first, second,
+        "should invalidate helper selection when observer code changes"
+    );
+}
diff --git a/crates/trusted-server-release/src/source/tests/layout.rs b/crates/trusted-server-release/src/source/tests/layout.rs
new file mode 100644
index 0000000000..34b8e7e572
--- /dev/null
+++ b/crates/trusted-server-release/src/source/tests/layout.rs
@@ -0,0 +1,240 @@
+//! Repository layout, configuration and Git lookup checks.
+
+use super::*;
+
+#[test]
+fn rejects_extensionless_rust_toolchain_before_other_checks() {
+    let fixture = Fixture::new();
+    write(&fixture.root, "rust-toolchain", b"nightly\n");
+    write(
+        &fixture.root,
+        ".git/objects/info/alternates",
+        b"/elsewhere\n",
+    );
+    assert_rejects(&fixture, "rust-toolchain");
+}
+
+#[test]
+fn rejects_linked_worktree_gitfile_indirection() {
+    let fixture = Fixture::new();
+    fs::rename(
+        fixture.root.join(".git"),
+        fixture.parent.path().join("moved-git"),
+    )
+    .expect("should move git directory");
+    write(&fixture.root, ".git", b"gitdir: ../moved-git\n");
+    assert_rejects(&fixture, "unsupported");
+}
+
+#[test]
+fn rejects_commondir_indirection() {
+    let fixture = Fixture::new();
+    write(&fixture.root, ".git/commondir", b"../other\n");
+    assert_rejects(&fixture, "commondir");
+}
+
+#[test]
+fn rejects_object_and_history_rewriting_channels() {
+    for (path, needle) in [
+        ("objects/info/alternates", ".git/objects/info/alternates"),
+        (
+            "objects/info/http-alternates",
+            ".git/objects/info/http-alternates",
+        ),
+        ("info/grafts", ".git/info/grafts"),
+        ("shallow", ".git/shallow"),
+        ("info/attributes", ".git/info/attributes"),
+        (
+            "refs/replace/0000000000000000000000000000000000000000",
+            ".git/refs/replace",
+        ),
+    ] {
+        let fixture = Fixture::new();
+        write(&fixture.root.join(".git"), path, b"fictional\n");
+        assert_rejects(&fixture, needle);
+    }
+}
+
+#[test]
+fn rejects_packed_replace_refs() {
+    let fixture = Fixture::new();
+    let line = format!(
+        "# pack-refs with: peeled fully-peeled sorted\n{} refs/replace/{}\n",
+        fixture.commit, fixture.commit
+    );
+    write(&fixture.root, ".git/packed-refs", line.as_bytes());
+    assert_rejects(&fixture, "refs/replace");
+}
+
+#[test]
+fn rejects_unreviewed_git_config_keys() {
+    for addition in [
+        "[include]\n\tpath = /dev/null\n",
+        "[includeIf \"gitdir:/\"]\n\tpath = /dev/null\n",
+        "[core]\n\tfsmonitor = true\n",
+        "[core]\n\thooksPath = /dev/null\n",
+        "[core]\n\tsshCommand = ssh\n",
+        "[core]\n\tworktree = /\n",
+        "[filter \"lfs\"]\n\tclean = cat\n",
+        "[diff \"x\"]\n\ttextconv = cat\n",
+        "[extensions]\n\tobjectformat = sha256\n",
+        "[user]\n\tname = Fictional\n",
+    ] {
+        let fixture = Fixture::new();
+        let config = fixture.root.join(".git/config");
+        let mut text = fs::read_to_string(&config).expect("should read fixture config");
+        text.push_str(addition);
+        fs::write(&config, text).expect("should write fixture config");
+        assert_rejects(&fixture, "git config");
+    }
+}
+
+#[test]
+fn parses_only_allowlisted_config_values() {
+    assert!(
+        check_git_config("[core]\n\trepositoryformatversion = 0\n\tbare = false\n[remote \"origin\"]\n\turl = https://example.com/r.git\n\tfetch = +refs/heads/*:refs/remotes/origin/*\n[branch \"main\"]\n\tremote = origin\n\tmerge = refs/heads/main\n").is_ok(),
+        "should accept allowlisted keys"
+    );
+    for text in [
+        "[core]\n\trepositoryformatversion = 1\n",
+        "[core]\n\tbare = true\n",
+        "[core]\n\tfilemode = maybe\n",
+        "[core]\n\tsymlinks = \"true\"\n",
+        "[core]\n\tfilemode = true \\\n",
+        "[remote \"origin\"]\n\tpushurl = https://example.com\n",
+        "[core.x]\n\tfilemode = true\n",
+        "\tfilemode = true\n",
+    ] {
+        assert!(
+            check_git_config(text).is_err(),
+            "should reject config {text:?}"
+        );
+    }
+}
+
+#[test]
+fn rejects_fsmonitor_without_executing_it() {
+    let fixture = Fixture::new();
+    let marker = fixture.parent.path().join("fsmonitor-ran");
+    let hook = fixture.parent.path().join("fsmonitor.sh");
+    fs::write(&hook, format!("#!/bin/sh\ntouch '{}'\n", marker.display()))
+        .expect("should write hook");
+    fs::set_permissions(&hook, fs::Permissions::from_mode(0o755)).expect("should chmod hook");
+    let config = fixture.root.join(".git/config");
+    let mut text = fs::read_to_string(&config).expect("should read config");
+    text.push_str(&format!("[core]\n\tfsmonitor = {}\n", hook.display()));
+    fs::write(&config, text).expect("should write config");
+    assert_rejects(&fixture, "git config");
+    assert!(
+        !marker.exists(),
+        "should never execute the fsmonitor command"
+    );
+}
+
+/// Audits an environment whose only PATH entry holds a fake `git` that leaves a marker.
+fn fake_git_environment(fixture: &Fixture) -> (AuditedEnvironment, PathBuf) {
+    let bin = fixture.parent.path().join("fake-bin");
+    fs::create_dir_all(&bin).expect("should create fake bin");
+    let marker = fixture.parent.path().join("fake-git-ran");
+    let script = bin.join("git");
+    fs::write(
+        &script,
+        format!("#!/bin/sh\n: > '{}'\nexit 1\n", marker.display()),
+    )
+    .expect("should write fake git");
+    fs::set_permissions(&script, fs::Permissions::from_mode(0o755)).expect("should chmod");
+    let audited = audit_environment(&[(OsString::from("PATH"), bin.into_os_string())])
+        .expect("should audit fake PATH");
+    (audited, marker)
+}
+
+#[test]
+fn config_audit_rejects_before_any_git_process_spawns() {
+    let control = Fixture::new();
+    let (audited, marker) = fake_git_environment(&control);
+    assert!(
+        approve(&control.root, &control.commit, &audited).is_err(),
+        "should fail when the fake git exits nonzero"
+    );
+    assert!(
+        marker.exists(),
+        "control should prove the fake git is reachable"
+    );
+
+    let fixture = Fixture::new();
+    let (audited, marker) = fake_git_environment(&fixture);
+    let config = fixture.root.join(".git/config");
+    let mut text = fs::read_to_string(&config).expect("should read config");
+    text.push_str("[core]\n\tfsmonitor = true\n");
+    fs::write(&config, text).expect("should write config");
+    let text = format!(
+        "{:?}",
+        approve(&fixture.root, &fixture.commit, &audited)
+            .err()
+            .expect("should reject fsmonitor config")
+    );
+    assert!(
+        text.contains("git config"),
+        "should name the config audit: {text}"
+    );
+    assert!(
+        !marker.exists(),
+        "should reject before spawning any git process"
+    );
+}
+
+#[test]
+fn ignores_relative_path_entries_when_locating_git() {
+    let fixture = Fixture::new();
+    let (_, marker) = fake_git_environment(&fixture);
+    let audited = audit_environment(&[(OsString::from("PATH"), OsString::from("fake-bin"))])
+        .expect("should audit relative PATH");
+    let text = format!(
+        "{:?}",
+        approve(
+            &fixture.parent.path().join("source"),
+            &fixture.commit,
+            &audited
+        )
+        .err()
+        .expect("should not find git on a relative entry")
+    );
+    assert!(
+        text.contains("absolute PATH"),
+        "should explain git lookup: {text}"
+    );
+    assert!(
+        !marker.exists(),
+        "should never run a relatively located git"
+    );
+}
+
+#[test]
+fn rejects_cargo_config_in_any_ancestor_directory() {
+    for name in ["config", "config.toml"] {
+        let fixture = Fixture::new();
+        write(
+            fixture.parent.path(),
+            &format!(".cargo/{name}"),
+            b"[build]\n",
+        );
+        assert_rejects(&fixture, ".cargo");
+    }
+}
+
+#[test]
+fn rejects_unreadable_packed_refs() {
+    let fixture = Fixture::new();
+    let packed = fixture.root.join(".git/packed-refs");
+    write(
+        &fixture.root,
+        ".git/packed-refs",
+        b"# pack-refs with: peeled\n",
+    );
+    fs::set_permissions(&packed, fs::Permissions::from_mode(0o000)).expect("should chmod");
+    if fs::read(&packed).is_ok() {
+        // Privileged runs can read mode-000 files, so the denial cannot be exercised.
+        return;
+    }
+    assert_rejects(&fixture, "packed-refs");
+}
diff --git a/crates/trusted-server-release/src/source/tests/objects.rs b/crates/trusted-server-release/src/source/tests/objects.rs
new file mode 100644
index 0000000000..b59d2e0aa2
--- /dev/null
+++ b/crates/trusted-server-release/src/source/tests/objects.rs
@@ -0,0 +1,384 @@
+//! Commit, tree and blob identity and parsing checks.
+
+use super::*;
+
+#[test]
+fn authenticates_clean_fixture_with_commit_epoch_and_closure() {
+    let fixture = Fixture::new();
+    let source = fixture
+        .authenticate()
+        .expect("should authenticate clean fixture");
+    assert_eq!(
+        source.commit().as_str(),
+        fixture.commit,
+        "should keep approved commit"
+    );
+    assert_eq!(source.epoch(), EPOCH, "should derive committer epoch");
+    assert!(
+        lower_hex(source.snapshot().fingerprint(), 64),
+        "should fingerprint the tracked snapshot"
+    );
+    assert!(
+        lower_hex(source.closure_digest(), 64),
+        "should digest closure"
+    );
+    assert_eq!(
+        source.closure_paths(),
+        [
+            ".cargo/config.toml",
+            ".tool-versions",
+            "Cargo.lock",
+            "Cargo.toml",
+            "crates/trusted-server-openrtb/Cargo.toml",
+            "crates/trusted-server-release/Cargo.toml",
+            "crates/trusted-server-release/src/main.rs",
+            "rust-toolchain.toml",
+            "scripts/release/bootstrap.sh",
+            "scripts/release/build-js.sh",
+            "scripts/release/build.sh",
+            "scripts/release/collect-js.mjs",
+            "scripts/release/observe-npm.mjs",
+        ],
+        "should record the complete helper-source closure"
+    );
+    assert_eq!(
+        source.tracked_sha256("AGENTS.md"),
+        Some(hex::encode(Sha256::digest(b"# Fictional agents\n")).as_str()),
+        "should expose tracked content digests"
+    );
+    source
+        .snapshot()
+        .verify_unchanged()
+        .expect("should verify unchanged worktree");
+}
+
+#[test]
+fn rejects_malformed_commit_arguments() {
+    let fixture = Fixture::new();
+    for commit in [
+        "ABC",
+        "--help",
+        &fixture.commit.to_uppercase(),
+        &fixture.commit[..39],
+    ] {
+        assert!(
+            approve(&fixture.root, commit, &fixture.audited()).is_err(),
+            "should reject commit argument {commit}"
+        );
+    }
+}
+
+#[test]
+fn rejects_unknown_commit_with_bounded_git_detail() {
+    let fixture = Fixture::new();
+    let text = format!(
+        "{:?}",
+        approve(&fixture.root, &"0".repeat(40), &fixture.audited())
+            .err()
+            .expect("should reject unknown commit")
+    );
+    assert!(
+        text.contains("git cat-file"),
+        "should name the failing git step: {text}"
+    );
+}
+
+#[test]
+fn rejects_non_commit_objects() {
+    let fixture = Fixture::new();
+    let tree = fixture.git(&["rev-parse", "HEAD^{tree}"]);
+    let text = format!(
+        "{:?}",
+        approve(&fixture.root, &tree, &fixture.audited())
+            .err()
+            .expect("should reject tree object")
+    );
+    assert!(text.contains("not a commit"), "should reject tree: {text}");
+}
+
+#[test]
+fn rejects_head_that_differs_from_approved_commit() {
+    let mut fixture = Fixture::new();
+    let approved = fixture.commit.clone();
+    write(&fixture.root, "AGENTS.md", b"# Changed\n");
+    fixture.commit_all();
+    let text = format!(
+        "{:?}",
+        approve(&fixture.root, &approved, &fixture.audited())
+            .err()
+            .expect("should reject HEAD mismatch")
+    );
+    assert!(
+        text.contains("HEAD"),
+        "should explain HEAD mismatch: {text}"
+    );
+}
+
+#[test]
+fn parses_committer_epoch_strictly() {
+    let header =
+        "tree 0000000000000000000000000000000000000000\nauthor A <a@example.com> 1 +0000\n";
+    let valid = format!("{header}committer C <c@example.com> 1700000000 -0130\n\nmessage\n");
+    assert_eq!(
+        committer_epoch(valid.as_bytes()).expect("should parse committer epoch"),
+        EPOCH
+    );
+    for committer in [
+        "",
+        "committer C <c@example.com> +1700000000 +0000\n",
+        "committer C <c@example.com> 17e8 +0000\n",
+        "committer C <c@example.com> 1700000000 0000\n",
+        "committer C <c@example.com> 1700000000 +0060\n",
+        "committer C <c@example.com> 1700000000 +01000\n",
+        "committer C <c@example.com> 1700000000\n",
+        "committer C <c@example.com> 1 +0000\ncommitter D <d@example.com> 2 +0000\n",
+    ] {
+        let raw = format!("{header}{committer}\nmessage\n");
+        assert!(
+            committer_epoch(raw.as_bytes()).is_err(),
+            "should reject committer line {committer:?}"
+        );
+    }
+}
+
+fn object_path(fixture: &Fixture, oid: &str) -> PathBuf {
+    fixture
+        .root
+        .join(".git/objects")
+        .join(&oid[..2])
+        .join(&oid[2..])
+}
+
+/// Replaces the loose object file for `target` with the bytes stored for `source`.
+fn substitute_object(fixture: &Fixture, target: &str, source: &str) {
+    let destination = object_path(fixture, target);
+    assert!(destination.exists(), "should have a loose target object");
+    fs::remove_file(&destination).expect("should remove read-only loose object");
+    fs::copy(object_path(fixture, source), &destination).expect("should copy loose object");
+}
+
+#[test]
+fn rejects_substituted_blob_object() {
+    let fixture = Fixture::new();
+    let target = fixture.git(&["rev-parse", "HEAD:AGENTS.md"]);
+    let source = fixture.git(&["rev-parse", "HEAD:Cargo.lock"]);
+    substitute_object(&fixture, &target, &source);
+    assert_rejects(&fixture, "object identity");
+}
+
+#[test]
+fn rejects_substituted_tree_object() {
+    let fixture = Fixture::new();
+    let target = fixture.git(&["rev-parse", "HEAD^{tree}"]);
+    let source = fixture.git(&["rev-parse", "HEAD:crates"]);
+    substitute_object(&fixture, &target, &source);
+    assert_rejects(&fixture, "object identity");
+}
+
+#[test]
+fn rejects_substituted_nested_tree_object() {
+    let fixture = Fixture::new();
+    let target = fixture.git(&["rev-parse", "HEAD:crates/other/src"]);
+    let source = fixture.git(&["rev-parse", "HEAD:crates/trusted-server-release/src"]);
+    substitute_object(&fixture, &target, &source);
+    assert_rejects(&fixture, "object identity");
+}
+
+#[test]
+fn rejects_substituted_commit_object() {
+    let fixture = Fixture::new();
+    let tree = fixture.git(&["rev-parse", "HEAD^{tree}"]);
+    let other = fixture.git(&["commit-tree", &tree, "-p", &fixture.commit, "-m", "other"]);
+    substitute_object(&fixture, &fixture.commit, &other);
+    assert_rejects(&fixture, "object identity");
+}
+
+fn tree_entry(mode: &str, name: &[u8]) -> Vec<u8> {
+    let mut bytes = format!("{mode} ").into_bytes();
+    bytes.extend_from_slice(name);
+    bytes.push(0);
+    bytes.extend_from_slice(&[0xab; 20]);
+    bytes
+}
+
+type ParsedTree = (Vec<TreeEntry>, Vec<(String, String)>);
+
+fn parse_tree_bytes(bytes: &[u8]) -> Result<ParsedTree, String> {
+    let mut entries = Vec::new();
+    let mut subtrees = Vec::new();
+    parse_tree_object("", bytes, &mut entries, &mut subtrees)
+        .map(|()| (entries, subtrees))
+        .map_err(|report| format!("{report:?}"))
+}
+
+#[test]
+fn parses_canonical_tree_objects() {
+    let bytes = [
+        tree_entry("100644", b"a"),
+        tree_entry("40000", b"a-dir"),
+        tree_entry("100755", b"b"),
+        tree_entry("100644", b"c.txt"),
+        tree_entry("40000", b"c"),
+    ]
+    .concat();
+    let (entries, subtrees) = parse_tree_bytes(&bytes).expect("should parse canonical tree");
+    assert_eq!(entries.len(), 3, "should collect blob entries");
+    assert_eq!(subtrees.len(), 2, "should collect subtrees");
+    assert_eq!(subtrees[0].1, "ab".repeat(20), "should hex-encode raw ids");
+}
+
+#[test]
+fn orders_tree_names_as_if_suffixed_by_slash() {
+    let canonical = [tree_entry("100644", b"c.txt"), tree_entry("40000", b"c")].concat();
+    assert!(
+        parse_tree_bytes(&canonical).is_ok(),
+        "should accept `c.txt` before tree `c` because `c/` sorts after `c.txt`"
+    );
+    let swapped = [tree_entry("40000", b"c"), tree_entry("100644", b"c.txt")].concat();
+    assert!(
+        parse_tree_bytes(&swapped).is_err(),
+        "should reject tree `c` before `c.txt`"
+    );
+}
+
+#[test]
+fn rejects_malformed_tree_objects() {
+    let mut missing_nul = b"100644 name".to_vec();
+    missing_nul.extend_from_slice(&[0xab; 20]);
+    let mut truncated = b"100644 name\0".to_vec();
+    truncated.extend_from_slice(&[0xab; 19]);
+    let cases: [(&str, Vec<u8>); 15] = [
+        ("missing NUL", missing_nul),
+        ("truncated id", truncated),
+        ("missing space", b"100644name\0".to_vec()),
+        ("zero-padded tree mode", tree_entry("040000", b"dir")),
+        ("legacy group-writable mode", tree_entry("100664", b"file")),
+        ("unknown mode", tree_entry("100600", b"file")),
+        ("slash in name", tree_entry("100644", b"a/b")),
+        ("empty name", tree_entry("100644", b"")),
+        ("dot name", tree_entry("40000", b".")),
+        ("dot-dot name", tree_entry("40000", b"..")),
+        ("git name", tree_entry("40000", b".git")),
+        ("uppercase git name", tree_entry("40000", b".GIT")),
+        (
+            "duplicate name",
+            [tree_entry("100644", b"a"), tree_entry("100644", b"a")].concat(),
+        ),
+        (
+            "file and tree with one name",
+            [tree_entry("100644", b"a"), tree_entry("40000", b"a")].concat(),
+        ),
+        (
+            "out of order",
+            [tree_entry("100644", b"b"), tree_entry("100644", b"a")].concat(),
+        ),
+    ];
+    for (label, bytes) in cases {
+        assert!(parse_tree_bytes(&bytes).is_err(), "should reject {label}");
+    }
+}
+
+fn walk_with(limits: &TreeLimits) -> Result<Vec<TreeEntry>, Report<ReleaseError>> {
+    let fixture = Fixture::new();
+    let git = Git::locate(&fixture.root, &fixture.audited()).expect("should locate git");
+    let tree = fixture.git(&["rev-parse", "HEAD^{tree}"]);
+    walk_tree(&git, &tree, limits)
+}
+
+#[test]
+fn enforces_tree_depth_limit_exactly() {
+    let exact = TreeLimits {
+        depth: 4,
+        entries: 1_000,
+        objects: 1_000,
+    };
+    assert!(
+        walk_with(&exact).is_ok(),
+        "should accept a tree exactly four levels deep"
+    );
+    let shallow = TreeLimits { depth: 3, ..exact };
+    let text = format!(
+        "{:?}",
+        walk_with(&shallow).expect_err("should reject depth")
+    );
+    assert!(
+        text.contains("depth"),
+        "should name the depth limit: {text}"
+    );
+}
+
+#[test]
+fn enforces_tree_entry_and_object_limits() {
+    let entries = TreeLimits {
+        depth: 64,
+        entries: 5,
+        objects: 1_000,
+    };
+    let text = format!(
+        "{:?}",
+        walk_with(&entries).expect_err("should reject entry count")
+    );
+    assert!(
+        text.contains("entry limit"),
+        "should name the entry limit: {text}"
+    );
+    let objects = TreeLimits {
+        depth: 64,
+        entries: 1_000,
+        objects: 3,
+    };
+    let text = format!(
+        "{:?}",
+        walk_with(&objects).expect_err("should reject tree object count")
+    );
+    assert!(
+        text.contains("object limit"),
+        "should name the object limit: {text}"
+    );
+}
+
+#[test]
+fn rejects_detected_sha1_collision_input() {
+    let vector = include_bytes!("../../../tests/fixtures/sha-mbles-1.bin");
+    let text = format!(
+        "{:?}",
+        checked_sha1(&[vector.as_slice()])
+            .expect_err("should detect the SHA-mbles chosen-prefix collision")
+    );
+    assert!(
+        text.contains("collision"),
+        "should report a collision: {text}"
+    );
+    assert_eq!(
+        checked_sha1(&[b"blob 0\0".as_slice()]).expect("should hash ordinary input"),
+        "e69de29bb2d1d6434b8b29ae775ad8c2e48c5391",
+        "should compute Git's empty-blob id"
+    );
+}
+
+#[test]
+fn rejects_non_ascii_tracked_names() {
+    let bytes = tree_entry("100644", "caf\u{e9}.txt".as_bytes());
+    let text = parse_tree_bytes(&bytes).expect_err("should reject non-ASCII names");
+    assert!(
+        text.contains("ASCII"),
+        "should explain the ASCII requirement: {text}"
+    );
+}
+
+#[test]
+fn enforces_aggregate_object_byte_budget() {
+    let fixture = Fixture::new();
+    let git = Git::locate(&fixture.root, &fixture.audited())
+        .expect("should locate git")
+        .with_object_budget(64);
+    let tree = fixture.git(&["rev-parse", "HEAD^{tree}"]);
+    let text = format!(
+        "{:?}",
+        walk_tree(&git, &tree, &TREE_LIMITS).expect_err("should exhaust the byte budget")
+    );
+    assert!(
+        text.contains("aggregate"),
+        "should name the aggregate bound: {text}"
+    );
+}
diff --git a/crates/trusted-server-release/src/source/tests/process.rs b/crates/trusted-server-release/src/source/tests/process.rs
new file mode 100644
index 0000000000..13703bd10b
--- /dev/null
+++ b/crates/trusted-server-release/src/source/tests/process.rs
@@ -0,0 +1,31 @@
+//! Git plumbing uses the same bounded child supervision as release recipes.
+
+use std::time::{Duration, Instant};
+
+use super::*;
+
+#[test]
+fn git_plumbing_deadline_terminates_the_child_group() {
+    let fixture = Fixture::new();
+    let tools = fixture.parent.path().join("fake-tools");
+    fs::create_dir(&tools).expect("should create fixture tools");
+    let fake = tools.join("git");
+    fs::write(&fake, b"#!/bin/sh\n/bin/sleep 2\n")
+        .expect("should create finite hanging git fixture");
+    fs::set_permissions(&fake, fs::Permissions::from_mode(0o700))
+        .expect("should make fixture executable");
+    let environment = audit_environment(&[(OsString::from("PATH"), tools.into_os_string())])
+        .expect("should audit fixture environment");
+    let git = Git::locate(&fixture.root, &environment)
+        .expect("should locate fixture git")
+        .with_wall_limit(Duration::from_millis(50));
+    let started = Instant::now();
+    assert!(
+        git.run(&["rev-parse", "HEAD"], 1024).is_err(),
+        "should reject a child that exceeds the Git deadline"
+    );
+    assert!(
+        started.elapsed() < Duration::from_secs(1),
+        "should terminate the sleeping child group before its normal exit"
+    );
+}
diff --git a/crates/trusted-server-release/src/source/tests/worktree.rs b/crates/trusted-server-release/src/source/tests/worktree.rs
new file mode 100644
index 0000000000..ef39219a7d
--- /dev/null
+++ b/crates/trusted-server-release/src/source/tests/worktree.rs
@@ -0,0 +1,141 @@
+//! Worktree comparison and mutation checks.
+
+use super::*;
+
+#[test]
+fn rejects_modified_tracked_file() {
+    let fixture = Fixture::new();
+    write(&fixture.root, "AGENTS.md", b"# Modified\n");
+    assert_rejects(&fixture, "AGENTS.md");
+}
+
+#[test]
+fn rejects_changed_executable_bit() {
+    let fixture = Fixture::new();
+    fs::set_permissions(
+        fixture.root.join("scripts/release/bootstrap.sh"),
+        fs::Permissions::from_mode(0o644),
+    )
+    .expect("should chmod");
+    assert_rejects(&fixture, "scripts/release/bootstrap.sh");
+}
+
+#[test]
+fn rejects_file_replaced_by_symlink() {
+    let fixture = Fixture::new();
+    let outside = fixture.parent.path().join("outside.md");
+    fs::write(&outside, b"# Fictional agents\n").expect("should write outside file");
+    fs::remove_file(fixture.root.join("AGENTS.md")).expect("should remove tracked file");
+    symlink(&outside, fixture.root.join("AGENTS.md")).expect("should create symlink");
+    assert_rejects(&fixture, "AGENTS.md");
+}
+
+#[test]
+fn rejects_preexisting_hard_link() {
+    let fixture = Fixture::new();
+    fs::hard_link(
+        fixture.root.join("Cargo.lock"),
+        fixture.parent.path().join("lock-link"),
+    )
+    .expect("should create hard link outside source");
+    assert_rejects(&fixture, "Cargo.lock");
+}
+
+#[test]
+fn rejects_missing_tracked_file() {
+    let fixture = Fixture::new();
+    fs::remove_file(fixture.root.join("crates/other/src/lib.rs")).expect("should remove file");
+    assert_rejects(&fixture, "crates/other/src/lib.rs");
+}
+
+#[test]
+fn rejects_untracked_and_ignored_paths() {
+    for (path, needle) in [
+        (".DS_Store", ".DS_Store"),
+        (
+            "crates/trusted-server-js/lib/node_modules/x/index.js",
+            "crates/trusted-server-js",
+        ),
+        (
+            "crates/other/src/extra_test.rs",
+            "crates/other/src/extra_test.rs",
+        ),
+        ("target/debug/fictional", "target"),
+    ] {
+        let mut fixture = Fixture::new();
+        write(
+            &fixture.root,
+            ".gitignore",
+            b".DS_Store\nnode_modules\ntarget\n*_test.rs\n",
+        );
+        fixture.commit_all();
+        write(&fixture.root, path, b"untracked\n");
+        assert_rejects(&fixture, needle);
+    }
+}
+
+#[test]
+fn rejects_empty_untracked_directory() {
+    let fixture = Fixture::new();
+    fs::create_dir(fixture.root.join("empty")).expect("should create directory");
+    assert_rejects(&fixture, "empty");
+}
+
+#[test]
+fn rejects_unreviewed_tracked_symlink() {
+    let mut fixture = Fixture::new();
+    symlink("Cargo.toml", fixture.root.join("manifest-link")).expect("should create symlink");
+    fixture.commit_all();
+    assert_rejects(&fixture, "manifest-link");
+}
+
+#[test]
+fn rejects_tracked_submodule() {
+    let mut fixture = Fixture::new();
+    let gitlink = format!("160000,{},vendor/module", fixture.commit);
+    fixture.git(&["update-index", "--add", "--cacheinfo", &gitlink]);
+    fixture.git(&["commit", "-q", "-m", "submodule"]);
+    fixture.commit = fixture.git(&["rev-parse", "HEAD"]);
+    assert_rejects(&fixture, "vendor/module");
+}
+
+type Mutation = fn(&Fixture);
+
+#[test]
+fn verify_unchanged_detects_mutations_after_snapshot() {
+    let mutations: [(&str, Mutation); 5] = [
+        ("content", |fixture| {
+            write(&fixture.root, "AGENTS.md", b"# Changed\n")
+        }),
+        ("mode", |fixture| {
+            fs::set_permissions(
+                fixture.root.join("Cargo.lock"),
+                fs::Permissions::from_mode(0o755),
+            )
+            .expect("should chmod");
+        }),
+        ("symlink", |fixture| {
+            fs::remove_file(fixture.root.join("Cargo.lock")).expect("should remove");
+            symlink("Cargo.toml", fixture.root.join("Cargo.lock")).expect("should link");
+        }),
+        ("hard link", |fixture| {
+            fs::hard_link(
+                fixture.root.join("Cargo.lock"),
+                fixture.parent.path().join("late-link"),
+            )
+            .expect("should hard link");
+        }),
+        ("new file", |fixture| {
+            write(&fixture.root, "late.txt", b"late\n")
+        }),
+    ];
+    for (label, mutate) in mutations {
+        let fixture = Fixture::new();
+        let source = fixture.authenticate().expect("should authenticate");
+        mutate(&fixture);
+        assert!(
+            source.snapshot().verify_unchanged().is_err(),
+            "should detect {label} mutation"
+        );
+    }
+}
diff --git a/crates/trusted-server-release/src/source/tree.rs b/crates/trusted-server-release/src/source/tree.rs
new file mode 100644
index 0000000000..58d9538826
--- /dev/null
+++ b/crates/trusted-server-release/src/source/tree.rs
@@ -0,0 +1,225 @@
+//! Verified walking of Git tree objects in their canonical binary form.
+
+use std::collections::BTreeSet;
+
+use error_stack::Report;
+
+use super::git::Git;
+use super::{Mode, REVIEWED_SYMLINKS, source_error};
+use crate::error::ReleaseError;
+
+const TREE_MODE: &[u8] = b"40000";
+
+/// One tracked non-tree entry at the approved commit.
+#[derive(Debug)]
+pub(super) struct TreeEntry {
+    pub(super) path: String,
+    pub(super) mode: Mode,
+    pub(super) oid: String,
+}
+
+/// Bounds for walking the approved commit's trees.
+#[derive(Clone, Copy)]
+pub(super) struct TreeLimits {
+    /// Maximum tree levels, counting the root tree as level one.
+    pub(super) depth: usize,
+    /// Maximum blob and subtree entries across all trees.
+    pub(super) entries: usize,
+    /// Maximum tree objects read.
+    pub(super) objects: usize,
+}
+
+/// Production tree bounds, far above the current repository's size.
+pub(super) const TREE_LIMITS: TreeLimits = TreeLimits {
+    depth: 256,
+    entries: 1_000_000,
+    objects: 100_000,
+};
+
+/// Walks every tree from `root_tree`, rehashing each tree object and parsing
+/// Git's binary tree format directly instead of trusting `ls-tree` output.
+pub(super) fn walk_tree(
+    git: &Git,
+    root_tree: &str,
+    limits: &TreeLimits,
+) -> Result<Vec<TreeEntry>, Report<ReleaseError>> {
+    let mut entries = Vec::new();
+    let mut level = vec![(String::new(), root_tree.to_owned())];
+    let mut depth = 0;
+    let mut objects = 0;
+    let mut subtrees_seen = 0;
+    while !level.is_empty() {
+        depth += 1;
+        objects += level.len();
+        if depth > limits.depth {
+            return Err(source_error("tracked tree exceeds the depth limit"));
+        }
+        if objects > limits.objects {
+            return Err(source_error("tracked tree exceeds the tree object limit"));
+        }
+        let oids: Vec<&str> = level.iter().map(|(_, oid)| oid.as_str()).collect();
+        let mut next = Vec::new();
+        git.read_objects("tree", &oids, |index, bytes| {
+            parse_tree_object(&level[index].0, bytes, &mut entries, &mut next)?;
+            if entries.len() + subtrees_seen + next.len() > limits.entries {
+                return Err(source_error("tracked tree exceeds the entry limit"));
+            }
+            Ok(())
+        })?;
+        subtrees_seen += next.len();
+        level = next;
+    }
+    Ok(entries)
+}
+
+/// One raw entry decoded from a tree object.
+struct RawEntry<'a> {
+    mode: &'a [u8],
+    name: &'a str,
+    oid: String,
+}
+
+/// Parses one binary tree object in Git's canonical form.
+///
+/// Entries must use canonical modes and names and appear in strictly
+/// increasing order, comparing tree names as if suffixed by `/`; this also
+/// rejects duplicate names, including a file and tree sharing one name.
+pub(super) fn parse_tree_object(
+    prefix: &str,
+    mut bytes: &[u8],
+    entries: &mut Vec<TreeEntry>,
+    subtrees: &mut Vec<(String, String)>,
+) -> Result<(), Report<ReleaseError>> {
+    let mut order = TreeOrder::default();
+    while !bytes.is_empty() {
+        let entry = next_entry(&mut bytes, prefix)?;
+        order.admit(&entry, prefix)?;
+        let path = if prefix.is_empty() {
+            entry.name.to_owned()
+        } else {
+            format!("{prefix}/{}", entry.name)
+        };
+        check_tracked_path(&path)?;
+        match classify_mode(entry.mode, &path)? {
+            None => subtrees.push((path, entry.oid)),
+            Some(mode) => entries.push(TreeEntry {
+                path,
+                mode,
+                oid: entry.oid,
+            }),
+        }
+    }
+    Ok(())
+}
+
+fn next_entry<'a>(
+    bytes: &mut &'a [u8],
+    prefix: &str,
+) -> Result<RawEntry<'a>, Report<ReleaseError>> {
+    let malformed = || source_error(format!("tree object for {prefix:?} is malformed"));
+    let data: &'a [u8] = bytes;
+    let space = data
+        .iter()
+        .position(|byte| *byte == b' ')
+        .ok_or_else(malformed)?;
+    let rest = &data[space + 1..];
+    let nul = rest
+        .iter()
+        .position(|byte| *byte == 0)
+        .ok_or_else(malformed)?;
+    let raw_oid = rest.get(nul + 1..nul + 21).ok_or_else(malformed)?;
+    let name = std::str::from_utf8(&rest[..nul])
+        .map_err(|_| source_error("tracked paths must be UTF-8"))?;
+    if name.is_empty() || name.contains('/') {
+        return Err(malformed());
+    }
+    *bytes = &rest[nul + 21..];
+    Ok(RawEntry {
+        mode: &data[..space],
+        name,
+        oid: hex::encode(raw_oid),
+    })
+}
+
+/// Enforces Git's canonical strictly increasing tree entry order.
+#[derive(Default)]
+struct TreeOrder<'a> {
+    previous: Option<Vec<u8>>,
+    names: BTreeSet<&'a str>,
+}
+
+impl<'a> TreeOrder<'a> {
+    fn admit(&mut self, entry: &RawEntry<'a>, prefix: &str) -> Result<(), Report<ReleaseError>> {
+        if !self.names.insert(entry.name) {
+            return Err(source_error(format!(
+                "tree object for {prefix:?} repeats the name {}",
+                entry.name
+            )));
+        }
+        let mut key = entry.name.as_bytes().to_vec();
+        if entry.mode == TREE_MODE {
+            key.push(b'/');
+        }
+        if self
+            .previous
+            .as_ref()
+            .is_some_and(|previous| *previous >= key)
+        {
+            return Err(source_error(format!(
+                "tree object for {prefix:?} is not in canonical order"
+            )));
+        }
+        self.previous = Some(key);
+        Ok(())
+    }
+}
+
+/// Maps a canonical mode to a tracked file mode, or `None` for a subtree.
+fn classify_mode(mode: &[u8], path: &str) -> Result<Option<Mode>, Report<ReleaseError>> {
+    let mode = match mode {
+        TREE_MODE => return Ok(None),
+        b"100644" => Mode::Regular,
+        b"100755" => Mode::Executable,
+        b"120000" => Mode::Symlink,
+        b"160000" => {
+            return Err(source_error(format!(
+                "tracked submodule {path} is not reviewed"
+            )));
+        }
+        _ => {
+            return Err(source_error(format!(
+                "tracked path {path} has an unsupported mode"
+            )));
+        }
+    };
+    if mode == Mode::Symlink && !REVIEWED_SYMLINKS.iter().any(|(link, _)| *link == path) {
+        return Err(source_error(format!(
+            "tracked symlink {path} is not reviewed"
+        )));
+    }
+    Ok(Some(mode))
+}
+
+/// Rejects unsafe tracked path components.
+///
+/// Components must be ASCII: case- and normalization-folding filesystems
+/// (HFS+/APFS Unicode normalization, NTFS and FAT aliasing) can map distinct
+/// non-ASCII tree names onto one worktree path, and no tracked path currently
+/// needs them.
+pub(super) fn check_tracked_path(path: &str) -> Result<(), Report<ReleaseError>> {
+    if !path.is_ascii() {
+        return Err(source_error(
+            "tracked path components must be ASCII to avoid filesystem name aliasing",
+        ));
+    }
+    let unsafe_component = path.split('/').any(|component| {
+        component.is_empty()
+            || component == "."
+            || component == ".."
+            || component.eq_ignore_ascii_case(".git")
+    });
+    if unsafe_component {
+        return Err(source_error("tracked path has an unsafe component"));
+    }
+    Ok(())
+}
diff --git a/crates/trusted-server-release/src/source/worktree.rs b/crates/trusted-server-release/src/source/worktree.rs
new file mode 100644
index 0000000000..c734d71ad0
--- /dev/null
+++ b/crates/trusted-server-release/src/source/worktree.rs
@@ -0,0 +1,235 @@
+//! Comparison of the checked-out worktree against approved tracked records.
+
+use std::collections::BTreeSet;
+use std::ffi::OsString;
+use std::fs::{self, Metadata};
+use std::os::unix::ffi::OsStrExt as _;
+use std::os::unix::fs::MetadataExt as _;
+use std::path::Path;
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256};
+
+use super::{Mode, Records, source_error};
+use crate::documents::hash_bounded_with_check;
+use crate::error::ReleaseError;
+
+const PROBLEMS_SHOWN: usize = 20;
+
+/// Untracked coordination paths reviewed for release sources. Empty for now.
+const REVIEWED_UNTRACKED: [&str; 0] = [];
+
+/// Walks the worktree without following symlinks and fails on any difference.
+pub(super) fn compare_worktree(
+    root: &Path,
+    expected: &Records,
+) -> Result<(), Report<ReleaseError>> {
+    compare_with_outputs(root, expected, &[])
+}
+
+/// Checks source while allowing only explicitly disjoint generated roots.
+pub(super) fn compare_with_outputs(
+    root: &Path,
+    expected: &Records,
+    outputs: &[&str],
+) -> Result<(), Report<ReleaseError>> {
+    compare_with_outputs_controlled(root, expected, outputs, &|| Ok(()))
+}
+
+/// Checks the owning attempt between directory entries and held-file chunks.
+///
+/// # Errors
+///
+/// Returns an error for changed source, unsafe output exclusions, exceeded
+/// entry limits or failed attempt checks.
+pub(super) fn compare_with_outputs_controlled(
+    root: &Path,
+    expected: &Records,
+    outputs: &[&str],
+    check: &dyn Fn() -> Result<(), Report<ReleaseError>>,
+) -> Result<(), Report<ReleaseError>> {
+    check()?;
+    for output in outputs {
+        if output.is_empty()
+            || output
+                .split('/')
+                .any(|part| part.is_empty() || part == "." || part == "..")
+            || expected
+                .keys()
+                .any(|path| path == output || path.starts_with(&format!("{output}/")))
+        {
+            return Err(source_error(
+                "generated root overlaps approved source or is not normal",
+            ));
+        }
+    }
+    let mut scan = Scan {
+        root,
+        expected,
+        ancestors: ancestor_directories(expected),
+        directories: vec![String::new()],
+        problems: Vec::new(),
+        seen: BTreeSet::new(),
+        outputs,
+        check,
+    };
+    while let Some(directory) = scan.directories.pop() {
+        for name in list_directory(root, &directory, check)? {
+            check()?;
+            scan.visit(&directory, &name);
+        }
+    }
+    let missing: Vec<String> = expected
+        .keys()
+        .filter(|path| !scan.seen.contains(*path))
+        .map(|path| format!("tracked path {path} is missing"))
+        .collect();
+    scan.problems.extend(missing);
+    check()?;
+    report_problems(scan.problems)
+}
+
+/// Every proper ancestor directory of a tracked path.
+fn ancestor_directories(expected: &Records) -> BTreeSet<&str> {
+    let mut ancestors = BTreeSet::new();
+    for path in expected.keys() {
+        let mut prefix = path.as_str();
+        while let Some((parent, _)) = prefix.rsplit_once('/') {
+            ancestors.insert(parent);
+            prefix = parent;
+        }
+    }
+    ancestors
+}
+
+fn list_directory(
+    root: &Path,
+    directory: &str,
+    check: &dyn Fn() -> Result<(), Report<ReleaseError>>,
+) -> Result<Vec<OsString>, Report<ReleaseError>> {
+    check()?;
+    let entries = fs::read_dir(root.join(directory))
+        .map_err(|error| source_error(format!("cannot list {directory:?}: {error}")))?;
+    let mut names = Vec::new();
+    for entry in entries {
+        check()?;
+        if names.len() >= 1_000_000 {
+            return Err(source_error("source directory exceeds tracked entry limit"));
+        }
+        names.push(
+            entry
+                .map_err(|error| source_error(error.to_string()))?
+                .file_name(),
+        );
+    }
+    names.sort();
+    Ok(names)
+}
+
+fn report_problems(mut problems: Vec<String>) -> Result<(), Report<ReleaseError>> {
+    if problems.is_empty() {
+        return Ok(());
+    }
+    let count = problems.len();
+    problems.truncate(PROBLEMS_SHOWN);
+    Err(source_error(format!(
+        "worktree differs from the approved commit ({count} problems): {}",
+        problems.join("; ")
+    )))
+}
+
+struct Scan<'a> {
+    root: &'a Path,
+    expected: &'a Records,
+    ancestors: BTreeSet<&'a str>,
+    directories: Vec<String>,
+    problems: Vec<String>,
+    seen: BTreeSet<String>,
+    outputs: &'a [&'a str],
+    check: &'a dyn Fn() -> Result<(), Report<ReleaseError>>,
+}
+
+impl Scan<'_> {
+    fn visit(&mut self, directory: &str, name: &OsString) {
+        let Some(name) = name.to_str() else {
+            self.problems.push(format!(
+                "untracked non-UTF-8 path {}",
+                name.to_string_lossy()
+            ));
+            return;
+        };
+        let relative = if directory.is_empty() {
+            name.to_owned()
+        } else {
+            format!("{directory}/{name}")
+        };
+        if relative == ".git" {
+            return;
+        }
+        if self.outputs.contains(&relative.as_str()) {
+            return;
+        }
+        self.observe(&relative);
+        self.seen.insert(relative);
+    }
+
+    fn observe(&mut self, relative: &str) {
+        let path = self.root.join(relative);
+        let metadata = match fs::symlink_metadata(&path) {
+            Ok(metadata) => metadata,
+            Err(error) => {
+                self.problems
+                    .push(format!("{relative} cannot be inspected: {error}"));
+                return;
+            }
+        };
+        if metadata.is_dir() && self.ancestors.contains(relative) {
+            self.directories.push(relative.to_owned());
+            return;
+        }
+        let Some(record) = self.expected.get(relative) else {
+            if !REVIEWED_UNTRACKED.contains(&relative) {
+                self.problems.push(format!("untracked path {relative}"));
+            }
+            return;
+        };
+        match observe_record(&path, &metadata, self.check) {
+            Ok(observed) if observed == *record => {}
+            Ok(_) => self.problems.push(format!(
+                "{relative} differs from the approved commit in mode, type or content"
+            )),
+            Err(reason) => self.problems.push(format!("{relative} {reason}")),
+        }
+    }
+}
+
+/// Observes the mode and content digest of one tracked worktree path.
+fn observe_record(
+    path: &Path,
+    metadata: &Metadata,
+    check: &dyn Fn() -> Result<(), Report<ReleaseError>>,
+) -> Result<(Mode, String), String> {
+    if metadata.file_type().is_symlink() {
+        let target = fs::read_link(path).map_err(|error| error.to_string())?;
+        return Ok((
+            Mode::Symlink,
+            hex::encode(Sha256::digest(target.as_os_str().as_bytes())),
+        ));
+    }
+    if !metadata.is_file() {
+        return Err("has an unsupported file type".to_owned());
+    }
+    if metadata.nlink() != 1 {
+        return Err(format!("has {} hard links", metadata.nlink()));
+    }
+    hash_bounded_with_check(path, 64 * 1024 * 1024, check)
+        .map(|raw| {
+            let mode = if raw.mode & 0o100 == 0 {
+                Mode::Regular
+            } else {
+                Mode::Executable
+            };
+            (mode, raw.sha256)
+        })
+        .map_err(|report| format!("{report:?}"))
+}
diff --git a/crates/trusted-server-release/src/spdx.rs b/crates/trusted-server-release/src/spdx.rs
new file mode 100644
index 0000000000..8e123a8e6d
--- /dev/null
+++ b/crates/trusted-server-release/src/spdx.rs
@@ -0,0 +1,560 @@
+//! Pure SPDX document rendering, with actual-build generation deliberately closed.
+//!
+//! Schema and graph validity do not establish complete composition coverage or
+//! grant signing, publication or qualification authority. Complete owning-input
+//! integration and full real-artifact inspection remain outstanding.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::path::{Component as PathComponent, Path, PathBuf};
+
+use error_stack::Report;
+use serde_json::{Value, json};
+use sha2::{Digest as _, Sha256};
+
+use crate::documents::{Role, canonical_json, lower_hex, validate_spdx};
+use crate::error::ReleaseError;
+use crate::javascript::JsBuildCompleted;
+use crate::materials::CargoOrigin;
+use crate::policy::ReleaseTarget;
+use crate::recipe::RecipeCompleted;
+
+pub(crate) mod candidate;
+pub(crate) mod cargo;
+pub(crate) mod javascript;
+pub(crate) mod native;
+pub(crate) mod platform;
+
+/// Validated bounded SPDX bytes, without a release-authorization capability.
+#[derive(Debug)]
+pub(crate) struct GeneratedSpdx {
+    bytes: Vec<u8>,
+    sha256: String,
+}
+
+impl GeneratedSpdx {
+    /// The exact serialized SPDX document bytes.
+    pub(crate) fn bytes(&self) -> &[u8] {
+        &self.bytes
+    }
+
+    /// SHA-256 of the exact document bytes, distinct from its executable root.
+    pub(crate) fn sha256(&self) -> &str {
+        &self.sha256
+    }
+}
+
+/// Rejects actual builds until complete owning composition inputs are available.
+///
+/// No current candidate receipt establishes complete native/tool coverage. This
+/// closed adapter performs no complete-input validation and emits no document.
+///
+/// # Errors
+///
+/// Always returns an error for the missing complete owning-input integration.
+pub(crate) fn generate_from_completed(
+    _completed: &RecipeCompleted,
+    _javascript: &JsBuildCompleted,
+) -> Result<GeneratedSpdx, Report<ReleaseError>> {
+    Err(spdx_error(
+        "complete owning composition input integration is unavailable; candidate native/tool coverage remains incomplete",
+    ))
+}
+
+fn spdx_error(detail: impl std::fmt::Display) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Spdx).attach(detail.to_string())
+}
+
+// Only this module's tests construct positive inputs until the owning adapter
+// can validate all required composition classes. No JSON constructor exists.
+struct SpdxInputs<'a> {
+    executable: &'a [u8],
+    expected_artifact_sha256: String,
+    name: String,
+    version: String,
+    source_commit: String,
+    target: ReleaseTarget,
+    created: String,
+    // Rendered as `creationInfo.comment`; candidate documents state their gaps here.
+    document_comment: Option<String>,
+    components: Vec<Component>,
+    dependencies: Vec<Dependency>,
+}
+
+struct Component {
+    // The future owning adapter must derive this logical key from verified
+    // original source/package identities, excluding temporary checkout/vendor
+    // paths that can occur inside opaque Cargo IDs.
+    identity: String,
+    name: String,
+    version: Option<String>,
+    roles: Vec<ComponentRole>,
+    origin: Option<Origin>,
+    declared_license: Option<String>,
+}
+
+#[derive(Clone, Copy, Eq, Ord, PartialEq, PartialOrd)]
+enum ComponentRole {
+    ObservedRust,
+    RetainedJavascript,
+    ConservativeJavascript,
+    ObservedNative,
+    BuildMaterial,
+    BuildTool,
+    ExternalRuntime,
+}
+
+enum Origin {
+    NativeVerified {
+        original: native::NativeOriginal,
+    },
+    PlatformMeasuredFile {
+        role: String,
+        sha256: String,
+    },
+    JavascriptVerified {
+        source_commit: String,
+        original: javascript::JavascriptOriginal,
+        producer: Option<String>,
+    },
+    CargoMaterial {
+        source: String,
+        original: CargoOrigin,
+        prepared_manifest_sha256: String,
+    },
+
+    Source {
+        commit: String,
+        path: String,
+    },
+    Distribution {
+        location: String,
+        sha256: String,
+    },
+    StructuredTree {
+        sha256: String,
+    },
+    Generated {
+        producer: String,
+        sha256: String,
+    },
+    RuntimeObservation {
+        artifact_sha256: String,
+    },
+}
+
+struct Dependency {
+    from: String,
+    to: String,
+    build: bool,
+}
+
+const ROOT_ID: &str = "SPDXRef-Artifact";
+const DOCUMENT_ID: &str = "SPDXRef-DOCUMENT";
+
+fn plain(value: &str) -> Result<(), Report<ReleaseError>> {
+    if value.is_empty() || value.len() > 8192 || value.chars().any(char::is_control) {
+        return Err(spdx_error("SPDX input is not bounded plain text"));
+    }
+    Ok(())
+}
+
+fn relative_source(path: &str) -> Result<(), Report<ReleaseError>> {
+    plain(path)?;
+    if path.contains('\\')
+        || Path::new(path)
+            .components()
+            .collect::<PathBuf>()
+            .as_os_str()
+            != Path::new(path).as_os_str()
+        || Path::new(path)
+            .components()
+            .any(|component| !matches!(component, PathComponent::Normal(_)))
+    {
+        return Err(spdx_error("source origin path is not relative and normal"));
+    }
+    Ok(())
+}
+
+fn valid_created(value: &str) -> bool {
+    let bytes = value.as_bytes();
+    if bytes.len() != 20
+        || [4, 7, 10, 13, 16, 19]
+            .into_iter()
+            .zip(b"--T::Z")
+            .any(|(index, expected)| bytes[index] != *expected)
+        || bytes
+            .iter()
+            .enumerate()
+            .any(|(index, byte)| ![4, 7, 10, 13, 16, 19].contains(&index) && !byte.is_ascii_digit())
+    {
+        return false;
+    }
+    let number = |range| {
+        value
+            .get(range)
+            .and_then(|part: &str| part.parse::<u32>().ok())
+    };
+    let (Some(year), Some(month), Some(day), Some(hour), Some(minute), Some(second)) = (
+        number(0..4),
+        number(5..7),
+        number(8..10),
+        number(11..13),
+        number(14..16),
+        number(17..19),
+    ) else {
+        return false;
+    };
+    let leap = year % 4 == 0 && (year % 100 != 0 || year % 400 == 0);
+    let days = match month {
+        1 | 3 | 5 | 7 | 8 | 10 | 12 => 31,
+        4 | 6 | 9 | 11 => 30,
+        2 if leap => 29,
+        2 => 28,
+        _ => 0,
+    };
+    year != 0 && day != 0 && day <= days && hour < 24 && minute < 60 && second < 60
+}
+
+fn component_id(identity: &str) -> String {
+    format!(
+        "SPDXRef-Component-{}",
+        hex::encode(Sha256::digest(identity.as_bytes()))
+    )
+}
+
+fn license(declaration: Option<&str>) -> Result<(&'static str, String), Report<ReleaseError>> {
+    let Some(declaration) = declaration else {
+        return Ok((
+            "NOASSERTION",
+            "No declared license information or license conclusion is asserted.".to_owned(),
+        ));
+    };
+    plain(declaration)?;
+    let known = match declaration {
+        "MIT" => "MIT",
+        "Apache-2.0" => "Apache-2.0",
+        "MIT OR Apache-2.0" => "MIT OR Apache-2.0",
+        "Apache-2.0 OR MIT" => "Apache-2.0 OR MIT",
+        _ => {
+            return Ok((
+                "NOASSERTION",
+                format!(
+                    "Unrecognized observed declaration: {declaration}. No license conclusion is asserted."
+                ),
+            ));
+        }
+    };
+    Ok((
+        known,
+        "Exact reviewed declaration retained; no license conclusion is asserted.".to_owned(),
+    ))
+}
+
+type OriginFields = (String, String, Option<(&'static str, String)>);
+
+fn origin_fields(
+    component: &Component,
+    inputs: &SpdxInputs<'_>,
+) -> Result<OriginFields, Report<ReleaseError>> {
+    let origin = component
+        .origin
+        .as_ref()
+        .ok_or_else(|| spdx_error("component has no contributing origin"))?;
+    if component.roles.contains(&ComponentRole::ExternalRuntime)
+        != matches!(origin, Origin::RuntimeObservation { .. })
+        || component.roles.contains(&ComponentRole::ExternalRuntime) && component.roles.len() != 1
+    {
+        return Err(spdx_error(
+            "runtime requirements and contributing origins have incompatible roles",
+        ));
+    }
+    let unknown_location = "NOASSERTION".to_owned();
+    match origin {
+        Origin::NativeVerified { original } => native::origin_fields(component, original),
+        Origin::PlatformMeasuredFile { role, sha256 } => {
+            platform::file_origin_fields(component, role, sha256)
+        }
+        Origin::JavascriptVerified {
+            source_commit,
+            original,
+            producer,
+        } => javascript::origin_fields(
+            component,
+            inputs,
+            source_commit,
+            original,
+            producer.as_deref(),
+        ),
+        Origin::CargoMaterial {
+            source,
+            original,
+            prepared_manifest_sha256,
+        } => {
+            cargo::validate_material(source, original)?;
+            if !lower_hex(prepared_manifest_sha256, 64) {
+                return Err(spdx_error("prepared Cargo manifest SHA-256 is invalid"));
+            }
+            let facts = serde_json::to_string(&json!({"locked_source":source,"original":original,"prepared_manifest_sha256":prepared_manifest_sha256})).map_err(spdx_error)?;
+            plain(&facts)?;
+            let checksum = match original {
+                CargoOrigin::Registry { archive_sha256 } => {
+                    Some(("SHA256", archive_sha256.clone()))
+                }
+                CargoOrigin::Git { .. } => None,
+            };
+            let source_info = format!(
+                "Verified original Cargo facts {facts}; prepared manifest and Git object identities are provenance evidence, not raw package checksums."
+            );
+            plain(&source_info)?;
+            Ok((unknown_location, source_info, checksum))
+        }
+
+        Origin::Source { commit, path } => {
+            if !lower_hex(commit, 40) || commit != &inputs.source_commit {
+                return Err(spdx_error(
+                    "workspace source origin differs from the selected source",
+                ));
+            }
+            relative_source(path)?;
+            Ok((
+                unknown_location,
+                format!("Approved source commit {commit}; source-relative path {path}."),
+                None,
+            ))
+        }
+        Origin::Distribution { location, sha256 } => {
+            plain(location)?;
+            if !location.starts_with("https://") || !lower_hex(sha256, 64) {
+                return Err(spdx_error(
+                    "distribution has no bounded origin and raw archive digest",
+                ));
+            }
+            Ok((location.clone(),"Checksum identifies the original distribution archive, not the final executable or individual surviving functions.".to_owned(),Some(("SHA256", sha256.clone()))))
+        }
+        Origin::StructuredTree { sha256 } => {
+            if !lower_hex(sha256, 64)
+                || component.roles.iter().any(|role| {
+                    !matches!(
+                        role,
+                        ComponentRole::BuildMaterial | ComponentRole::BuildTool
+                    )
+                })
+            {
+                return Err(spdx_error(
+                    "structured tree evidence cannot replace a contributing original",
+                ));
+            }
+            Ok((
+                unknown_location,
+                format!(
+                    "Structured installed-tree evidence SHA-256 {sha256}; this is not a raw-file checksum or original acquisition provenance."
+                ),
+                None,
+            ))
+        }
+        Origin::Generated { producer, sha256 } => {
+            if !lower_hex(sha256, 64)
+                || !inputs.components.iter().any(|candidate| {
+                    candidate.identity == *producer
+                        && candidate.identity != component.identity
+                        && candidate.roles.contains(&ComponentRole::BuildTool)
+                })
+            {
+                return Err(spdx_error(
+                    "generated contributor has no known build-tool producer or byte digest",
+                ));
+            }
+            Ok((
+                unknown_location,
+                format!(
+                    "Observed generated module bytes before later transformations; producer identity {producer}."
+                ),
+                Some(("SHA256", sha256.clone())),
+            ))
+        }
+        Origin::RuntimeObservation { artifact_sha256 } => {
+            if artifact_sha256 != &inputs.expected_artifact_sha256 {
+                return Err(spdx_error(
+                    "runtime requirement belongs to another executable",
+                ));
+            }
+            Ok((unknown_location,"Logical requirement observed in accepted executable bytes; installed runtime identity and bytes are not asserted.".to_owned(),None))
+        }
+    }
+}
+
+fn component_package(
+    component: &Component,
+    inputs: &SpdxInputs<'_>,
+) -> Result<Value, Report<ReleaseError>> {
+    plain(&component.name)?;
+    let (declared, license_comment) = license(component.declared_license.as_deref())?;
+    let (download, source_info, checksum) = origin_fields(component, inputs)?;
+    let mut value = json!({"SPDXID":component_id(&component.identity),"name":component.name,"downloadLocation":download,"filesAnalyzed":false,"licenseDeclared":declared,"licenseConcluded":"NOASSERTION","licenseComments":license_comment,"copyrightText":"NOASSERTION","sourceInfo":source_info});
+    if let Some(version) = &component.version {
+        plain(version)?;
+        value["versionInfo"] = json!(version);
+    }
+    if let Some((algorithm, digest)) = checksum {
+        value["checksums"] = json!([{"algorithm":algorithm,"checksumValue":digest}]);
+    }
+    Ok(value)
+}
+
+fn render(inputs: &SpdxInputs<'_>) -> Result<GeneratedSpdx, Report<ReleaseError>> {
+    plain(&inputs.name)?;
+    plain(&inputs.version)?;
+    if inputs.executable.is_empty()
+        || inputs.executable.len() as u64 > Role::Executable.limit()
+        || !lower_hex(&inputs.expected_artifact_sha256, 64)
+        || hex::encode(Sha256::digest(inputs.executable)) != inputs.expected_artifact_sha256
+        || !lower_hex(&inputs.source_commit, 40)
+        || !valid_created(&inputs.created)
+        || inputs.components.len() > 16_384
+        || inputs.dependencies.len() > 65_536
+    {
+        return Err(spdx_error(
+            "SPDX root identity, timestamp or input bounds are invalid",
+        ));
+    }
+    let mut components = BTreeMap::new();
+    let mut identifiers = BTreeSet::from([ROOT_ID.to_owned(), DOCUMENT_ID.to_owned()]);
+    for component in &inputs.components {
+        plain(&component.identity)?;
+        if component.roles.is_empty()
+            || component.roles.iter().collect::<BTreeSet<_>>().len() != component.roles.len()
+        {
+            return Err(spdx_error("component roles must be nonempty and unique"));
+        }
+        if components
+            .insert(component.identity.as_str(), component)
+            .is_some()
+            || !identifiers.insert(component_id(&component.identity))
+        {
+            return Err(spdx_error(
+                "duplicate component identity or SPDX identifier",
+            ));
+        }
+    }
+    let mut packages = vec![
+        json!({"SPDXID":ROOT_ID,"name":inputs.name,"versionInfo":inputs.version,"downloadLocation":"NOASSERTION","filesAnalyzed":false,"licenseDeclared":"NOASSERTION","licenseConcluded":"NOASSERTION","copyrightText":"NOASSERTION","checksums":[{"algorithm":"SHA256","checksumValue":inputs.expected_artifact_sha256}],"sourceInfo":format!("Final executable for {}; approved source commit {}.",inputs.target.triple(),inputs.source_commit)}),
+    ];
+    let mut relationships = BTreeSet::new();
+    relationships.insert((
+        DOCUMENT_ID.to_owned(),
+        "DESCRIBES",
+        ROOT_ID.to_owned(),
+        "Selected final executable.",
+    ));
+    for component in components.values() {
+        packages.push(component_package(component, inputs)?);
+        let id = component_id(&component.identity);
+        for role in &component.roles {
+            let (from, kind, to, comment) = match role {
+                ComponentRole::ObservedRust | ComponentRole::ObservedNative => (
+                    ROOT_ID.to_owned(),
+                    "GENERATED_FROM",
+                    id.clone(),
+                    "Conservative observed compilation input; final function reachability is not asserted.",
+                ),
+                ComponentRole::RetainedJavascript => (
+                    ROOT_ID.to_owned(),
+                    "CONTAINS",
+                    id.clone(),
+                    "Complete module bytes observed in final executable; function reachability is not asserted.",
+                ),
+                ComponentRole::ConservativeJavascript => (
+                    ROOT_ID.to_owned(),
+                    "GENERATED_FROM",
+                    id.clone(),
+                    "Conservative post-Rollup rendered input before esbuild minification; final function reachability is not asserted.",
+                ),
+                ComponentRole::BuildMaterial => (
+                    id.clone(),
+                    "BUILD_DEPENDENCY_OF",
+                    ROOT_ID.to_owned(),
+                    "Prepared build input; final executable retention is not asserted.",
+                ),
+                ComponentRole::BuildTool => (
+                    id.clone(),
+                    "BUILD_TOOL_OF",
+                    ROOT_ID.to_owned(),
+                    "Build tool input; executable embedding and original acquisition are not asserted.",
+                ),
+                ComponentRole::ExternalRuntime => (
+                    id.clone(),
+                    "RUNTIME_DEPENDENCY_OF",
+                    ROOT_ID.to_owned(),
+                    "Logical external runtime requirement; runtime bytes are not embedded component evidence.",
+                ),
+            };
+            relationships.insert((from, kind, to, comment));
+        }
+        if let Some(
+            Origin::Generated { producer, .. }
+            | Origin::JavascriptVerified {
+                producer: Some(producer),
+                ..
+            },
+        ) = &component.origin
+        {
+            relationships.insert((
+                component_id(producer),
+                "GENERATES",
+                component_id(&component.identity),
+                "Observed producer of generated module bytes before later transformations.",
+            ));
+        }
+    }
+    let mut dependency_keys = BTreeSet::new();
+    for dependency in &inputs.dependencies {
+        if !components.contains_key(dependency.from.as_str())
+            || !components.contains_key(dependency.to.as_str())
+            || dependency.from == dependency.to
+            || !dependency_keys.insert((&dependency.from, &dependency.to, dependency.build))
+        {
+            return Err(spdx_error(
+                "dependency is duplicated, self-referential or dangling",
+            ));
+        }
+        let (from, kind, to) = if dependency.build {
+            (
+                component_id(&dependency.to),
+                "BUILD_DEPENDENCY_OF",
+                component_id(&dependency.from),
+            )
+        } else {
+            (
+                component_id(&dependency.from),
+                "DEPENDS_ON",
+                component_id(&dependency.to),
+            )
+        };
+        relationships.insert((
+            from,
+            kind,
+            to,
+            "Potential Cargo package relation between observed endpoints; exact compiler unit dependency DAG is not asserted.",
+        ));
+    }
+    let relationships:Vec<_> = relationships.into_iter().map(|(from,kind,to,comment)| json!({"spdxElementId":from,"relationshipType":kind,"relatedSpdxElement":to,"comment":comment})).collect();
+    let mut document = json!({"SPDXID":DOCUMENT_ID,"spdxVersion":"SPDX-2.3","dataLicense":"CC0-1.0","name":format!("{} {} composition",inputs.name,inputs.version),"creationInfo":{"created":inputs.created,"creators":[format!("Tool: trusted-server-release-{}",env!("CARGO_PKG_VERSION"))]},"documentDescribes":[ROOT_ID],"packages":packages,"relationships":relationships});
+    if let Some(comment) = &inputs.document_comment {
+        plain(comment)?;
+        document["creationInfo"]["comment"] = json!(comment);
+    }
+    let semantic_bytes = canonical_json(&document, Role::Spdx)
+        .map_err(|error| error.change_context(ReleaseError::Spdx))?;
+    document["documentNamespace"] = json!(format!(
+        "https://spdx.org/spdxdocs/trusted-server-{}",
+        hex::encode(Sha256::digest(&semantic_bytes))
+    ));
+    validate_spdx(&document).map_err(|error| error.change_context(ReleaseError::Spdx))?;
+    let bytes = canonical_json(&document, Role::Spdx)
+        .map_err(|error| error.change_context(ReleaseError::Spdx))?;
+    let sha256 = hex::encode(Sha256::digest(&bytes));
+    Ok(GeneratedSpdx { bytes, sha256 })
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/trusted-server-release/src/spdx/candidate.rs b/crates/trusted-server-release/src/spdx/candidate.rs
new file mode 100644
index 0000000000..f8c195c51e
--- /dev/null
+++ b/crates/trusted-server-release/src/spdx/candidate.rs
@@ -0,0 +1,331 @@
+//! Unqualified candidate whole-document SPDX that states its coverage gaps.
+//!
+//! The closed [`super::generate_from_completed`] path stays closed: a
+//! [`CandidateSpdx`] is never converted into a [`super::GeneratedSpdx`]. Its
+//! creation comment names the document a candidate and lists every recorded
+//! coverage gap, so it grants no signing, publication or qualification
+//! authority.
+
+use std::collections::BTreeSet;
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256};
+
+use super::cargo::CargoProjection;
+use super::javascript::JavascriptProjection;
+use super::native::NativeProjection;
+use super::platform::PlatformProjection;
+use super::{Component, Dependency, SpdxInputs, lower_hex, plain, render, spdx_error};
+use crate::composition::CompositionView;
+use crate::composition::origin::Original;
+use crate::documents::Role;
+use crate::error::ReleaseError;
+use crate::recipe::RecipeCompleted;
+use crate::source::ApprovedSource;
+
+#[cfg(test)]
+mod tests;
+
+const SECONDS_PER_DAY: u64 = 86_400;
+const LAST_FOUR_DIGIT_YEAR: u64 = 9_999;
+const MAX_ROOT_VERSION_LENGTH: usize = 128;
+
+/// Validated bounded candidate SPDX bytes with their explicit coverage gaps.
+///
+/// This type has no conversion into [`super::GeneratedSpdx`] and carries no
+/// release-authorization capability.
+#[derive(Debug)]
+pub(crate) struct CandidateSpdx {
+    bytes: Vec<u8>,
+    sha256: String,
+    gaps: Vec<String>,
+}
+
+impl CandidateSpdx {
+    /// The exact serialized candidate SPDX document bytes.
+    pub(crate) fn bytes(&self) -> &[u8] {
+        &self.bytes
+    }
+
+    /// SHA-256 of the exact document bytes, distinct from its executable root.
+    pub(crate) fn sha256(&self) -> &str {
+        &self.sha256
+    }
+
+    /// Sorted, unique coverage gaps stated in the document's creation comment.
+    pub(crate) fn gaps(&self) -> &[String] {
+        &self.gaps
+    }
+}
+
+/// Renders a gap-bearing candidate document for one completed build.
+///
+/// All four projections must come from the same sealed composition receipt,
+/// and the root package must be the policy asset's workspace package at the
+/// approved commit.
+///
+/// # Errors
+///
+/// Rejects another approved source, missing or changed composition receipts,
+/// a platform projection over another receipt, an unverified root package,
+/// overlapping or dangling projected parts, an empty required part, a
+/// gap-free candidate, an unrepresentable creation time, changed final bytes
+/// or a document beyond the SPDX size limit.
+pub(crate) fn candidate_from_completed(
+    completed: &RecipeCompleted,
+    source: &ApprovedSource,
+) -> Result<CandidateSpdx, Report<ReleaseError>> {
+    if source.commit() != completed.commit() {
+        return Err(spdx_error(
+            "approved source differs from the completed build commit",
+        ));
+    }
+    let created = spdx_created(source.epoch())?;
+    let view = completed.composition_view()?;
+    let rust = CargoProjection::from_completed(completed)?;
+    let native = NativeProjection::from_completed(completed)?;
+    let javascript = JavascriptProjection::from_completed(completed)?;
+    let platform = PlatformProjection::from_completed(completed)?;
+    if platform.receipt_sha256() != view.receipt_sha256() {
+        return Err(spdx_error(
+            "platform projection belongs to another composition receipt",
+        ));
+    }
+    let version = root_version(completed, &view)?;
+    let gaps = platform.coverage_gaps();
+    let (components, dependencies) = merge_parts(CandidateParts {
+        rust: rust.into_parts(),
+        native: native.into_parts(),
+        javascript: javascript.into_parts(),
+        platform: platform.into_parts(),
+    })?;
+    let executable = completed.read_final_bytes()?;
+    let artifact = completed.asset().artifact();
+    let inputs = SpdxInputs {
+        executable: &executable,
+        expected_artifact_sha256: completed.artifact().sha256().to_owned(),
+        name: artifact.name.to_owned(),
+        version,
+        source_commit: completed.commit().as_str().to_owned(),
+        target: artifact.target,
+        created,
+        document_comment: None,
+        components,
+        dependencies,
+    };
+    render_candidate(inputs, gaps)
+}
+
+/// Formats `SOURCE_DATE_EPOCH` as an SPDX `created` UTC timestamp.
+///
+/// Uses proleptic Gregorian civil-date arithmetic for days since 1970-01-01.
+fn spdx_created(epoch: u64) -> Result<String, Report<ReleaseError>> {
+    let days = epoch / SECONDS_PER_DAY;
+    let seconds_of_day = epoch % SECONDS_PER_DAY;
+    let shifted = days
+        .checked_add(719_468)
+        .ok_or_else(|| spdx_error("source epoch exceeds the SPDX timestamp range"))?;
+    let era = shifted / 146_097;
+    let day_of_era = shifted % 146_097;
+    let year_of_era =
+        (day_of_era - day_of_era / 1_460 + day_of_era / 36_524 - day_of_era / 146_096) / 365;
+    let day_of_year = day_of_era - (365 * year_of_era + year_of_era / 4 - year_of_era / 100);
+    let shifted_month = (5 * day_of_year + 2) / 153;
+    let day = day_of_year - (153 * shifted_month + 2) / 5 + 1;
+    let month = if shifted_month < 10 {
+        shifted_month + 3
+    } else {
+        shifted_month - 9
+    };
+    let year = era * 400 + year_of_era + u64::from(month <= 2);
+    if year > LAST_FOUR_DIGIT_YEAR {
+        return Err(spdx_error(
+            "source epoch is beyond the four-digit SPDX year range",
+        ));
+    }
+    Ok(format!(
+        "{year:04}-{month:02}-{day:02}T{:02}:{:02}:{:02}Z",
+        seconds_of_day / 3_600,
+        seconds_of_day % 3_600 / 60,
+        seconds_of_day % 60
+    ))
+}
+
+/// Pure facts joining the policy asset package to its verified original.
+struct RootIdentityInputs<'a> {
+    asset_package: &'a str,
+    observed_name: &'a str,
+    observed_version: &'a str,
+    origin_name: &'a str,
+    origin_version: &'a str,
+    original: &'a Original,
+    source_commit: &'a str,
+}
+
+/// Returns the root version when the asset package is the approved workspace package.
+fn checked_root_version(inputs: &RootIdentityInputs<'_>) -> Result<String, Report<ReleaseError>> {
+    plain(inputs.asset_package)?;
+    if inputs.asset_package.contains(['/', '\\'])
+        || !lower_hex(inputs.source_commit, 40)
+        || inputs.observed_name != inputs.asset_package
+        || inputs.origin_name != inputs.asset_package
+        || inputs.origin_version != inputs.observed_version
+        || inputs.observed_version.is_empty()
+        || inputs.observed_version.len() > MAX_ROOT_VERSION_LENGTH
+        || inputs
+            .observed_version
+            .chars()
+            .any(|character| character.is_control() || character.is_whitespace())
+    {
+        return Err(spdx_error(
+            "candidate root is not the verified policy asset package version",
+        ));
+    }
+    let expected_manifest = format!("crates/{}/Cargo.toml", inputs.asset_package);
+    match inputs.original {
+        Original::Workspace {
+            source_commit,
+            path,
+        } if source_commit == inputs.source_commit
+            && path.to_str() == Some(expected_manifest.as_str()) =>
+        {
+            Ok(inputs.observed_version.to_owned())
+        }
+        _ => Err(spdx_error(
+            "candidate root has no matching approved workspace origin",
+        )),
+    }
+}
+
+/// Joins the selected Cargo package to the policy asset through its verified original.
+fn root_version(
+    completed: &RecipeCompleted,
+    view: &CompositionView<'_>,
+) -> Result<String, Report<ReleaseError>> {
+    let id = view.graph().selected_package_id();
+    let mut packages = view
+        .observations()
+        .packages()
+        .iter()
+        .filter(|package| package.id() == id);
+    let package = packages
+        .next()
+        .ok_or_else(|| spdx_error("candidate has no selected root package"))?;
+    if packages.next().is_some() {
+        return Err(spdx_error("candidate selected root package is ambiguous"));
+    }
+    let origin = view
+        .package_origins()
+        .package(id)
+        .ok_or_else(|| spdx_error("candidate selected root package has no verified origin"))?;
+    checked_root_version(&RootIdentityInputs {
+        asset_package: completed.asset().artifact().package,
+        observed_name: package.name(),
+        observed_version: package.version(),
+        origin_name: origin.name(),
+        origin_version: origin.version(),
+        original: origin.origin(),
+        source_commit: completed.commit().as_str(),
+    })
+}
+
+type ProjectedPart = (Vec<Component>, Vec<Dependency>);
+
+/// The four adapter projections of one sealed composition receipt.
+struct CandidateParts {
+    rust: ProjectedPart,
+    native: ProjectedPart,
+    javascript: ProjectedPart,
+    platform: ProjectedPart,
+}
+
+/// Concatenates disjoint parts whose edges stay inside their own part.
+///
+/// Native may be empty (an artifact can have no native contributors); Rust,
+/// JavaScript and platform parts may not.
+fn merge_parts(parts: CandidateParts) -> Result<ProjectedPart, Report<ReleaseError>> {
+    let CandidateParts {
+        rust,
+        native,
+        javascript,
+        platform,
+    } = parts;
+    let mut identities = BTreeSet::new();
+    let mut components = Vec::new();
+    let mut dependencies = Vec::new();
+    for (label, required, (part_components, part_dependencies)) in [
+        ("Rust", true, rust),
+        ("native", false, native),
+        ("JavaScript", true, javascript),
+        ("platform", true, platform),
+    ] {
+        if required && part_components.is_empty() {
+            return Err(spdx_error(format!("candidate {label} projection is empty")));
+        }
+        let local = part_components
+            .iter()
+            .map(|component| component.identity.as_str())
+            .collect::<BTreeSet<_>>();
+        if local.len() != part_components.len()
+            || part_dependencies.iter().any(|dependency| {
+                !local.contains(dependency.from.as_str()) || !local.contains(dependency.to.as_str())
+            })
+        {
+            return Err(spdx_error(format!(
+                "candidate {label} projection repeats an identity or has a dangling edge"
+            )));
+        }
+        for component in &part_components {
+            if !identities.insert(component.identity.clone()) {
+                return Err(spdx_error(format!(
+                    "candidate {label} projection repeats another adapter's identity"
+                )));
+            }
+        }
+        components.extend(part_components);
+        dependencies.extend(part_dependencies);
+    }
+    Ok((components, dependencies))
+}
+
+/// Renders validated inputs with a creation comment naming every gap.
+fn render_candidate(
+    mut inputs: SpdxInputs<'_>,
+    gaps: Vec<String>,
+) -> Result<CandidateSpdx, Report<ReleaseError>> {
+    let gaps = gaps
+        .into_iter()
+        .collect::<BTreeSet<_>>()
+        .into_iter()
+        .collect::<Vec<_>>();
+    if gaps.is_empty() {
+        return Err(spdx_error(
+            "candidate SPDX requires at least one stated coverage gap",
+        ));
+    }
+    for gap in &gaps {
+        plain(gap)?;
+    }
+    inputs.document_comment = Some(format!(
+        "Unqualified candidate composition document; not a complete SBOM and grants no signing, publication or qualification authority. Known coverage gaps: {}.",
+        gaps.join(", ")
+    ));
+    let generated = render(&inputs)?;
+    bounded_candidate(generated.bytes, gaps)
+}
+
+/// Wraps rendered bytes after enforcing the SPDX document size limit.
+fn bounded_candidate(
+    bytes: Vec<u8>,
+    gaps: Vec<String>,
+) -> Result<CandidateSpdx, Report<ReleaseError>> {
+    if bytes.is_empty() || bytes.len() as u64 > Role::Spdx.limit() {
+        return Err(spdx_error("candidate SPDX bytes exceed the document limit"));
+    }
+    let sha256 = hex::encode(Sha256::digest(&bytes));
+    Ok(CandidateSpdx {
+        bytes,
+        sha256,
+        gaps,
+    })
+}
diff --git a/crates/trusted-server-release/src/spdx/candidate/tests.rs b/crates/trusted-server-release/src/spdx/candidate/tests.rs
new file mode 100644
index 0000000000..53aff3cd90
--- /dev/null
+++ b/crates/trusted-server-release/src/spdx/candidate/tests.rs
@@ -0,0 +1,403 @@
+use std::path::PathBuf;
+
+use serde_json::{Value, json};
+use sha2::Sha256;
+
+use super::*;
+use crate::spdx::{ComponentRole, Origin, valid_created};
+
+const EXECUTABLE: &[u8] = b"fictional candidate executable bytes";
+const COMMIT: &str = "1111111111111111111111111111111111111111";
+const ROOT_PACKAGE: &str = "example-adapter";
+
+// ---- Step 1: SPDX creation timestamps from SOURCE_DATE_EPOCH ----
+
+#[test]
+fn spdx_created_renders_the_unix_epoch_start() {
+    let created = spdx_created(0).expect("should render the Unix epoch start");
+    assert_eq!(
+        created, "1970-01-01T00:00:00Z",
+        "should render epoch zero as midnight on 1970-01-01"
+    );
+    assert!(
+        valid_created(&created),
+        "should satisfy the renderer timestamp check"
+    );
+}
+
+#[test]
+fn spdx_created_skips_february_29_in_a_non_leap_century() {
+    assert_eq!(
+        spdx_created(4_107_456_000).expect("should render the last February day of 2100"),
+        "2100-02-28T00:00:00Z",
+        "should keep 2100-02-28"
+    );
+    assert_eq!(
+        spdx_created(4_107_542_400).expect("should render the following day"),
+        "2100-03-01T00:00:00Z",
+        "should honour the 100-year non-leap rule"
+    );
+}
+
+#[test]
+fn spdx_created_renders_a_leap_day() {
+    let created = spdx_created(951_782_400).expect("should render a leap day");
+    assert_eq!(
+        created, "2000-02-29T00:00:00Z",
+        "should honour the 400-year leap rule"
+    );
+    assert!(
+        valid_created(&created),
+        "should satisfy the renderer timestamp check"
+    );
+}
+
+#[test]
+fn spdx_created_renders_time_of_day_and_the_last_four_digit_second() {
+    let afternoon = spdx_created(1_700_000_000).expect("should render a time of day");
+    assert_eq!(
+        afternoon, "2023-11-14T22:13:20Z",
+        "should render hours, minutes and seconds"
+    );
+    let last = spdx_created(253_402_300_799).expect("should render the last four-digit second");
+    assert_eq!(
+        last, "9999-12-31T23:59:59Z",
+        "should render the final representable second"
+    );
+    for created in [afternoon, last] {
+        assert!(
+            valid_created(&created),
+            "should satisfy the renderer timestamp check"
+        );
+    }
+}
+
+#[test]
+fn spdx_created_rejects_years_beyond_four_digits() {
+    for epoch in [253_402_300_800, u64::MAX] {
+        assert!(
+            spdx_created(epoch).is_err(),
+            "should reject epoch {epoch} past year 9999"
+        );
+    }
+}
+
+// ---- Step 2: root identity from the policy asset package ----
+
+fn workspace_original(path: &str) -> Original {
+    Original::Workspace {
+        source_commit: COMMIT.to_owned(),
+        path: PathBuf::from(path),
+    }
+}
+
+fn root_inputs(original: &Original) -> RootIdentityInputs<'_> {
+    RootIdentityInputs {
+        asset_package: ROOT_PACKAGE,
+        observed_name: ROOT_PACKAGE,
+        observed_version: "1.2.3",
+        origin_name: ROOT_PACKAGE,
+        origin_version: "1.2.3",
+        original,
+        source_commit: COMMIT,
+    }
+}
+
+#[test]
+fn root_identity_accepts_the_asset_package_workspace_origin() {
+    let original = workspace_original("crates/example-adapter/Cargo.toml");
+    let version = checked_root_version(&root_inputs(&original))
+        .expect("should accept the asset package's workspace origin");
+    assert_eq!(version, "1.2.3", "should return the verified version");
+}
+
+#[test]
+fn root_identity_rejects_a_registry_origin() {
+    let original = Original::Material {
+        source: "registry+https://example.com/index".to_owned(),
+        original: crate::materials::CargoOrigin::Registry {
+            archive_sha256: "a".repeat(64),
+        },
+    };
+    assert!(
+        checked_root_version(&root_inputs(&original)).is_err(),
+        "should reject a root package that resolves to a registry original"
+    );
+}
+
+#[test]
+fn root_identity_rejects_another_manifest_path_or_commit() {
+    for path in [
+        "crates/another-adapter/Cargo.toml",
+        "crates/example-adapter/sub/Cargo.toml",
+        "Cargo.toml",
+    ] {
+        let original = workspace_original(path);
+        assert!(
+            checked_root_version(&root_inputs(&original)).is_err(),
+            "should reject workspace manifest {path}"
+        );
+    }
+    let original = Original::Workspace {
+        source_commit: "2".repeat(40),
+        path: PathBuf::from("crates/example-adapter/Cargo.toml"),
+    };
+    assert!(
+        checked_root_version(&root_inputs(&original)).is_err(),
+        "should reject a workspace origin at another commit"
+    );
+}
+
+#[test]
+fn root_identity_rejects_name_or_version_mismatches() {
+    let original = workspace_original("crates/example-adapter/Cargo.toml");
+    let mut version_mismatch = root_inputs(&original);
+    version_mismatch.origin_version = "1.2.4";
+    let mut name_mismatch = root_inputs(&original);
+    name_mismatch.observed_name = "another-adapter";
+    let mut origin_name_mismatch = root_inputs(&original);
+    origin_name_mismatch.origin_name = "another-adapter";
+    let mut empty_version = root_inputs(&original);
+    empty_version.observed_version = "";
+    empty_version.origin_version = "";
+    for (label, inputs) in [
+        ("version", version_mismatch),
+        ("observed name", name_mismatch),
+        ("origin name", origin_name_mismatch),
+        ("empty version", empty_version),
+    ] {
+        assert!(
+            checked_root_version(&inputs).is_err(),
+            "should reject a root {label} mismatch"
+        );
+    }
+}
+
+// ---- Step 3: merging the four projected parts ----
+
+fn source_component(identity: &str, role: ComponentRole) -> Component {
+    Component {
+        identity: identity.to_owned(),
+        name: identity.to_owned(),
+        version: Some("1.0.0".to_owned()),
+        roles: vec![role],
+        origin: Some(Origin::Source {
+            commit: COMMIT.to_owned(),
+            path: "crates/example-adapter/Cargo.toml".to_owned(),
+        }),
+        declared_license: None,
+    }
+}
+
+fn tool_component(identity: &str) -> Component {
+    Component {
+        identity: identity.to_owned(),
+        name: identity.to_owned(),
+        version: None,
+        roles: vec![ComponentRole::BuildTool],
+        origin: Some(Origin::StructuredTree {
+            sha256: "d".repeat(64),
+        }),
+        declared_license: None,
+    }
+}
+
+fn edge(from: &str, to: &str) -> Dependency {
+    Dependency {
+        from: from.to_owned(),
+        to: to.to_owned(),
+        build: false,
+    }
+}
+
+fn parts() -> CandidateParts {
+    CandidateParts {
+        rust: (
+            vec![
+                source_component("rust:root", ComponentRole::ObservedRust),
+                source_component("rust:dependency", ComponentRole::ObservedRust),
+            ],
+            vec![edge("rust:root", "rust:dependency")],
+        ),
+        native: (Vec::new(), Vec::new()),
+        javascript: (
+            vec![source_component(
+                "js:core",
+                ComponentRole::RetainedJavascript,
+            )],
+            Vec::new(),
+        ),
+        platform: (vec![tool_component("platform:rust-tree")], Vec::new()),
+    }
+}
+
+#[test]
+fn merge_counts_equal_the_sum_of_the_parts() {
+    let (components, dependencies) = merge_parts(parts()).expect("should merge disjoint parts");
+    assert_eq!(components.len(), 4, "should keep every projected component");
+    assert_eq!(dependencies.len(), 1, "should keep every projected edge");
+}
+
+#[test]
+fn merge_rejects_a_cross_adapter_duplicate_identity() {
+    let mut duplicated = parts();
+    duplicated
+        .platform
+        .0
+        .push(source_component("js:core", ComponentRole::BuildMaterial));
+    assert!(
+        merge_parts(duplicated).is_err(),
+        "should reject one identity projected by two adapters"
+    );
+}
+
+#[test]
+fn merge_rejects_edges_that_dangle_or_cross_parts() {
+    let mut dangling = parts();
+    dangling.rust.1.push(edge("rust:root", "rust:absent"));
+    assert!(
+        merge_parts(dangling).is_err(),
+        "should reject an edge to an absent component"
+    );
+    let mut crossing = parts();
+    crossing.rust.1.push(edge("rust:root", "js:core"));
+    assert!(
+        merge_parts(crossing).is_err(),
+        "should reject an edge whose endpoint belongs to another part"
+    );
+}
+
+#[test]
+fn merge_rejects_an_empty_required_part() {
+    for label in ["rust", "javascript", "platform"] {
+        let mut missing = parts();
+        match label {
+            "rust" => missing.rust = (Vec::new(), Vec::new()),
+            "javascript" => missing.javascript = (Vec::new(), Vec::new()),
+            "platform" => missing.platform = (Vec::new(), Vec::new()),
+            _ => unreachable!("should select a required part"),
+        }
+        assert!(
+            merge_parts(missing).is_err(),
+            "should reject an empty {label} part"
+        );
+    }
+}
+
+// ---- Step 4: gap-bearing candidate rendering ----
+
+fn candidate_inputs() -> SpdxInputs<'static> {
+    let (components, dependencies) = merge_parts(parts()).expect("should merge fixture parts");
+    SpdxInputs {
+        executable: EXECUTABLE,
+        expected_artifact_sha256: hex::encode(Sha256::digest(EXECUTABLE)),
+        name: "example-adapter.wasm".to_owned(),
+        version: "1.2.3".to_owned(),
+        source_commit: COMMIT.to_owned(),
+        target: crate::policy::ReleaseTarget::Wasm32Wasip1,
+        created: "2026-01-01T00:00:00Z".to_owned(),
+        document_comment: None,
+        components,
+        dependencies,
+    }
+}
+
+fn gaps(names: &[&str]) -> Vec<String> {
+    names.iter().map(|name| (*name).to_owned()).collect()
+}
+
+#[test]
+fn candidate_rendering_rejects_an_empty_gap_list() {
+    assert!(
+        render_candidate(candidate_inputs(), Vec::new()).is_err(),
+        "should never present a gap-free candidate as complete"
+    );
+}
+
+#[test]
+fn candidate_rendering_rejects_an_unplain_gap() {
+    for gap in ["", "line\nbreak"] {
+        assert!(
+            render_candidate(candidate_inputs(), gaps(&[gap])).is_err(),
+            "should reject gap {gap:?}"
+        );
+    }
+}
+
+#[test]
+fn candidate_comment_names_the_candidate_and_lists_sorted_unique_gaps() {
+    let candidate = render_candidate(
+        candidate_inputs(),
+        gaps(&["zeta-gap", "alpha-gap", "zeta-gap"]),
+    )
+    .expect("should render a gap-bearing candidate");
+    assert_eq!(
+        candidate.gaps(),
+        ["alpha-gap", "zeta-gap"],
+        "should retain sorted unique gaps"
+    );
+    let document: Value =
+        serde_json::from_slice(candidate.bytes()).expect("should parse candidate bytes");
+    let comment = document["creationInfo"]["comment"]
+        .as_str()
+        .expect("should carry a creation comment");
+    assert!(
+        comment.contains("candidate"),
+        "should name the document a candidate"
+    );
+    let alpha = comment
+        .find("alpha-gap")
+        .expect("should list the first gap");
+    let zeta = comment
+        .find("zeta-gap")
+        .expect("should list the second gap");
+    assert!(alpha < zeta, "should list gaps in sorted order");
+    assert_eq!(
+        comment.matches("zeta-gap").count(),
+        1,
+        "should list each gap once"
+    );
+}
+
+#[test]
+fn candidate_document_validates_and_binds_root_and_document_digests() {
+    let inputs = candidate_inputs();
+    let artifact_sha256 = inputs.expected_artifact_sha256.clone();
+    let candidate = render_candidate(inputs, gaps(&["native-material-coverage-incomplete"]))
+        .expect("should render a gap-bearing candidate");
+    let document: Value =
+        serde_json::from_slice(candidate.bytes()).expect("should parse candidate bytes");
+    crate::documents::validate_spdx(&document).expect("should satisfy the pinned SPDX schema");
+    let root = document["packages"]
+        .as_array()
+        .expect("should contain packages")
+        .iter()
+        .find(|package| package["SPDXID"] == "SPDXRef-Artifact")
+        .expect("should contain the executable root");
+    assert_eq!(
+        root["checksums"],
+        json!([{"algorithm":"SHA256","checksumValue":artifact_sha256}]),
+        "should bind the root to the artifact SHA-256"
+    );
+    assert_eq!(
+        candidate.sha256(),
+        hex::encode(Sha256::digest(candidate.bytes())),
+        "should hash the exact document bytes"
+    );
+}
+
+#[test]
+fn candidate_bounds_reject_documents_over_sixteen_mebibytes() {
+    let limit = usize::try_from(Role::Spdx.limit()).expect("should fit the SPDX limit in usize");
+    assert!(
+        bounded_candidate(vec![b' '; limit + 1], gaps(&["example-gap"])).is_err(),
+        "should reject a document past the SPDX limit"
+    );
+    let bounded = bounded_candidate(b"{}\n".to_vec(), gaps(&["example-gap"]))
+        .expect("should accept a small document");
+    assert_eq!(
+        bounded.sha256(),
+        hex::encode(Sha256::digest(b"{}\n")),
+        "should hash accepted bytes"
+    );
+}
diff --git a/crates/trusted-server-release/src/spdx/cargo.rs b/crates/trusted-server-release/src/spdx/cargo.rs
new file mode 100644
index 0000000000..12d1adcceb
--- /dev/null
+++ b/crates/trusted-server-release/src/spdx/cargo.rs
@@ -0,0 +1,412 @@
+//! Conservative projection of verified observed Cargo packages.
+//!
+//! This adapter preserves borrowed sealed unit observations separately from
+//! package roles and potential package relationships. It grants no complete
+//! composition, qualification, signing or publication authority.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use error_stack::Report;
+use serde_json::json;
+
+use crate::composition::graph::GraphEvidence;
+use crate::composition::origin::{Original, VerifiedPackageOrigins};
+use crate::composition::{CargoObservations, CompositionView, RustPackage, UnitContext};
+use crate::error::ReleaseError;
+use crate::materials::{CargoOrigin, GitSourceConfig};
+use crate::recipe::RecipeCompleted;
+
+use super::{
+    Component, ComponentRole, Dependency, Origin, lower_hex, plain, relative_source, spdx_error,
+};
+
+/// Renderer-ready observed Rust packages, retaining their sealed unit evidence.
+///
+/// Native/tool completeness and complete SPDX generation remain unavailable.
+pub(crate) struct CargoProjection<'a> {
+    view: CompositionView<'a>,
+    components: Vec<Component>,
+    dependencies: Vec<Dependency>,
+}
+
+impl<'a> CargoProjection<'a> {
+    /// Projects exact observed package IDs after checking the completed owner.
+    ///
+    /// # Errors
+    ///
+    /// Rejects changed receipts, mismatched source/material identities, missing
+    /// origins, ambiguous package identities and unsupported compiler contexts.
+    pub(crate) fn from_completed(
+        completed: &'a RecipeCompleted,
+    ) -> Result<Self, Report<ReleaseError>> {
+        let view = completed.composition_view()?;
+        let origins = view.package_origins();
+        if origins.source_commit() != completed.commit().as_str()
+            || !lower_hex(origins.source_commit(), 40)
+            || origins.materials_sha256() != completed.materials_digest()
+            || !lower_hex(origins.materials_sha256(), 64)
+        {
+            return Err(spdx_error(
+                "Cargo originals belong to another source or material tree",
+            ));
+        }
+        let (components, dependencies) = project(view.observations(), view.graph(), origins)?;
+        Ok(Self {
+            view,
+            components,
+            dependencies,
+        })
+    }
+
+    /// Returns the number of verified observed package components.
+    pub(crate) fn component_count(&self) -> usize {
+        self.components.len()
+    }
+
+    /// Returns borrowed sealed units with their original contexts and features.
+    pub(crate) fn observations(&self) -> &CargoObservations {
+        self.view.observations()
+    }
+
+    /// Releases the renderer components and potential package relations.
+    pub(super) fn into_parts(self) -> (Vec<Component>, Vec<Dependency>) {
+        (self.components, self.dependencies)
+    }
+}
+
+fn project(
+    observed: &CargoObservations,
+    graph: &GraphEvidence,
+    origins: &VerifiedPackageOrigins,
+) -> Result<(Vec<Component>, Vec<Dependency>), Report<ReleaseError>> {
+    let mut identities = BTreeMap::new();
+    let mut stable = BTreeSet::new();
+    let mut components = Vec::new();
+    let observed_ids = observed
+        .packages()
+        .iter()
+        .map(RustPackage::id)
+        .collect::<BTreeSet<_>>();
+    if observed_ids.len() != observed.packages().len()
+        || observed_ids
+            != graph
+                .observed_package_ids()
+                .iter()
+                .map(String::as_str)
+                .collect()
+        || !observed_ids.contains(graph.selected_package_id())
+        || observed
+            .units()
+            .iter()
+            .any(|unit| !observed_ids.contains(unit.package_id()))
+    {
+        return Err(spdx_error(
+            "Cargo package, unit and graph observations disagree",
+        ));
+    }
+    for package in observed.packages() {
+        let verified = origins
+            .package(package.id())
+            .ok_or_else(|| spdx_error("observed Cargo ID has no verified original"))?;
+        if package.name() != verified.name()
+            || package.version() != verified.version()
+            || !lower_hex(verified.prepared_manifest_sha256(), 64)
+        {
+            return Err(spdx_error(
+                "observed package facts conflict with verified original",
+            ));
+        }
+        let (identity, origin) = match verified.origin() {
+            Original::Workspace {
+                source_commit,
+                path,
+            } => {
+                let path = path
+                    .to_str()
+                    .ok_or_else(|| spdx_error("tracked manifest is not UTF-8"))?;
+                if source_commit != origins.source_commit()
+                    || verified.relative_manifest_path() != std::path::Path::new(path)
+                {
+                    return Err(spdx_error(
+                        "workspace original conflicts with selected source",
+                    ));
+                }
+                (
+                    workspace_identity(source_commit, path, package.name(), package.version())?,
+                    Origin::Source {
+                        commit: source_commit.clone(),
+                        path: path.to_owned(),
+                    },
+                )
+            }
+            Original::Material { source, original } => (
+                material_identity(source, original, package.name(), package.version())?,
+                Origin::CargoMaterial {
+                    source: source.clone(),
+                    original: original.clone(),
+                    prepared_manifest_sha256: verified.prepared_manifest_sha256().to_owned(),
+                },
+            ),
+        };
+        if !stable.insert(identity.clone())
+            || identities.insert(package.id(), identity.clone()).is_some()
+        {
+            return Err(spdx_error(
+                "distinct observed Cargo aliases have the same stable original identity",
+            ));
+        }
+        let roles = package_roles(observed, package.id())?;
+        components.push(Component {
+            identity,
+            name: package.name().to_owned(),
+            version: Some(package.version().to_owned()),
+            roles,
+            origin: Some(origin),
+            declared_license: package.license().map(str::to_owned),
+        });
+    }
+    let mut dependencies = Vec::new();
+    let mut edges = BTreeSet::new();
+    for edge in graph.potential_edges() {
+        for dependency in project_edge(edge.parent(), edge.dependency(), edge.kinds(), &identities)?
+        {
+            if !edges.insert((
+                dependency.from.clone(),
+                dependency.to.clone(),
+                dependency.build,
+            )) {
+                return Err(spdx_error(
+                    "duplicate or self-referential projected dependency",
+                ));
+            }
+            dependencies.push(dependency);
+        }
+    }
+    Ok((components, dependencies))
+}
+
+fn workspace_identity(
+    commit: &str,
+    path: &str,
+    name: &str,
+    version: &str,
+) -> Result<String, Report<ReleaseError>> {
+    if !lower_hex(commit, 40) {
+        return Err(spdx_error("workspace identity has no selected commit"));
+    }
+    relative_source(path)?;
+    identity(
+        &json!(["cargo-workspace-v1", commit, path, name, version]),
+        name,
+        version,
+    )
+}
+
+fn identity(
+    value: &serde_json::Value,
+    name: &str,
+    version: &str,
+) -> Result<String, Report<ReleaseError>> {
+    plain(name)?;
+    plain(version)?;
+    let key = serde_json::to_string(value).map_err(spdx_error)?;
+    plain(&key)?;
+    Ok(key)
+}
+
+fn material_identity(
+    source: &str,
+    original: &CargoOrigin,
+    name: &str,
+    version: &str,
+) -> Result<String, Report<ReleaseError>> {
+    validate_material(source, original)?;
+    let facts = match original {
+        CargoOrigin::Registry { archive_sha256 } => {
+            json!(["cargo-registry-v1", source, archive_sha256, name, version])
+        }
+        CargoOrigin::Git {
+            revision,
+            repository_tree,
+            package_tree,
+            package_path,
+            ..
+        } => json!([
+            "cargo-git-v1",
+            source,
+            revision,
+            repository_tree,
+            package_tree,
+            package_path,
+            name,
+            version
+        ]),
+    };
+    identity(&facts, name, version)
+}
+
+pub(super) fn validate_material(
+    source: &str,
+    original: &CargoOrigin,
+) -> Result<(), Report<ReleaseError>> {
+    plain(source)?;
+    match original {
+        CargoOrigin::Registry { archive_sha256 } => {
+            let location = source
+                .strip_prefix("registry+")
+                .or_else(|| source.strip_prefix("sparse+"))
+                .ok_or_else(|| {
+                    spdx_error("original registry source is not a locked registry identity")
+                })?;
+            if !location.strip_prefix("https://").is_some_and(|rest| {
+                let authority = rest.split('/').next().unwrap_or_default();
+                !authority.is_empty()
+                    && authority.bytes().all(|byte| {
+                        byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'-' | b':')
+                    })
+                    && rest.bytes().all(|byte| {
+                        byte.is_ascii_graphic() && !matches!(byte, b'#' | b'?' | b'\\' | b'"')
+                    })
+            }) || !lower_hex(archive_sha256, 64)
+            {
+                return Err(spdx_error(
+                    "registry original source or archive SHA-256 is invalid",
+                ));
+            }
+        }
+        CargoOrigin::Git {
+            revision,
+            repository_tree,
+            package_tree,
+            package_path,
+            committed_manifest_blob,
+            committed_manifest_sha256,
+            normalized_manifest_sha256,
+        } => {
+            let (selector, locked_revision) = source
+                .rsplit_once('#')
+                .ok_or_else(|| spdx_error("Git original has no locked revision"))?;
+            GitSourceConfig::parse(selector)
+                .map_err(|error| error.change_context(ReleaseError::Spdx))?;
+            if locked_revision != revision
+                || [
+                    revision,
+                    repository_tree,
+                    package_tree,
+                    committed_manifest_blob,
+                ]
+                .iter()
+                .any(|value| !lower_hex(value, 40))
+                || !lower_hex(committed_manifest_sha256, 64)
+                || normalized_manifest_sha256
+                    .as_ref()
+                    .is_some_and(|value| !lower_hex(value, 64))
+            {
+                return Err(spdx_error(
+                    "Git original object or manifest identities are invalid",
+                ));
+            }
+            if !package_path.is_empty() {
+                relative_source(package_path)?;
+            }
+        }
+    }
+    Ok(())
+}
+
+fn classify(
+    context: UnitContext,
+    kinds: &[String],
+    crate_types: &[String],
+) -> Result<ComponentRole, Report<ReleaseError>> {
+    if crate_types.is_empty()
+        || crate_types.iter().collect::<BTreeSet<_>>().len() != crate_types.len()
+    {
+        return Err(spdx_error("compiler crate types are empty or duplicated"));
+    }
+    if kinds.is_empty() || kinds.iter().collect::<BTreeSet<_>>().len() != kinds.len() {
+        return Err(spdx_error("compiler target kinds are empty or duplicated"));
+    }
+    let library_kind = |kind: &String| {
+        matches!(
+            kind.as_str(),
+            "lib" | "rlib" | "dylib" | "staticlib" | "cdylib"
+        )
+    };
+    if kinds.iter().all(library_kind) && crate_types.iter().all(library_kind) {
+        return Ok(if context == UnitContext::Host {
+            ComponentRole::BuildMaterial
+        } else {
+            ComponentRole::ObservedRust
+        });
+    }
+    let [kind] = kinds else {
+        return Err(spdx_error("compiler target kinds are unsupported"));
+    };
+    match (context, kind.as_str()) {
+        (UnitContext::Host, "proc-macro") if crate_types == ["proc-macro"] => {
+            Ok(ComponentRole::BuildTool)
+        }
+        (UnitContext::Host, "custom-build") if crate_types == ["bin"] => {
+            Ok(ComponentRole::BuildTool)
+        }
+        (UnitContext::Target, "bin") if crate_types == ["bin"] => Ok(ComponentRole::ObservedRust),
+        _ => Err(spdx_error(
+            "compiler unit context or kind is impossible or unsupported",
+        )),
+    }
+}
+
+#[cfg(test)]
+mod tests;
+
+fn package_roles(
+    observed: &CargoObservations,
+    package_id: &str,
+) -> Result<Vec<ComponentRole>, Report<ReleaseError>> {
+    let mut roles = BTreeSet::new();
+    for unit in observed
+        .units()
+        .iter()
+        .filter(|unit| unit.package_id() == package_id)
+    {
+        roles.insert(classify(
+            unit.context(),
+            unit.target_kind(),
+            unit.crate_types(),
+        )?);
+    }
+    if roles.is_empty() {
+        return Err(spdx_error("observed package has no compiler units"));
+    }
+    Ok(roles.into_iter().collect())
+}
+
+fn project_edge(
+    parent: &str,
+    dependency: &str,
+    kinds: &[String],
+    identities: &BTreeMap<&str, String>,
+) -> Result<Vec<Dependency>, Report<ReleaseError>> {
+    let (Some(from), Some(to)) = (identities.get(parent), identities.get(dependency)) else {
+        return Ok(Vec::new());
+    };
+    let mut result = Vec::new();
+    for kind in kinds {
+        let build = match kind.as_str() {
+            "normal" => false,
+            "build" => true,
+            "dev" => continue,
+            _ => return Err(spdx_error("unknown potential package dependency kind")),
+        };
+        if from == to {
+            return Err(spdx_error("self-referential projected dependency"));
+        }
+        result.push(Dependency {
+            from: from.clone(),
+            to: to.clone(),
+            build,
+        });
+    }
+    Ok(result)
+}
diff --git a/crates/trusted-server-release/src/spdx/cargo/tests.rs b/crates/trusted-server-release/src/spdx/cargo/tests.rs
new file mode 100644
index 0000000000..ccaba8ef49
--- /dev/null
+++ b/crates/trusted-server-release/src/spdx/cargo/tests.rs
@@ -0,0 +1,370 @@
+use super::*;
+use crate::composition::{CargoLayout, observe_cargo};
+use crate::policy::ReleaseTarget;
+use std::path::PathBuf;
+
+fn git() -> CargoOrigin {
+    CargoOrigin::Git {
+        revision: "a".repeat(40),
+        repository_tree: "b".repeat(40),
+        package_tree: "c".repeat(40),
+        package_path: "packages/example".to_owned(),
+        committed_manifest_blob: "d".repeat(40),
+        committed_manifest_sha256: "e".repeat(64),
+        normalized_manifest_sha256: None,
+    }
+}
+
+#[test]
+fn original_identity_distinguishes_complete_registry_and_git_facts() {
+    let registry = CargoOrigin::Registry {
+        archive_sha256: "f".repeat(64),
+    };
+    let identity = |source: &str, original: &CargoOrigin| {
+        material_identity(source, original, "example", "1.0.0")
+            .expect("should accept verified original")
+    };
+    assert_ne!(
+        identity("registry+https://example.com/first", &registry),
+        identity("registry+https://example.com/second", &registry),
+        "should distinguish registry source identities"
+    );
+    let source = format!("git+https://example.com/repo?tag=v1#{}", "a".repeat(40));
+    let original = git();
+    let first = identity(&source, &original);
+    assert_ne!(
+        first,
+        identity(&source.replace("tag=v1", "branch=v1"), &original),
+        "should preserve Git selector"
+    );
+    let mut changed = git();
+    if let CargoOrigin::Git { package_path, .. } = &mut changed {
+        *package_path = "other".to_owned();
+    }
+    assert_ne!(
+        first,
+        identity(&source, &changed),
+        "should preserve package path"
+    );
+    let mut changed = git();
+    if let CargoOrigin::Git { revision, .. } = &mut changed {
+        *revision = "f".repeat(40);
+    }
+    assert_ne!(
+        first,
+        identity(&source.replace(&"a".repeat(40), &"f".repeat(40)), &changed),
+        "should preserve locked revision"
+    );
+    assert!(
+        material_identity(&source, &changed, "example", "1.0.0").is_err(),
+        "should reject conflicting locked revision"
+    );
+}
+
+#[test]
+fn malformed_originals_and_noncanonical_paths_are_rejected() {
+    for source in [
+        "https://example.com/index",
+        "registry+file:///tmp/index",
+        "registry+https://",
+        "registry+https://example.com/index#extra",
+    ] {
+        assert!(
+            material_identity(
+                source,
+                &CargoOrigin::Registry {
+                    archive_sha256: "f".repeat(64)
+                },
+                "example",
+                "1"
+            )
+            .is_err(),
+            "should reject malformed registry identity"
+        );
+    }
+    for path in ["../outside", "/absolute", "a//b", "a/./b", "a\\b"] {
+        let mut original = git();
+        if let CargoOrigin::Git { package_path, .. } = &mut original {
+            *package_path = path.to_owned();
+        }
+        assert!(
+            material_identity(
+                &format!("git+https://example.com/repo#{}", "a".repeat(40)),
+                &original,
+                "example",
+                "1"
+            )
+            .is_err(),
+            "should reject invalid package path"
+        );
+    }
+    assert!(
+        material_identity(
+            "registry+https://example.com/index",
+            &CargoOrigin::Registry {
+                archive_sha256: "a".repeat(40)
+            },
+            "example",
+            "1"
+        )
+        .is_err(),
+        "should reject non-SHA256 archive identity"
+    );
+}
+
+#[test]
+fn compiler_roles_fail_closed_and_preserve_host_target_distinction() {
+    for (context, kind, crate_type, expected) in [
+        (
+            UnitContext::Host,
+            "proc-macro",
+            "proc-macro",
+            ComponentRole::BuildTool,
+        ),
+        (
+            UnitContext::Host,
+            "custom-build",
+            "bin",
+            ComponentRole::BuildTool,
+        ),
+        (
+            UnitContext::Host,
+            "lib",
+            "lib",
+            ComponentRole::BuildMaterial,
+        ),
+        (
+            UnitContext::Target,
+            "lib",
+            "lib",
+            ComponentRole::ObservedRust,
+        ),
+        (
+            UnitContext::Target,
+            "bin",
+            "bin",
+            ComponentRole::ObservedRust,
+        ),
+    ] {
+        assert!(
+            classify(context, &[kind.to_owned()], &[crate_type.to_owned()])
+                .expect("should classify known compiler unit")
+                == expected,
+            "should retain observed compiler role"
+        );
+    }
+    for (context, kind, crate_type) in [
+        (UnitContext::Target, "proc-macro", "proc-macro"),
+        (UnitContext::Target, "custom-build", "bin"),
+        (UnitContext::Host, "bin", "bin"),
+        (UnitContext::Target, "example", "bin"),
+        (UnitContext::Target, "lib", "unknown"),
+    ] {
+        assert!(
+            classify(context, &[kind.to_owned()], &[crate_type.to_owned()]).is_err(),
+            "should reject impossible or unknown unit"
+        );
+    }
+}
+
+#[test]
+fn workspace_logical_identity_ignores_relocated_opaque_ids() {
+    let metadata =
+        include_str!("../../../tests/fixtures/composition/cargo-1.95-cross-host-metadata.json");
+    let messages =
+        include_str!("../../../tests/fixtures/composition/cargo-1.95-cross-messages.jsonl");
+    let capture = |root: &str| {
+        let layout = CargoLayout::new(
+            ReleaseTarget::Wasm32Wasip1,
+            PathBuf::from(format!("{root}/target")),
+            PathBuf::from(format!("{root}/source")),
+        )
+        .expect("should accept layout");
+        observe_cargo(
+            metadata.replace("/build", root).as_bytes(),
+            messages.replace("/build", root).as_bytes(),
+            &layout,
+        )
+        .expect("should observe relocated fixture")
+    };
+    let first = capture("/first");
+    let second = capture("/second");
+    assert_ne!(
+        first.packages()[0].id(),
+        second.packages()[0].id(),
+        "should actually relocate opaque Cargo identities"
+    );
+    let keys = |observed: &CargoObservations| {
+        observed
+            .packages()
+            .iter()
+            .map(|package| {
+                workspace_identity(
+                    &"a".repeat(40),
+                    &format!("{}/Cargo.toml", package.name()),
+                    package.name(),
+                    package.version(),
+                )
+                .expect("should accept tracked manifest")
+            })
+            .collect::<Vec<_>>()
+    };
+    assert_eq!(
+        keys(&first),
+        keys(&second),
+        "should retain stable source identities after relocation"
+    );
+}
+
+#[test]
+fn registry_locked_source_requires_an_actual_https_authority() {
+    let original = CargoOrigin::Registry {
+        archive_sha256: "a".repeat(64),
+    };
+    for source in [
+        "registry+https:///index",
+        "registry+https://@/index",
+        "sparse+https:///index",
+    ] {
+        assert!(
+            material_identity(source, &original, "example", "1").is_err(),
+            "should reject registry identity without a valid authority"
+        );
+    }
+}
+
+#[test]
+fn per_unit_feature_receipts_remain_separate_for_multiple_roles() {
+    let metadata =
+        include_bytes!("../../../tests/fixtures/composition/cargo-1.95-cross-host-metadata.json");
+    let messages =
+        include_str!("../../../tests/fixtures/composition/cargo-1.95-cross-messages.jsonl");
+    let mut stream = String::new();
+    for line in messages.lines() {
+        let mut message: serde_json::Value =
+            serde_json::from_str(line).expect("should parse observed compiler line");
+        if message["reason"] == "compiler-artifact"
+            && message["package_id"]
+                .as_str()
+                .is_some_and(|id| id.contains("example-app@"))
+        {
+            message["features"] = if message["target"]["kind"][0] == "custom-build" {
+                json!(["host-only"])
+            } else {
+                json!(["target-only"])
+            };
+        }
+        stream.push_str(&serde_json::to_string(&message).expect("should serialize compiler line"));
+        stream.push('\n');
+    }
+    let layout = CargoLayout::new(
+        ReleaseTarget::Wasm32Wasip1,
+        PathBuf::from("/build/target"),
+        PathBuf::from("/build/source"),
+    )
+    .expect("should accept fixture layout");
+    let observed = observe_cargo(metadata, stream.as_bytes(), &layout)
+        .expect("should observe distinct compiler units");
+    let units = observed
+        .units()
+        .iter()
+        .filter(|unit| unit.package_id().contains("example-app@"))
+        .collect::<Vec<_>>();
+    let roles = package_roles(&observed, units[0].package_id())
+        .expect("should classify all observed roles");
+    assert!(
+        roles.contains(&ComponentRole::BuildTool) && roles.contains(&ComponentRole::ObservedRust),
+        "should retain multiple package roles"
+    );
+    assert!(
+        units
+            .iter()
+            .any(|unit| unit.context() == UnitContext::Host && unit.features() == ["host-only"]),
+        "should retain host features separately"
+    );
+    assert!(units.iter().any(|unit| unit.context() == UnitContext::Target && unit.features() == ["target-only"]),"should retain target features separately");
+    assert!(
+        units.iter().all(|unit| unit.features().len() == 1),
+        "should never synthesize package feature unions"
+    );
+}
+
+#[test]
+fn package_edges_require_both_observed_endpoints_and_skip_dev_kinds() {
+    let identities = BTreeMap::from([
+        ("parent", "stable-parent".to_owned()),
+        ("child", "stable-child".to_owned()),
+    ]);
+    assert!(
+        project_edge(
+            "parent",
+            "potential-only",
+            &["normal".to_owned()],
+            &identities
+        )
+        .expect("should exclude potential-only endpoint")
+        .is_empty(),
+        "should exclude potential graph membership"
+    );
+    assert!(
+        project_edge("parent", "child", &["dev".to_owned()], &identities)
+            .expect("should skip dev-only relation")
+            .is_empty(),
+        "should omit dev-only dependencies"
+    );
+    let edges = project_edge(
+        "parent",
+        "child",
+        &["normal".to_owned(), "build".to_owned()],
+        &identities,
+    )
+    .expect("should preserve normal and build declarations");
+    assert_eq!(edges.len(), 2, "should retain both relation kinds");
+    assert!(
+        !edges[0].build && edges[1].build,
+        "should preserve normal versus build semantics"
+    );
+}
+
+#[test]
+fn multiple_library_outputs_preserve_host_and_target_roles() {
+    let kinds = ["cdylib".to_owned(), "rlib".to_owned()];
+    for (context, expected) in [
+        (UnitContext::Host, ComponentRole::BuildMaterial),
+        (UnitContext::Target, ComponentRole::ObservedRust),
+    ] {
+        assert!(
+            classify(context, &kinds, &kinds)
+                .expect("should accept multiple compatible library outputs")
+                == expected,
+            "should preserve library compiler context"
+        );
+    }
+}
+
+#[test]
+fn multiple_library_outputs_reject_mixed_duplicate_and_incompatible_kinds() {
+    for kinds in [
+        vec!["lib", "bin"],
+        vec!["rlib", "proc-macro"],
+        vec!["rlib", "custom-build"],
+        vec!["rlib", "test"],
+        vec!["rlib", "rlib"],
+        vec![],
+    ] {
+        let kinds = kinds.into_iter().map(str::to_owned).collect::<Vec<_>>();
+        assert!(
+            classify(UnitContext::Target, &kinds, &["rlib".to_owned()]).is_err(),
+            "should reject non-library or duplicate target kinds"
+        );
+    }
+    assert!(
+        classify(
+            UnitContext::Target,
+            &["cdylib".to_owned(), "rlib".to_owned()],
+            &["bin".to_owned()]
+        )
+        .is_err(),
+        "should reject incompatible library crate types"
+    );
+}
diff --git a/crates/trusted-server-release/src/spdx/javascript.rs b/crates/trusted-server-release/src/spdx/javascript.rs
new file mode 100644
index 0000000000..3c4f0172f0
--- /dev/null
+++ b/crates/trusted-server-release/src/spdx/javascript.rs
@@ -0,0 +1,365 @@
+//! Artifact-specific conservative projection of checked original JavaScript facts.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use error_stack::Report;
+use serde_json::json;
+
+use crate::composition::CompositionView;
+use crate::composition::javascript::JsMembership;
+use crate::error::ReleaseError;
+use crate::javascript::contributions::{
+    Material, ModuleContributions, Origin as JsOrigin, RetainedContributions,
+};
+use crate::recipe::RecipeCompleted;
+
+use super::{Component, ComponentRole, Dependency, Origin, lower_hex, plain, spdx_error};
+
+/// Checked renderer inputs without complete native/tool coverage authority.
+pub(crate) struct JavascriptProjection<'a> {
+    view: CompositionView<'a>,
+    originals: &'a RetainedContributions,
+    components: Vec<Component>,
+}
+
+impl<'a> JavascriptProjection<'a> {
+    /// Joins the sealed artifact observations to its frozen original inventory.
+    ///
+    /// # Errors
+    ///
+    /// Rejects changed receipts and conflicting source, inventory or module joins.
+    pub(crate) fn from_completed(
+        completed: &'a RecipeCompleted,
+    ) -> Result<Self, Report<ReleaseError>> {
+        let view = completed.composition_view()?;
+        let originals = completed.javascript_contributions()?;
+        let components = project(
+            view.javascript(),
+            originals,
+            completed.commit().as_str(),
+            completed.artifact().sha256(),
+        )?;
+        Ok(Self {
+            view,
+            originals,
+            components,
+        })
+    }
+    /// Returns the exact checked collector facts, retaining observation lengths and stages.
+    pub(crate) fn originals(&self) -> &RetainedContributions {
+        self.originals
+    }
+    /// Returns the checked renderer component count.
+    pub(crate) fn component_count(&self) -> usize {
+        self.components.len()
+    }
+    /// Returns final-byte observations borrowed from the sealed owner.
+    pub(crate) fn membership(&self) -> &JsMembership {
+        self.view.javascript()
+    }
+    /// Releases the renderer components; JavaScript projects no package edges.
+    pub(super) fn into_parts(self) -> (Vec<Component>, Vec<Dependency>) {
+        (self.components, Vec::new())
+    }
+}
+
+/// Typed originals copied only from the checked collector export.
+#[derive(Clone, serde::Serialize)]
+pub(super) enum JavascriptOriginal {
+    Bundle {
+        id: String,
+        filename: String,
+        size: u64,
+        sha256: String,
+    },
+    Contribution(JsOrigin),
+    Material(Material),
+}
+
+fn key(
+    commit: &str,
+    kind: &str,
+    facts: &impl serde::Serialize,
+) -> Result<String, Report<ReleaseError>> {
+    let value = serde_json::to_string(&json!(["javascript-v1", commit, kind, facts]))
+        .map_err(spdx_error)?;
+    plain(&value)?;
+    Ok(value)
+}
+
+fn material_id(material: &Material) -> &str {
+    match material {
+        Material::Source { id, .. }
+        | Material::NpmPackage { id, .. }
+        | Material::ToolDistribution { id, .. }
+        | Material::LifecycleEvent { id, .. }
+        | Material::LifecycleOutput { id, .. } => id,
+    }
+}
+
+fn project(
+    membership: &JsMembership,
+    originals: &RetainedContributions,
+    commit: &str,
+    artifact: &str,
+) -> Result<Vec<Component>, Report<ReleaseError>> {
+    if !lower_hex(commit, 40)
+        || originals.source_commit() != commit
+        || membership.artifact_sha256() != artifact
+        || !lower_hex(artifact, 64)
+        || membership.inventory_sha256() != originals.inventory_sha256()
+    {
+        return Err(spdx_error(
+            "JavaScript original source, inventory or artifact identity differs",
+        ));
+    }
+    let mut components = Vec::new();
+    let mut material_keys = BTreeMap::new();
+    let generated_owners = originals
+        .modules()
+        .iter()
+        .flat_map(ModuleContributions::contributions)
+        .filter_map(|entry| match entry.origin() {
+            JsOrigin::Generated {
+                owner_lock_path, ..
+            } => Some(format!("npm:{owner_lock_path}")),
+            _ => None,
+        })
+        .collect::<BTreeSet<_>>();
+    for material in originals.materials() {
+        let identity = key(commit, "material", material)?;
+        if material_keys
+            .insert(material_id(material), identity.clone())
+            .is_some()
+        {
+            return Err(spdx_error("duplicate JavaScript material"));
+        }
+        let (name, version) = match material {
+            Material::NpmPackage { name, version, .. }
+            | Material::ToolDistribution { name, version, .. } => {
+                (name.clone(), Some(version.clone()))
+            }
+            _ => (material_id(material).to_owned(), None),
+        };
+        let tool = generated_owners.contains(material_id(material))
+            || originals
+                .tools()
+                .iter()
+                .any(|tool| tool.material_id() == material_id(material));
+        components.push(component(
+            identity,
+            name,
+            version,
+            if tool {
+                ComponentRole::BuildTool
+            } else {
+                ComponentRole::BuildMaterial
+            },
+            commit,
+            JavascriptOriginal::Material(material.clone()),
+            None,
+        ));
+    }
+    let modules = membership.modules().collect::<Vec<_>>();
+    if modules.len() != originals.modules().len() {
+        return Err(spdx_error("JavaScript module sets differ"));
+    }
+    let mut observed = BTreeMap::new();
+    for (module, classification) in modules {
+        if observed
+            .insert(module.id(), (module, classification))
+            .is_some()
+        {
+            return Err(spdx_error("duplicate JavaScript module"));
+        }
+    }
+    for module in originals.modules() {
+        let (found, classification) = observed
+            .remove(module.id())
+            .ok_or_else(|| spdx_error("missing JavaScript module"))?;
+        if found.filename() != module.filename()
+            || found.size() != module.size()
+            || found.sha256() != module.sha256()
+        {
+            return Err(spdx_error("JavaScript complete module identities differ"));
+        }
+        let retained = match classification {
+            "conservative_embedded_js" => true,
+            "js_build_material" => false,
+            _ => return Err(spdx_error("unknown final JavaScript classification")),
+        };
+        let bundle = JavascriptOriginal::Bundle {
+            id: module.id().to_owned(),
+            filename: module.filename().to_owned(),
+            size: module.size(),
+            sha256: module.sha256().to_owned(),
+        };
+        components.push(component(
+            key(commit, "bundle", &bundle)?,
+            module.id().to_owned(),
+            None,
+            if retained {
+                ComponentRole::RetainedJavascript
+            } else {
+                ComponentRole::BuildMaterial
+            },
+            commit,
+            bundle,
+            None,
+        ));
+        for contribution in module.contributions() {
+            if contribution.stage() != "rollup-rendered" || contribution.rendered_length() == 0 {
+                return Err(spdx_error("unknown JavaScript contribution observation"));
+            }
+            let origin = contribution.origin();
+            let producer = match origin {
+                JsOrigin::Generated {
+                    owner_lock_path, ..
+                } => Some(
+                    material_keys
+                        .get(format!("npm:{owner_lock_path}").as_str())
+                        .ok_or_else(|| spdx_error("missing generated JavaScript owner"))?
+                        .clone(),
+                ),
+                _ => None,
+            };
+            let original = JavascriptOriginal::Contribution(origin.clone());
+            let identity = key(commit, "rendered", &json!([module.id(), original]))?;
+            components.push(component(
+                identity,
+                format!("{} rendered input", module.id()),
+                None,
+                if retained {
+                    ComponentRole::ConservativeJavascript
+                } else {
+                    ComponentRole::BuildMaterial
+                },
+                commit,
+                original,
+                producer,
+            ));
+        }
+    }
+    Ok(components)
+}
+
+fn component(
+    identity: String,
+    name: String,
+    version: Option<String>,
+    role: ComponentRole,
+    commit: &str,
+    original: JavascriptOriginal,
+    producer: Option<String>,
+) -> Component {
+    Component {
+        identity,
+        name,
+        version,
+        roles: vec![role],
+        origin: Some(Origin::JavascriptVerified {
+            source_commit: commit.to_owned(),
+            original,
+            producer,
+        }),
+        declared_license: None,
+    }
+}
+
+#[cfg(test)]
+mod tests;
+
+pub(super) fn origin_fields(
+    component: &Component,
+    inputs: &super::SpdxInputs<'_>,
+    commit: &str,
+    original: &JavascriptOriginal,
+    producer: Option<&str>,
+) -> Result<super::OriginFields, Report<ReleaseError>> {
+    if commit != inputs.source_commit || !lower_hex(commit, 40) {
+        return Err(spdx_error("JavaScript source differs from selected source"));
+    }
+    if component.declared_license.is_some() {
+        return Err(spdx_error(
+            "JavaScript declared license exceeds measured facts",
+        ));
+    }
+    if !matches!(
+        (original, component.roles.as_slice()),
+        (
+            JavascriptOriginal::Bundle { .. },
+            [ComponentRole::RetainedJavascript | ComponentRole::BuildMaterial]
+        ) | (
+            JavascriptOriginal::Contribution(_),
+            [ComponentRole::ConservativeJavascript | ComponentRole::BuildMaterial]
+        ) | (
+            JavascriptOriginal::Material(_),
+            [ComponentRole::BuildTool | ComponentRole::BuildMaterial]
+        )
+    ) {
+        return Err(spdx_error(
+            "JavaScript origin and component roles are incompatible",
+        ));
+    }
+    let generated = matches!(
+        original,
+        JavascriptOriginal::Contribution(JsOrigin::Generated { .. })
+    );
+    if generated != producer.is_some()
+        || producer.is_some_and(|id| {
+            !inputs.components.iter().any(|candidate| {
+                candidate.identity == id
+                    && candidate.identity != component.identity
+                    && candidate.roles.contains(&ComponentRole::BuildTool)
+            })
+        })
+    {
+        return Err(spdx_error(
+            "generated JavaScript has no checked build-tool owner",
+        ));
+    }
+    let checksum = match original {
+        JavascriptOriginal::Bundle { sha256, .. } => Some(("SHA256", sha256.clone())),
+        JavascriptOriginal::Contribution(
+            JsOrigin::Source { sha256, .. } | JsOrigin::Npm { sha256, .. },
+        ) => Some(("SHA256", sha256.clone())),
+        JavascriptOriginal::Contribution(JsOrigin::Generated {
+            generated_sha256, ..
+        }) => Some(("SHA256", generated_sha256.clone())),
+        JavascriptOriginal::Material(Material::NpmPackage { integrity, .. }) => {
+            Some(("SHA512", archive_sha512(integrity)?))
+        }
+        JavascriptOriginal::Material(
+            Material::Source { sha256, .. }
+            | Material::ToolDistribution { sha256, .. }
+            | Material::LifecycleOutput { sha256, .. },
+        ) => Some(("SHA256", sha256.clone())),
+        JavascriptOriginal::Material(Material::LifecycleEvent { .. }) => None,
+    };
+    if checksum.as_ref().is_some_and(|(algorithm, digest)| {
+        !lower_hex(digest, if *algorithm == "SHA512" { 128 } else { 64 })
+    }) {
+        return Err(spdx_error("invalid JavaScript original digest"));
+    }
+    let facts = serde_json::to_string(
+        &json!({"source_commit":commit,"original":original,"producer":producer}),
+    )
+    .map_err(spdx_error)?;
+    let info = format!(
+        "Verified original JavaScript facts {facts}; npm archive SHA512 integrity and structured installed-tree SHA256 are distinct. Rendered inputs are conservative post-Rollup, before esbuild minification; final function reachability is not asserted."
+    );
+    plain(&info)?;
+    Ok(("NOASSERTION".to_owned(), info, checksum))
+}
+
+fn archive_sha512(integrity: &str) -> Result<String, Report<ReleaseError>> {
+    let encoded = integrity
+        .strip_prefix("sha512-")
+        .ok_or_else(|| spdx_error("npm original integrity is not SHA512"))?;
+    let bytes = base64::Engine::decode(&base64::engine::general_purpose::STANDARD, encoded)
+        .map_err(spdx_error)?;
+    if bytes.len() != 64 {
+        return Err(spdx_error("npm original SHA512 length differs"));
+    }
+    Ok(hex::encode(bytes))
+}
diff --git a/crates/trusted-server-release/src/spdx/javascript/tests.rs b/crates/trusted-server-release/src/spdx/javascript/tests.rs
new file mode 100644
index 0000000000..8f97272c1d
--- /dev/null
+++ b/crates/trusted-server-release/src/spdx/javascript/tests.rs
@@ -0,0 +1,387 @@
+use super::*;
+use crate::composition::javascript::{JsInputs, JsRetentionPolicy, collect_js};
+use crate::javascript::JsBuildCompleted;
+use sha2::{Digest as _, Sha256};
+
+fn role_originals() -> [JavascriptOriginal; 3] {
+    [
+        JavascriptOriginal::Bundle {
+            id: "example".to_owned(),
+            filename: "tsjs-example.js".to_owned(),
+            size: 16,
+            sha256: "b".repeat(64),
+        },
+        JavascriptOriginal::Contribution(JsOrigin::Source {
+            path: "src/example.ts".to_owned(),
+            transform: "source".to_owned(),
+            sha256: "c".repeat(64),
+        }),
+        JavascriptOriginal::Material(Material::Source {
+            id: "source:example".to_owned(),
+            path: "src/example.ts".to_owned(),
+            sha256: "d".repeat(64),
+        }),
+    ]
+}
+
+fn role_inputs(
+    original: JavascriptOriginal,
+    role: ComponentRole,
+) -> super::super::SpdxInputs<'static> {
+    let bytes = b"fictional executable";
+    super::super::SpdxInputs {
+        executable: bytes,
+        expected_artifact_sha256: hex::encode(Sha256::digest(bytes)),
+        name: "example-artifact".to_owned(),
+        version: "1.0.0".to_owned(),
+        source_commit: "a".repeat(40),
+        target: crate::policy::ReleaseTarget::Wasm32Wasip1,
+        created: "2026-01-01T00:00:00Z".to_owned(),
+        document_comment: None,
+        components: vec![component(
+            "javascript:example".to_owned(),
+            "example".to_owned(),
+            None,
+            role,
+            &"a".repeat(40),
+            original,
+            None,
+        )],
+        dependencies: Vec::new(),
+    }
+}
+
+#[test]
+fn materials_cannot_render_complete_module_containment() {
+    let original = role_originals()[2].clone();
+    let inputs = role_inputs(original, ComponentRole::RetainedJavascript);
+    let error = super::super::render(&inputs)
+        .expect_err("should reject material evidence claiming complete module containment");
+    assert!(
+        format!("{error:?}").contains("JavaScript origin and component roles are incompatible"),
+        "should reject the unsupported containment claim at the JavaScript origin boundary"
+    );
+}
+
+#[test]
+fn javascript_originals_accept_only_their_single_supported_roles() {
+    let roles = [
+        ComponentRole::ObservedRust,
+        ComponentRole::RetainedJavascript,
+        ComponentRole::ConservativeJavascript,
+        ComponentRole::ObservedNative,
+        ComponentRole::BuildMaterial,
+        ComponentRole::BuildTool,
+        ComponentRole::ExternalRuntime,
+    ];
+    for (original, allowed) in role_originals().into_iter().zip([
+        [
+            ComponentRole::RetainedJavascript,
+            ComponentRole::BuildMaterial,
+        ],
+        [
+            ComponentRole::ConservativeJavascript,
+            ComponentRole::BuildMaterial,
+        ],
+        [ComponentRole::BuildTool, ComponentRole::BuildMaterial],
+    ]) {
+        for role in roles {
+            let inputs = role_inputs(original.clone(), role);
+            assert_eq!(
+                super::super::render(&inputs).is_ok(),
+                allowed.contains(&role),
+                "should accept exactly the supported original and role pairs"
+            );
+        }
+        for invalid in [vec![], vec![allowed[0], allowed[0]], allowed.to_vec()] {
+            let mut inputs = role_inputs(original.clone(), allowed[0]);
+            inputs.components[0].roles = invalid;
+            assert!(
+                super::super::render(&inputs).is_err(),
+                "should reject empty, duplicate or mixed JavaScript roles"
+            );
+        }
+    }
+}
+
+#[test]
+fn javascript_originals_reject_unmeasured_declared_licenses() {
+    for (original, roles) in role_originals().into_iter().zip([
+        [
+            ComponentRole::RetainedJavascript,
+            ComponentRole::BuildMaterial,
+        ],
+        [
+            ComponentRole::ConservativeJavascript,
+            ComponentRole::BuildMaterial,
+        ],
+        [ComponentRole::BuildTool, ComponentRole::BuildMaterial],
+    ]) {
+        for role in roles {
+            let mut inputs = role_inputs(original.clone(), role);
+            inputs.components[0].declared_license = Some("MIT".to_owned());
+
+            let error = super::super::render(&inputs)
+                .expect_err("should reject unmeasured JavaScript declared licenses");
+            assert!(
+                format!("{error:?}").contains("JavaScript declared license exceeds measured facts"),
+                "should reject the unmeasured license at the JavaScript origin boundary"
+            );
+        }
+    }
+}
+
+#[test]
+fn valid_javascript_role_document_bytes_remain_unchanged() {
+    let original = role_originals()[0].clone();
+    let inputs = role_inputs(original, ComponentRole::RetainedJavascript);
+    let generated = super::super::render(&inputs).expect("should render valid module evidence");
+    // Captured before JavaScript origin/role validation was introduced.
+    assert_eq!(
+        generated.sha256(),
+        "2a79890ec323d58b8c6b8f304b06977c8355c8a5c341301b9782a82ddc489ee8",
+        "should preserve valid rendered bytes"
+    );
+}
+
+#[test]
+fn retained_and_absent_modules_have_different_contributor_roles() {
+    let completed = JsBuildCompleted::fixture_for_projection(&"a".repeat(40));
+    let originals = completed
+        .retained_contributions()
+        .expect("should export originals");
+    for (bytes, retained) in [
+        (b"prefix fictional module suffix".as_slice(), true),
+        (b"operator binary".as_slice(), false),
+    ] {
+        let modules = completed.retained_modules().expect("should export modules");
+        let root =
+            std::fs::canonicalize(completed.rehash_for_handoff().expect("should rehash owner"))
+                .expect("should canonicalize");
+        let digest = hex::encode(Sha256::digest(bytes));
+        let membership = collect_js(
+            bytes,
+            &digest,
+            &JsInputs {
+                retained_root: &root,
+                modules: &modules,
+                inventory_sha256: originals.inventory_sha256(),
+                policy: JsRetentionPolicy::ObserveCli,
+            },
+        )
+        .expect("should inspect final bytes");
+        let components = project(&membership, &originals, &"a".repeat(40), &digest)
+            .expect("should project checked joins");
+        assert!(
+            components
+                .iter()
+                .any(|component| component.roles.contains(&ComponentRole::RetainedJavascript))
+                == retained,
+            "should claim retention only for complete final bytes"
+        );
+        assert!(
+            components.iter().any(|component| component
+                .roles
+                .contains(&ComponentRole::ConservativeJavascript))
+                == retained,
+            "should preserve conservative origin role only for retained module"
+        );
+        assert!(
+            project(&membership, &originals, &"b".repeat(40), &digest).is_err(),
+            "should reject another source"
+        );
+        assert!(
+            project(&membership, &originals, &"a".repeat(40), &"f".repeat(64)).is_err(),
+            "should reject another artifact"
+        );
+        if !retained {
+            let document = super::super::render(&super::super::SpdxInputs {
+                executable: bytes,
+                expected_artifact_sha256: digest,
+                name: "example-cli".to_owned(),
+                version: "1.0.0".to_owned(),
+                source_commit: "a".repeat(40),
+                target: crate::policy::ReleaseTarget::X86_64UnknownLinuxGnu,
+                created: "2026-01-01T00:00:00Z".to_owned(),
+                document_comment: None,
+                components,
+                dependencies: Vec::new(),
+            })
+            .expect("should render absent CLI modules as build evidence");
+            let value: serde_json::Value = serde_json::from_slice(document.bytes())
+                .expect("should parse rendered CLI evidence");
+            let relationships = value["relationships"]
+                .as_array()
+                .expect("should list relationships");
+            assert!(
+                relationships.iter().all(|edge| {
+                    edge["relationshipType"] != "CONTAINS"
+                        && edge["relationshipType"] != "GENERATED_FROM"
+                }),
+                "should claim no retained or conservative JS contributors in an absent CLI artifact"
+            );
+            assert!(
+                relationships
+                    .iter()
+                    .any(|edge| edge["relationshipType"] == "BUILD_DEPENDENCY_OF"),
+                "should preserve discarded JS as build evidence"
+            );
+        }
+    }
+}
+
+#[test]
+fn checked_originals_render_distinct_archive_tree_and_generated_evidence() {
+    let completed = JsBuildCompleted::fixture_for_projection(&"a".repeat(40));
+    let originals = completed
+        .retained_contributions()
+        .expect("should export originals");
+    let bytes = b"prefix fictional module suffix";
+    let digest = hex::encode(Sha256::digest(bytes));
+    let modules = completed.retained_modules().expect("should export modules");
+    let root = std::fs::canonicalize(completed.rehash_for_handoff().expect("should rehash owner"))
+        .expect("should canonicalize");
+    let membership = collect_js(
+        bytes,
+        &digest,
+        &JsInputs {
+            retained_root: &root,
+            modules: &modules,
+            inventory_sha256: originals.inventory_sha256(),
+            policy: JsRetentionPolicy::FastlyAll,
+        },
+    )
+    .expect("should inspect final bytes");
+    let components = project(&membership, &originals, &"a".repeat(40), &digest)
+        .expect("should project originals");
+    let inputs = super::super::SpdxInputs {
+        executable: bytes,
+        expected_artifact_sha256: digest,
+        name: "example-artifact".to_owned(),
+        version: "1.0.0".to_owned(),
+        source_commit: "a".repeat(40),
+        target: crate::policy::ReleaseTarget::Wasm32Wasip1,
+        created: "2026-01-01T00:00:00Z".to_owned(),
+        document_comment: None,
+        components,
+        dependencies: Vec::new(),
+    };
+    let generated = super::super::render(&inputs).expect("should render checked original facts");
+    let value: serde_json::Value =
+        serde_json::from_slice(generated.bytes()).expect("should parse document");
+    let packages = value["packages"]
+        .as_array()
+        .expect("should contain packages");
+    let npm = packages
+        .iter()
+        .find(|package| package["name"] == "vite")
+        .expect("should retain npm package");
+    assert_eq!(
+        npm["downloadLocation"], "NOASSERTION",
+        "should not invent original archive URL"
+    );
+    assert_eq!(
+        npm["checksums"][0]["algorithm"], "SHA512",
+        "should identify original npm archive algorithm"
+    );
+    assert_eq!(
+        npm["checksums"][0]["checksumValue"],
+        "0".repeat(128),
+        "should decode original archive integrity"
+    );
+    assert!(
+        npm["sourceInfo"]
+            .as_str()
+            .expect("should describe original")
+            .contains(&"d".repeat(64)),
+        "should retain installed tree separately"
+    );
+    assert!(
+        packages
+            .iter()
+            .all(|package| package["licenseDeclared"] == "NOASSERTION"),
+        "should not infer licenses"
+    );
+    assert!(
+        value["relationships"]
+            .as_array()
+            .expect("should contain relationships")
+            .iter()
+            .any(|edge| edge["relationshipType"] == "GENERATES"),
+        "should join checked generated owner"
+    );
+    assert!(
+        !String::from_utf8(generated.bytes().to_vec())
+            .expect("should encode UTF8")
+            .contains(root.to_str().expect("should encode root")),
+        "should exclude private root"
+    );
+}
+
+#[test]
+fn relocated_owners_preserve_stable_component_identities() {
+    let mut identities = Vec::new();
+    for _ in 0..2 {
+        let completed = JsBuildCompleted::fixture_for_projection(&"a".repeat(40));
+        let originals = completed
+            .retained_contributions()
+            .expect("should export originals");
+        let bytes = b"operator binary";
+        let digest = hex::encode(Sha256::digest(bytes));
+        let modules = completed.retained_modules().expect("should export modules");
+        let root =
+            std::fs::canonicalize(completed.rehash_for_handoff().expect("should rehash owner"))
+                .expect("should canonicalize");
+        let membership = collect_js(
+            bytes,
+            &digest,
+            &JsInputs {
+                retained_root: &root,
+                modules: &modules,
+                inventory_sha256: originals.inventory_sha256(),
+                policy: JsRetentionPolicy::ObserveCli,
+            },
+        )
+        .expect("should inspect final bytes");
+        identities.push(
+            project(&membership, &originals, &"a".repeat(40), &digest)
+                .expect("should project")
+                .into_iter()
+                .map(|component| component.identity)
+                .collect::<Vec<_>>(),
+        );
+    }
+    assert_eq!(
+        identities[0], identities[1],
+        "should ignore private owner relocation"
+    );
+}
+
+#[test]
+fn equal_module_bytes_do_not_substitute_for_exact_original_inventory() {
+    let owner = JsBuildCompleted::fixture_for_tests(&"a".repeat(40));
+    let other = JsBuildCompleted::fixture_for_projection(&"a".repeat(40));
+    let originals = other
+        .retained_contributions()
+        .expect("should export different originals");
+    let bytes = b"fictional module";
+    let digest = hex::encode(Sha256::digest(bytes));
+    let modules = owner.retained_modules().expect("should export modules");
+    let root = std::fs::canonicalize(owner.rehash_for_handoff().expect("should rehash owner"))
+        .expect("should canonicalize");
+    let membership = collect_js(
+        bytes,
+        &digest,
+        &JsInputs {
+            retained_root: &root,
+            modules: &modules,
+            inventory_sha256: owner.inventory_sha256(),
+            policy: JsRetentionPolicy::FastlyAll,
+        },
+    )
+    .expect("should inspect same complete module bytes");
+    assert!(
+        project(&membership, &originals, &"a".repeat(40), &digest).is_err(),
+        "should reject different raw inventory despite equal complete module bytes"
+    );
+}
diff --git a/crates/trusted-server-release/src/spdx/native.rs b/crates/trusted-server-release/src/spdx/native.rs
new file mode 100644
index 0000000000..434e33d16d
--- /dev/null
+++ b/crates/trusted-server-release/src/spdx/native.rs
@@ -0,0 +1,358 @@
+//! Conservative native projection from sealed composition and verified originals.
+
+use std::collections::BTreeSet;
+
+use error_stack::Report;
+use serde::Serialize;
+use serde_json::json;
+
+use crate::composition::native::{NativeContributor, NativeInventory, reviewed_wrapper_version};
+use crate::composition::origin::{Original, VerifiedPackageOrigins};
+use crate::composition::{CargoObservations, CompositionView, UnitContext};
+use crate::error::ReleaseError;
+use crate::materials::CargoOrigin;
+use crate::recipe::RecipeCompleted;
+
+use super::{
+    Component, ComponentRole, Dependency, Origin, OriginFields, cargo, lower_hex, plain,
+    relative_source, spdx_error,
+};
+
+/// Renderer inputs borrowed from sealed native receipts, without complete coverage.
+pub(crate) struct NativeProjection<'a> {
+    view: CompositionView<'a>,
+    components: Vec<Component>,
+}
+
+impl<'a> NativeProjection<'a> {
+    /// Joins measured native inputs to the completed build's verified originals.
+    ///
+    /// # Errors
+    ///
+    /// Rejects changed receipts, wrong source/material identities and conflicting
+    /// package, compiler-context, feature or original-source joins.
+    pub(crate) fn from_completed(
+        completed: &'a RecipeCompleted,
+    ) -> Result<Self, Report<ReleaseError>> {
+        let view = completed.composition_view()?;
+        let origins = view.package_origins();
+        if origins.source_commit() != completed.commit().as_str()
+            || !lower_hex(origins.source_commit(), 40)
+            || origins.materials_sha256() != completed.materials_digest()
+            || !lower_hex(origins.materials_sha256(), 64)
+        {
+            return Err(spdx_error(
+                "native originals belong to another source or material tree",
+            ));
+        }
+        let components = project(view.native(), view.observations(), origins)?;
+        Ok(Self { view, components })
+    }
+
+    /// Returns the number of checked native wrapper-context components.
+    pub(crate) fn component_count(&self) -> usize {
+        self.components.len()
+    }
+
+    /// Returns the borrowed measured receipts with their existing coverage gaps.
+    pub(crate) fn inventory(&self) -> &NativeInventory {
+        self.view.native()
+    }
+
+    /// Releases the renderer components; native contexts project no package edges.
+    pub(super) fn into_parts(self) -> (Vec<Component>, Vec<Dependency>) {
+        (self.components, Vec::new())
+    }
+}
+
+/// Sanitized native facts; no opaque Cargo IDs or private working paths are kept.
+#[derive(Serialize)]
+pub(super) struct NativeOriginal {
+    locked_source: String,
+    cargo_wrapper_name: String,
+    cargo_wrapper_version: String,
+    native_implementation_version: Option<String>,
+    original_registry_archive_sha256: String,
+    context: UnitContext,
+    features: Vec<String>,
+    prepared_source_tree_sha256: String,
+    source_subtrees: Vec<Subtree>,
+    static_libraries: Vec<String>,
+    static_output_archives: Vec<Archive>,
+}
+
+#[derive(Serialize)]
+struct Subtree {
+    relative_path: String,
+    tree_sha256: String,
+}
+
+#[derive(Serialize)]
+struct Archive {
+    filename: String,
+    size: u64,
+    sha256: String,
+}
+
+fn project(
+    inventory: &NativeInventory,
+    observed: &CargoObservations,
+    origins: &VerifiedPackageOrigins,
+) -> Result<Vec<Component>, Report<ReleaseError>> {
+    let mut seen = BTreeSet::new();
+    let mut stable = BTreeSet::new();
+    let mut components = Vec::new();
+    for contributor in inventory.contributors() {
+        if !seen.insert((
+            contributor.package_id(),
+            contributor.context() == UnitContext::Target,
+        )) {
+            return Err(spdx_error("duplicate native package/context receipt"));
+        }
+        let mut matching = observed
+            .packages()
+            .iter()
+            .filter(|package| package.id() == contributor.package_id());
+        let package = matching
+            .next()
+            .ok_or_else(|| spdx_error("native receipt has no observed package"))?;
+        if matching.next().is_some()
+            || package.name() != contributor.name()
+            || package.version() != contributor.version()
+            || !contributor.reviewed_wrapper()
+        {
+            return Err(spdx_error(
+                "native receipt has an unknown or conflicting Cargo wrapper",
+            ));
+        }
+        let verified = origins
+            .package(contributor.package_id())
+            .ok_or_else(|| spdx_error("native receipt has no verified exact-ID original"))?;
+        if verified.name() != contributor.name() || verified.version() != contributor.version() {
+            return Err(spdx_error(
+                "native receipt conflicts with verified wrapper identity",
+            ));
+        }
+        let Original::Material {
+            source,
+            original: CargoOrigin::Registry { archive_sha256 },
+        } = verified.origin()
+        else {
+            return Err(spdx_error(
+                "native input lacks a verified reviewed registry original",
+            ));
+        };
+        if archive_sha256 != contributor.original_sha256() {
+            return Err(spdx_error(
+                "native original registry archive digest differs",
+            ));
+        }
+        cargo::validate_material(
+            source,
+            &CargoOrigin::Registry {
+                archive_sha256: archive_sha256.clone(),
+            },
+        )?;
+        let expected_classification = match contributor.context() {
+            UnitContext::Target => "conservative_embedded_contributor",
+            UnitContext::Host => "build_tool_native_contributor",
+        };
+        if contributor.classification() != expected_classification {
+            return Err(spdx_error(
+                "native classification conflicts with observed context",
+            ));
+        }
+        let consumers = observed
+            .units()
+            .iter()
+            .filter(|unit| {
+                unit.package_id() == contributor.package_id()
+                    && unit.context() == contributor.context()
+                    && !unit.target_kind().iter().any(|kind| kind == "custom-build")
+            })
+            .collect::<Vec<_>>();
+        if consumers.is_empty()
+            || consumers
+                .iter()
+                .any(|unit| unit.features() != contributor.features())
+            || contributor.features().iter().collect::<BTreeSet<_>>().len()
+                != contributor.features().len()
+        {
+            return Err(spdx_error(
+                "native compiler context or effective unit features differ",
+            ));
+        }
+        let original = original(contributor, source)?;
+        let identity = serde_json::to_string(&json!([
+            "native-registry-v1",
+            source,
+            archive_sha256,
+            contributor.name(),
+            contributor.version(),
+            contributor.context()
+        ]))
+        .map_err(spdx_error)?;
+        plain(&identity)?;
+        if !stable.insert(identity.clone()) {
+            return Err(spdx_error(
+                "distinct native Cargo aliases have the same stable original/context identity",
+            ));
+        }
+        components.push(Component {
+            identity,
+            name: format!(
+                "Native inputs from Cargo wrapper {}@{}",
+                contributor.name(),
+                contributor.version()
+            ),
+            version: None,
+            roles: vec![if contributor.context() == UnitContext::Target {
+                ComponentRole::ObservedNative
+            } else {
+                ComponentRole::BuildMaterial
+            }],
+            origin: Some(Origin::NativeVerified { original }),
+            declared_license: None,
+        });
+    }
+    let mut expected = BTreeSet::new();
+    for unit in observed.units() {
+        if unit.target_kind().iter().any(|kind| kind == "custom-build") {
+            continue;
+        }
+        let package = observed
+            .packages()
+            .iter()
+            .find(|package| package.id() == unit.package_id())
+            .ok_or_else(|| spdx_error("native compiler context has no observed package"))?;
+        if reviewed_wrapper_version(package.name()).is_some() {
+            expected.insert((package.id(), unit.context() == UnitContext::Target));
+        }
+    }
+    if seen != expected {
+        return Err(spdx_error(
+            "observed native consuming contexts lack exact measured receipts",
+        ));
+    }
+    Ok(components)
+}
+
+fn original(
+    contributor: &NativeContributor,
+    source: &str,
+) -> Result<NativeOriginal, Report<ReleaseError>> {
+    if !lower_hex(contributor.source_tree_sha256(), 64) {
+        return Err(spdx_error("native prepared tree digest is invalid"));
+    }
+    let mut paths = BTreeSet::new();
+    let mut source_subtrees = Vec::new();
+    for subtree in contributor.source_subtrees() {
+        relative_source(subtree.path())?;
+        if !paths.insert(subtree.path()) || !lower_hex(subtree.sha256(), 64) {
+            return Err(spdx_error(
+                "native source subtree identity is invalid or duplicated",
+            ));
+        }
+        source_subtrees.push(Subtree {
+            relative_path: subtree.path().to_owned(),
+            tree_sha256: subtree.sha256().to_owned(),
+        });
+    }
+    let mut archives = BTreeSet::new();
+    let mut static_output_archives = Vec::new();
+    for archive in contributor.archives() {
+        let filename = archive
+            .filename()
+            .ok_or_else(|| spdx_error("native output has no logical filename"))?;
+        relative_source(filename)?;
+        if !archives.insert(filename.to_owned())
+            || !filename.ends_with(".a")
+            || archive.size() < 8
+            || !lower_hex(archive.sha256(), 64)
+        {
+            return Err(spdx_error(
+                "native output archive identity is invalid or duplicated",
+            ));
+        }
+        static_output_archives.push(Archive {
+            filename: filename.to_owned(),
+            size: archive.size(),
+            sha256: archive.sha256().to_owned(),
+        });
+    }
+    let mut libraries = BTreeSet::new();
+    for directive in contributor.linked_libs() {
+        let library = directive
+            .strip_prefix("static=")
+            .ok_or_else(|| spdx_error("native directive is not a static library"))?;
+        relative_source(library)?;
+        if library.contains('/') || !libraries.insert(format!("lib{library}.a")) {
+            return Err(spdx_error("native static library is invalid or duplicated"));
+        }
+    }
+    if source_subtrees.is_empty() || archives.is_empty() || archives != libraries {
+        return Err(spdx_error(
+            "native source or static-output coverage differs from link directives",
+        ));
+    }
+    Ok(NativeOriginal {
+        locked_source: source.to_owned(),
+        cargo_wrapper_name: contributor.name().to_owned(),
+        cargo_wrapper_version: contributor.version().to_owned(),
+        native_implementation_version: None,
+        original_registry_archive_sha256: contributor.original_sha256().to_owned(),
+        context: contributor.context(),
+        features: contributor.features().to_vec(),
+        prepared_source_tree_sha256: contributor.source_tree_sha256().to_owned(),
+        source_subtrees,
+        static_libraries: contributor.linked_libs().to_vec(),
+        static_output_archives,
+    })
+}
+
+pub(super) fn origin_fields(
+    component: &Component,
+    original: &NativeOriginal,
+) -> Result<OriginFields, Report<ReleaseError>> {
+    let expected = if original.context == UnitContext::Target {
+        ComponentRole::ObservedNative
+    } else {
+        ComponentRole::BuildMaterial
+    };
+    if component.roles != [expected]
+        || component.version.is_some()
+        || component.declared_license.is_some()
+    {
+        return Err(spdx_error(
+            "native roles, implementation version or declared license exceed measured facts",
+        ));
+    }
+    cargo::validate_material(
+        &original.locked_source,
+        &CargoOrigin::Registry {
+            archive_sha256: original.original_registry_archive_sha256.clone(),
+        },
+    )?;
+    let facts = serde_json::to_string(original).map_err(spdx_error)?;
+    let info = format!(
+        "Verified native inputs from Cargo wrapper facts {facts}. Cargo wrapper versions do not identify native implementation versions. Checksum identifies the original registry source archive; prepared/subtree digests are structured tree evidence and static output archives are measured build products. Conservative static-link inputs do not establish final function reachability. Complete native/tool coverage and original tool acquisition are not asserted."
+    );
+    plain(&info)?;
+    Ok((
+        "NOASSERTION".to_owned(),
+        info,
+        Some(("SHA256", original.original_registry_archive_sha256.clone())),
+    ))
+}
+
+#[cfg(test)]
+pub(crate) fn validate_for_tests(
+    inventory: &NativeInventory,
+    observed: &CargoObservations,
+    origins: &VerifiedPackageOrigins,
+) -> Result<(), Report<ReleaseError>> {
+    project(inventory, observed, origins).map(|_| ())
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/trusted-server-release/src/spdx/native/tests.rs b/crates/trusted-server-release/src/spdx/native/tests.rs
new file mode 100644
index 0000000000..b5045928a0
--- /dev/null
+++ b/crates/trusted-server-release/src/spdx/native/tests.rs
@@ -0,0 +1,148 @@
+use super::*;
+use crate::composition::UnitContext;
+use crate::composition::native::fixture_for_projection;
+use crate::composition::origin::VerifiedPackageOrigins;
+use sha2::Digest as _;
+
+#[test]
+fn native_license_declarations_require_native_license_evidence() {
+    for name in ["aws-lc-sys", "ring", "libsqlite3-sys"] {
+        for context in [UnitContext::Target, UnitContext::Host] {
+            let (inventory, observed) = fixture_for_projection(name, context);
+            let origins = VerifiedPackageOrigins::fixture_native_registry(&observed);
+            let mut components = project(&inventory, &observed, &origins)
+                .expect("should project measured native inputs");
+            components[0].declared_license = Some("MIT".to_owned());
+            let executable = b"fictional native executable";
+            let result = super::super::render(&super::super::SpdxInputs {
+                executable,
+                expected_artifact_sha256: hex::encode(sha2::Sha256::digest(executable)),
+                name: "example-cli".to_owned(),
+                version: "1.0.0".to_owned(),
+                source_commit: "a".repeat(40),
+                target: crate::policy::ReleaseTarget::Aarch64AppleDarwin,
+                created: "2026-01-01T00:00:00Z".to_owned(),
+                document_comment: None,
+                components,
+                dependencies: Vec::new(),
+            });
+            assert!(
+                result.is_err(),
+                "should reject an unsupported native license declaration for {name} in {context:?}"
+            );
+        }
+    }
+}
+
+#[test]
+fn target_and_host_native_inputs_keep_distinct_roles_and_unknown_implementation_versions() {
+    for context in [UnitContext::Target, UnitContext::Host] {
+        let (inventory, observed) = fixture_for_projection("ring", context);
+        let origins = VerifiedPackageOrigins::fixture_native_registry(&observed);
+        let components =
+            project(&inventory, &observed, &origins).expect("should project checked native facts");
+        assert_eq!(
+            components.len(),
+            1,
+            "should project one native wrapper context"
+        );
+        assert!(
+            components[0]
+                .roles
+                .contains(&if context == UnitContext::Target {
+                    ComponentRole::ObservedNative
+                } else {
+                    ComponentRole::BuildMaterial
+                }),
+            "should distinguish target contribution from host build input"
+        );
+        assert_eq!(
+            components[0].version, None,
+            "should not reuse Cargo wrapper version as native implementation version"
+        );
+    }
+}
+
+#[test]
+fn native_original_archive_checksum_and_measured_outputs_remain_distinct() {
+    for name in ["aws-lc-sys", "ring", "libsqlite3-sys"] {
+        let (inventory, observed) = fixture_for_projection(name, UnitContext::Target);
+        let origins = VerifiedPackageOrigins::fixture_native_registry(&observed);
+        let components =
+            project(&inventory, &observed, &origins).expect("should project checked native facts");
+        let executable = b"fictional native executable";
+        let document = super::super::render(&super::super::SpdxInputs {
+            executable,
+            expected_artifact_sha256: hex::encode(sha2::Sha256::digest(executable)),
+            name: "example-cli".to_owned(),
+            version: "1.0.0".to_owned(),
+            source_commit: "a".repeat(40),
+            target: crate::policy::ReleaseTarget::Aarch64AppleDarwin,
+            created: "2026-01-01T00:00:00Z".to_owned(),
+            document_comment: None,
+            components,
+            dependencies: Vec::new(),
+        })
+        .expect("should render native original facts against authoritative schema");
+        let value: serde_json::Value =
+            serde_json::from_slice(document.bytes()).expect("should parse SPDX");
+        let package = &value["packages"][1];
+        assert_eq!(
+            package["checksums"],
+            json!([{"algorithm":"SHA256","checksumValue":"a".repeat(64)}]),
+            "should checksum only the original registry source archive"
+        );
+        assert!(
+            package.get("versionInfo").is_none(),
+            "should not label native implementation with Cargo wrapper version"
+        );
+        assert_eq!(
+            package["downloadLocation"], "NOASSERTION",
+            "should not invent source archive URL"
+        );
+        assert_eq!(
+            package["licenseDeclared"], "NOASSERTION",
+            "should not infer native implementation license from wrapper"
+        );
+        let info = package["sourceInfo"]
+            .as_str()
+            .expect("should describe native provenance");
+        assert!(
+            info.contains(inventory.contributors()[0].archives()[0].sha256()),
+            "should retain measured static output digest as provenance"
+        );
+        assert!(
+            info.contains(inventory.contributors()[0].source_tree_sha256()),
+            "should retain structured prepared-tree provenance"
+        );
+        assert!(
+            info.contains("Cargo wrapper versions do not identify native implementation versions"),
+            "should label wrapper version limitations"
+        );
+        assert!(
+            !info.contains(observed.packages()[0].id()),
+            "should omit opaque package ID"
+        );
+        assert!(
+            !info.contains("/target/") && !info.contains("/vendor/"),
+            "should omit private source/output paths"
+        );
+    }
+}
+
+#[test]
+fn native_logical_ids_do_not_depend_on_private_source_and_output_roots() {
+    let identities = (0..2)
+        .map(|_| {
+            let (inventory, observed) = fixture_for_projection("ring", UnitContext::Target);
+            let origins = VerifiedPackageOrigins::fixture_native_registry(&observed);
+            project(&inventory, &observed, &origins).expect("should project relocated facts")[0]
+                .identity
+                .clone()
+        })
+        .collect::<Vec<_>>();
+    assert_eq!(
+        identities[0], identities[1],
+        "should preserve native logical identity across private root relocation"
+    );
+}
diff --git a/crates/trusted-server-release/src/spdx/platform.rs b/crates/trusted-server-release/src/spdx/platform.rs
new file mode 100644
index 0000000000..a71e3aed48
--- /dev/null
+++ b/crates/trusted-server-release/src/spdx/platform.rs
@@ -0,0 +1,447 @@
+//! Conservative projection of sealed installed-tool and logical runtime facts.
+
+use std::collections::BTreeSet;
+
+use error_stack::Report;
+use serde_json::json;
+
+use super::{
+    Component, ComponentRole, Dependency, Origin, OriginFields, lower_hex, plain, spdx_error,
+};
+use crate::composition::CompositionView;
+use crate::composition::external::Runtime;
+use crate::composition::platform::PlatformEvidence;
+use crate::error::ReleaseError;
+use crate::policy::ReleaseTarget;
+use crate::recipe::RecipeCompleted;
+
+#[cfg(test)]
+mod tests;
+
+/// Borrowed sealed platform evidence with conservative renderer components.
+///
+/// Coverage exclusions and incompleteness remain in the exact borrowed receipt;
+/// this adapter grants no complete-document or acquisition authority.
+pub(crate) struct PlatformProjection<'a> {
+    view: CompositionView<'a>,
+    components: Vec<Component>,
+}
+
+impl<'a> PlatformProjection<'a> {
+    /// Projects typed platform measurements after validating their completed owner.
+    ///
+    /// # Errors
+    ///
+    /// Rejects changed sealed receipts, another artifact, target, source, Rust
+    /// tree, GNU boundary/plan or an inconsistent Apple SDK observation.
+    pub(crate) fn from_completed(
+        completed: &'a RecipeCompleted,
+    ) -> Result<Self, Report<ReleaseError>> {
+        let view = completed.composition_view()?;
+        let owner = Owner {
+            target: completed.asset().artifact().target,
+            artifact: completed.artifact().sha256().to_owned(),
+            rust_tree: completed.rust_tools_digest().to_owned(),
+            source: completed.commit().as_str().to_owned(),
+            receipt_source: view.package_origins().source_commit().to_owned(),
+            boundary: completed.boundary_fingerprint(),
+            plan: completed.plan_digest().to_owned(),
+        };
+        let components = project(view.platform(), &owner)?;
+        Ok(Self { view, components })
+    }
+    /// Returns the number of renderer components without completeness authority.
+    pub(crate) fn component_count(&self) -> usize {
+        self.components.len()
+    }
+    /// Borrows exact sealed measurements, retaining exclusions and incompleteness.
+    pub(crate) fn evidence(&self) -> &PlatformEvidence {
+        self.view.platform()
+    }
+    /// Returns the digest of the exact sealed owning receipt.
+    pub(crate) fn receipt_sha256(&self) -> &str {
+        self.view.receipt_sha256()
+    }
+    /// Returns sorted, unique coverage gaps recorded in the sealed measurements.
+    pub(super) fn coverage_gaps(&self) -> Vec<String> {
+        coverage_gaps(self.view.platform())
+    }
+    /// Releases the renderer components; platform facts project no package edges.
+    pub(super) fn into_parts(self) -> (Vec<Component>, Vec<Dependency>) {
+        (self.components, Vec::new())
+    }
+}
+
+/// Names each recorded incompleteness without upgrading any measurement.
+fn coverage_gaps(platform: &PlatformEvidence) -> Vec<String> {
+    let mut gaps = BTreeSet::new();
+    if !platform.material_native_coverage_complete() {
+        gaps.insert("native-material-coverage-incomplete".to_owned());
+    }
+    for role in platform.unresolved_native_tool_roles() {
+        gaps.insert(format!("native-tool-host-path-unresolved:{role}"));
+    }
+    if platform.apple_tool_closure_unmeasured() {
+        gaps.insert("apple-tool-closure-unmeasured".to_owned());
+    }
+    if let Some(apple) = platform.apple() {
+        for exclusion in apple.coverage_exclusions() {
+            gaps.insert(format!("apple-coverage-excluded:{exclusion}"));
+        }
+    }
+    if let Some(gnu) = platform.gnu() {
+        if gnu.tool_closure_unmeasured() {
+            gaps.insert("gnu-tool-closure-unmeasured".to_owned());
+        }
+        if gnu.original_acquisition_unverified() {
+            gaps.insert("gnu-original-acquisition-unverified".to_owned());
+        }
+        if !gnu.content_unmeasured_files().is_empty() {
+            gaps.insert("gnu-privileged-helper-content-unmeasured".to_owned());
+        }
+    }
+    if platform.fastly_tools().is_some() {
+        gaps.insert("fastly-tool-closure-unmeasured".to_owned());
+        gaps.insert("fastly-original-acquisition-unverified".to_owned());
+    }
+    gaps.into_iter().collect()
+}
+
+struct Owner {
+    target: ReleaseTarget,
+    artifact: String,
+    rust_tree: String,
+    source: String,
+    receipt_source: String,
+    boundary: [u8; 32],
+    plan: String,
+}
+
+fn identity(
+    target: ReleaseTarget,
+    role: &str,
+    value: &str,
+) -> Result<String, Report<ReleaseError>> {
+    plain(role)?;
+    plain(value)?;
+    let key = serde_json::to_string(&json!(["platform-v1", target.triple(), role, value]))
+        .map_err(spdx_error)?;
+    plain(&key)?;
+    Ok(key)
+}
+
+fn component(
+    target: ReleaseTarget,
+    role: &str,
+    value: &str,
+    name: String,
+    roles: Vec<ComponentRole>,
+    origin: Origin,
+) -> Result<Component, Report<ReleaseError>> {
+    plain(&name)?;
+    Ok(Component {
+        identity: identity(target, role, value)?,
+        name,
+        version: None,
+        roles,
+        origin: Some(origin),
+        declared_license: None,
+    })
+}
+
+fn project(
+    platform: &PlatformEvidence,
+    owner: &Owner,
+) -> Result<Vec<Component>, Report<ReleaseError>> {
+    let external = platform.external_requirements();
+    if !lower_hex(&owner.source, 40)
+        || owner.source != owner.receipt_source
+        || !lower_hex(&owner.artifact, 64)
+        || !lower_hex(&owner.rust_tree, 64)
+        || platform.target() != owner.target.triple()
+        || platform.artifact_sha256() != owner.artifact
+        || platform.rust().target() != owner.target.triple()
+        || platform.rust().tree_sha256() != owner.rust_tree
+        || external.target() != owner.target
+        || external.artifact_sha256() != owner.artifact
+        || platform.apple().is_some() != owner.target.is_darwin()
+    {
+        return Err(spdx_error(
+            "platform measurements differ from the sealed source/artifact/target/tool owner",
+        ));
+    }
+    let mut components = vec![component(
+        owner.target,
+        "rust-installed-tree",
+        &owner.rust_tree,
+        "Measured Rust tool tree".to_owned(),
+        vec![ComponentRole::BuildMaterial, ComponentRole::BuildTool],
+        Origin::StructuredTree {
+            sha256: owner.rust_tree.clone(),
+        },
+    )?];
+    if let Some(apple) = platform.apple() {
+        if external.macho_sdk() != Some(apple.sdk_version()) {
+            return Err(spdx_error(
+                "Apple SDK differs from accepted executable requirements",
+            ));
+        }
+        for (role, sha256) in apple.tool_files() {
+            components.push(measured_file(
+                owner.target,
+                &format!("apple-{role}"),
+                sha256,
+                ComponentRole::BuildTool,
+            )?);
+        }
+        components.push(measured_file(
+            owner.target,
+            "apple-sdk-settings",
+            apple.sdk_settings_sha256(),
+            ComponentRole::BuildMaterial,
+        )?);
+        if let Some(sha256) = apple.sdk_tree_sha256() {
+            if !lower_hex(sha256, 64) {
+                return Err(spdx_error("invalid detached SDK tree identity"));
+            }
+            components.push(component(
+                owner.target,
+                "apple-sdk-installed-tree",
+                sha256,
+                "Measured detached Apple SDK tree".to_owned(),
+                vec![ComponentRole::BuildMaterial],
+                Origin::StructuredTree {
+                    sha256: sha256.to_owned(),
+                },
+            )?);
+        }
+        if let Some(sha256) = apple.liblto_sha256() {
+            components.push(measured_file(
+                owner.target,
+                "apple-liblto",
+                sha256,
+                ComponentRole::BuildTool,
+            )?);
+        }
+        if let Some(sha256) = apple.libtapi_sha256() {
+            components.push(measured_file(
+                owner.target,
+                "apple-libtapi",
+                sha256,
+                ComponentRole::BuildTool,
+            )?);
+        }
+        let toolchain_trees = [
+            (
+                "apple-toolchain-library-tree",
+                apple.library_tree_sha256(),
+                "Measured Apple toolchain library directory tree",
+                ComponentRole::BuildMaterial,
+            ),
+            (
+                "apple-clang-resource-tree",
+                apple.clang_resource_tree_sha256(),
+                "Measured Apple clang resource directory tree",
+                ComponentRole::BuildMaterial,
+            ),
+            (
+                "apple-toolchain-helper-tree",
+                apple.helper_tree_sha256(),
+                "Measured Apple toolchain helper directory tree",
+                ComponentRole::BuildTool,
+            ),
+        ];
+        for (role, digest, name, component_role) in toolchain_trees {
+            let Some(sha256) = digest else {
+                continue;
+            };
+            if !lower_hex(sha256, 64) {
+                return Err(spdx_error("invalid Apple toolchain tree identity"));
+            }
+            components.push(component(
+                owner.target,
+                role,
+                sha256,
+                name.to_owned(),
+                vec![component_role],
+                Origin::StructuredTree {
+                    sha256: sha256.to_owned(),
+                },
+            )?);
+        }
+    }
+    if let Some(gnu) = platform.gnu() {
+        if owner.target != ReleaseTarget::X86_64UnknownLinuxGnu {
+            return Err(spdx_error("GNU measurements belong to another platform"));
+        }
+        gnu.verify_binding(&owner.boundary, &owner.plan)
+            .map_err(|error| error.change_context(ReleaseError::Spdx))?;
+        let sha256 = gnu.installed_files_sha256();
+        if !lower_hex(sha256, 64) {
+            return Err(spdx_error("invalid GNU installed-image identity"));
+        }
+        components.push(component(
+            owner.target,
+            "gnu-installed-image-tree",
+            sha256,
+            format!(
+                "Measured GNU installed image files; {} reviewed privileged helpers bound by metadata only",
+                gnu.content_unmeasured_files().len()
+            ),
+            vec![ComponentRole::BuildMaterial],
+            Origin::StructuredTree {
+                sha256: sha256.to_owned(),
+            },
+        )?);
+        for (role, sha256) in gnu.measured_files() {
+            let component_role = match role {
+                "compiler_runtime" => ComponentRole::BuildMaterial,
+                "compiler"
+                | "archiver"
+                | "gcc_linker_candidate"
+                | "gcc_assembler_candidate"
+                | "configured_cc1"
+                | "configured_collect2"
+                | "configured_as"
+                | "configured_ld" => ComponentRole::BuildTool,
+                _ => return Err(spdx_error("GNU measured file role has not been reviewed")),
+            };
+            components.push(measured_file(
+                owner.target,
+                &format!("gnu-selected-or-configured-{role}"),
+                sha256,
+                component_role,
+            )?);
+        }
+    }
+    if let Some(fastly) = platform.fastly_tools() {
+        if owner.target != ReleaseTarget::Wasm32Wasip1 {
+            return Err(spdx_error("Fastly measurements belong to another platform"));
+        }
+        fastly
+            .verify_binding(&owner.boundary, &owner.plan)
+            .map_err(|error| error.change_context(ReleaseError::Spdx))?;
+        for (role, sha256) in fastly.measured_files() {
+            if ![
+                "host_compiler",
+                "host_archiver",
+                "configured_host_assembler",
+                "wasm_rust_linker",
+            ]
+            .contains(&role)
+            {
+                return Err(spdx_error("Fastly file role has not been reviewed"));
+            }
+            components.push(measured_file(
+                owner.target,
+                &format!("fastly-selected-or-configured-{role}"),
+                sha256,
+                ComponentRole::BuildTool,
+            )?);
+        }
+    }
+    let mut runtime = |kind: &str, value: &str| -> Result<(), Report<ReleaseError>> {
+        components.push(component(
+            owner.target,
+            kind,
+            value,
+            format!("Logical {kind}: {value}"),
+            vec![ComponentRole::ExternalRuntime],
+            Origin::RuntimeObservation {
+                artifact_sha256: owner.artifact.clone(),
+            },
+        )?);
+        Ok(())
+    };
+    match external.runtime() {
+        Runtime::Elf {
+            interpreter,
+            needed,
+            version_requirements,
+            max_glibc,
+        } => {
+            runtime("ELF loader", interpreter)?;
+            for library in needed {
+                runtime("ELF needed library", library)?;
+            }
+            for requirement in version_requirements {
+                runtime(
+                    "ELF symbol version",
+                    &serde_json::to_string(requirement).map_err(spdx_error)?,
+                )?;
+            }
+            runtime("ELF maximum required GLIBC", max_glibc)?;
+        }
+        Runtime::Macho {
+            loader,
+            cpu,
+            dylibs,
+            minimum_os,
+            sdk,
+        } => {
+            runtime("Mach-O loader", loader)?;
+            runtime("Mach-O CPU", cpu)?;
+            for library in dylibs {
+                runtime("Mach-O dylib", library)?;
+            }
+            runtime("Mach-O minimum OS", minimum_os)?;
+            runtime("Mach-O SDK", sdk)?;
+        }
+        Runtime::Wasm { import_modules } => {
+            for module in import_modules {
+                runtime("Wasm host import", module)?;
+            }
+        }
+    }
+    Ok(components)
+}
+
+fn measured_file(
+    target: ReleaseTarget,
+    role: &str,
+    sha256: &str,
+    component_role: ComponentRole,
+) -> Result<Component, Report<ReleaseError>> {
+    if !lower_hex(sha256, 64) {
+        return Err(spdx_error("invalid measured platform raw-file identity"));
+    }
+    component(
+        target,
+        role,
+        sha256,
+        format!("Measured platform file ({role})"),
+        vec![component_role],
+        Origin::PlatformMeasuredFile {
+            role: role.to_owned(),
+            sha256: sha256.to_owned(),
+        },
+    )
+}
+
+pub(super) fn file_origin_fields(
+    component: &Component,
+    role: &str,
+    sha256: &str,
+) -> Result<OriginFields, Report<ReleaseError>> {
+    plain(role)?;
+    if !lower_hex(sha256, 64)
+        || component.roles.is_empty()
+        || component.roles.iter().any(|role| {
+            !matches!(
+                role,
+                ComponentRole::BuildMaterial | ComponentRole::BuildTool
+            )
+        })
+    {
+        return Err(spdx_error(
+            "measured platform files cannot assert original acquisition or runtime bytes",
+        ));
+    }
+    Ok((
+        "NOASSERTION".to_owned(),
+        format!(
+            "Measured installed platform raw file for {role}; no original acquisition, download location, license or executed helper claim is asserted."
+        ),
+        Some(("SHA256", sha256.to_owned())),
+    ))
+}
diff --git a/crates/trusted-server-release/src/spdx/platform/tests.rs b/crates/trusted-server-release/src/spdx/platform/tests.rs
new file mode 100644
index 0000000000..71393b4fd5
--- /dev/null
+++ b/crates/trusted-server-release/src/spdx/platform/tests.rs
@@ -0,0 +1,646 @@
+use super::*;
+use crate::composition::platform::tests::projection_fixture;
+use sha2::{Digest as _, Sha256};
+
+#[test]
+fn libtapi_projects_only_present_measured_bytes_as_a_build_tool() {
+    for present in [false, true] {
+        let platform =
+            crate::composition::platform::tests::projection_toolchain_with_libtapi_fixture(present);
+        let components = project(&platform, &Owner::fixture(&platform))
+            .expect("should project optional TAPI measurements");
+        let tapi = components.iter().find(|component| {
+            matches!(
+                &component.origin,
+                Some(Origin::PlatformMeasuredFile { role, .. }) if role == "apple-libtapi"
+            )
+        });
+        assert_eq!(
+            tapi.is_some(),
+            present,
+            "should project only present libtapi"
+        );
+        if let Some(component) = tapi {
+            assert!(
+                component.declared_license.is_none(),
+                "should not invent a libtapi license"
+            );
+            let digest = hex::encode(Sha256::digest(b"fictional libtapi"));
+            assert!(
+                component.roles == [ComponentRole::BuildTool],
+                "should assert only a build tool role"
+            );
+            let (location, comment, checksum) =
+                file_origin_fields(component, "apple-libtapi", &digest)
+                    .expect("should render measured libtapi bytes");
+            assert_eq!(location, "NOASSERTION", "should not claim acquisition");
+            assert_eq!(
+                checksum,
+                Some(("SHA256", digest.clone())),
+                "should preserve raw-file checksum"
+            );
+            assert!(
+                comment.contains("no original acquisition")
+                    && comment.contains("executed helper claim"),
+                "should retain conservative measurement scope"
+            );
+            assert!(
+                matches!(&component.origin, Some(Origin::PlatformMeasuredFile { sha256, .. }) if sha256 == &digest),
+                "should bind measured libtapi bytes"
+            );
+        }
+        assert!(
+            coverage_gaps(&platform)
+                .contains(&"apple-coverage-excluded:toolchain_libraries".to_owned()),
+            "should retain unresolved library dependency/load closure coverage"
+        );
+        let receipt = serde_json::to_value(&platform).expect("should serialize platform receipt");
+        assert_eq!(
+            receipt["native_tools"]["full_closure_measured"], false,
+            "should retain incomplete closure"
+        );
+    }
+}
+
+impl Owner {
+    fn fixture(platform: &crate::composition::platform::PlatformEvidence) -> Self {
+        Self {
+            target: platform.external_requirements().target(),
+            artifact: platform.artifact_sha256().to_owned(),
+            rust_tree: platform.rust().tree_sha256().to_owned(),
+            source: "a".repeat(40),
+            receipt_source: "a".repeat(40),
+            boundary: [1; 32],
+            plan: "b".repeat(64),
+        }
+    }
+}
+
+#[test]
+fn projects_measured_trees_without_raw_checksums_and_runtime_without_byte_claims() {
+    let platform = projection_fixture(crate::policy::ReleaseTarget::Wasm32Wasip1);
+    let owner = Owner::fixture(&platform);
+    let components = project(&platform, &owner).expect("should project measured platform facts");
+    let rust = components
+        .iter()
+        .find(|component| component.name == "Measured Rust tool tree")
+        .expect("should project Rust tool tree");
+    assert!(
+        rust.roles.contains(&ComponentRole::BuildTool)
+            && rust.roles.contains(&ComponentRole::BuildMaterial),
+        "should preserve both installed Rust roles"
+    );
+    assert!(
+        matches!(&rust.origin, Some(Origin::StructuredTree { .. })),
+        "should not treat a structured tree digest as file bytes"
+    );
+    assert!(
+        components
+            .iter()
+            .any(|component| component.roles == [ComponentRole::ExternalRuntime]),
+        "should project actual Wasm logical imports"
+    );
+    for component in &components {
+        assert!(
+            !component.identity.contains("/boundary/")
+                && !component.identity.contains("/private/")
+                && !component.identity.contains("/var/"),
+            "should use stable identities independent of temporary roots"
+        );
+        assert!(
+            component.declared_license.is_none(),
+            "should not invent licenses"
+        );
+    }
+}
+
+#[test]
+fn rejects_another_artifact_target_rust_tree_or_source_owner() {
+    let platform = projection_fixture(crate::policy::ReleaseTarget::Wasm32Wasip1);
+    for field in ["artifact", "target", "rust", "source"] {
+        let mut owner = Owner::fixture(&platform);
+        match field {
+            "artifact" => owner.artifact = "b".repeat(64),
+            "target" => owner.target = crate::policy::ReleaseTarget::X86_64UnknownLinuxGnu,
+            "rust" => owner.rust_tree = "c".repeat(64),
+            "source" => owner.receipt_source = "d".repeat(40),
+            _ => unreachable!("should select a fixture field"),
+        }
+        assert!(
+            project(&platform, &owner).is_err(),
+            "should reject mismatched {field} owner"
+        );
+    }
+}
+
+#[test]
+fn gnu_projection_requires_the_owning_boundary_and_plan_and_calls_candidates_honestly() {
+    let platform = projection_fixture(crate::policy::ReleaseTarget::X86_64UnknownLinuxGnu)
+        .with_gnu(crate::recipe::gnu::GnuEvidence::projection_fixture())
+        .expect("should attach fictional typed GNU observations");
+    let mut owner = Owner::fixture(&platform);
+    let components = project(&platform, &owner).expect("should join GNU boundary and plan");
+    assert!(
+        components
+            .iter()
+            .any(|component| component.name.contains("gcc_linker_candidate")
+                && component.roles == [ComponentRole::BuildTool]),
+        "should retain configured candidate meaning without claiming execution"
+    );
+    owner.boundary = [2; 32];
+    assert!(
+        project(&platform, &owner).is_err(),
+        "should reject another GNU boundary"
+    );
+    owner.boundary = [1; 32];
+    owner.plan = "f".repeat(64);
+    assert!(
+        project(&platform, &owner).is_err(),
+        "should reject another GNU invocation"
+    );
+}
+
+#[test]
+fn apple_projection_preserves_raw_file_identity_and_logical_runtime_without_private_paths() {
+    let platform = projection_fixture(crate::policy::ReleaseTarget::Aarch64AppleDarwin);
+    let owner = Owner::fixture(&platform);
+    let components = project(&platform, &owner).expect("should project Apple platform");
+    assert_eq!(
+        components
+            .iter()
+            .filter(|component| matches!(
+                &component.origin,
+                Some(Origin::PlatformMeasuredFile { .. })
+            ))
+            .count(),
+        4,
+        "should project three tools and SDK settings as raw files"
+    );
+    assert!(
+        components.iter().any(|component| component.name
+            == format!(
+                "Logical Mach-O SDK: {}",
+                platform
+                    .external_requirements()
+                    .macho_sdk()
+                    .expect("should preserve accepted SDK")
+            )),
+        "should preserve accepted SDK requirement"
+    );
+    for component in &components {
+        assert!(
+            !component.identity.contains("MacOSX.platform")
+                && !component.identity.contains("/private/"),
+            "should exclude private SDK and tool paths from identity"
+        );
+    }
+}
+
+#[test]
+fn measured_file_renderer_asserts_only_bytes_and_rejects_runtime_roles() {
+    let mut component = measured_file(
+        crate::policy::ReleaseTarget::Wasm32Wasip1,
+        "fictional-tool",
+        &"a".repeat(64),
+        ComponentRole::BuildTool,
+    )
+    .expect("should describe installed file");
+    let (location, information, checksum) =
+        file_origin_fields(&component, "fictional-tool", &"a".repeat(64))
+            .expect("should render measured bytes");
+    assert_eq!(
+        location, "NOASSERTION",
+        "should not invent original acquisition location"
+    );
+    assert_eq!(
+        checksum,
+        Some(("SHA256", "a".repeat(64))),
+        "should checksum measured raw bytes"
+    );
+    assert!(
+        information.contains("no original acquisition") && information.contains("executed helper"),
+        "should preserve limits of measured facts"
+    );
+    component.roles = vec![ComponentRole::ExternalRuntime];
+    assert!(
+        file_origin_fields(&component, "fictional-tool", &"a".repeat(64)).is_err(),
+        "should never assign installed bytes to logical runtime requirements"
+    );
+}
+
+#[test]
+fn detached_sdk_is_structured_material_without_raw_file_checksum() {
+    let platform = crate::composition::platform::tests::projection_detached_sdk_fixture();
+    let owner = Owner::fixture(&platform);
+    let components = project(&platform, &owner).expect("should project detached SDK");
+    let sdk = components
+        .iter()
+        .find(|component| component.name == "Measured detached Apple SDK tree")
+        .expect("should retain SDK tree");
+    assert!(
+        sdk.roles == [ComponentRole::BuildMaterial]
+            && matches!(&sdk.origin, Some(Origin::StructuredTree { .. })),
+        "should preserve SDK tree evidence as structured material"
+    );
+    assert!(
+        platform
+            .apple()
+            .expect("should retain Apple receipt")
+            .sdk_tree_sha256()
+            .is_some(),
+        "should borrow original SDK tree receipt"
+    );
+}
+
+#[test]
+fn measured_toolchain_projects_library_resource_and_helper_trees_and_retains_closure_gaps() {
+    let platform = crate::composition::platform::tests::projection_measured_toolchain_fixture();
+    let owner = Owner::fixture(&platform);
+    let components = project(&platform, &owner).expect("should project measured toolchain");
+    let apple = platform.apple().expect("should retain Apple receipt");
+    for (name, sha256, role) in [
+        (
+            "Measured Apple toolchain library directory tree",
+            apple.library_tree_sha256(),
+            ComponentRole::BuildMaterial,
+        ),
+        (
+            "Measured Apple clang resource directory tree",
+            apple.clang_resource_tree_sha256(),
+            ComponentRole::BuildMaterial,
+        ),
+        (
+            "Measured Apple toolchain helper directory tree",
+            apple.helper_tree_sha256(),
+            ComponentRole::BuildTool,
+        ),
+    ] {
+        let sha256 = sha256.expect("should hold the measured tree digest");
+        let tree = components
+            .iter()
+            .find(|component| component.name == name)
+            .unwrap_or_else(|| panic!("should project {name}"));
+        assert!(
+            tree.roles == [role]
+                && matches!(&tree.origin, Some(Origin::StructuredTree { sha256: digest }) if digest == sha256),
+            "should project {name} as a structured tree"
+        );
+        assert!(
+            tree.declared_license.is_none(),
+            "should not invent a tree license"
+        );
+        if name == "Measured Apple toolchain library directory tree" {
+            let inputs = super::super::SpdxInputs {
+                executable: b"",
+                expected_artifact_sha256: owner.artifact.clone(),
+                name: "fictional-artifact".to_owned(),
+                version: "1.0.0".to_owned(),
+                source_commit: owner.source.clone(),
+                target: owner.target,
+                created: "2026-01-01T00:00:00Z".to_owned(),
+                document_comment: None,
+                components: vec![],
+                dependencies: vec![],
+            };
+            let (location, comment, checksum) = super::super::origin_fields(tree, &inputs)
+                .expect("should render structured library material");
+            assert_eq!(location, "NOASSERTION", "should not invent acquisition");
+            assert!(
+                checksum.is_none(),
+                "should not render a raw-file checksum for a tree"
+            );
+            assert!(
+                comment.contains("Structured installed-tree evidence"),
+                "should state only installed-tree evidence"
+            );
+            assert_eq!(
+                tree.identity,
+                identity(owner.target, "apple-toolchain-library-tree", sha256)
+                    .expect("should construct stable library material identity"),
+                "should retain stable library tree role"
+            );
+        }
+    }
+    assert!(
+        components
+            .iter()
+            .any(|component| component.name == "Measured platform file (apple-liblto)"),
+        "should project libLTO as a measured file"
+    );
+    let gaps = coverage_gaps(&platform);
+    for measured in ["tool_helpers", "liblto", "clang_resource_directory"] {
+        assert!(
+            !gaps.contains(&format!("apple-coverage-excluded:{measured}")),
+            "should not state measured {measured} as excluded"
+        );
+    }
+    for retained in [
+        "apple-coverage-excluded:toolchain_libraries",
+        "apple-tool-closure-unmeasured",
+    ] {
+        assert!(
+            gaps.iter().any(|gap| gap == retained),
+            "should retain {retained}"
+        );
+    }
+}
+
+#[test]
+fn rendered_projection_preserves_runtime_constraints_without_runtime_byte_checksums() {
+    let platform = projection_fixture(crate::policy::ReleaseTarget::Wasm32Wasip1);
+    let owner = Owner::fixture(&platform);
+    let executable =
+        crate::inspect::tests::builders::wasm_module(&[("fastly_http_req", "downstream_get")]);
+    let components = project(&platform, &owner).expect("should project platform");
+    let inputs = super::super::SpdxInputs {
+        executable: &executable,
+        expected_artifact_sha256: owner.artifact,
+        name: "fictional-artifact".to_owned(),
+        version: "1.0.0".to_owned(),
+        source_commit: owner.source,
+        target: owner.target,
+        created: "2026-01-01T00:00:00Z".to_owned(),
+        document_comment: None,
+        components,
+        dependencies: vec![],
+    };
+    let rendered =
+        super::super::render(&inputs).expect("should render schema-valid fictional projection");
+    let json: serde_json::Value =
+        serde_json::from_slice(rendered.bytes()).expect("should inspect rendered document");
+    let runtime = json["packages"]
+        .as_array()
+        .expect("should retain packages")
+        .iter()
+        .find(|package| package["name"] == "Logical Wasm host import: fastly_http_req")
+        .expect("should retain exact runtime requirement");
+    assert!(
+        runtime.get("checksums").is_none(),
+        "should never checksum logical runtime bytes"
+    );
+    assert_eq!(
+        runtime["downloadLocation"], "NOASSERTION",
+        "should not invent runtime acquisition"
+    );
+}
+
+#[test]
+fn compiler_runtime_archive_is_a_build_dependency_with_no_tool_or_retention_claim() {
+    let platform = projection_fixture(crate::policy::ReleaseTarget::X86_64UnknownLinuxGnu)
+        .with_gnu(crate::recipe::gnu::GnuEvidence::projection_fixture())
+        .expect("should attach fictional GNU receipt");
+    let owner = Owner::fixture(&platform);
+    let components = project(&platform, &owner).expect("should project installed GNU facts");
+    let runtime = components
+        .iter()
+        .find(|component| component.name.contains("compiler_runtime"))
+        .expect("should project measured compiler runtime archive");
+    assert!(
+        runtime.roles == [ComponentRole::BuildMaterial],
+        "should classify libgcc.a as build material rather than an executed tool"
+    );
+    let id = super::super::component_id(&runtime.identity);
+    let executable = crate::inspect::tests::builders::elf(
+        &crate::inspect::tests::builders::ElfSpec::conforming(),
+    );
+    let inputs = super::super::SpdxInputs {
+        executable: &executable,
+        expected_artifact_sha256: owner.artifact,
+        name: "fictional-artifact".to_owned(),
+        version: "1.0.0".to_owned(),
+        source_commit: owner.source,
+        target: owner.target,
+        created: "2026-01-01T00:00:00Z".to_owned(),
+        document_comment: None,
+        components,
+        dependencies: vec![],
+    };
+    let rendered = super::super::render(&inputs).expect("should render measured GNU projection");
+    let json: serde_json::Value =
+        serde_json::from_slice(rendered.bytes()).expect("should inspect rendered relationships");
+    let relationships = json["relationships"]
+        .as_array()
+        .expect("should retain relationships");
+    assert!(
+        relationships
+            .iter()
+            .any(|relation| relation["spdxElementId"] == id
+                && relation["relationshipType"] == "BUILD_DEPENDENCY_OF"
+                && relation["comment"]
+                    .as_str()
+                    .is_some_and(|comment| comment.contains("retention is not asserted"))),
+        "should preserve archive as a measured build dependency without retention inference"
+    );
+    assert!(
+        !relationships
+            .iter()
+            .any(|relation| relation["spdxElementId"] == id
+                && matches!(
+                    relation["relationshipType"].as_str(),
+                    Some("BUILD_TOOL_OF" | "RUNTIME_DEPENDENCY_OF" | "CONTAINS")
+                )),
+        "should not classify compiler runtime archive as tool, logical runtime, or retained bytes"
+    );
+    let package = json["packages"]
+        .as_array()
+        .expect("should retain packages")
+        .iter()
+        .find(|package| package["SPDXID"] == id)
+        .expect("should retain measured archive package");
+    assert_eq!(
+        package["checksums"][0]["checksumValue"],
+        "c".repeat(64),
+        "should retain measured archive raw-byte identity"
+    );
+    assert_eq!(
+        package["downloadLocation"], "NOASSERTION",
+        "should not invent original archive acquisition"
+    );
+}
+
+#[test]
+fn new_gnu_file_roles_require_review_before_projection() {
+    let platform = projection_fixture(crate::policy::ReleaseTarget::X86_64UnknownLinuxGnu)
+        .with_gnu(crate::recipe::gnu::GnuEvidence::projection_fixture_with_unknown_file_role())
+        .expect("should attach fictional unknown resource");
+    assert!(
+        project(&platform, &Owner::fixture(&platform)).is_err(),
+        "should reject new resources until their component role is reviewed"
+    );
+}
+
+#[test]
+fn coverage_gaps_name_unresolved_fastly_tools_and_incomplete_native_materials() {
+    let platform = projection_fixture(crate::policy::ReleaseTarget::Wasm32Wasip1);
+    let gaps = coverage_gaps(&platform);
+    for expected in [
+        "native-material-coverage-incomplete",
+        "native-tool-host-path-unresolved:compiler",
+        "native-tool-host-path-unresolved:linker",
+        "native-tool-host-path-unresolved:build_tools",
+    ] {
+        assert!(
+            gaps.iter().any(|gap| gap == expected),
+            "should state gap {expected}"
+        );
+    }
+    assert!(
+        gaps.windows(2).all(|pair| pair[0] < pair[1]),
+        "should list gaps sorted and unique"
+    );
+    assert!(
+        !gaps.iter().any(|gap| gap.starts_with("apple-")),
+        "should not invent Apple gaps for a Wasm target"
+    );
+}
+
+#[test]
+fn coverage_gaps_retain_gnu_tool_closure_without_unreadable_helpers() {
+    let platform = projection_fixture(crate::policy::ReleaseTarget::X86_64UnknownLinuxGnu)
+        .with_gnu(crate::recipe::gnu::GnuEvidence::projection_fixture())
+        .expect("should attach fictional GNU measurements");
+    assert!(
+        platform
+            .gnu()
+            .expect("should hold GNU evidence")
+            .content_unmeasured_files()
+            .is_empty(),
+        "should exercise fully readable installed files"
+    );
+    let gaps = coverage_gaps(&platform);
+    assert!(
+        gaps.iter().any(|gap| gap == "gnu-tool-closure-unmeasured"),
+        "should retain the unmeasured GNU tool closure"
+    );
+    assert!(
+        gaps.windows(2).all(|pair| pair[0] < pair[1]),
+        "should list gaps sorted and unique"
+    );
+}
+
+#[test]
+fn coverage_gaps_retain_gnu_unverified_acquisition_without_unreadable_helpers() {
+    let platform = projection_fixture(crate::policy::ReleaseTarget::X86_64UnknownLinuxGnu)
+        .with_gnu(crate::recipe::gnu::GnuEvidence::projection_fixture())
+        .expect("should attach fictional GNU measurements");
+    let gaps = coverage_gaps(&platform);
+    assert!(
+        gaps.iter()
+            .any(|gap| gap == "gnu-original-acquisition-unverified"),
+        "should retain unverified GNU original acquisition"
+    );
+    assert!(
+        !gaps
+            .iter()
+            .any(|gap| gap == "gnu-privileged-helper-content-unmeasured"),
+        "should not invent unreadable helper content"
+    );
+}
+
+#[test]
+fn coverage_gaps_do_not_invent_gnu_measurements_for_other_platforms() {
+    for target in [
+        crate::policy::ReleaseTarget::Wasm32Wasip1,
+        crate::policy::ReleaseTarget::Aarch64AppleDarwin,
+        crate::policy::ReleaseTarget::X86_64AppleDarwin,
+    ] {
+        let platform = projection_fixture(target);
+        assert!(
+            !coverage_gaps(&platform)
+                .iter()
+                .any(|gap| gap.starts_with("gnu-")),
+            "should not invent GNU gaps for {}",
+            target.triple()
+        );
+    }
+}
+
+#[test]
+fn coverage_gaps_retain_apple_exclusions_and_unmeasured_tool_closure() {
+    let platform = projection_fixture(crate::policy::ReleaseTarget::Aarch64AppleDarwin);
+    let gaps = coverage_gaps(&platform);
+    assert!(
+        gaps.iter()
+            .any(|gap| gap == "apple-tool-closure-unmeasured"),
+        "should state the unmeasured Apple tool closure"
+    );
+    let apple = platform.apple().expect("should hold Apple evidence");
+    assert!(
+        !apple.coverage_exclusions().is_empty(),
+        "should record fixture exclusions"
+    );
+    for exclusion in apple.coverage_exclusions() {
+        let expected = format!("apple-coverage-excluded:{exclusion}");
+        assert!(
+            gaps.contains(&expected),
+            "should state Apple exclusion {exclusion}"
+        );
+    }
+    assert!(
+        !gaps
+            .iter()
+            .any(|gap| gap.starts_with("native-tool-host-path-unresolved:")),
+        "should not report unresolved host paths for explicit Apple files"
+    );
+}
+
+#[test]
+fn fastly_selected_tools_project_with_owner_binding_and_conservative_gaps() {
+    let platform = projection_fixture(ReleaseTarget::Wasm32Wasip1)
+        .with_fastly_tools(crate::recipe::fastly_tools::FastlyToolEvidence::projection_fixture())
+        .expect("should attach fictional Fastly selections");
+    let mut owner = Owner::fixture(&platform);
+    let components = project(&platform, &owner).expect("should project fixed host files");
+    let files = components
+        .iter()
+        .filter(|component| matches!(component.origin, Some(Origin::PlatformMeasuredFile { .. })))
+        .collect::<Vec<_>>();
+    assert_eq!(
+        files.len(),
+        4,
+        "should project four selected or configured files"
+    );
+    for component in files {
+        assert!(
+            component.roles == [ComponentRole::BuildTool],
+            "should retain installed tool scope"
+        );
+        assert!(
+            component.declared_license.is_none(),
+            "should not invent acquisition or license"
+        );
+        assert!(
+            !component.identity.contains("/boundary"),
+            "should exclude private paths from identity"
+        );
+    }
+    let gaps = coverage_gaps(&platform);
+    for gap in [
+        "native-tool-host-path-unresolved:assembler",
+        "native-tool-host-path-unresolved:build_tools",
+        "fastly-tool-closure-unmeasured",
+        "native-material-coverage-incomplete",
+    ] {
+        assert!(
+            gaps.contains(&gap.to_owned()),
+            "should retain honest gap {gap}"
+        );
+    }
+    for role in ["compiler", "archiver", "linker"] {
+        assert!(
+            !gaps.contains(&format!("native-tool-host-path-unresolved:{role}")),
+            "should resolve selected host role {role}"
+        );
+    }
+    owner.boundary = [2; 32];
+    assert!(
+        project(&platform, &owner).is_err(),
+        "should reject another boundary"
+    );
+    owner.boundary = [1; 32];
+    owner.plan = "f".repeat(64);
+    assert!(
+        project(&platform, &owner).is_err(),
+        "should reject another plan"
+    );
+}
diff --git a/crates/trusted-server-release/src/spdx/tests.rs b/crates/trusted-server-release/src/spdx/tests.rs
new file mode 100644
index 0000000000..4dbe3a681f
--- /dev/null
+++ b/crates/trusted-server-release/src/spdx/tests.rs
@@ -0,0 +1,656 @@
+use serde_json::{Value, json};
+use sha2::Sha256;
+
+use super::*;
+
+const EXECUTABLE: &[u8] = b"fictional final executable bytes";
+
+fn fixture() -> SpdxInputs<'static> {
+    let digest = hex::encode(Sha256::digest(EXECUTABLE));
+    SpdxInputs {
+        executable: EXECUTABLE,
+        expected_artifact_sha256: digest.clone(),
+        name: "example-artifact".to_owned(),
+        version: "1.0.0".to_owned(),
+        source_commit: "a".repeat(40),
+        target: ReleaseTarget::Wasm32Wasip1,
+        created: "2026-01-01T00:00:00Z".to_owned(),
+        document_comment: None,
+        components: vec![
+            component(
+                "rust:example",
+                ComponentRole::ObservedRust,
+                Origin::Source {
+                    commit: "a".repeat(40),
+                    path: "crates/example".to_owned(),
+                },
+            ),
+            component(
+                "js:core",
+                ComponentRole::RetainedJavascript,
+                Origin::Distribution {
+                    location: "https://example.com/core.tgz".to_owned(),
+                    sha256: "b".repeat(64),
+                },
+            ),
+            component(
+                "native:example",
+                ComponentRole::ObservedNative,
+                Origin::Distribution {
+                    location: "https://example.com/native.tgz".to_owned(),
+                    sha256: "c".repeat(64),
+                },
+            ),
+            component(
+                "prepared:discarded",
+                ComponentRole::BuildMaterial,
+                Origin::Source {
+                    commit: "a".repeat(40),
+                    path: "src/discarded.ts".to_owned(),
+                },
+            ),
+            component(
+                "tool:example",
+                ComponentRole::BuildTool,
+                Origin::StructuredTree {
+                    sha256: "d".repeat(64),
+                },
+            ),
+            component(
+                "runtime:example",
+                ComponentRole::ExternalRuntime,
+                Origin::RuntimeObservation {
+                    artifact_sha256: digest,
+                },
+            ),
+        ],
+        dependencies: vec![],
+    }
+}
+
+fn component(identity: &str, role: ComponentRole, origin: Origin) -> Component {
+    Component {
+        identity: identity.to_owned(),
+        name: identity.to_owned(),
+        version: Some("1.0.0".to_owned()),
+        roles: vec![role],
+        origin: Some(origin),
+        declared_license: Some("MIT".to_owned()),
+    }
+}
+
+fn document(inputs: &SpdxInputs<'_>) -> Value {
+    serde_json::from_slice(
+        render(inputs)
+            .expect("should render fictional complete inputs")
+            .bytes(),
+    )
+    .expect("should parse generated SPDX")
+}
+
+fn package<'a>(document: &'a Value, name: &str) -> &'a Value {
+    document["packages"]
+        .as_array()
+        .expect("should contain packages")
+        .iter()
+        .find(|package| package["name"] == name)
+        .expect("should find component package")
+}
+
+fn relation(document: &Value, from: &str, kind: &str, to: &str) -> bool {
+    document["relationships"]
+        .as_array()
+        .expect("should contain relationships")
+        .iter()
+        .any(|relation| {
+            relation["spdxElementId"] == from
+                && relation["relationshipType"] == kind
+                && relation["relatedSpdxElement"] == to
+        })
+}
+
+#[test]
+fn renders_schema_valid_document_with_exact_executable_root_and_document_digest() {
+    let inputs = fixture();
+    let output = render(&inputs).expect("should render fictional complete inputs");
+    let doc: Value = serde_json::from_slice(output.bytes()).expect("should parse generated bytes");
+    crate::documents::validate_spdx(&doc)
+        .expect("should validate against the pinned authoritative schema");
+    assert_eq!(
+        doc["spdxVersion"], "SPDX-2.3",
+        "should use the required SPDX version"
+    );
+    assert_eq!(
+        doc["SPDXID"], "SPDXRef-DOCUMENT",
+        "should use the document identifier"
+    );
+    let root = package(&doc, "example-artifact");
+    assert_eq!(
+        root["checksums"],
+        json!([{"algorithm":"SHA256","checksumValue":inputs.expected_artifact_sha256}]),
+        "should bind root only to raw executable bytes"
+    );
+    assert_eq!(
+        doc["documentDescribes"],
+        json!([root["SPDXID"]]),
+        "should describe exactly one root package"
+    );
+    assert_eq!(
+        output.sha256(),
+        hex::encode(Sha256::digest(output.bytes())),
+        "should hash exact document bytes separately"
+    );
+    assert!(
+        output.bytes().ends_with(b"\n"),
+        "should terminate bounded canonical JSON"
+    );
+}
+
+#[test]
+fn distinguishes_observed_contributors_retained_js_materials_tools_and_external_requirements() {
+    let doc = document(&fixture());
+    let root = package(&doc, "example-artifact")["SPDXID"]
+        .as_str()
+        .expect("should have root ID");
+    for (name, kind, component_first) in [
+        ("rust:example", "GENERATED_FROM", false),
+        ("native:example", "GENERATED_FROM", false),
+        ("js:core", "CONTAINS", false),
+        ("prepared:discarded", "BUILD_DEPENDENCY_OF", true),
+        ("tool:example", "BUILD_TOOL_OF", true),
+        ("runtime:example", "RUNTIME_DEPENDENCY_OF", true),
+    ] {
+        let id = package(&doc, name)["SPDXID"]
+            .as_str()
+            .expect("should identify component");
+        assert!(
+            if component_first {
+                relation(&doc, id, kind, root)
+            } else {
+                relation(&doc, root, kind, id)
+            },
+            "should preserve {name} role"
+        );
+    }
+    assert!(
+        package(&doc, "tool:example").get("checksums").is_none(),
+        "should never mislabel a structured tree digest as a raw file checksum"
+    );
+    assert!(
+        package(&doc, "tool:example")["sourceInfo"]
+            .as_str()
+            .expect("should describe measured tree")
+            .contains(&"d".repeat(64)),
+        "should preserve tree evidence without changing checksum meaning"
+    );
+    assert_eq!(
+        package(&doc, "rust:example")["filesAnalyzed"],
+        false,
+        "should not claim file license analysis"
+    );
+    assert!(
+        package(&doc, "rust:example")
+            .get("packageVerificationCode")
+            .is_none(),
+        "should omit file verification code without file analysis"
+    );
+}
+
+#[test]
+fn stable_ids_and_document_bytes_do_not_depend_on_input_component_order() {
+    let inputs = fixture();
+    let first = render(&inputs).expect("should render sorted inputs");
+    let mut reordered = fixture();
+    reordered.components.reverse();
+    assert_eq!(
+        first.bytes(),
+        render(&reordered)
+            .expect("should render reordered inputs")
+            .bytes(),
+        "should sort identities and relationships deterministically"
+    );
+    let doc = document(&inputs);
+    let ids: Vec<_> = doc["packages"]
+        .as_array()
+        .expect("should contain packages")
+        .iter()
+        .map(|package| package["SPDXID"].as_str().expect("should contain SPDX ID"))
+        .collect();
+    assert_eq!(
+        ids.len(),
+        ids.iter().collect::<std::collections::BTreeSet<_>>().len(),
+        "should issue unique stable SPDX IDs"
+    );
+}
+
+#[test]
+fn one_cargo_identity_can_be_both_observed_target_and_host_build_tool() {
+    let mut inputs = fixture();
+    inputs.components[0].roles.push(ComponentRole::BuildTool);
+    let first = render(&inputs).expect("should render both roles of one Cargo identity");
+    let doc: Value =
+        serde_json::from_slice(first.bytes()).expect("should parse dual-role document");
+    let root = package(&doc, "example-artifact")["SPDXID"]
+        .as_str()
+        .expect("should identify artifact");
+    let identity = package(&doc, "rust:example")["SPDXID"]
+        .as_str()
+        .expect("should identify Cargo package");
+    assert!(
+        relation(&doc, root, "GENERATED_FROM", identity),
+        "should retain observed target contributor role"
+    );
+    assert!(
+        relation(&doc, identity, "BUILD_TOOL_OF", root),
+        "should retain host build tool role"
+    );
+    assert_eq!(
+        doc["packages"]
+            .as_array()
+            .expect("should contain packages")
+            .iter()
+            .filter(|package| package["name"] == "rust:example")
+            .count(),
+        1,
+        "should represent one exact Cargo identity with one SPDX package"
+    );
+    inputs.components[0].roles.reverse();
+    assert_eq!(
+        first.bytes(),
+        render(&inputs)
+            .expect("should render reversed roles")
+            .bytes(),
+        "should preserve stable bytes independently of role order"
+    );
+}
+
+#[test]
+fn component_roles_must_be_nonempty_unique_and_compatible_with_origin() {
+    for mutation in ["empty", "duplicate", "runtime_mixed", "tree_contributor"] {
+        let mut inputs = fixture();
+        match mutation {
+            "empty" => inputs.components[0].roles.clear(),
+            "duplicate" => inputs.components[0].roles.push(ComponentRole::ObservedRust),
+            "runtime_mixed" => inputs.components[5]
+                .roles
+                .push(ComponentRole::BuildMaterial),
+            "tree_contributor" => inputs.components[4].roles.push(ComponentRole::ObservedRust),
+            _ => unreachable!(),
+        }
+        assert!(
+            render(&inputs).is_err(),
+            "should reject {mutation} component roles"
+        );
+    }
+}
+
+#[test]
+fn normal_and_build_dependencies_preserve_direction_and_reject_duplicates() {
+    let mut inputs = fixture();
+    inputs.dependencies = vec![
+        Dependency {
+            from: "rust:example".to_owned(),
+            to: "native:example".to_owned(),
+            build: false,
+        },
+        Dependency {
+            from: "rust:example".to_owned(),
+            to: "tool:example".to_owned(),
+            build: true,
+        },
+    ];
+    let first = render(&inputs).expect("should render normal and build dependency edges");
+    let doc: Value =
+        serde_json::from_slice(first.bytes()).expect("should parse dependency document");
+    let parent = package(&doc, "rust:example")["SPDXID"]
+        .as_str()
+        .expect("should identify parent package");
+    let dependency = package(&doc, "native:example")["SPDXID"]
+        .as_str()
+        .expect("should identify ordinary dependency");
+    let build = package(&doc, "tool:example")["SPDXID"]
+        .as_str()
+        .expect("should identify build dependency");
+    assert!(
+        relation(&doc, parent, "DEPENDS_ON", dependency),
+        "should point normal dependency from parent to dependency"
+    );
+    assert!(
+        relation(&doc, build, "BUILD_DEPENDENCY_OF", parent),
+        "should point build dependency toward its consuming parent"
+    );
+    inputs.dependencies.reverse();
+    assert_eq!(
+        first.bytes(),
+        render(&inputs)
+            .expect("should render reordered dependencies")
+            .bytes(),
+        "should sort dependency relationships independently of input order"
+    );
+    inputs.dependencies.push(Dependency {
+        from: "rust:example".to_owned(),
+        to: "native:example".to_owned(),
+        build: false,
+    });
+    assert!(
+        render(&inputs).is_err(),
+        "should reject duplicate dependency edges"
+    );
+}
+
+#[test]
+fn rejects_root_digest_changes_duplicate_identities_missing_origins_and_dangling_edges() {
+    for mutation in [
+        "digest",
+        "duplicate",
+        "origin",
+        "dangling",
+        "runtime_digest",
+        "origin_role",
+        "invalid_license",
+    ] {
+        let mut inputs = fixture();
+        match mutation {
+            "digest" => inputs.expected_artifact_sha256 = "f".repeat(64),
+            "duplicate" => inputs.components[1].identity = inputs.components[0].identity.clone(),
+            "origin" => inputs.components[0].origin = None,
+            "dangling" => inputs.dependencies.push(Dependency {
+                from: "rust:example".to_owned(),
+                to: "missing".to_owned(),
+                build: false,
+            }),
+            "runtime_digest" => {
+                inputs.components[5].origin = Some(Origin::RuntimeObservation {
+                    artifact_sha256: "f".repeat(64),
+                })
+            }
+            "origin_role" => {
+                inputs.components[0].origin = Some(Origin::RuntimeObservation {
+                    artifact_sha256: inputs.expected_artifact_sha256.clone(),
+                })
+            }
+            "invalid_license" => {
+                inputs.components[0].declared_license = Some("MIT\0injected".to_owned())
+            }
+            _ => unreachable!(),
+        }
+        assert!(render(&inputs).is_err(), "should reject {mutation}");
+    }
+}
+
+#[test]
+fn declared_license_facts_remain_exact_without_becoming_license_conclusions() {
+    for declaration in [
+        "MIT",
+        "Apache-2.0",
+        "MIT OR Apache-2.0",
+        "Apache-2.0 OR MIT",
+    ] {
+        let mut inputs = fixture();
+        inputs.components[0].declared_license = Some(declaration.to_owned());
+        let doc = document(&inputs);
+        let observed = package(&doc, "rust:example");
+        assert_eq!(
+            observed["licenseDeclared"], declaration,
+            "should retain the exact reviewed observed declaration"
+        );
+        assert_eq!(
+            observed["licenseConcluded"], "NOASSERTION",
+            "should not turn a declaration into license analysis"
+        );
+        assert_eq!(
+            observed["filesAnalyzed"], false,
+            "should not imply license-file inspection"
+        );
+    }
+    for declaration in [
+        None,
+        Some("Example unreviewed license"),
+        Some("MIT AND LicenseRef-Example-Unreviewed"),
+        Some("NONE"),
+    ] {
+        let mut inputs = fixture();
+        inputs.components[0].declared_license = declaration.map(str::to_owned);
+        let doc = document(&inputs);
+        let observed = package(&doc, "rust:example");
+        assert_eq!(
+            observed["licenseDeclared"], "NOASSERTION",
+            "should not infer a declaration from missing or unreviewed facts"
+        );
+        assert_eq!(
+            observed["licenseConcluded"], "NOASSERTION",
+            "should not infer a legal conclusion or license absence"
+        );
+        if let Some(declaration) = declaration {
+            assert!(
+                observed["licenseComments"]
+                    .as_str()
+                    .expect("should retain bounded declaration context")
+                    .contains(declaration),
+                "should preserve an unreviewed declaration without reinterpreting it"
+            );
+        }
+    }
+}
+
+#[test]
+fn unknown_licenses_use_noassertion_and_never_become_unsupported_expressions() {
+    let mut inputs = fixture();
+    inputs.components[0].declared_license = Some("Example unknown license".to_owned());
+    inputs.components[1].declared_license = None;
+    let doc = document(&inputs);
+    for name in ["rust:example", "js:core"] {
+        assert_eq!(
+            package(&doc, name)["licenseDeclared"],
+            "NOASSERTION",
+            "should not invent a declared license for {name}"
+        );
+        assert_eq!(
+            package(&doc, name)["licenseConcluded"],
+            "NOASSERTION",
+            "should not claim a license conclusion"
+        );
+    }
+    assert!(
+        package(&doc, "rust:example")["licenseComments"]
+            .as_str()
+            .expect("should explain unknown declaration")
+            .contains("Example unknown license"),
+        "should retain bounded observed declaration as an explanation"
+    );
+    assert_eq!(
+        package(&doc, "native:example")["licenseDeclared"],
+        "MIT",
+        "should preserve a reviewed exact known declaration"
+    );
+}
+
+#[test]
+fn generated_js_requires_a_known_producer_and_retains_generated_bytes_identity() {
+    let mut inputs = fixture();
+    inputs.components.push(component(
+        "generated:helper",
+        ComponentRole::BuildMaterial,
+        Origin::Generated {
+            producer: "tool:example".to_owned(),
+            sha256: "e".repeat(64),
+        },
+    ));
+    let doc = document(&inputs);
+    let generated = package(&doc, "generated:helper");
+    assert_eq!(
+        generated["checksums"][0]["checksumValue"],
+        "e".repeat(64),
+        "should preserve hash of actual generated code bytes"
+    );
+    assert!(
+        relation(
+            &doc,
+            package(&doc, "tool:example")["SPDXID"]
+                .as_str()
+                .expect("should identify producer"),
+            "GENERATES",
+            generated["SPDXID"]
+                .as_str()
+                .expect("should identify generated module")
+        ),
+        "should retain generated producer relationship"
+    );
+    inputs
+        .components
+        .last_mut()
+        .expect("should contain generated helper")
+        .origin = Some(Origin::Generated {
+        producer: "missing".to_owned(),
+        sha256: "e".repeat(64),
+    });
+    assert!(
+        render(&inputs).is_err(),
+        "should reject unknown virtual/plugin producer"
+    );
+}
+
+#[test]
+fn rejects_invalid_source_identity_and_creation_time() {
+    for mutation in [
+        "commit",
+        "empty_artifact",
+        "timestamp",
+        "calendar",
+        "source_escape",
+        "source_alias",
+    ] {
+        let mut inputs = fixture();
+        match mutation {
+            "commit" => inputs.source_commit = "short".to_owned(),
+            "empty_artifact" => inputs.executable = b"",
+            "timestamp" => inputs.created = "yesterday".to_owned(),
+            "calendar" => inputs.created = "2026-02-30T00:00:00Z".to_owned(),
+            "source_escape" => {
+                inputs.components[0].origin = Some(Origin::Source {
+                    commit: "a".repeat(40),
+                    path: "../outside".to_owned(),
+                })
+            }
+            "source_alias" => {
+                inputs.components[0].origin = Some(Origin::Source {
+                    commit: "a".repeat(40),
+                    path: "src//example.rs".to_owned(),
+                })
+            }
+            _ => unreachable!(),
+        }
+        assert!(render(&inputs).is_err(), "should reject {mutation}");
+    }
+}
+
+#[test]
+fn rejects_an_spdx_document_exceeding_the_attestation_byte_limit() {
+    let mut inputs = fixture();
+    for index in 0..4096 {
+        let mut item = component(
+            &format!("oversize:{index}"),
+            ComponentRole::BuildMaterial,
+            Origin::Source {
+                commit: "a".repeat(40),
+                path: format!("source/{index}"),
+            },
+        );
+        item.name = "x".repeat(8192);
+        inputs.components.push(item);
+    }
+    let error =
+        render(&inputs).expect_err("should reject oversized predicates before returning bytes");
+    assert!(
+        format!("{error:?}").contains("output exceeds role byte limit"),
+        "should exercise the 16 MiB serialization bound"
+    );
+}
+
+#[test]
+fn verified_cargo_originals_render_without_inventing_download_locations() {
+    let mut inputs = fixture();
+    inputs.components = vec![
+        component(
+            "cargo:registry",
+            ComponentRole::ObservedRust,
+            Origin::CargoMaterial {
+                source: "registry+https://example.com/index".to_owned(),
+                original: CargoOrigin::Registry {
+                    archive_sha256: "b".repeat(64),
+                },
+                prepared_manifest_sha256: "c".repeat(64),
+            },
+        ),
+        component(
+            "cargo:git",
+            ComponentRole::BuildTool,
+            Origin::CargoMaterial {
+                source: format!("git+https://example.com/repo#{}", "a".repeat(40)),
+                original: CargoOrigin::Git {
+                    revision: "a".repeat(40),
+                    repository_tree: "b".repeat(40),
+                    package_tree: "c".repeat(40),
+                    package_path: String::new(),
+                    committed_manifest_blob: "d".repeat(40),
+                    committed_manifest_sha256: "e".repeat(64),
+                    normalized_manifest_sha256: None,
+                },
+                prepared_manifest_sha256: "f".repeat(64),
+            },
+        ),
+    ];
+    let rendered = render(&inputs).expect("should render schema-valid verified Cargo originals");
+    let document: Value =
+        serde_json::from_slice(rendered.bytes()).expect("should parse rendered document");
+    let packages = document["packages"]
+        .as_array()
+        .expect("should have packages");
+    let registry = packages
+        .iter()
+        .find(|package| package["name"] == "cargo:registry")
+        .expect("should include registry");
+    let git = packages
+        .iter()
+        .find(|package| package["name"] == "cargo:git")
+        .expect("should include Git");
+    assert_eq!(
+        registry["downloadLocation"], "NOASSERTION",
+        "should avoid treating index as archive URL"
+    );
+    assert_eq!(
+        registry["checksums"][0]["checksumValue"],
+        "b".repeat(64),
+        "should identify original archive only"
+    );
+    assert!(
+        git.get("checksums").is_none(),
+        "should not label Git object or manifest evidence as raw package SHA256"
+    );
+    assert!(
+        git["sourceInfo"]
+            .as_str()
+            .expect("should have source information")
+            .contains(&"d".repeat(40)),
+        "should preserve original Git facts"
+    );
+}
+
+#[test]
+fn javascript_preminification_contributors_do_not_claim_complete_module_retention() {
+    let mut inputs = fixture();
+    inputs.components[0].roles = vec![ComponentRole::ConservativeJavascript];
+    let output = render(&inputs).expect("should render conservative input");
+    let value: Value = serde_json::from_slice(output.bytes()).expect("should parse SPDX");
+    assert!(
+        value["relationships"]
+            .as_array()
+            .expect("should contain relationships")
+            .iter()
+            .any(|edge| edge["relationshipType"] == "GENERATED_FROM"
+                && edge["comment"]
+                    .as_str()
+                    .is_some_and(|text| text.contains("minification"))),
+        "should preserve pre-minification limitation"
+    );
+}
diff --git a/crates/trusted-server-release/src/tool_tree.rs b/crates/trusted-server-release/src/tool_tree.rs
new file mode 100644
index 0000000000..0b9c1d5918
--- /dev/null
+++ b/crates/trusted-server-release/src/tool_tree.rs
@@ -0,0 +1,109 @@
+//! Content digest of a selected tool tree, shared by the JS and Rust recipes.
+//!
+//! The digest covers every entry's relative path, kind, permission bits and,
+//! for regular files, size and SHA-256. It rejects anything a later swap could
+//! hide behind: hard-linked files (a second path can rewrite the content),
+//! absolute or root-escaping symlinks, dangling symlinks, and special files.
+
+use std::collections::BTreeMap;
+use std::fs;
+use std::os::unix::fs::{MetadataExt as _, PermissionsExt as _};
+use std::path::Path;
+
+use error_stack::Report;
+use sha2::{Digest as _, Sha256};
+
+use crate::documents::hash_bounded_with_check;
+use crate::error::ReleaseError;
+
+/// Per-file byte limit while hashing a tool tree.
+const FILE_BYTE_LIMIT: u64 = 512 * 1024 * 1024;
+/// Total byte limit across one tool tree.
+const TREE_BYTE_LIMIT: u64 = 2 * 1024 * 1024 * 1024;
+/// Entry limit across one tool tree.
+const ENTRY_LIMIT: usize = 100_000;
+
+fn tree_error(detail: impl std::fmt::Display) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Material).attach(detail.to_string())
+}
+
+/// Hashes the whole tree below `root`, calling `check` between entries and
+/// file chunks so the owning attempt can cancel or expire it.
+///
+/// # Errors
+///
+/// Returns [`ReleaseError::Material`] for a hard-linked or special file, a
+/// non-UTF-8 name, an absolute, dangling or root-escaping symlink, an
+/// exceeded byte or entry limit, or when `check` fails.
+pub(crate) fn tool_tree_digest(
+    root: &Path,
+    check: &dyn Fn() -> Result<(), Report<ReleaseError>>,
+) -> Result<String, Report<ReleaseError>> {
+    let mut digest = Sha256::new();
+    let mut total_bytes = 0_u64;
+    let mut pending = vec![root.to_owned()];
+    let mut facts = BTreeMap::new();
+    while let Some(directory) = pending.pop() {
+        for entry in fs::read_dir(directory).map_err(tree_error)? {
+            check()?;
+            let entry = entry.map_err(tree_error)?;
+            let path = entry.path();
+            let relative = path
+                .strip_prefix(root)
+                .map_err(tree_error)?
+                .to_str()
+                .ok_or_else(|| tree_error("tool path is not UTF-8"))?
+                .to_owned();
+            let metadata = fs::symlink_metadata(&path).map_err(tree_error)?;
+            let fact = if metadata.is_dir() {
+                pending.push(path.clone());
+                format!("directory:{}", metadata.permissions().mode() & 0o7777)
+            } else if metadata.is_file() && metadata.nlink() == 1 {
+                let raw = hash_bounded_with_check(&path, FILE_BYTE_LIMIT, check)?;
+                total_bytes += raw.size;
+                if total_bytes > TREE_BYTE_LIMIT {
+                    return Err(tree_error("selected tool tree exceeds total byte limit"));
+                }
+                format!(
+                    "file:{}:{}:{}",
+                    metadata.permissions().mode() & 0o7777,
+                    raw.size,
+                    raw.sha256
+                )
+            } else if metadata.file_type().is_symlink() {
+                let target = fs::read_link(&path).map_err(tree_error)?;
+                if target.is_absolute()
+                    || !fs::canonicalize(&path)
+                        .map_err(tree_error)?
+                        .starts_with(root)
+                {
+                    return Err(tree_error("selected tool alias escapes its owned root"));
+                }
+                format!(
+                    "alias:{}",
+                    target
+                        .to_str()
+                        .ok_or_else(|| tree_error("tool alias is not UTF-8"))?
+                )
+            } else {
+                return Err(tree_error(
+                    "selected tool contains an unsafe file type or hardlink",
+                ));
+            };
+            facts.insert(relative, fact);
+            if facts.len() > ENTRY_LIMIT {
+                return Err(tree_error("selected tool tree exceeds file limit"));
+            }
+        }
+    }
+    for (relative, fact) in facts {
+        digest.update(relative.as_bytes());
+        digest.update([0]);
+        digest.update(fact.as_bytes());
+        digest.update([0]);
+    }
+    Ok(hex::encode(digest.finalize()))
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/trusted-server-release/src/tool_tree/tests.rs b/crates/trusted-server-release/src/tool_tree/tests.rs
new file mode 100644
index 0000000000..f88887c842
--- /dev/null
+++ b/crates/trusted-server-release/src/tool_tree/tests.rs
@@ -0,0 +1,165 @@
+use std::fs;
+use std::os::unix::fs::symlink;
+use std::path::PathBuf;
+
+use super::*;
+
+/// A fictional tool tree below a canonical temporary root.
+struct Tree {
+    _directory: tempfile::TempDir,
+    root: PathBuf,
+}
+
+impl Tree {
+    fn new() -> Self {
+        let directory = tempfile::tempdir().expect("should create tree directory");
+        let outer = fs::canonicalize(directory.path()).expect("should canonicalize");
+        let root = outer.join("tools");
+        fs::create_dir_all(root.join("bin")).expect("should create bin");
+        fs::write(root.join("bin/tool"), b"fictional tool").expect("should write tool");
+        fs::create_dir(outer.join("outside")).expect("should create outside directory");
+        fs::write(outer.join("outside/secret"), b"outside").expect("should write outside file");
+        Self {
+            _directory: directory,
+            root,
+        }
+    }
+
+    fn digest(&self) -> Result<String, Report<ReleaseError>> {
+        tool_tree_digest(&self.root, &|| Ok(()))
+    }
+
+    fn rejection(&self) -> String {
+        match self.digest() {
+            Ok(_) => panic!("should reject the tree"),
+            Err(error) => format!("{error:?}"),
+        }
+    }
+}
+
+#[test]
+fn identical_trees_have_identical_digests_and_edits_change_them() {
+    let tree = Tree::new();
+    let baseline = tree.digest().expect("should digest the tree");
+    assert_eq!(
+        baseline,
+        tree.digest().expect("should digest again"),
+        "should be deterministic over an unchanged tree"
+    );
+    assert_eq!(baseline.len(), 64, "should be a SHA-256 hex digest");
+
+    fs::write(tree.root.join("bin/tool"), b"fictional tool!").expect("should edit content");
+    let edited = tree.digest().expect("should digest the edited tree");
+    assert_ne!(baseline, edited, "should detect a content edit");
+
+    fs::write(tree.root.join("bin/tool"), b"fictional tool").expect("should restore content");
+    assert_eq!(
+        baseline,
+        tree.digest().expect("should digest the restored tree"),
+        "should return to the baseline when content is restored"
+    );
+
+    fs::set_permissions(
+        tree.root.join("bin/tool"),
+        fs::Permissions::from_mode(0o755),
+    )
+    .expect("should change mode");
+    assert_ne!(
+        baseline,
+        tree.digest().expect("should digest the chmod tree"),
+        "should detect a permission change"
+    );
+}
+
+#[test]
+fn added_and_renamed_entries_change_the_digest() {
+    let tree = Tree::new();
+    let baseline = tree.digest().expect("should digest the tree");
+    fs::rename(tree.root.join("bin/tool"), tree.root.join("bin/renamed"))
+        .expect("should rename the tool");
+    assert_ne!(
+        baseline,
+        tree.digest().expect("should digest the renamed tree"),
+        "should detect a rename"
+    );
+    fs::rename(tree.root.join("bin/renamed"), tree.root.join("bin/tool"))
+        .expect("should restore the name");
+    fs::write(tree.root.join("extra"), b"").expect("should add an entry");
+    assert_ne!(
+        baseline,
+        tree.digest().expect("should digest the extended tree"),
+        "should detect an added empty file"
+    );
+}
+
+#[test]
+fn hard_linked_files_are_rejected() {
+    let tree = Tree::new();
+    fs::hard_link(tree.root.join("bin/tool"), tree.root.join("bin/alias"))
+        .expect("should link inside the tree");
+    assert!(
+        tree.rejection().contains("hardlink"),
+        "should reject a second link inside the tree"
+    );
+    let tree = Tree::new();
+    let outside = tree
+        .root
+        .parent()
+        .expect("should have parent")
+        .join("outside/secret");
+    fs::hard_link(&outside, tree.root.join("bin/leak")).expect("should link from outside");
+    assert!(
+        tree.rejection().contains("hardlink"),
+        "should reject a link shared with a path outside the tree"
+    );
+}
+
+#[test]
+fn escaping_dangling_or_absolute_aliases_are_rejected() {
+    let cases: [(&str, &str); 3] = [
+        ("relative escape", "../../outside/secret"),
+        ("dangling", "missing"),
+        ("absolute", "/usr/bin/true"),
+    ];
+    for (label, target) in cases {
+        let tree = Tree::new();
+        symlink(target, tree.root.join("bin/alias")).expect("should create alias");
+        let rejection = tree.rejection();
+        assert!(
+            rejection.contains("alias") || rejection.contains("No such file"),
+            "should reject the {label} alias: {rejection}"
+        );
+    }
+}
+
+#[test]
+fn inside_relative_alias_is_accepted_and_recorded() {
+    let tree = Tree::new();
+    let baseline = tree.digest().expect("should digest the tree");
+    symlink("tool", tree.root.join("bin/alias")).expect("should create inside alias");
+    let with_alias = tree
+        .digest()
+        .expect("should accept an inside relative alias");
+    assert_ne!(
+        baseline, with_alias,
+        "should record the alias in the digest"
+    );
+    fs::remove_file(tree.root.join("bin/alias")).expect("should remove alias");
+    symlink("./tool", tree.root.join("bin/alias")).expect("should create alias with other text");
+    assert_ne!(
+        with_alias,
+        tree.digest().expect("should digest the other alias"),
+        "should bind the alias target text"
+    );
+}
+
+#[test]
+fn failing_check_stops_the_digest() {
+    let tree = Tree::new();
+    let error = tool_tree_digest(&tree.root, &|| Err(tree_error("cancelled")))
+        .expect_err("should stop when the owning attempt fails");
+    assert!(
+        format!("{error:?}").contains("cancelled"),
+        "should surface the check failure"
+    );
+}
diff --git a/crates/trusted-server-release/src/workflow_contract.rs b/crates/trusted-server-release/src/workflow_contract.rs
new file mode 100644
index 0000000000..8468ba7789
--- /dev/null
+++ b/crates/trusted-server-release/src/workflow_contract.rs
@@ -0,0 +1,268 @@
+//! Checks a deliberately closed, reviewed validation workflow without executing it.
+
+use crate::error::ReleaseError;
+use error_stack::Report;
+use serde_yaml_ng::Value;
+use sha2::{Digest as _, Sha256};
+use std::fs::OpenOptions;
+use std::io::Read as _;
+use std::os::unix::fs::OpenOptionsExt as _;
+use std::path::{Path, PathBuf};
+
+#[cfg(test)]
+mod tests;
+
+// SHA-256 of compact sorted-key JSON produced from the reviewed YAML AST.
+// Updating this value requires reviewing every command, input and action again.
+const WORKFLOW_SHA256: &str = "5f5e965ad60ade5766d59162b7f89054fac00c5a7d634c1335eb1c8fc10e659f";
+
+// Raw bytes additionally bind each version comment and the restricted YAML spelling.
+const RAW_WORKFLOW_SHA256: &str =
+    "59bb3a304f4865b45d2e1ddd74121910dbe1e763648cb0eea7b725d02fb344a7";
+
+// The fixed sibling is executable validation policy and has its own reviewed pin.
+const HELPER_SHA256: &str = "48a6728f812c1cc23ed78f02b90f0c32922ec4af750eabe8f4d94d4de1ac30dc";
+
+const MAX_BYTES: usize = 1024 * 1024;
+
+fn parse_document(text: &str) -> Result<Value, Report<ReleaseError>> {
+    if text.len() > MAX_BYTES {
+        return Err(reject("workflow exceeds 1 MiB"));
+    }
+    restricted_syntax(text)?;
+    let value = serde_yaml_ng::from_str(text)
+        .map_err(|error| Report::new(ReleaseError::Document).attach(error.to_string()))?;
+    unambiguous_value(&value)?;
+    Ok(value)
+}
+
+fn reject(message: &str) -> Report<ReleaseError> {
+    Report::new(ReleaseError::Document).attach(message.to_owned())
+}
+
+// Only literal run blocks may contain reference indicators, including in quotes.
+// Rejecting unsupported spellings is intentional: this is not a YAML formatter.
+fn restricted_syntax(text: &str) -> Result<(), Report<ReleaseError>> {
+    let mut block_indent = None;
+    for line in text.lines() {
+        let indent = line.len() - line.trim_start_matches(' ').len();
+        if let Some(parent) = block_indent {
+            if line.trim().is_empty() || indent > parent {
+                continue;
+            }
+            block_indent = None;
+        }
+        let mut quote = None;
+        let mut characters = line.chars().peekable();
+        while let Some(character) = characters.next() {
+            match (quote, character) {
+                (Some('"'), '\\') => {
+                    characters.next();
+                }
+                (Some('\''), '\'') if characters.peek() == Some(&'\'') => {
+                    characters.next();
+                }
+                (Some(active), value) if active == value => quote = None,
+                (Some(_), _) => {}
+                (None, '#') => break,
+                (None, '\'' | '"') => quote = Some(character),
+                _ => {}
+            }
+        }
+        if quote.is_some() {
+            return Err(reject("multiline quoted scalars are unsupported"));
+        }
+        if line.contains(['&', '*', '!']) || line.contains('\t') {
+            return Err(reject(
+                "reference indicators, tags and tabs outside run blocks are unsupported",
+            ));
+        }
+        if line.trim() == "run: |" {
+            block_indent = Some(indent);
+        }
+    }
+    Ok(())
+}
+
+fn unambiguous_value(value: &Value) -> Result<(), Report<ReleaseError>> {
+    match value {
+        Value::Mapping(mapping) => {
+            for (key, value) in mapping {
+                let Some(key) = key.as_str() else {
+                    return Err(reject("mapping keys must be strings"));
+                };
+                if key == "<<" {
+                    return Err(reject("YAML merge keys are forbidden"));
+                }
+                unambiguous_value(value)?;
+            }
+        }
+        Value::Sequence(sequence) => {
+            for value in sequence {
+                unambiguous_value(value)?;
+            }
+        }
+        Value::Tagged(_) => return Err(reject("YAML tags are forbidden")),
+        _ => {}
+    }
+    Ok(())
+}
+
+fn validate_structure(value: &Value, text: &str) -> Result<(), Report<ReleaseError>> {
+    let triggers = value
+        .get("on")
+        .and_then(Value::as_mapping)
+        .ok_or_else(|| reject("on must contain workflow_call only"))?;
+    if triggers.len() != 1 || !triggers.contains_key("workflow_call") {
+        return Err(reject("workflow_call is the only permitted trigger"));
+    }
+    if let Some(call) = triggers
+        .get("workflow_call")
+        .filter(|value| !value.is_null())
+    {
+        let call = call
+            .as_mapping()
+            .ok_or_else(|| reject("workflow_call must be a mapping"))?;
+        let inputs = call
+            .get("inputs")
+            .and_then(Value::as_mapping)
+            .ok_or_else(|| reject("workflow_call permits only the source_sha input"))?;
+        let source = inputs
+            .get("source_sha")
+            .ok_or_else(|| reject("source_sha is required"))?;
+        if call.len() != 1
+            || inputs.len() != 1
+            || source.get("type").and_then(Value::as_str) != Some("string")
+            || source.get("required").and_then(Value::as_bool) != Some(true)
+        {
+            return Err(reject("only required string source_sha is permitted"));
+        }
+    }
+    let permissions = value
+        .get("permissions")
+        .and_then(Value::as_mapping)
+        .ok_or_else(|| reject("explicit read permissions are required"))?;
+    if permissions.len() != 1 || permissions.get("contents").and_then(Value::as_str) != Some("read")
+    {
+        return Err(reject("only contents: read is permitted at workflow scope"));
+    }
+    validate_actions(value, text)?;
+    Ok(())
+}
+
+/// Reads the explicit validation workflow and its fixed sibling helper.
+///
+/// This local check executes nothing and constructs no release authorization.
+///
+/// # Errors
+///
+/// Returns an error for unsupported paths, syntax, authority, or unreviewed bytes.
+pub(crate) fn check_files(paths: &[PathBuf]) -> Result<(), Report<ReleaseError>> {
+    let [path] = paths else {
+        return Err(reject("exactly one reviewed workflow path is required"));
+    };
+    if path.file_name().and_then(|name| name.to_str()) != Some("release-validation.yml") {
+        return Err(reject(
+            "only release-validation.yml is reviewed; local invocation graphs remain unsupported",
+        ));
+    }
+    let bytes = read_bounded(path)?;
+    if hex::encode(Sha256::digest(&bytes)) != RAW_WORKFLOW_SHA256 {
+        return Err(reject(
+            "workflow bytes differ from the reviewed source including action annotations",
+        ));
+    }
+    let text = std::str::from_utf8(&bytes).map_err(|_| reject("workflow must be UTF-8"))?;
+    let value = parse_document(text)?;
+    validate_structure(&value, text)?;
+    let json = serde_json::to_value(value)
+        .map_err(|_| reject("workflow cannot be represented as JSON"))?;
+    let canonical =
+        serde_json::to_vec(&json).map_err(|_| reject("workflow canonicalization failed"))?;
+    if hex::encode(Sha256::digest(&canonical)) != WORKFLOW_SHA256 {
+        return Err(reject(
+            "workflow differs from the reviewed structural command manifest",
+        ));
+    }
+    let helper = read_bounded(&path.with_file_name("release-validation.mjs"))?;
+    if hex::encode(Sha256::digest(&helper)) != HELPER_SHA256 {
+        return Err(reject(
+            "validation helper differs from the reviewed executable policy",
+        ));
+    }
+    Ok(())
+}
+
+fn validate_actions(value: &Value, text: &str) -> Result<(), Report<ReleaseError>> {
+    match value {
+        Value::Mapping(mapping) => {
+            for (key, value) in mapping {
+                if key.as_str() == Some("uses") {
+                    let action = value
+                        .as_str()
+                        .ok_or_else(|| reject("uses must be a string"))?;
+                    let (repository, commit) = action
+                        .rsplit_once('@')
+                        .ok_or_else(|| reject("actions must have immutable pins"))?;
+                    if repository.starts_with('.')
+                        || !repository.contains('/')
+                        || commit.len() != 40
+                        || !commit.bytes().all(|byte| byte.is_ascii_hexdigit())
+                    {
+                        return Err(reject(
+                            "local calls and non-commit action pins are forbidden",
+                        ));
+                    }
+                    let annotated = text.lines().any(|line| {
+                        let line = line.trim();
+                        let Some(rest) = line
+                            .strip_prefix("- uses: ")
+                            .or_else(|| line.strip_prefix("uses: "))
+                        else {
+                            return false;
+                        };
+                        rest.strip_prefix(action)
+                            .and_then(|rest| rest.strip_prefix(" # v"))
+                            .is_some_and(|version| {
+                                version.starts_with(|character: char| character.is_ascii_digit())
+                            })
+                    });
+                    if !annotated {
+                        return Err(reject("action pins require an adjacent version comment"));
+                    }
+                }
+                validate_actions(value, text)?;
+            }
+        }
+        Value::Sequence(sequence) => {
+            for value in sequence {
+                validate_actions(value, text)?;
+            }
+        }
+        _ => {}
+    }
+    Ok(())
+}
+
+fn read_bounded(path: &Path) -> Result<Vec<u8>, Report<ReleaseError>> {
+    let file = OpenOptions::new()
+        .read(true)
+        .custom_flags(libc::O_NOFOLLOW | libc::O_NONBLOCK)
+        .open(path)
+        .map_err(|error| reject(&error.to_string()))?;
+    if !file
+        .metadata()
+        .map_err(|error| reject(&error.to_string()))?
+        .is_file()
+    {
+        return Err(reject("held workflow input must be a regular file"));
+    }
+    let mut bytes = Vec::new();
+    file.take((MAX_BYTES + 1) as u64)
+        .read_to_end(&mut bytes)
+        .map_err(|error| reject(&error.to_string()))?;
+    if bytes.len() > MAX_BYTES {
+        return Err(reject("workflow input exceeds 1 MiB"));
+    }
+    Ok(bytes)
+}
diff --git a/crates/trusted-server-release/src/workflow_contract/tests.rs b/crates/trusted-server-release/src/workflow_contract/tests.rs
new file mode 100644
index 0000000000..c6e65c3780
--- /dev/null
+++ b/crates/trusted-server-release/src/workflow_contract/tests.rs
@@ -0,0 +1,294 @@
+use super::*;
+
+#[test]
+fn rejects_anchor_and_alias_syntax() {
+    for yaml in [
+        "a: &value example\nb: *value\n",
+        "{a: &value example, b: *value}",
+        "a: &value [example]\nb: *value\n",
+    ] {
+        assert!(
+            parse_document(yaml).is_err(),
+            "should reject YAML references: {yaml}"
+        );
+    }
+}
+
+#[test]
+fn rejects_merge_and_non_string_keys() {
+    for yaml in [
+        "'<<': {a: example}\n",
+        "true: example\n",
+        "? [example, other]\n: value\n",
+    ] {
+        assert!(
+            parse_document(yaml).is_err(),
+            "should reject ambiguous mappings: {yaml}"
+        );
+    }
+}
+
+#[test]
+fn rejects_oversized_yaml_before_parsing() {
+    let yaml = format!("a: {}", "x".repeat(1024 * 1024));
+    assert!(
+        parse_document(&yaml).is_err(),
+        "should bound YAML before parsing"
+    );
+}
+
+#[test]
+fn rejects_duplicate_keys_and_multiple_documents() {
+    for yaml in [
+        "a: example\na: other\n",
+        "a: example\n---\nb: other\n",
+        "a: {nested: one, nested: two}\n",
+    ] {
+        assert!(
+            parse_document(yaml).is_err(),
+            "should reject ambiguous documents: {yaml}"
+        );
+    }
+}
+
+#[test]
+fn accepts_shell_metacharacters_only_as_scalar_content() {
+    let yaml = "run: |\n  test -f example && printf '%s' '*.json'\n";
+    assert!(
+        parse_document(yaml).is_ok(),
+        "should accept inert scalar content: {yaml}"
+    );
+}
+
+const STRUCTURAL: &str = "name: Example validation\non:\n  workflow_call:\npermissions:\n  contents: read\njobs:\n  check:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@0123456789012345678901234567890123456789 # v4.0.0\n      - run: cargo fmt --all -- --check\n";
+
+#[test]
+fn rejects_ambient_triggers() {
+    let yaml = STRUCTURAL.replace("  workflow_call:", "  push:");
+    assert!(
+        validate_structure(&parse_document(&yaml).expect("should parse fixture"), &yaml).is_err(),
+        "should require workflow_call only"
+    );
+}
+
+#[test]
+fn rejects_permission_escalation() {
+    for yaml in [
+        STRUCTURAL.replace("contents: read", "contents: write"),
+        STRUCTURAL.replace("  contents: read", "  contents: read\n  id-token: write"),
+        STRUCTURAL.replace("  contents: read\n", ""),
+    ] {
+        assert!(
+            validate_structure(&parse_document(&yaml).expect("should parse fixture"), &yaml)
+                .is_err(),
+            "should require exact read permissions"
+        );
+    }
+}
+
+#[test]
+fn rejects_references_hidden_by_plain_scalar_quotes() {
+    let yaml = "{a: foo'bar, b: &anchor example, c: *anchor, d: baz'}";
+    assert!(
+        parse_document(yaml).is_err(),
+        "should not treat quotes inside plain scalars as YAML quoting"
+    );
+}
+
+#[test]
+fn rejects_unpinned_and_local_actions() {
+    for action in [
+        "actions/checkout@v4",
+        "./.github/actions/example",
+        "./.github/workflows/example.yml@main",
+        "actions/checkout@012345678901234567890123456789012345678",
+    ] {
+        let yaml = STRUCTURAL.replace(
+            "actions/checkout@0123456789012345678901234567890123456789",
+            action,
+        );
+        assert!(
+            validate_structure(&parse_document(&yaml).expect("should parse fixture"), &yaml)
+                .is_err(),
+            "should reject action {action}"
+        );
+    }
+}
+
+#[test]
+fn accepts_reviewed_workflow_structure() {
+    let text = include_str!("../../../../.github/workflows/release-validation.yml");
+    let value = parse_document(text).expect("should parse reviewed workflow");
+    validate_structure(&value, text)
+        .expect("should accept reviewed source input and job permissions");
+}
+
+#[test]
+fn rejects_reference_characters_in_quoted_scalars_conservatively() {
+    for yaml in [
+        "name: 'example & * literal'\n",
+        "name: 'example ! literal'\n",
+    ] {
+        assert!(
+            parse_document(yaml).is_err(),
+            "should reject unsupported quoted reference spellings"
+        );
+    }
+}
+
+#[test]
+fn rejects_multiline_quoted_scalars() {
+    assert!(
+        parse_document("name: \"example\n  run: |\n    other\"\n").is_err(),
+        "should reject fake block headers in multiline quotes"
+    );
+}
+
+#[test]
+fn reads_bounded_regular_files() {
+    let directory = tempfile::tempdir().expect("should create fixture directory");
+    let path = directory.path().join("example.yml");
+    std::fs::write(&path, vec![b'x'; MAX_BYTES + 1]).expect("should write oversized fixture");
+    assert!(
+        read_bounded(&path).is_err(),
+        "should reject held oversized file"
+    );
+    assert!(
+        read_bounded(directory.path()).is_err(),
+        "should reject directories"
+    );
+}
+
+#[test]
+fn accepts_only_reviewed_explicit_workflow() {
+    let path = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("../../.github/workflows/release-validation.yml");
+    check_files(&[path]).expect("should accept the reviewed explicit workflow and helper");
+}
+
+#[test]
+fn rejects_each_missing_action_version_comment() {
+    let directory = tempfile::tempdir().expect("should create fixture directory");
+    let path = directory.path().join("release-validation.yml");
+    let text = include_str!("../../../../.github/workflows/release-validation.yml");
+    let yaml = text.replacen(" # v5.0.0 (Node 24)", "", 1);
+    std::fs::write(&path, yaml).expect("should write unannotated action fixture");
+    assert!(
+        check_files(&[path]).is_err(),
+        "should reject even one unannotated occurrence of a repeated action"
+    );
+}
+
+#[test]
+fn rejects_unreviewed_workflow_authority_and_commands() {
+    let reviewed = include_str!("../../../../.github/workflows/release-validation.yml");
+    let mutations = [
+        ("  workflow_call:", "  push:"),
+        ("  workflow_call:", "  workflow_call:\n    secrets: inherit"),
+        (
+            "  workflow_call:",
+            "  workflow_call:\n    paths: ['example']",
+        ),
+        ("      source_sha:", "      commands:"),
+        ("  contents: read", "  contents: write"),
+        ("  contents: read", "  contents: read\n  id-token: write"),
+        (
+            "  contents: read",
+            "  contents: read\n  attestations: write",
+        ),
+        (
+            "    needs: admission",
+            "    needs: admission\n    if: false",
+        ),
+        (
+            "    needs: admission",
+            "    needs: admission\n    continue-on-error: true",
+        ),
+        (
+            "      - name: Read pinned Node version",
+            "      - continue-on-error: true\n        name: Read pinned Node version",
+        ),
+        (
+            "actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8",
+            "actions/checkout@v5",
+        ),
+        (
+            "actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8",
+            "./.github/actions/example",
+        ),
+        (
+            "actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8",
+            "./.github/workflows/example.yml@main",
+        ),
+        ("cargo test-fastly", "cargo publish"),
+        ("cargo test-fastly", "${{ inputs.commands }}"),
+        ("persist-credentials: false", "persist-credentials: true"),
+    ];
+    for (needle, replacement) in mutations {
+        assert!(
+            reviewed.contains(needle),
+            "should locate mutation target {needle}"
+        );
+        let directory = tempfile::tempdir().expect("should create fixture directory");
+        let path = directory.path().join("release-validation.yml");
+        std::fs::write(&path, reviewed.replacen(needle, replacement, 1))
+            .expect("should write negative workflow fixture");
+        assert!(
+            check_files(&[path]).is_err(),
+            "should reject unreviewed mutation {replacement}"
+        );
+    }
+}
+
+#[test]
+fn rejects_empty_multiple_and_unreviewed_paths() {
+    assert!(check_files(&[]).is_err(), "should require an explicit path");
+    assert!(
+        check_files(&[PathBuf::from("example.yml")]).is_err(),
+        "should reject unreviewed filenames"
+    );
+    assert!(
+        check_files(&[
+            PathBuf::from("release-validation.yml"),
+            PathBuf::from("example.yml")
+        ])
+        .is_err(),
+        "should reject unreviewed invocation graphs"
+    );
+}
+
+#[test]
+fn rejects_leaf_symlink_inputs() {
+    let directory = tempfile::tempdir().expect("should create fixture directory");
+    let target = directory.path().join("example.yml");
+    let link = directory.path().join("release-validation.yml");
+    std::fs::write(&target, "a: example\n").expect("should create regular fixture");
+    std::os::unix::fs::symlink(&target, &link).expect("should create symlink fixture");
+    assert!(
+        read_bounded(&link).is_err(),
+        "should reject a symlink without following it"
+    );
+}
+
+#[test]
+fn rejects_unreviewed_sibling_helper() {
+    let directory = tempfile::tempdir().expect("should create fixture directory");
+    let path = directory.path().join("release-validation.yml");
+    std::fs::write(
+        &path,
+        include_str!("../../../../.github/workflows/release-validation.yml"),
+    )
+    .expect("should write reviewed workflow fixture");
+    let helper = directory.path().join("release-validation.mjs");
+    std::fs::write(&helper, "throw new Error('example unreviewed helper');\n")
+        .expect("should write changed helper fixture");
+    assert!(
+        check_files(std::slice::from_ref(&path)).is_err(),
+        "should bind helper commands to reviewed bytes"
+    );
+    std::fs::remove_file(&helper).expect("should remove helper fixture");
+    assert!(
+        check_files(&[path]).is_err(),
+        "should require the fixed sibling helper"
+    );
+}
diff --git a/crates/trusted-server-release/tests/boundary.rs b/crates/trusted-server-release/tests/boundary.rs
new file mode 100644
index 0000000000..117bcdfb5a
--- /dev/null
+++ b/crates/trusted-server-release/tests/boundary.rs
@@ -0,0 +1,141 @@
+//! Public process tests for the `boundary-probe connect` subcommand.
+//!
+//! The probe makes one TCP connect to a literal loopback `IP:PORT`, prints
+//! `connected` (exit 0) or `denied errno=<n>` (exit 3) with the real errno,
+//! and does nothing else.
+
+use std::io::ErrorKind;
+use std::net::TcpListener;
+use std::process::{Command, Output};
+
+const RELEASE_BIN: &str = env!("CARGO_BIN_EXE_trusted-server-release");
+const DENIED_STATUS: i32 = 3;
+
+fn probe(address: &str) -> Output {
+    Command::new(RELEASE_BIN)
+        .args(["boundary-probe", "connect", address])
+        .env_clear()
+        .output()
+        .expect("should run the release binary")
+}
+
+fn listener() -> TcpListener {
+    let listener = TcpListener::bind("127.0.0.1:0").expect("should bind listener");
+    listener
+        .set_nonblocking(true)
+        .expect("should make listener non-blocking");
+    listener
+}
+
+fn accepted(listener: &TcpListener) -> usize {
+    let mut count = 0;
+    loop {
+        match listener.accept() {
+            Ok(_) => count += 1,
+            Err(error) if error.kind() == ErrorKind::WouldBlock => return count,
+            Err(error) => {
+                assert!(
+                    error.kind() == ErrorKind::Interrupted,
+                    "should accept: {error}"
+                );
+            }
+        }
+    }
+}
+
+#[test]
+fn probe_connects_to_a_loopback_listener() {
+    let listener = listener();
+    let address = listener
+        .local_addr()
+        .expect("should read address")
+        .to_string();
+    let output = probe(&address);
+    assert_eq!(
+        output.status.code(),
+        Some(0),
+        "should exit 0 when connected"
+    );
+    assert_eq!(
+        output.stdout, b"connected\n",
+        "should print exactly one report"
+    );
+    assert_eq!(
+        accepted(&listener),
+        1,
+        "should complete exactly one handshake"
+    );
+}
+
+#[test]
+fn probe_reports_the_real_refusal_errno() {
+    let address = {
+        let closed = TcpListener::bind("127.0.0.1:0").expect("should bind");
+        closed
+            .local_addr()
+            .expect("should read address")
+            .to_string()
+    };
+    let output = probe(&address);
+    assert_eq!(
+        output.status.code(),
+        Some(DENIED_STATUS),
+        "should exit 3 when refused"
+    );
+    assert_eq!(
+        String::from_utf8_lossy(&output.stdout),
+        format!("denied errno={}\n", libc::ECONNREFUSED),
+        "should report the operating system's errno"
+    );
+}
+
+#[test]
+fn probe_rejects_non_loopback_and_malformed_addresses() {
+    for address in ["192.0.2.1:80", "localhost:80", "127.0.0.1:0", "127.0.0.1"] {
+        let output = probe(address);
+        assert_eq!(output.status.code(), Some(1), "should reject {address}");
+        assert!(output.stdout.is_empty(), "should not report for {address}");
+    }
+    let extra = Command::new(RELEASE_BIN)
+        .args(["boundary-probe", "connect", "127.0.0.1:80", "extra"])
+        .env_clear()
+        .output()
+        .expect("should run the release binary");
+    assert_eq!(
+        extra.status.code(),
+        Some(1),
+        "should reject extra arguments"
+    );
+}
+
+#[cfg(target_os = "macos")]
+#[test]
+fn probe_is_denied_with_eperm_under_sandbox_exec() {
+    let listener = listener();
+    let address = listener
+        .local_addr()
+        .expect("should read address")
+        .to_string();
+    let output = Command::new("/usr/bin/sandbox-exec")
+        .args([
+            "-p",
+            "(version 1)(allow default)(deny network*)",
+            RELEASE_BIN,
+            "boundary-probe",
+            "connect",
+            &address,
+        ])
+        .env_clear()
+        .output()
+        .expect("should run the sandboxed release binary");
+    assert_eq!(
+        output.status.code(),
+        Some(DENIED_STATUS),
+        "should exit 3 when denied"
+    );
+    assert_eq!(
+        output.stdout, b"denied errno=1\n",
+        "should report real EPERM"
+    );
+    assert_eq!(accepted(&listener), 0, "should observe no accept");
+}
diff --git a/crates/trusted-server-release/tests/commands.rs b/crates/trusted-server-release/tests/commands.rs
new file mode 100644
index 0000000000..2dccdc1bcd
--- /dev/null
+++ b/crates/trusted-server-release/tests/commands.rs
@@ -0,0 +1,713 @@
+use std::collections::BTreeSet;
+use std::ffi::OsString;
+use std::fs;
+use std::os::unix::fs::{PermissionsExt as _, symlink};
+use std::path::{Path, PathBuf};
+use std::process::{Command, Output};
+
+use serde_json::{Value, json};
+use sha2::{Digest as _, Sha256};
+use tempfile::{TempDir, tempdir};
+
+const RELEASE_BIN: &str = env!("CARGO_BIN_EXE_trusted-server-release");
+const REPOSITORY: &str = concat!(env!("CARGO_MANIFEST_DIR"), "/../..");
+const COHORT: &str = "scripts/release/release-cohort.json";
+const TOOLS: &str = "scripts/release/release-tools.json";
+const CLI_POLICY: &str = "crates/trusted-server-cli/release-policy.json";
+const BOOTSTRAP: &str = "scripts/release/bootstrap.sh";
+
+#[test]
+fn workflow_contract_command_checks_reviewed_files_without_release_authority() {
+    let root = tempdir().expect("should create private workflow fixture");
+    for name in ["release-validation.yml", "release-validation.mjs"] {
+        fs::copy(
+            Path::new(REPOSITORY).join(".github/workflows").join(name),
+            root.path().join(name),
+        )
+        .expect("should copy reviewed contract input");
+    }
+    let output = Command::new(RELEASE_BIN)
+        .current_dir(root.path())
+        .env_clear()
+        .args([
+            "check-workflow-contract",
+            "--workflow",
+            "release-validation.yml",
+        ])
+        .output()
+        .expect("should run only the release contract checker");
+    assert!(
+        output.status.success(),
+        "should accept the reviewed workflow: {}",
+        stderr(&output)
+    );
+    let report: Value =
+        serde_json::from_slice(&output.stdout).expect("should parse contract diagnostic");
+    assert_eq!(
+        report["release_qualification"], false,
+        "should grant no release authority"
+    );
+    assert_eq!(
+        report["source_eligibility"], false,
+        "should grant no source eligibility"
+    );
+}
+
+#[test]
+fn workflow_contract_command_requires_an_explicit_readable_workflow() {
+    for arguments in [
+        vec!["check-workflow-contract"],
+        vec![
+            "check-workflow-contract",
+            "--workflow",
+            "missing-example.yml",
+        ],
+    ] {
+        let output = Command::new(RELEASE_BIN)
+            .env_clear()
+            .args(arguments)
+            .output()
+            .expect("should run only the release contract checker");
+        assert!(
+            !output.status.success(),
+            "should reject absent contract input"
+        );
+        assert!(
+            output.stdout.is_empty(),
+            "should emit no acceptance on failure"
+        );
+    }
+}
+
+#[test]
+fn workflow_contract_command_rejects_changed_workflow_or_runtime_helper() {
+    for changed in ["release-validation.yml", "release-validation.mjs"] {
+        let root = tempdir().expect("should create private workflow fixture");
+        for name in ["release-validation.yml", "release-validation.mjs"] {
+            let original = fs::read(Path::new(REPOSITORY).join(".github/workflows").join(name))
+                .expect("should read reviewed contract input");
+            let bytes = if name == changed {
+                if name.ends_with(".yml") {
+                    String::from_utf8(original)
+                        .expect("should decode reviewed YAML")
+                        .replace("cargo test-fastly", "echo example-command")
+                        .into_bytes()
+                } else {
+                    [
+                        original.as_slice(),
+                        b"\n// Example unreviewed helper change.\n",
+                    ]
+                    .concat()
+                }
+            } else {
+                original
+            };
+            fs::write(root.path().join(name), bytes).expect("should write private contract input");
+        }
+        let output = Command::new(RELEASE_BIN)
+            .current_dir(root.path())
+            .env_clear()
+            .args([
+                "check-workflow-contract",
+                "--workflow",
+                "release-validation.yml",
+            ])
+            .output()
+            .expect("should run only the release contract checker");
+        assert!(!output.status.success(), "should reject changed {changed}");
+        assert!(
+            output.stdout.is_empty(),
+            "should emit no acceptance on failure"
+        );
+    }
+}
+
+fn manual_package_fixture(root: &Path) -> (String, String) {
+    let manifest = b"manifest_version = 3\nname = \"example-app\"\n";
+    let wasm = b"\0asm\x01\0\0\0";
+    let directory = root.join("pkg");
+    fs::create_dir(&directory).expect("should create package directory");
+    fs::write(root.join("fastly.toml"), manifest).expect("should write reviewed manifest");
+    let encoder = flate2::write::GzEncoder::new(Vec::new(), flate2::Compression::fast());
+    let mut archive = tar::Builder::new(encoder);
+    for (path, kind, bytes) in [
+        ("example-app/", tar::EntryType::Directory, &b""[..]),
+        ("example-app/bin/", tar::EntryType::Directory, &b""[..]),
+        (
+            "example-app/bin/main.wasm",
+            tar::EntryType::Regular,
+            &wasm[..],
+        ),
+        (
+            "example-app/fastly.toml",
+            tar::EntryType::Regular,
+            &manifest[..],
+        ),
+    ] {
+        let mut header = tar::Header::new_ustar();
+        header.set_entry_type(kind);
+        header.set_mode(0o755);
+        header.set_size(bytes.len() as u64);
+        header.set_cksum();
+        archive
+            .append_data(&mut header, path, bytes)
+            .expect("should write bounded fictional package member");
+    }
+    let bytes = archive
+        .into_inner()
+        .expect("should finish archive")
+        .finish()
+        .expect("should finish gzip");
+    fs::write(directory.join("example-app.tar.gz"), bytes).expect("should write package");
+    (
+        hex::encode(Sha256::digest(manifest)),
+        hex::encode(Sha256::digest(wasm)),
+    )
+}
+
+fn inspect_manual_package(root: &Path, manifest: &str, wasm: &str) -> Output {
+    Command::new(RELEASE_BIN)
+        .current_dir(root)
+        .env_clear()
+        .args([
+            "inspect-fastly-package",
+            "--package-dir",
+            "pkg",
+            "--manifest",
+            "fastly.toml",
+            "--expected-manifest-sha256",
+            manifest,
+            "--expected-wasm-sha256",
+            wasm,
+        ])
+        .output()
+        .expect("should run only the local release inspector")
+}
+
+#[test]
+fn manual_fastly_package_command_accepts_exact_bytes_without_release_authority() {
+    let root = tempdir().expect("should create private package fixture");
+    let (manifest, wasm) = manual_package_fixture(root.path());
+    let output = inspect_manual_package(root.path(), &manifest, &wasm);
+    assert!(
+        output.status.success(),
+        "should accept exact package: {}",
+        stderr(&output)
+    );
+    let report: Value =
+        serde_json::from_slice(&output.stdout).expect("should parse inspection report");
+    assert_eq!(
+        report["accepted"], true,
+        "should report the bounded byte checks"
+    );
+    assert_eq!(
+        report["module_sha256"], wasm,
+        "should bind the actual module member"
+    );
+    assert_eq!(
+        report["manifest_sha256"], manifest,
+        "should bind reviewed manifest bytes"
+    );
+    assert_eq!(
+        report["limits"]["runtime_validated"], false,
+        "should retain runtime limitation"
+    );
+    assert_eq!(
+        report["limits"]["official_release_verified"], false,
+        "should not mint release trust"
+    );
+    assert_eq!(
+        report["limits"]["deployment_authorized"], false,
+        "should not authorize mutation"
+    );
+}
+
+#[test]
+fn manual_fastly_package_command_rejects_an_unmatched_expected_digest() {
+    let root = tempdir().expect("should create private package fixture");
+    let (manifest, _) = manual_package_fixture(root.path());
+    let output = inspect_manual_package(root.path(), &manifest, &"b".repeat(64));
+    assert!(
+        !output.status.success(),
+        "should reject another expected executable"
+    );
+    assert!(
+        output.stdout.is_empty(),
+        "should emit no acceptance on failure"
+    );
+}
+
+/// Preflight rejects any ancestor Cargo configuration layer, so fixtures need a
+/// temporary directory whose ancestry has none; report that host precondition.
+/// Integration tests cannot import the crate-private unit-test fixture, so
+/// this helper and the Git fixture setup are intentionally duplicated here.
+fn assert_clean_ancestry(path: &Path) {
+    let canonical = fs::canonicalize(path).expect("should resolve fixture directory");
+    for ancestor in canonical.ancestors() {
+        for name in ["config", "config.toml"] {
+            let layer = ancestor.join(".cargo").join(name);
+            assert!(
+                !layer.exists(),
+                "fixture temporary directory ancestry must not contain {}; set TMPDIR to a clean directory",
+                layer.display()
+            );
+        }
+    }
+}
+
+fn host_path() -> OsString {
+    std::env::var_os("PATH").expect("should have a PATH to locate git")
+}
+
+fn tracked_input(path: &str) -> Vec<u8> {
+    fs::read(Path::new(REPOSITORY).join(path)).expect("should read tracked release input")
+}
+
+fn write(root: &Path, path: &str, bytes: &[u8]) {
+    let path = root.join(path);
+    fs::create_dir_all(path.parent().expect("should have parent")).expect("should create dirs");
+    fs::write(path, bytes).expect("should write fixture file");
+}
+
+/// A clean fixture repository holding the real tracked release inputs.
+struct SourceFixture {
+    parent: TempDir,
+    root: PathBuf,
+    commit: String,
+}
+
+impl SourceFixture {
+    fn new(customize: impl FnOnce(&Path)) -> Self {
+        let parent = tempdir().expect("should create fixture parent");
+        assert_clean_ancestry(parent.path());
+        let root = parent.path().join("source");
+        for path in [COHORT, TOOLS, CLI_POLICY] {
+            write(&root, path, &tracked_input(path));
+        }
+        write(
+            &root,
+            "Cargo.toml",
+            b"[workspace]\nmembers = [\n    \"crates/trusted-server-openrtb\",\n    \"crates/trusted-server-release\",\n]\n",
+        );
+        write(&root, "Cargo.lock", b"# fictional lock\nversion = 4\n");
+        write(
+            &root,
+            "rust-toolchain.toml",
+            b"[toolchain]\nchannel = \"1.95.0\"\n",
+        );
+        write(&root, ".cargo/config.toml", b"[alias]\n");
+        write(&root, ".tool-versions", b"rust 1.95.0\n");
+        write(&root, BOOTSTRAP, b"#!/bin/sh\nexit 1\n");
+        for script in [
+            "build-js.sh",
+            "build.sh",
+            "collect-js.mjs",
+            "observe-npm.mjs",
+        ] {
+            write(
+                &root,
+                &format!("scripts/release/{script}"),
+                b"// fictional driver\n",
+            );
+        }
+        write(
+            &root,
+            "crates/trusted-server-openrtb/Cargo.toml",
+            b"[package]\nname = \"fictional-openrtb\"\n",
+        );
+        write(
+            &root,
+            "crates/trusted-server-release/Cargo.toml",
+            b"[package]\nname = \"fictional-release\"\n",
+        );
+        write(&root, "AGENTS.md", b"# Fictional agents\n");
+        symlink("AGENTS.md", root.join("CLAUDE.md")).expect("should create reviewed symlink");
+        customize(&root);
+        let fixture = Self {
+            parent,
+            root,
+            commit: String::new(),
+        };
+        fixture.git(&["init", "-q"]);
+        fixture.git(&["add", "-A"]);
+        fixture.git(&["commit", "-q", "-m", "fixture"]);
+        Self {
+            commit: fixture.git(&["rev-parse", "HEAD"]),
+            ..fixture
+        }
+    }
+
+    fn git(&self, args: &[&str]) -> String {
+        let home = self.parent.path().join("fixture-home");
+        fs::create_dir_all(&home).expect("should create fixture home");
+        // Finish fixture writes synchronously before taking no-write snapshots.
+        let output = Command::new("git")
+            .args(["-c", "maintenance.auto=false", "-c", "gc.auto=0"])
+            .args(args)
+            .current_dir(&self.root)
+            .env_clear()
+            .env("PATH", host_path())
+            .env("HOME", &home)
+            .env("LC_ALL", "C")
+            .env("GIT_CONFIG_NOSYSTEM", "1")
+            .env("GIT_CONFIG_GLOBAL", "/dev/null")
+            .env("GIT_AUTHOR_NAME", "Fictional Author")
+            .env("GIT_AUTHOR_EMAIL", "author@example.com")
+            .env("GIT_AUTHOR_DATE", "1700000000 +0000")
+            .env("GIT_COMMITTER_NAME", "Fictional Committer")
+            .env("GIT_COMMITTER_EMAIL", "committer@example.com")
+            .env("GIT_COMMITTER_DATE", "1700000000 +0000")
+            .output()
+            .expect("should run fixture git");
+        assert!(
+            output.status.success(),
+            "should run fixture git {args:?}: {}",
+            String::from_utf8_lossy(&output.stderr)
+        );
+        String::from_utf8(output.stdout)
+            .expect("should emit UTF-8")
+            .trim()
+            .to_owned()
+    }
+
+    fn release(&self, args: &[&str], environment: &[(&str, &str)]) -> Output {
+        Command::new(RELEASE_BIN)
+            .args(args)
+            .current_dir(&self.root)
+            .env_clear()
+            .env("PATH", host_path())
+            .envs(environment.iter().copied())
+            .output()
+            .expect("should run release producer")
+    }
+
+    fn preflight(&self, require_qualified: bool, environment: &[(&str, &str)]) -> Output {
+        let mut args = vec![
+            "preflight",
+            "--cohort",
+            COHORT,
+            "--source-commit",
+            &self.commit,
+        ];
+        if require_qualified {
+            args.push("--require-qualified");
+        }
+        self.release(&args, environment)
+    }
+
+    fn listing(&self) -> BTreeSet<PathBuf> {
+        let mut paths = BTreeSet::new();
+        let mut pending = vec![self.root.clone()];
+        while let Some(directory) = pending.pop() {
+            for entry in fs::read_dir(&directory).expect("should list fixture") {
+                let path = entry.expect("should read fixture entry").path();
+                if fs::symlink_metadata(&path)
+                    .expect("should inspect fixture entry")
+                    .is_dir()
+                {
+                    pending.push(path.clone());
+                }
+                paths.insert(path);
+            }
+        }
+        paths
+    }
+}
+
+fn stderr(output: &Output) -> String {
+    String::from_utf8_lossy(&output.stderr).into_owned()
+}
+
+fn assert_failed_without_output(output: &Output, needle: &str) {
+    let text = stderr(output);
+    assert!(!output.status.success(), "should fail closed: {text}");
+    assert!(output.stdout.is_empty(), "should emit no stdout on failure");
+    assert!(
+        text.contains(needle),
+        "should explain failure with `{needle}`, got: {text}"
+    );
+}
+
+#[test]
+fn producer_dispatch_remains_closed_for_every_invocation() {
+    let root = tempdir().expect("should create private process fixture");
+    fs::write(root.path().join("sentinel"), b"untouched").expect("should create sentinel");
+    for arguments in [
+        vec![],
+        vec!["--help"],
+        vec!["--version"],
+        vec!["help"],
+        vec!["preflight", "--require-qualified"],
+        vec!["schema", "--schema-file", "override.json"],
+        vec!["publish"],
+    ] {
+        let output = Command::new(RELEASE_BIN)
+            .args(&arguments)
+            .current_dir(root.path())
+            .env_clear()
+            .output()
+            .expect("should run closed producer binary");
+        assert!(
+            !output.status.success(),
+            "should reject pending invocation {arguments:?}"
+        );
+        assert!(
+            output.stdout.is_empty(),
+            "should emit no result or release bytes"
+        );
+        assert!(
+            stderr(&output).contains("release execution remains disabled"),
+            "should explain pending execution gate"
+        );
+        if !arguments.is_empty() {
+            assert!(
+                stderr(&output).contains("Invalid release invocation"),
+                "should report a usage error for {arguments:?}"
+            );
+            assert!(
+                stderr(&output).contains("invalid invocation:"),
+                "should surface the argument error kind for {arguments:?}"
+            );
+        }
+        assert_eq!(
+            fs::read_dir(root.path())
+                .expect("should inspect process writes")
+                .count(),
+            1,
+            "should create no release output"
+        );
+    }
+    assert_eq!(
+        fs::read(root.path().join("sentinel")).expect("should read sentinel"),
+        b"untouched",
+        "should preserve existing operator files"
+    );
+}
+
+#[test]
+fn inherited_approval_labels_cannot_enable_preflight() {
+    let fixture = SourceFixture::new(|_| {});
+    let output = fixture.preflight(
+        true,
+        &[
+            ("TS_RELEASE_BUILD", "1"),
+            ("TS_RELEASE_SOURCE_COMMIT", &"a".repeat(40)),
+            ("RELEASE_AUTHENTICATED", "true"),
+            ("RELEASE_QUALIFIED", "true"),
+        ],
+    );
+    assert_failed_without_output(&output, "not qualified");
+}
+
+#[test]
+fn clean_fixture_preflight_fails_at_closed_selector_without_writes() {
+    let fixture = SourceFixture::new(|_| {});
+    let before = fixture.listing();
+    let output = fixture.preflight(true, &[]);
+    assert_failed_without_output(&output, "Production release selection is not qualified");
+    assert!(
+        stderr(&output).contains(
+            "source matched locally; git executable and remote eligibility not established"
+        ),
+        "should pass every earlier check before the selector without overclaiming"
+    );
+    assert_eq!(fixture.listing(), before, "should write no files");
+}
+
+#[test]
+fn qualified_looking_tools_still_fail_at_closed_receipt_check() {
+    let fixture = SourceFixture::new(|root| {
+        let digest = "ab".repeat(32);
+        let mut tools: Value =
+            serde_json::from_slice(&tracked_input(TOOLS)).expect("should parse tools");
+        for section in ["environments", "recipes", "tools"] {
+            for entry in tools[section]
+                .as_array_mut()
+                .expect("should contain entries")
+            {
+                for (key, field) in entry.as_object_mut().expect("should be an object") {
+                    if key == "qualification" {
+                        *field = json!("qualified");
+                    } else if field.is_null() && key.ends_with("sha256") {
+                        *field = json!(digest);
+                    } else if field.is_null() && key != "revision" {
+                        *field = json!("fictional.example.com/qualified");
+                    }
+                }
+            }
+        }
+        write(
+            root,
+            TOOLS,
+            &serde_json::to_vec(&tools).expect("should encode tools"),
+        );
+    });
+    let output = fixture.preflight(true, &[]);
+    assert_failed_without_output(&output, "production selection remains closed");
+}
+
+#[test]
+fn omitting_require_qualified_still_fails() {
+    let fixture = SourceFixture::new(|_| {});
+    let output = fixture.preflight(false, &[]);
+    assert_failed_without_output(&output, "Production release selection is not qualified");
+}
+
+#[test]
+fn empty_skip_flag_fails_naming_the_variable() {
+    let fixture = SourceFixture::new(|_| {});
+    let output = fixture.preflight(true, &[("TSJS_SKIP_BUILD", "")]);
+    assert_failed_without_output(&output, "TSJS_SKIP_BUILD");
+}
+
+#[test]
+fn untracked_extensionless_rust_toolchain_fails() {
+    let fixture = SourceFixture::new(|_| {});
+    write(&fixture.root, "rust-toolchain", b"nightly\n");
+    let output = fixture.preflight(true, &[]);
+    assert_failed_without_output(&output, "rust-toolchain");
+}
+
+#[test]
+fn wrong_cohort_path_fails() {
+    let fixture = SourceFixture::new(|root| {
+        write(root, "other/release-cohort.json", &tracked_input(COHORT));
+    });
+    let outside = fixture.parent.path().join("release-cohort.json");
+    for cohort in [
+        "other/release-cohort.json",
+        "scripts/release/../release/release-cohort.json",
+        outside.to_str().expect("should be UTF-8"),
+    ] {
+        let output = fixture.release(
+            &[
+                "preflight",
+                "--cohort",
+                cohort,
+                "--source-commit",
+                &fixture.commit,
+                "--require-qualified",
+            ],
+            &[],
+        );
+        assert_failed_without_output(&output, "--cohort must name");
+    }
+}
+
+#[test]
+fn candidate_cohort_listing_its_own_rc_branch_fails() {
+    let fixture = SourceFixture::new(|root| {
+        let mut cohort: Value =
+            serde_json::from_slice(&tracked_input(COHORT)).expect("should parse cohort");
+        cohort["eligible_branches"] = json!(["main", "rc/202610"]);
+        write(
+            root,
+            COHORT,
+            &serde_json::to_vec(&cohort).expect("should encode cohort"),
+        );
+    });
+    let output = fixture.preflight(true, &[]);
+    assert_failed_without_output(&output, "eligible_branches");
+}
+
+#[test]
+fn fsmonitor_config_fails_without_executing_it() {
+    let fixture = SourceFixture::new(|_| {});
+    let marker = fixture.parent.path().join("fsmonitor-ran");
+    let hook = fixture.parent.path().join("fsmonitor.sh");
+    fs::write(&hook, format!("#!/bin/sh\ntouch '{}'\n", marker.display()))
+        .expect("should write fsmonitor command");
+    fs::set_permissions(&hook, fs::Permissions::from_mode(0o755)).expect("should chmod");
+    let config = fixture.root.join(".git/config");
+    let mut text = fs::read_to_string(&config).expect("should read config");
+    text.push_str(&format!("[core]\n\tfsmonitor = {}\n", hook.display()));
+    fs::write(&config, text).expect("should write config");
+    let output = fixture.preflight(true, &[]);
+    assert_failed_without_output(&output, "git config");
+    assert!(
+        !marker.exists(),
+        "should never execute the fsmonitor command"
+    );
+}
+
+#[test]
+fn audit_inputs_reports_incomplete_with_distinct_status() {
+    let fixture = SourceFixture::new(|_| {});
+    let output = fixture.release(&["audit-inputs"], &[]);
+    assert_eq!(
+        output.status.code(),
+        Some(3),
+        "should use the incomplete status"
+    );
+    let report: Value = serde_json::from_slice(&output.stdout).expect("should print JSON report");
+    assert_eq!(report["status"], json!("incomplete"));
+    let not_established = report["not_established"].to_string();
+    for fact in [
+        "git executable identity (Task 8)",
+        "rustup override/toolchain selection (bootstrap, Task 8)",
+    ] {
+        assert!(
+            not_established.contains(fact),
+            "should list {fact} as not established"
+        );
+    }
+    assert!(
+        report["pending"]
+            .as_array()
+            .is_some_and(|pending| !pending.is_empty()),
+        "should list pending pins"
+    );
+    assert_eq!(
+        report["inputs"].as_array().map(Vec::len),
+        Some(3),
+        "should list input digests"
+    );
+}
+
+fn bootstrap(directory: &Path) -> Output {
+    Command::new("/bin/sh")
+        .arg(Path::new(REPOSITORY).join(BOOTSTRAP))
+        .current_dir(directory)
+        .env_clear()
+        .output()
+        .expect("should run bootstrap")
+}
+
+#[test]
+fn bootstrap_rejects_extensionless_rust_toolchain_before_closing() {
+    let root = tempdir().expect("should create bootstrap fixture");
+    let closed = bootstrap(root.path());
+    assert!(!closed.status.success(), "should stay closed");
+    assert!(
+        stderr(&closed).contains("pending"),
+        "should explain the closed launcher"
+    );
+    fs::write(root.path().join("rust-toolchain"), b"nightly\n").expect("should write pin");
+    let rejected = bootstrap(root.path());
+    assert!(!rejected.status.success(), "should reject the pin");
+    assert!(
+        stderr(&rejected).contains("rust-toolchain"),
+        "should name the extensionless toolchain file"
+    );
+}
+
+#[test]
+fn bootstrap_checks_rust_toolchain_at_its_repository_root() {
+    let tree = tempdir().expect("should create bootstrap tree");
+    let script = tree.path().join(BOOTSTRAP);
+    fs::create_dir_all(script.parent().expect("should have parent")).expect("should create dirs");
+    fs::copy(Path::new(REPOSITORY).join(BOOTSTRAP), &script).expect("should copy bootstrap");
+    fs::write(tree.path().join("rust-toolchain"), b"nightly\n").expect("should write pin");
+    let elsewhere = tempdir().expect("should create unrelated working directory");
+    let output = Command::new("/bin/sh")
+        .arg(&script)
+        .current_dir(elsewhere.path())
+        .env_clear()
+        .output()
+        .expect("should run bootstrap");
+    assert!(!output.status.success(), "should stay closed");
+    assert!(
+        stderr(&output).contains("rust-toolchain"),
+        "should reject the repository-root pin even from another working directory"
+    );
+}
diff --git a/crates/trusted-server-release/tests/fixtures/README.md b/crates/trusted-server-release/tests/fixtures/README.md
new file mode 100644
index 0000000000..0bbc65d2b1
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/README.md
@@ -0,0 +1,17 @@
+# Release document fixtures
+
+Private unit tests in `src/documents/tests.rs`, `src/policy/tests.rs`, `src/preflight/tests.rs` and `src/source/tests.rs` are registered by their modules; public process tests in `tests/commands.rs` exercise the closed dispatch, the fail-closed `preflight` and `audit-inputs` commands, and the closed POSIX bootstrap. Fixture documents, names and digests are fictional controls. Schema-valid fixtures demonstrate structural validation, not source approval, authenticated acquisition, complete SPDX coverage or release qualification.
+
+The source-owned `../../schemas/spdx-2.3.schema.json` is retained byte-for-byte from the SPDX specification at commit `aadf3b0b8dbbabdb4d880b0fc714255fea436ff7`, path `schemas/spdx-schema.json`: 45,312 bytes, SHA-256 `239208b7ac287b3cf5d9a9af23f9d69863971102a5e1587a27a398b43490b89b`, JSON Schema Draft 7. SPDX specification contributors provide this material under Creative Commons Attribution 3.0 Unported; the original repository license is retained in `../../schemas/SPDX-LICENSE`. The schema has not been modified.
+
+Source: [SPDX specification schema](https://github.com/spdx/spdx-spec/blob/aadf3b0b8dbbabdb4d880b0fc714255fea436ff7/schemas/spdx-schema.json), [upstream license](https://github.com/spdx/spdx-spec/blob/aadf3b0b8dbbabdb4d880b0fc714255fea436ff7/LICENSE).
+
+The exact `jsonschema` 0.58.6 dependency is a locally tested evaluator candidate. Default HTTP, file, TLS and IDNA features and optional language bindings are disabled. Every evaluator construction selects a draft explicitly and uses `offline()` to reject unregistered references, including under feature unification. Production code selects only the three retained schemas; no schema-file CLI override exists. The synthetic prefix-items control qualifies Draft 2020-12 behavior alongside structural positive and negative tests of the governing index and qualification-result schemas.
+
+Atomic-output callers must select a trusted parent directory. Source and process tests build their own Git repositories in temporary directories (`git init`, fictional files, fixed fictional author and committer dates) under a cleared environment; they never assert success against the developer checkout. Process fixtures copy the tracked cohort, tools and consumer policy bytes and may mutate only those copies, for example a candidate cohort listing its own `rc/` branch or structurally qualified tool pins with fictional digests. A clean fixture still fails at the closed qualified selector because pins are pending and authenticated acquisition receipts (Task 8) cannot be constructed; remote branch-tip ancestry and ruleset validation (Task 14) are not established locally. Producer execution and the POSIX bootstrap remain closed. Full real-artifact SPDX coverage remains Task 11 work.
+
+The 640-byte `sha-mbles-1.bin` is the public SHA-1 chosen-prefix collision vector from the SHA-mbles research (Leurent and Peyrin, 2020), copied byte-for-byte from the `sha1-checked` 0.10.0 crate test data (SHA-256 `3ead211681cec93d265c8ac123dd062e105408cebf82fa6e2b126f4f40bcb88c`). The unit test hashes it directly to prove collision detection rejects it; Git-framed objects add a `<kind> <length>\0` header, so an attacker would have to include that header in the chosen prefix.
+
+Fixture and process tests require a `git` executable on an absolute `PATH` entry; they build every repository under a cleared environment. Because preflight rejects any `.cargo/config` or `.cargo/config.toml` above the source root, the temporary directory used for fixtures must have no such ancestor layer; the fixtures assert this and name the offending file (set `TMPDIR` to a clean directory if needed).
+
+The `index/candidate/` files are the golden output of the unqualified candidate release index assembly (`src/distribution.rs`), rendered from fictional entry facts in `src/distribution/tests.rs` and compared byte-for-byte by `distribution::tests::golden`. Every name, digest and commit is fictional except `policy_sha256`, which is the SHA-256 of the tracked `crates/trusted-server-cli/release-policy.json`, so the consumer accepts the producer policy as current; a change to that policy requires regenerating these files in the same change. The index bytes are named `candidate-release-index.json`, never `release-index.json`; the tag is the sentinel `v0.0.0-unqualified-candidate`; both signature bundle records per artifact are the empty-file record (size 0, SHA-256 of zero bytes) and no bundle file exists. The CLI's `release::evidence::candidate_fixture_tests` includes these files test-only (neither crate depends on the other), runs every unsigned consumer join over them and confirms that the consumer's non-empty bundle rule rejects the candidate. These fixtures grant no signing, publication or qualification authority.
diff --git a/crates/trusted-server-release/tests/fixtures/cargo-denial/Cargo.lock b/crates/trusted-server-release/tests/fixtures/cargo-denial/Cargo.lock
new file mode 100644
index 0000000000..ca5880e993
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/cargo-denial/Cargo.lock
@@ -0,0 +1,19 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "build-direct"
+version = "0.1.0"
+
+[[package]]
+name = "build-grandchild"
+version = "0.1.0"
+
+[[package]]
+name = "control"
+version = "0.1.0"
+
+[[package]]
+name = "macro-attempt"
+version = "0.1.0"
diff --git a/crates/trusted-server-release/tests/fixtures/cargo-denial/Cargo.toml b/crates/trusted-server-release/tests/fixtures/cargo-denial/Cargo.toml
new file mode 100644
index 0000000000..c1d688f798
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/cargo-denial/Cargo.toml
@@ -0,0 +1,18 @@
+# Ordinary CI denial fixture: every member but `control` tries one loopback
+# connection while Cargo builds it and fails the build reporting the errno.
+[workspace]
+resolver = "3"
+members = [
+    "crates/build-direct",
+    "crates/build-grandchild",
+    "crates/control",
+    "crates/macro-attempt",
+]
+
+[workspace.package]
+edition = "2024"
+publish = false
+version = "0.1.0"
+
+[profile.release]
+debug = 1
diff --git a/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/build-direct/Cargo.toml b/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/build-direct/Cargo.toml
new file mode 100644
index 0000000000..ee55bd2fd2
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/build-direct/Cargo.toml
@@ -0,0 +1,6 @@
+[package]
+name = "build-direct"
+edition.workspace = true
+publish.workspace = true
+version.workspace = true
+build = "build.rs"
diff --git a/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/build-direct/build.rs b/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/build-direct/build.rs
new file mode 100644
index 0000000000..8a29343946
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/build-direct/build.rs
@@ -0,0 +1,13 @@
+//! Attempts one loopback connection while Cargo runs this build script.
+
+use std::net::TcpStream;
+
+fn main() {
+    println!("cargo::rerun-if-changed=build.rs");
+    let report = match TcpStream::connect(("127.0.0.1", 9)) {
+        Ok(_) => "connected".to_owned(),
+        Err(error) => format!("errno=[{}]", error.raw_os_error().unwrap_or(-1)),
+    };
+    eprintln!("TS_DENIAL case=build-direct {report}");
+    std::process::exit(1);
+}
diff --git a/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/build-direct/src/main.rs b/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/build-direct/src/main.rs
new file mode 100644
index 0000000000..3b4d2fdf57
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/build-direct/src/main.rs
@@ -0,0 +1,3 @@
+//! Never built: the build script fails first.
+
+fn main() {}
diff --git a/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/build-grandchild/Cargo.toml b/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/build-grandchild/Cargo.toml
new file mode 100644
index 0000000000..3db47f1365
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/build-grandchild/Cargo.toml
@@ -0,0 +1,6 @@
+[package]
+name = "build-grandchild"
+edition.workspace = true
+publish.workspace = true
+version.workspace = true
+build = "build.rs"
diff --git a/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/build-grandchild/build.rs b/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/build-grandchild/build.rs
new file mode 100644
index 0000000000..e544f0b3c9
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/build-grandchild/build.rs
@@ -0,0 +1,29 @@
+//! Re-executes this build script; the child attempts one loopback connection.
+
+use std::net::TcpStream;
+use std::process::Command;
+
+/// Marks the re-executed child.
+const CHILD: &str = "TS_DENIAL_GRANDCHILD";
+
+fn main() {
+    if std::env::var_os(CHILD).is_some() {
+        let report = match TcpStream::connect(("127.0.0.1", 9)) {
+            Ok(_) => "connected".to_owned(),
+            Err(error) => format!("errno=[{}]", error.raw_os_error().unwrap_or(-1)),
+        };
+        println!("{report}");
+        return;
+    }
+    println!("cargo::rerun-if-changed=build.rs");
+    let program = std::env::current_exe().expect("should locate the build script");
+    let report = match Command::new(program).env(CHILD, "1").output() {
+        Ok(output) if output.status.success() => {
+            format!("child {}", String::from_utf8_lossy(&output.stdout).trim())
+        }
+        Ok(output) => format!("child failed with {}", output.status),
+        Err(error) => format!("child could not start: {error}"),
+    };
+    eprintln!("TS_DENIAL case=build-grandchild {report}");
+    std::process::exit(1);
+}
diff --git a/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/build-grandchild/src/main.rs b/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/build-grandchild/src/main.rs
new file mode 100644
index 0000000000..3b4d2fdf57
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/build-grandchild/src/main.rs
@@ -0,0 +1,3 @@
+//! Never built: the build script fails first.
+
+fn main() {}
diff --git a/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/control/Cargo.toml b/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/control/Cargo.toml
new file mode 100644
index 0000000000..c4da64d26b
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/control/Cargo.toml
@@ -0,0 +1,6 @@
+[package]
+name = "control"
+edition.workspace = true
+publish.workspace = true
+version.workspace = true
+build = "build.rs"
diff --git a/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/control/build.rs b/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/control/build.rs
new file mode 100644
index 0000000000..364cd30c61
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/control/build.rs
@@ -0,0 +1,5 @@
+//! A build script that attempts nothing, so the control still runs one.
+
+fn main() {
+    println!("cargo::rerun-if-changed=build.rs");
+}
diff --git a/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/control/src/control.rs b/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/control/src/control.rs
new file mode 100644
index 0000000000..ac63fa4cce
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/control/src/control.rs
@@ -0,0 +1,3 @@
+fn main() {
+    println!("control {}", file!());
+}
diff --git a/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/control/src/main.rs b/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/control/src/main.rs
new file mode 100644
index 0000000000..bee5750bdf
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/control/src/main.rs
@@ -0,0 +1,4 @@
+//! Builds without any connection attempt.
+
+// The absolute include gives rustc a real source location to remap and retain.
+include!(concat!(env!("CARGO_MANIFEST_DIR"), "/src/control.rs"));
diff --git a/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/macro-attempt/Cargo.toml b/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/macro-attempt/Cargo.toml
new file mode 100644
index 0000000000..70ec74ca80
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/macro-attempt/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "macro-attempt"
+edition.workspace = true
+publish.workspace = true
+version.workspace = true
+
+[lib]
+proc-macro = true
+
+[[bin]]
+name = "macro-attempt"
+path = "src/main.rs"
diff --git a/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/macro-attempt/src/lib.rs b/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/macro-attempt/src/lib.rs
new file mode 100644
index 0000000000..a3761ecd3e
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/macro-attempt/src/lib.rs
@@ -0,0 +1,17 @@
+//! A procedural macro that attempts one loopback connection while it expands.
+
+use std::net::TcpStream;
+
+use proc_macro::TokenStream;
+
+/// Expands to a compile error reporting the connection attempt.
+#[proc_macro]
+pub fn attempt(_input: TokenStream) -> TokenStream {
+    let report = match TcpStream::connect(("127.0.0.1", 9)) {
+        Ok(_) => "connected".to_owned(),
+        Err(error) => format!("errno=[{}]", error.raw_os_error().unwrap_or(-1)),
+    };
+    format!("compile_error!(\"TS_DENIAL case=macro-attempt {report}\");")
+        .parse()
+        .expect("should parse the generated report")
+}
diff --git a/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/macro-attempt/src/main.rs b/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/macro-attempt/src/main.rs
new file mode 100644
index 0000000000..0c2156a90b
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/cargo-denial/crates/macro-attempt/src/main.rs
@@ -0,0 +1,5 @@
+//! Uses the connecting macro, so building this binary expands it.
+
+macro_attempt::attempt!();
+
+fn main() {}
diff --git a/crates/trusted-server-release/tests/fixtures/collection/README.md b/crates/trusted-server-release/tests/fixtures/collection/README.md
new file mode 100644
index 0000000000..36844b9ea2
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/collection/README.md
@@ -0,0 +1,61 @@
+# Collection candidate fixtures
+
+`build-record.json` is fictional imported diagnostic data. The tests fill its
+artifact, inventory, composition, and runtime digests from local fixture bytes.
+
+`composition.json` is a fictional sealed composition receipt in the producer's
+exact `composition_export()` shape: Cargo query plan digests, compiler
+observations, and the graph, package origin, native, JavaScript and platform
+receipts. The tests fill its target, final artifact digest (JavaScript,
+platform and external-requirement bindings), approved source commit (package
+origins and workspace origins) and shared inventory digest per build. The
+collector rejects unknown or missing members at every level it checks, binds
+the receipt to the record's artifact, source, inventory, materials digest and
+fixed target, requires compiled units and one well-formed origin per observed
+package, rejects any complete material native coverage claim, and requires a
+Fastly receipt to embed every prepared JS module. The platform's installed-tool
+subtrees stay opaque apart from those bindings, Apple evidence present exactly
+for Darwin targets, and a runtime format (`wasm`, `elf`, `macho`) matching the
+target; the tests add fictional Apple and runtime facts per target.
+A Fastly runtime diagnostic names the build role (`A` or `B`) whose own run
+accepted the final bytes and must match its record's role. That role is
+asserted by the producer inside its own record, so it catches mix-ups and reuse
+in an honest pipeline but not a malicious producer copying the other role's
+runtime object over equal bytes. Binding strength comes from the trusted upload
+role and job isolation; a per-run Viceroy identity remains a named gap. A
+missing optional
+native reproduction has a separate bounded result with no upload ID, transfer
+digest, or invented environment observations. Its outcome derives from the
+observed job state: never started, skipped or cancelled before starting is
+`unavailable`; started without an upload, or a failed or timed-out conclusion,
+is `failed`.
+
+The record's boundary block keeps two identities apart. `fingerprint` and
+`execution_fingerprint` name the boundary instance; they must be equal (the
+socket denial receipt belongs to the instance that ran the build) and differ
+between A and B. Because each instance fingerprint includes a fresh nonce, that
+difference only proves separate instances. `invocation_digest` is the exact
+build invocation digest (program, arguments including jobs, environment,
+checkout-root working directory and umask); A and B must also differ there.
+
+The dependency capability has no production constructor: the qualified adapter
+is an uninhabited type. An imported record never constructs local recipe,
+network-denial, composition, or runtime proof types. In particular, the imported
+composition receipt checks digest and identity consistency; it does not prove
+complete source coverage or final executable membership. These diagnostics
+cannot authorize signing, publication, or deployment.
+
+The pending workflow adapter must obtain upload identities from trusted current
+run dependencies, supply the approved repository to both exact-ID requests,
+limit transport bytes and time, and reject transfer warnings. Raw artifact REST
+metadata corroborates artifact ID/name/digest, expiration, run, source, and
+repository IDs; it does not independently identify a producing job or attempt.
+The adapter must never select a caller-supplied download URL.
+
+The ZIP reader accepts a declared flat ZIP32 profile with stored or raw-deflate
+members and optional data descriptors. It rejects ZIP64, extras, encryption,
+nonregular members, multidisk archives, comments, duplicate identities,
+undeclared bytes, and local/central/descriptor disagreements. It retains checked
+member bytes in memory and performs no filesystem extraction. Qualification of
+the actual upload action archive format and trusted producer export remains
+required before official collection.
diff --git a/crates/trusted-server-release/tests/fixtures/collection/build-record.json b/crates/trusted-server-release/tests/fixtures/collection/build-record.json
new file mode 100644
index 0000000000..540a3df51b
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/collection/build-record.json
@@ -0,0 +1,48 @@
+{
+  "schema_version": 1,
+  "source_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "recipe_sha256": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+  "asset": "trusted-server-fastly.wasm",
+  "role": "A",
+  "job": "fastly-a",
+  "attempt": 1,
+  "inputs": {
+    "cargo_lock": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+    "materials": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+    "rust_tools": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+    "js_settings": "1111111111111111111111111111111111111111111111111111111111111111",
+    "js_tools": "2222222222222222222222222222222222222222222222222222222222222222"
+  },
+  "inventory_sha256": "",
+  "artifact_sha256": "",
+  "artifact_size": 0,
+  "composition_sha256": "",
+  "ambient": {
+    "umask": 18,
+    "jobs": 4,
+    "checkout_root": "/external-release-A",
+    "started_at_seconds": 100,
+    "execution_uid": 1000,
+    "host_locale": "C",
+    "host_timezone": "UTC",
+    "child_locale": "C",
+    "child_timezone": "UTC"
+  },
+  "claim": {
+    "varied": ["umask", "jobs", "checkout_root", "start_time"],
+    "normalized": ["locale", "timezone"],
+    "unsupported": ["execution_user"]
+  },
+  "boundary": {
+    "fingerprint": "3333333333333333333333333333333333333333333333333333333333333333",
+    "execution_fingerprint": "3333333333333333333333333333333333333333333333333333333333333333",
+    "invocation_digest": "5555555555555555555555555555555555555555555555555555555555555555",
+    "confined": true,
+    "control_exit": 0,
+    "control_accepts": 1,
+    "probe_exit": 3,
+    "probe_errno": 1,
+    "probe_accepts": 0
+  },
+  "runtime": null
+}
diff --git a/crates/trusted-server-release/tests/fixtures/collection/composition.json b/crates/trusted-server-release/tests/fixtures/collection/composition.json
new file mode 100644
index 0000000000..9ac423af0e
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/collection/composition.json
@@ -0,0 +1,203 @@
+{
+  "metadata_plan_sha256": "7777777777777777777777777777777777777777777777777777777777777777",
+  "tree_plan_sha256": "8888888888888888888888888888888888888888888888888888888888888888",
+  "observations": {
+    "packages": [
+      {
+        "id": "path+file:///workspace/crates/example-app#0.1.0",
+        "name": "example-app",
+        "version": "0.1.0",
+        "source": null,
+        "manifest_path": "/workspace/crates/example-app/Cargo.toml",
+        "license": "Apache-2.0"
+      },
+      {
+        "id": "registry+https://registry.example.com/index#example-dep@1.0.0",
+        "name": "example-dep",
+        "version": "1.0.0",
+        "source": "registry+https://registry.example.com/index",
+        "manifest_path": "/workspace/vendor/example-dep-1.0.0/Cargo.toml",
+        "license": null
+      }
+    ],
+    "units": [
+      {
+        "package_id": "registry+https://registry.example.com/index#example-dep@1.0.0",
+        "target_name": "example_dep",
+        "target_kind": ["lib"],
+        "crate_types": ["lib"],
+        "context": "target",
+        "features": ["default"],
+        "profile": {
+          "opt_level": "3",
+          "debuginfo": 2,
+          "debug_assertions": false,
+          "overflow_checks": false,
+          "test": false
+        },
+        "filenames": [
+          "/workspace/target/release/deps/libexample_dep-0000000000000000.rlib"
+        ],
+        "executable": null
+      },
+      {
+        "package_id": "path+file:///workspace/crates/example-app#0.1.0",
+        "target_name": "example-app",
+        "target_kind": ["bin"],
+        "crate_types": ["bin"],
+        "context": "target",
+        "features": [],
+        "profile": {
+          "opt_level": "3",
+          "debuginfo": 2,
+          "debug_assertions": false,
+          "overflow_checks": false,
+          "test": false
+        },
+        "filenames": ["/workspace/target/release/example-app"],
+        "executable": "/workspace/target/release/example-app"
+      }
+    ],
+    "build_scripts": [
+      {
+        "package_id": "registry+https://registry.example.com/index#example-dep@1.0.0",
+        "context": "target",
+        "out_dir": "/workspace/target/release/build/example-dep-0000000000000000/out",
+        "linked_libs": ["static=example"],
+        "linked_paths": [
+          "native=/workspace/target/release/build/example-dep-0000000000000000/out"
+        ],
+        "cfgs": ["example_cfg"],
+        "environment": [["EXAMPLE_ENV", "1"]]
+      }
+    ]
+  },
+  "composition": {
+    "graph": {
+      "selected_package_id": "path+file:///workspace/crates/example-app#0.1.0",
+      "tree_package_ids": [
+        "path+file:///workspace/crates/example-app#0.1.0",
+        "registry+https://registry.example.com/index#example-dep@1.0.0"
+      ],
+      "observed_package_ids": [
+        "path+file:///workspace/crates/example-app#0.1.0",
+        "registry+https://registry.example.com/index#example-dep@1.0.0"
+      ],
+      "edges": [
+        {
+          "parent": "path+file:///workspace/crates/example-app#0.1.0",
+          "dependency": "registry+https://registry.example.com/index#example-dep@1.0.0",
+          "kinds": ["normal"]
+        }
+      ]
+    },
+    "package_origins": {
+      "source_commit": "",
+      "materials_sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+      "packages": {
+        "path+file:///workspace/crates/example-app#0.1.0": {
+          "name": "example-app",
+          "version": "0.1.0",
+          "manifest_path": "crates/example-app/Cargo.toml",
+          "prepared_manifest_sha256": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
+          "origin": {
+            "kind": "workspace",
+            "source_commit": "",
+            "path": "crates/example-app/Cargo.toml"
+          }
+        },
+        "registry+https://registry.example.com/index#example-dep@1.0.0": {
+          "name": "example-dep",
+          "version": "1.0.0",
+          "manifest_path": "vendor/example-dep-1.0.0/Cargo.toml",
+          "prepared_manifest_sha256": "b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2",
+          "origin": {
+            "kind": "material",
+            "source": "registry+https://registry.example.com/index",
+            "original": {
+              "kind": "registry",
+              "archive_sha256": "c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3"
+            }
+          }
+        }
+      }
+    },
+    "native": {
+      "contributors": [
+        {
+          "package_id": "registry+https://registry.example.com/index#example-dep@1.0.0",
+          "name": "example-dep",
+          "version": "1.0.0",
+          "context": "target",
+          "features": ["default"],
+          "classification": "conservative_embedded_contributor",
+          "original_sha256": "c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3",
+          "source_tree_sha256": "d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4",
+          "source_subtrees": [
+            {
+              "path": "native",
+              "sha256": "e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5"
+            }
+          ],
+          "linked_libs": ["static=example"],
+          "linked_paths": [
+            "native=/workspace/target/release/build/example-dep-0000000000000000/out"
+          ],
+          "archives": [
+            {
+              "path": "/workspace/target/release/build/example-dep-0000000000000000/out/libexample.a",
+              "size": 4096,
+              "sha256": "f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6"
+            }
+          ]
+        }
+      ],
+      "build_tool_package_ids": [],
+      "material_native_coverage_complete": false
+    },
+    "javascript": {
+      "artifact_sha256": "",
+      "inventory_sha256": "",
+      "modules": [
+        {
+          "module": {
+            "id": "core",
+            "filename": "tsjs-core.js",
+            "size": 64,
+            "sha256": "0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a"
+          },
+          "classification": "conservative_embedded_js"
+        }
+      ],
+      "method": "complete-uncompressed-module-substring; no function reachability claim"
+    },
+    "platform": {
+      "target": "",
+      "artifact_sha256": "",
+      "rust": {
+        "tree_sha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+        "target": "",
+        "cargo": "cargo 1.95.0",
+        "rustc": "rustc 1.95.0",
+        "target_standard_library": "lib/rustlib/example-target/lib",
+        "identity_scope": "fictional-installed-tree",
+        "origin": "fictional-unauthenticated",
+        "qualification": "unqualified"
+      },
+      "apple": null,
+      "external_requirements": {
+        "target": "",
+        "artifact_sha256": "",
+        "runtime": {
+          "format": "wasm",
+          "import_modules": ["fastly_http_req"]
+        }
+      },
+      "native_tools": {
+        "scope": "host_path_unresolved",
+        "roles": ["compiler", "assembler", "archiver", "linker", "build_tools"]
+      },
+      "material_native_coverage_complete": false
+    }
+  }
+}
diff --git a/crates/trusted-server-release/tests/fixtures/composition/README.md b/crates/trusted-server-release/tests/fixtures/composition/README.md
new file mode 100644
index 0000000000..27c36f2a62
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/composition/README.md
@@ -0,0 +1,27 @@
+# Cargo observation fixtures
+
+The Cargo 1.95 metadata and JSONL fixtures are actual Cargo outputs. Absolute
+checkout and target roots are relocated to `/build/source` and `/build/target`;
+other observed fields are preserved. These are parser regressions, not release
+qualification evidence.
+
+The `cargo-1.95-cross-*` fixture uses resolver 2 and three fictional packages:
+
+- `example-app` has a build script that calls its build dependency,
+  `example-host-helper`.
+- `example-host-helper` depends on `example-host-unix` under
+  `[target.'cfg(unix)'.dependencies]`.
+- Both helper packages are excluded from workspace membership but remain path
+  dependencies. All functions are empty except the calls above.
+
+The commands are `cargo metadata --format-version 1 --frozen --offline`, the
+same command with `--filter-platform wasm32-wasip1`, and
+`cargo build --release --target wasm32-wasip1 --frozen --offline --message-format json`.
+The cross-build runs on a Unix host. Cargo compiles `example-host-unix` for that
+host, but the target-filtered metadata omits its identity. The unfiltered
+catalog preserves the identity needed for an exact join. Metadata membership
+alone never marks a package as a contributor.
+
+The original `cargo-1.95-metadata.json` and `cargo-1.95-messages.jsonl` use the
+`cargo-denial` fixture's `control` package, with a host build script and a target
+Wasm executable.
diff --git a/crates/trusted-server-release/tests/fixtures/composition/cargo-1.95-cross-host-metadata.json b/crates/trusted-server-release/tests/fixtures/composition/cargo-1.95-cross-host-metadata.json
new file mode 100644
index 0000000000..319111217c
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/composition/cargo-1.95-cross-host-metadata.json
@@ -0,0 +1 @@
+{"packages":[{"name":"example-app","version":"0.1.0","id":"path+file:///build/source/app#example-app@0.1.0","license":null,"license_file":null,"description":null,"source":null,"dependencies":[{"name":"example-host-helper","source":null,"req":"*","kind":"build","rename":null,"optional":false,"uses_default_features":true,"features":[],"target":null,"registry":null,"path":"/build/source/host-helper"}],"targets":[{"kind":["bin"],"crate_types":["bin"],"name":"example-app","src_path":"/build/source/app/src/main.rs","edition":"2024","doc":true,"doctest":false,"test":true},{"kind":["custom-build"],"crate_types":["bin"],"name":"build-script-build","src_path":"/build/source/app/build.rs","edition":"2024","doc":false,"doctest":false,"test":false}],"features":{},"manifest_path":"/build/source/app/Cargo.toml","metadata":null,"publish":null,"authors":[],"categories":[],"keywords":[],"readme":null,"repository":null,"homepage":null,"documentation":null,"edition":"2024","links":null,"default_run":null,"rust_version":null},{"name":"example-host-helper","version":"0.1.0","id":"path+file:///build/source/host-helper#example-host-helper@0.1.0","license":null,"license_file":null,"description":null,"source":null,"dependencies":[{"name":"example-host-unix","source":null,"req":"*","kind":null,"rename":null,"optional":false,"uses_default_features":true,"features":[],"target":"cfg(unix)","registry":null,"path":"/build/source/host-unix"}],"targets":[{"kind":["lib"],"crate_types":["lib"],"name":"example_host_helper","src_path":"/build/source/host-helper/src/lib.rs","edition":"2024","doc":true,"doctest":true,"test":true}],"features":{},"manifest_path":"/build/source/host-helper/Cargo.toml","metadata":null,"publish":null,"authors":[],"categories":[],"keywords":[],"readme":null,"repository":null,"homepage":null,"documentation":null,"edition":"2024","links":null,"default_run":null,"rust_version":null},{"name":"example-host-unix","version":"0.1.0","id":"path+file:///build/source/host-unix#example-host-unix@0.1.0","license":null,"license_file":null,"description":null,"source":null,"dependencies":[],"targets":[{"kind":["lib"],"crate_types":["lib"],"name":"example_host_unix","src_path":"/build/source/host-unix/src/lib.rs","edition":"2024","doc":true,"doctest":true,"test":true}],"features":{},"manifest_path":"/build/source/host-unix/Cargo.toml","metadata":null,"publish":null,"authors":[],"categories":[],"keywords":[],"readme":null,"repository":null,"homepage":null,"documentation":null,"edition":"2024","links":null,"default_run":null,"rust_version":null}],"workspace_members":["path+file:///build/source/app#example-app@0.1.0"],"workspace_default_members":["path+file:///build/source/app#example-app@0.1.0"],"resolve":{"nodes":[{"id":"path+file:///build/source/app#example-app@0.1.0","dependencies":["path+file:///build/source/host-helper#example-host-helper@0.1.0"],"deps":[{"name":"example_host_helper","pkg":"path+file:///build/source/host-helper#example-host-helper@0.1.0","dep_kinds":[{"kind":"build","target":null}]}],"features":[]},{"id":"path+file:///build/source/host-helper#example-host-helper@0.1.0","dependencies":["path+file:///build/source/host-unix#example-host-unix@0.1.0"],"deps":[{"name":"example_host_unix","pkg":"path+file:///build/source/host-unix#example-host-unix@0.1.0","dep_kinds":[{"kind":null,"target":"cfg(unix)"}]}],"features":[]},{"id":"path+file:///build/source/host-unix#example-host-unix@0.1.0","dependencies":[],"deps":[],"features":[]}],"root":null},"target_directory":"/build/target","build_directory":"/build/target","version":1,"workspace_root":"/build/source","metadata":null}
diff --git a/crates/trusted-server-release/tests/fixtures/composition/cargo-1.95-cross-messages.jsonl b/crates/trusted-server-release/tests/fixtures/composition/cargo-1.95-cross-messages.jsonl
new file mode 100644
index 0000000000..ba95168d0a
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/composition/cargo-1.95-cross-messages.jsonl
@@ -0,0 +1,6 @@
+{"reason":"compiler-artifact","package_id":"path+file:///build/source/host-unix#example-host-unix@0.1.0","manifest_path":"/build/source/host-unix/Cargo.toml","target":{"kind":["lib"],"crate_types":["lib"],"name":"example_host_unix","src_path":"/build/source/host-unix/src/lib.rs","edition":"2024","doc":true,"doctest":true,"test":true},"profile":{"opt_level":"0","debuginfo":0,"debug_assertions":false,"overflow_checks":false,"test":false},"features":[],"filenames":["/build/target/release/deps/libexample_host_unix-03af688a1a7bf4c9.rlib","/build/target/release/deps/libexample_host_unix-03af688a1a7bf4c9.rmeta"],"executable":null,"fresh":false}
+{"reason":"compiler-artifact","package_id":"path+file:///build/source/host-helper#example-host-helper@0.1.0","manifest_path":"/build/source/host-helper/Cargo.toml","target":{"kind":["lib"],"crate_types":["lib"],"name":"example_host_helper","src_path":"/build/source/host-helper/src/lib.rs","edition":"2024","doc":true,"doctest":true,"test":true},"profile":{"opt_level":"0","debuginfo":0,"debug_assertions":false,"overflow_checks":false,"test":false},"features":[],"filenames":["/build/target/release/deps/libexample_host_helper-7702908834aa9f62.rlib","/build/target/release/deps/libexample_host_helper-7702908834aa9f62.rmeta"],"executable":null,"fresh":false}
+{"reason":"compiler-artifact","package_id":"path+file:///build/source/app#example-app@0.1.0","manifest_path":"/build/source/app/Cargo.toml","target":{"kind":["custom-build"],"crate_types":["bin"],"name":"build-script-build","src_path":"/build/source/app/build.rs","edition":"2024","doc":false,"doctest":false,"test":false},"profile":{"opt_level":"0","debuginfo":0,"debug_assertions":false,"overflow_checks":false,"test":false},"features":[],"filenames":["/build/target/release/build/example-app-855de26c2664a2a7/build-script-build"],"executable":null,"fresh":false}
+{"reason":"build-script-executed","package_id":"path+file:///build/source/app#example-app@0.1.0","linked_libs":[],"linked_paths":[],"cfgs":[],"env":[],"out_dir":"/build/target/wasm32-wasip1/release/build/example-app-f1024798a111146f/out"}
+{"reason":"compiler-artifact","package_id":"path+file:///build/source/app#example-app@0.1.0","manifest_path":"/build/source/app/Cargo.toml","target":{"kind":["bin"],"crate_types":["bin"],"name":"example-app","src_path":"/build/source/app/src/main.rs","edition":"2024","doc":true,"doctest":false,"test":true},"profile":{"opt_level":"3","debuginfo":0,"debug_assertions":false,"overflow_checks":false,"test":false},"features":[],"filenames":["/build/target/wasm32-wasip1/release/example-app.wasm"],"executable":"/build/target/wasm32-wasip1/release/example-app.wasm","fresh":false}
+{"reason":"build-finished","success":true}
diff --git a/crates/trusted-server-release/tests/fixtures/composition/cargo-1.95-cross-target-filtered-metadata.json b/crates/trusted-server-release/tests/fixtures/composition/cargo-1.95-cross-target-filtered-metadata.json
new file mode 100644
index 0000000000..8e60215698
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/composition/cargo-1.95-cross-target-filtered-metadata.json
@@ -0,0 +1 @@
+{"packages":[{"name":"example-app","version":"0.1.0","id":"path+file:///build/source/app#example-app@0.1.0","license":null,"license_file":null,"description":null,"source":null,"dependencies":[{"name":"example-host-helper","source":null,"req":"*","kind":"build","rename":null,"optional":false,"uses_default_features":true,"features":[],"target":null,"registry":null,"path":"/build/source/host-helper"}],"targets":[{"kind":["bin"],"crate_types":["bin"],"name":"example-app","src_path":"/build/source/app/src/main.rs","edition":"2024","doc":true,"doctest":false,"test":true},{"kind":["custom-build"],"crate_types":["bin"],"name":"build-script-build","src_path":"/build/source/app/build.rs","edition":"2024","doc":false,"doctest":false,"test":false}],"features":{},"manifest_path":"/build/source/app/Cargo.toml","metadata":null,"publish":null,"authors":[],"categories":[],"keywords":[],"readme":null,"repository":null,"homepage":null,"documentation":null,"edition":"2024","links":null,"default_run":null,"rust_version":null},{"name":"example-host-helper","version":"0.1.0","id":"path+file:///build/source/host-helper#example-host-helper@0.1.0","license":null,"license_file":null,"description":null,"source":null,"dependencies":[{"name":"example-host-unix","source":null,"req":"*","kind":null,"rename":null,"optional":false,"uses_default_features":true,"features":[],"target":"cfg(unix)","registry":null,"path":"/build/source/host-unix"}],"targets":[{"kind":["lib"],"crate_types":["lib"],"name":"example_host_helper","src_path":"/build/source/host-helper/src/lib.rs","edition":"2024","doc":true,"doctest":true,"test":true}],"features":{},"manifest_path":"/build/source/host-helper/Cargo.toml","metadata":null,"publish":null,"authors":[],"categories":[],"keywords":[],"readme":null,"repository":null,"homepage":null,"documentation":null,"edition":"2024","links":null,"default_run":null,"rust_version":null}],"workspace_members":["path+file:///build/source/app#example-app@0.1.0"],"workspace_default_members":["path+file:///build/source/app#example-app@0.1.0"],"resolve":{"nodes":[{"id":"path+file:///build/source/app#example-app@0.1.0","dependencies":["path+file:///build/source/host-helper#example-host-helper@0.1.0"],"deps":[{"name":"example_host_helper","pkg":"path+file:///build/source/host-helper#example-host-helper@0.1.0","dep_kinds":[{"kind":"build","target":null}]}],"features":[]},{"id":"path+file:///build/source/host-helper#example-host-helper@0.1.0","dependencies":[],"deps":[],"features":[]}],"root":null},"target_directory":"/build/target","build_directory":"/build/target","version":1,"workspace_root":"/build/source","metadata":null}
diff --git a/crates/trusted-server-release/tests/fixtures/composition/cargo-1.95-cross-tree.txt b/crates/trusted-server-release/tests/fixtures/composition/cargo-1.95-cross-tree.txt
new file mode 100644
index 0000000000..a776e84266
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/composition/cargo-1.95-cross-tree.txt
@@ -0,0 +1,3 @@
+0example-app v0.1.0 (/build/source/app)
+1example-host-helper v0.1.0 (/build/source/host-helper)
+2example-host-unix v0.1.0 (/build/source/host-unix)
diff --git a/crates/trusted-server-release/tests/fixtures/composition/cargo-1.95-messages.jsonl b/crates/trusted-server-release/tests/fixtures/composition/cargo-1.95-messages.jsonl
new file mode 100644
index 0000000000..d892021e39
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/composition/cargo-1.95-messages.jsonl
@@ -0,0 +1,4 @@
+{"reason":"compiler-artifact","package_id":"path+file:///build/source/crates/control#0.1.0","manifest_path":"/build/source/crates/control/Cargo.toml","target":{"kind":["custom-build"],"crate_types":["bin"],"name":"build-script-build","src_path":"/build/source/crates/control/build.rs","edition":"2024","doc":false,"doctest":false,"test":false},"profile":{"opt_level":"0","debuginfo":1,"debug_assertions":false,"overflow_checks":false,"test":false},"features":[],"filenames":["/build/target/release/build/control-e9a0e6682a959041/build-script-build"],"executable":null,"fresh":false}
+{"reason":"build-script-executed","package_id":"path+file:///build/source/crates/control#0.1.0","linked_libs":[],"linked_paths":[],"cfgs":[],"env":[],"out_dir":"/build/target/wasm32-wasip1/release/build/control-f4e07eca19516eeb/out"}
+{"reason":"compiler-artifact","package_id":"path+file:///build/source/crates/control#0.1.0","manifest_path":"/build/source/crates/control/Cargo.toml","target":{"kind":["bin"],"crate_types":["bin"],"name":"control","src_path":"/build/source/crates/control/src/main.rs","edition":"2024","doc":true,"doctest":false,"test":true},"profile":{"opt_level":"3","debuginfo":1,"debug_assertions":false,"overflow_checks":false,"test":false},"features":[],"filenames":["/build/target/wasm32-wasip1/release/control.wasm"],"executable":"/build/target/wasm32-wasip1/release/control.wasm","fresh":false}
+{"reason":"build-finished","success":true}
diff --git a/crates/trusted-server-release/tests/fixtures/composition/cargo-1.95-metadata.json b/crates/trusted-server-release/tests/fixtures/composition/cargo-1.95-metadata.json
new file mode 100644
index 0000000000..1dcd300ab7
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/composition/cargo-1.95-metadata.json
@@ -0,0 +1,270 @@
+{
+  "packages": [
+    {
+      "name": "build-direct",
+      "version": "0.1.0",
+      "id": "path+file:///build/source/crates/build-direct#0.1.0",
+      "license": null,
+      "license_file": null,
+      "description": null,
+      "source": null,
+      "dependencies": [],
+      "targets": [
+        {
+          "kind": [
+            "bin"
+          ],
+          "crate_types": [
+            "bin"
+          ],
+          "name": "build-direct",
+          "src_path": "/build/source/crates/build-direct/src/main.rs",
+          "edition": "2024",
+          "doc": true,
+          "doctest": false,
+          "test": true
+        },
+        {
+          "kind": [
+            "custom-build"
+          ],
+          "crate_types": [
+            "bin"
+          ],
+          "name": "build-script-build",
+          "src_path": "/build/source/crates/build-direct/build.rs",
+          "edition": "2024",
+          "doc": false,
+          "doctest": false,
+          "test": false
+        }
+      ],
+      "features": {},
+      "manifest_path": "/build/source/crates/build-direct/Cargo.toml",
+      "metadata": null,
+      "publish": [],
+      "authors": [],
+      "categories": [],
+      "keywords": [],
+      "readme": null,
+      "repository": null,
+      "homepage": null,
+      "documentation": null,
+      "edition": "2024",
+      "links": null,
+      "default_run": null,
+      "rust_version": null
+    },
+    {
+      "name": "build-grandchild",
+      "version": "0.1.0",
+      "id": "path+file:///build/source/crates/build-grandchild#0.1.0",
+      "license": null,
+      "license_file": null,
+      "description": null,
+      "source": null,
+      "dependencies": [],
+      "targets": [
+        {
+          "kind": [
+            "bin"
+          ],
+          "crate_types": [
+            "bin"
+          ],
+          "name": "build-grandchild",
+          "src_path": "/build/source/crates/build-grandchild/src/main.rs",
+          "edition": "2024",
+          "doc": true,
+          "doctest": false,
+          "test": true
+        },
+        {
+          "kind": [
+            "custom-build"
+          ],
+          "crate_types": [
+            "bin"
+          ],
+          "name": "build-script-build",
+          "src_path": "/build/source/crates/build-grandchild/build.rs",
+          "edition": "2024",
+          "doc": false,
+          "doctest": false,
+          "test": false
+        }
+      ],
+      "features": {},
+      "manifest_path": "/build/source/crates/build-grandchild/Cargo.toml",
+      "metadata": null,
+      "publish": [],
+      "authors": [],
+      "categories": [],
+      "keywords": [],
+      "readme": null,
+      "repository": null,
+      "homepage": null,
+      "documentation": null,
+      "edition": "2024",
+      "links": null,
+      "default_run": null,
+      "rust_version": null
+    },
+    {
+      "name": "control",
+      "version": "0.1.0",
+      "id": "path+file:///build/source/crates/control#0.1.0",
+      "license": null,
+      "license_file": null,
+      "description": null,
+      "source": null,
+      "dependencies": [],
+      "targets": [
+        {
+          "kind": [
+            "bin"
+          ],
+          "crate_types": [
+            "bin"
+          ],
+          "name": "control",
+          "src_path": "/build/source/crates/control/src/main.rs",
+          "edition": "2024",
+          "doc": true,
+          "doctest": false,
+          "test": true
+        },
+        {
+          "kind": [
+            "custom-build"
+          ],
+          "crate_types": [
+            "bin"
+          ],
+          "name": "build-script-build",
+          "src_path": "/build/source/crates/control/build.rs",
+          "edition": "2024",
+          "doc": false,
+          "doctest": false,
+          "test": false
+        }
+      ],
+      "features": {},
+      "manifest_path": "/build/source/crates/control/Cargo.toml",
+      "metadata": null,
+      "publish": [],
+      "authors": [],
+      "categories": [],
+      "keywords": [],
+      "readme": null,
+      "repository": null,
+      "homepage": null,
+      "documentation": null,
+      "edition": "2024",
+      "links": null,
+      "default_run": null,
+      "rust_version": null
+    },
+    {
+      "name": "macro-attempt",
+      "version": "0.1.0",
+      "id": "path+file:///build/source/crates/macro-attempt#0.1.0",
+      "license": null,
+      "license_file": null,
+      "description": null,
+      "source": null,
+      "dependencies": [],
+      "targets": [
+        {
+          "kind": [
+            "proc-macro"
+          ],
+          "crate_types": [
+            "proc-macro"
+          ],
+          "name": "macro_attempt",
+          "src_path": "/build/source/crates/macro-attempt/src/lib.rs",
+          "edition": "2024",
+          "doc": true,
+          "doctest": true,
+          "test": true
+        },
+        {
+          "kind": [
+            "bin"
+          ],
+          "crate_types": [
+            "bin"
+          ],
+          "name": "macro-attempt",
+          "src_path": "/build/source/crates/macro-attempt/src/main.rs",
+          "edition": "2024",
+          "doc": true,
+          "doctest": false,
+          "test": true
+        }
+      ],
+      "features": {},
+      "manifest_path": "/build/source/crates/macro-attempt/Cargo.toml",
+      "metadata": null,
+      "publish": [],
+      "authors": [],
+      "categories": [],
+      "keywords": [],
+      "readme": null,
+      "repository": null,
+      "homepage": null,
+      "documentation": null,
+      "edition": "2024",
+      "links": null,
+      "default_run": null,
+      "rust_version": null
+    }
+  ],
+  "workspace_members": [
+    "path+file:///build/source/crates/build-direct#0.1.0",
+    "path+file:///build/source/crates/build-grandchild#0.1.0",
+    "path+file:///build/source/crates/control#0.1.0",
+    "path+file:///build/source/crates/macro-attempt#0.1.0"
+  ],
+  "workspace_default_members": [
+    "path+file:///build/source/crates/build-direct#0.1.0",
+    "path+file:///build/source/crates/build-grandchild#0.1.0",
+    "path+file:///build/source/crates/control#0.1.0",
+    "path+file:///build/source/crates/macro-attempt#0.1.0"
+  ],
+  "resolve": {
+    "nodes": [
+      {
+        "id": "path+file:///build/source/crates/build-direct#0.1.0",
+        "dependencies": [],
+        "deps": [],
+        "features": []
+      },
+      {
+        "id": "path+file:///build/source/crates/build-grandchild#0.1.0",
+        "dependencies": [],
+        "deps": [],
+        "features": []
+      },
+      {
+        "id": "path+file:///build/source/crates/control#0.1.0",
+        "dependencies": [],
+        "deps": [],
+        "features": []
+      },
+      {
+        "id": "path+file:///build/source/crates/macro-attempt#0.1.0",
+        "dependencies": [],
+        "deps": [],
+        "features": []
+      }
+    ],
+    "root": null
+  },
+  "target_directory": "/build/target",
+  "build_directory": "/build/target",
+  "version": 1,
+  "workspace_root": "/build/source",
+  "metadata": null
+}
diff --git a/crates/trusted-server-release/tests/fixtures/index/candidate/candidate-release-index.json b/crates/trusted-server-release/tests/fixtures/index/candidate/candidate-release-index.json
new file mode 100644
index 0000000000..c642eeff0a
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/index/candidate/candidate-release-index.json
@@ -0,0 +1 @@
+{"artifacts":[{"assurance_profile":"provenance-sbom-repeatable","capabilities":["fastly-production"],"companions":{"build_evidence":{"name":"trusted-server-fastly.wasm.build-evidence.json","sha256":"d507ab4f6377db0ffc5f35c0471322aeaf5b0fd454dcd6e223d5801d68017230","size":1396},"build_recipe":{"name":"trusted-server-fastly.wasm.build-recipe.json","sha256":"5dd2af6404b6554d20cdb67be8228f88f0726447612f29476972f6f8f3ff98d1","size":948},"provenance":{"name":"trusted-server-fastly.wasm.provenance.sigstore.json","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","size":0},"rebuild_check":{"name":"trusted-server-fastly.wasm.rebuild-check.json","sha256":"381505ae1be7d5c46e7019a6e514c2e1ef7844bc85faba3ddb0da67513190437","size":646},"sbom":{"name":"trusted-server-fastly.wasm.spdx.json","sha256":"ac94b402aa1d0fb889bc9cb063e81ff41573c16d52fd93a02290bec75b3f7dcb","size":886},"sbom_attestation":{"name":"trusted-server-fastly.wasm.sbom.sigstore.json","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","size":0}},"compatibility":{"architecture":"wasm32","minimum_version":"wasip1","runtime":"fastly-compute"},"js_inventory_sha256":"64540e73dc3fb484a0fb0e5ee96b54e5ed12fcb34c7038107d7fbf75b59e9796","kind":"wasm-core","name":"trusted-server-fastly.wasm","package":"trusted-server-adapter-fastly","role":"server","sha256":"53ebda42e7686cb0048b1b9d75de6ae360c436f63f844a09177e139fa96b9617","size":53,"target":"wasm32-wasip1","variant":"default"},{"assurance_profile":"provenance-sbom","capabilities":["cli-execute"],"companions":{"build_evidence":{"name":"ts-aarch64-apple-darwin.build-evidence.json","sha256":"4398ff1d660f8f25741f0d26128312c856f8a80ed45fad92ce1961e3f89f6b66","size":1260},"build_recipe":{"name":"ts-aarch64-apple-darwin.build-recipe.json","sha256":"c2ae63588adfd51957a42b943c668a8b0c9119f12b5cf13098c927662a82f95b","size":975},"provenance":{"name":"ts-aarch64-apple-darwin.provenance.sigstore.json","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","size":0},"rebuild_check":{"name":"ts-aarch64-apple-darwin.rebuild-check.json","sha256":"e20a78e71af499d34b2d1aeb16b1429cfe7281a8eec715e571ebc7a840fa000f","size":619},"sbom":{"name":"ts-aarch64-apple-darwin.spdx.json","sha256":"fe487f344797a42c97bdfe44248af98fc8d3e05aff8453c7e2f57f5bd5b88992","size":877},"sbom_attestation":{"name":"ts-aarch64-apple-darwin.sbom.sigstore.json","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","size":0}},"compatibility":{"architecture":"aarch64","minimum_version":"13.0","runtime":"macos"},"js_inventory_sha256":"64540e73dc3fb484a0fb0e5ee96b54e5ed12fcb34c7038107d7fbf75b59e9796","kind":"native-executable","name":"ts-aarch64-apple-darwin","package":"trusted-server-cli","role":"operator-cli","sha256":"ba83ee6a8918e5d9d50f042f53dc853341d43b36a89e755cce842076b46ecc17","size":50,"target":"aarch64-apple-darwin","variant":"default"},{"assurance_profile":"provenance-sbom","capabilities":["cli-execute"],"companions":{"build_evidence":{"name":"ts-x86_64-apple-darwin.build-evidence.json","sha256":"248b207f66e9b325327779d493b353d9ccf88942d5739eaa89a42962d17c5fb1","size":1258},"build_recipe":{"name":"ts-x86_64-apple-darwin.build-recipe.json","sha256":"0b01813499eceb2aafc9e35311f6b14dce56c6b499fd0f5b97333c5267d2b114","size":973},"provenance":{"name":"ts-x86_64-apple-darwin.provenance.sigstore.json","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","size":0},"rebuild_check":{"name":"ts-x86_64-apple-darwin.rebuild-check.json","sha256":"26737bde3396202434cd28fb6d9f3e7b085e4a82e7762e3f0177cb09d6966e21","size":618},"sbom":{"name":"ts-x86_64-apple-darwin.spdx.json","sha256":"dbaef04e50548077cced269f7d4baade02717ce3d9b054bbbd335d9bdea1020a","size":874},"sbom_attestation":{"name":"ts-x86_64-apple-darwin.sbom.sigstore.json","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","size":0}},"compatibility":{"architecture":"x86_64","minimum_version":"13.0","runtime":"macos"},"js_inventory_sha256":"64540e73dc3fb484a0fb0e5ee96b54e5ed12fcb34c7038107d7fbf75b59e9796","kind":"native-executable","name":"ts-x86_64-apple-darwin","package":"trusted-server-cli","role":"operator-cli","sha256":"d3866b0e34f91e944be06eba013f25dab3a62d66d2ea6ac1d4b7a035ca4cda9d","size":49,"target":"x86_64-apple-darwin","variant":"default"},{"assurance_profile":"provenance-sbom","capabilities":["cli-execute"],"companions":{"build_evidence":{"name":"ts-x86_64-unknown-linux-gnu.build-evidence.json","sha256":"5a8f3a8ae4277cc3bcd03a7b58c600469b22205a957718b6570d5ddc1644ee63","size":1268},"build_recipe":{"name":"ts-x86_64-unknown-linux-gnu.build-recipe.json","sha256":"de836324f0ca933580b1eb336f177fc21e1cc43140004ff5ecba735371cd3ee1","size":983},"provenance":{"name":"ts-x86_64-unknown-linux-gnu.provenance.sigstore.json","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","size":0},"rebuild_check":{"name":"ts-x86_64-unknown-linux-gnu.rebuild-check.json","sha256":"c1f61f93204390231ef694c26eb0c6b3035475490ef4e4ae2850fa8d13714ce6","size":623},"sbom":{"name":"ts-x86_64-unknown-linux-gnu.spdx.json","sha256":"dd5cb2569a0ca2a1abbe110be9b966a282dff42dae9059cebcfa8b15268b274f","size":889},"sbom_attestation":{"name":"ts-x86_64-unknown-linux-gnu.sbom.sigstore.json","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","size":0}},"compatibility":{"architecture":"x86_64","minimum_version":"glibc-2.34","runtime":"linux-gnu"},"js_inventory_sha256":"64540e73dc3fb484a0fb0e5ee96b54e5ed12fcb34c7038107d7fbf75b59e9796","kind":"native-executable","name":"ts-x86_64-unknown-linux-gnu","package":"trusted-server-cli","role":"operator-cli","sha256":"f1772b30282757aae1e6917cb270a76cccbca4565e9364b3155c1daf7a98e927","size":54,"target":"x86_64-unknown-linux-gnu","variant":"default"}],"cohort":"phase1-fastly-cli","cohort_source_commit":"0123456789abcdef0123456789abcdef01234567","policy_sha256":"f08ce10cd16ff2d1acc482db2b85eb53b667ec2b4753792f277d12f41d1f636c","policy_version":1,"recipe_source_commit":"0123456789abcdef0123456789abcdef01234567","repository":"IABTechLab/trusted-server","schema_version":1,"source_commit":"0123456789abcdef0123456789abcdef01234567","tag":"v0.0.0-unqualified-candidate","tsjs_inventory":{"name":"tsjs-inventory.json","sha256":"64540e73dc3fb484a0fb0e5ee96b54e5ed12fcb34c7038107d7fbf75b59e9796","size":449}}
diff --git a/crates/trusted-server-release/tests/fixtures/index/candidate/trusted-server-fastly.wasm.build-evidence.json b/crates/trusted-server-release/tests/fixtures/index/candidate/trusted-server-fastly.wasm.build-evidence.json
new file mode 100644
index 0000000000..575cb44766
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/index/candidate/trusted-server-fastly.wasm.build-evidence.json
@@ -0,0 +1 @@
+{"artifact_sha256":"53ebda42e7686cb0048b1b9d75de6ae360c436f63f844a09177e139fa96b9617","artifact_size":53,"asset":"trusted-server-fastly.wasm","compatibility_tests":[{"facts":{"health_status":"200","viceroy_version":"0.0.0-fictional"},"name":"fastly-final-byte-publisher-request","outcome":"passed"}],"domain":"trusted-server.release.candidate-build-evidence","embedded_modules":[{"filename":"tsjs-core.js","id":"core","sha256":"b206e4e772105ede4afc00a7971ec971b757cfb4f2e2e62975a459f2a6e160ae","size":26},{"filename":"tsjs-prebid.js","id":"prebid","sha256":"429a327f21c12ce0e398855d8c4c992c380a93a973bad5b4778b1a828c3843d6","size":28}],"gaps":["authenticated-bootstrap-not-established","fictional-coverage-gap","signature-bundles-awaiting-signature","trusted-workflow-transfer-not-bound","workflow-run-identity-unavailable"],"js_inventory_sha256":"64540e73dc3fb484a0fb0e5ee96b54e5ed12fcb34c7038107d7fbf75b59e9796","prepared_modules":[{"filename":"tsjs-core.js","id":"core","sha256":"b206e4e772105ede4afc00a7971ec971b757cfb4f2e2e62975a459f2a6e160ae","size":26},{"filename":"tsjs-prebid.js","id":"prebid","sha256":"429a327f21c12ce0e398855d8c4c992c380a93a973bad5b4778b1a828c3843d6","size":28}],"release_qualification":false,"schema_version":1,"source_commit":"0123456789abcdef0123456789abcdef01234567","target":"wasm32-wasip1","transfer_artifact_id":null,"variant":"default","workflow_run_id":null}
diff --git a/crates/trusted-server-release/tests/fixtures/index/candidate/trusted-server-fastly.wasm.build-recipe.json b/crates/trusted-server-release/tests/fixtures/index/candidate/trusted-server-fastly.wasm.build-recipe.json
new file mode 100644
index 0000000000..17c27b6f55
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/index/candidate/trusted-server-fastly.wasm.build-recipe.json
@@ -0,0 +1 @@
+{"asset":"trusted-server-fastly.wasm","domain":"trusted-server.release.candidate-build-recipe","gaps":["authenticated-bootstrap-not-established","fictional-coverage-gap","signature-bundles-awaiting-signature","trusted-workflow-transfer-not-bound","workflow-run-identity-unavailable"],"inputs":{"cargo_lock_sha256":"0d95b8073b49236f0ec898c9efba2201ee27f00aa64148a74c61990dbdb7eabe","materials_digest":"7edac7b524ebfb25e7d463ed246ec0c6dff3917828e7372b1d8a7ade48d29b54","rust_tools_digest":"3d1bccbc4fde967b6e0724d8e07740e1959bcbc4fbeeb04f53f760aa77bf06bf"},"invocation_sha256":"b3fdb94d7962a986406510a2bc0a7a539f9ec1a27d25714385eacd6141da1886","package":"trusted-server-adapter-fastly","recipe_definition_sha256":"4d62015ed31382ffa84a7b8d1aa56482ebca46ac93ee3e41f921d2fe051d7380","release_qualification":false,"source_commit":"0123456789abcdef0123456789abcdef01234567","target":"wasm32-wasip1","variant":"default","version":1,"workflow_run_id":null}
diff --git a/crates/trusted-server-release/tests/fixtures/index/candidate/trusted-server-fastly.wasm.rebuild-check.json b/crates/trusted-server-release/tests/fixtures/index/candidate/trusted-server-fastly.wasm.rebuild-check.json
new file mode 100644
index 0000000000..9683969f4c
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/index/candidate/trusted-server-fastly.wasm.rebuild-check.json
@@ -0,0 +1 @@
+{"asset":"trusted-server-fastly.wasm","canonical_sha256":"53ebda42e7686cb0048b1b9d75de6ae360c436f63f844a09177e139fa96b9617","domain":"trusted-server.release.candidate-rebuild-check","gaps":["authenticated-bootstrap-not-established","fictional-coverage-gap","signature-bundles-awaiting-signature","trusted-workflow-transfer-not-bound","workflow-run-identity-unavailable"],"outcome":"matched","release_qualification":false,"reproduction_sha256":"53ebda42e7686cb0048b1b9d75de6ae360c436f63f844a09177e139fa96b9617","reproduction_transfer_artifact_id":null,"source_commit":"0123456789abcdef0123456789abcdef01234567","version":1,"workflow_run_id":null}
diff --git a/crates/trusted-server-release/tests/fixtures/index/candidate/trusted-server-fastly.wasm.spdx.json b/crates/trusted-server-release/tests/fixtures/index/candidate/trusted-server-fastly.wasm.spdx.json
new file mode 100644
index 0000000000..f584c37815
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/index/candidate/trusted-server-fastly.wasm.spdx.json
@@ -0,0 +1 @@
+{"SPDXID":"SPDXRef-DOCUMENT","creationInfo":{"comment":"Unqualified candidate fixture; gaps: fictional-coverage-gap","created":"2026-01-01T00:00:00Z","creators":["Tool: fictional-candidate-fixture"]},"dataLicense":"CC0-1.0","documentDescribes":["SPDXRef-Artifact"],"documentNamespace":"https://example.com/spdx/candidate/trusted-server-fastly.wasm","name":"trusted-server-fastly.wasm","packages":[{"SPDXID":"SPDXRef-Artifact","checksums":[{"algorithm":"SHA256","checksumValue":"53ebda42e7686cb0048b1b9d75de6ae360c436f63f844a09177e139fa96b9617"}],"copyrightText":"NOASSERTION","downloadLocation":"NOASSERTION","filesAnalyzed":false,"licenseConcluded":"NOASSERTION","licenseDeclared":"NOASSERTION","name":"trusted-server-fastly.wasm"}],"relationships":[{"relatedSpdxElement":"SPDXRef-Artifact","relationshipType":"DESCRIBES","spdxElementId":"SPDXRef-DOCUMENT"}],"spdxVersion":"SPDX-2.3"}
diff --git a/crates/trusted-server-release/tests/fixtures/index/candidate/ts-aarch64-apple-darwin.build-evidence.json b/crates/trusted-server-release/tests/fixtures/index/candidate/ts-aarch64-apple-darwin.build-evidence.json
new file mode 100644
index 0000000000..bae45e03ed
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/index/candidate/ts-aarch64-apple-darwin.build-evidence.json
@@ -0,0 +1 @@
+{"artifact_sha256":"ba83ee6a8918e5d9d50f042f53dc853341d43b36a89e755cce842076b46ecc17","artifact_size":50,"asset":"ts-aarch64-apple-darwin","compatibility_tests":[{"facts":{"startup_kind":"fictional-startup"},"name":"native-startup","outcome":"passed"}],"domain":"trusted-server.release.candidate-build-evidence","embedded_modules":[{"filename":"tsjs-core.js","id":"core","sha256":"b206e4e772105ede4afc00a7971ec971b757cfb4f2e2e62975a459f2a6e160ae","size":26}],"gaps":["authenticated-bootstrap-not-established","fictional-coverage-gap","native-reproduction-unavailable","signature-bundles-awaiting-signature","trusted-workflow-transfer-not-bound","workflow-run-identity-unavailable"],"js_inventory_sha256":"64540e73dc3fb484a0fb0e5ee96b54e5ed12fcb34c7038107d7fbf75b59e9796","prepared_modules":[{"filename":"tsjs-core.js","id":"core","sha256":"b206e4e772105ede4afc00a7971ec971b757cfb4f2e2e62975a459f2a6e160ae","size":26},{"filename":"tsjs-prebid.js","id":"prebid","sha256":"429a327f21c12ce0e398855d8c4c992c380a93a973bad5b4778b1a828c3843d6","size":28}],"release_qualification":false,"schema_version":1,"source_commit":"0123456789abcdef0123456789abcdef01234567","target":"aarch64-apple-darwin","transfer_artifact_id":null,"variant":"default","workflow_run_id":null}
diff --git a/crates/trusted-server-release/tests/fixtures/index/candidate/ts-aarch64-apple-darwin.build-recipe.json b/crates/trusted-server-release/tests/fixtures/index/candidate/ts-aarch64-apple-darwin.build-recipe.json
new file mode 100644
index 0000000000..634e49cd57
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/index/candidate/ts-aarch64-apple-darwin.build-recipe.json
@@ -0,0 +1 @@
+{"asset":"ts-aarch64-apple-darwin","domain":"trusted-server.release.candidate-build-recipe","gaps":["authenticated-bootstrap-not-established","fictional-coverage-gap","native-reproduction-unavailable","signature-bundles-awaiting-signature","trusted-workflow-transfer-not-bound","workflow-run-identity-unavailable"],"inputs":{"cargo_lock_sha256":"0d95b8073b49236f0ec898c9efba2201ee27f00aa64148a74c61990dbdb7eabe","materials_digest":"7edac7b524ebfb25e7d463ed246ec0c6dff3917828e7372b1d8a7ade48d29b54","rust_tools_digest":"3d1bccbc4fde967b6e0724d8e07740e1959bcbc4fbeeb04f53f760aa77bf06bf"},"invocation_sha256":"b3fdb94d7962a986406510a2bc0a7a539f9ec1a27d25714385eacd6141da1886","package":"trusted-server-cli","recipe_definition_sha256":"4d62015ed31382ffa84a7b8d1aa56482ebca46ac93ee3e41f921d2fe051d7380","release_qualification":false,"source_commit":"0123456789abcdef0123456789abcdef01234567","target":"aarch64-apple-darwin","variant":"default","version":1,"workflow_run_id":null}
diff --git a/crates/trusted-server-release/tests/fixtures/index/candidate/ts-aarch64-apple-darwin.rebuild-check.json b/crates/trusted-server-release/tests/fixtures/index/candidate/ts-aarch64-apple-darwin.rebuild-check.json
new file mode 100644
index 0000000000..0d54ebcb47
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/index/candidate/ts-aarch64-apple-darwin.rebuild-check.json
@@ -0,0 +1 @@
+{"asset":"ts-aarch64-apple-darwin","canonical_sha256":"ba83ee6a8918e5d9d50f042f53dc853341d43b36a89e755cce842076b46ecc17","domain":"trusted-server.release.candidate-rebuild-check","gaps":["authenticated-bootstrap-not-established","fictional-coverage-gap","native-reproduction-unavailable","signature-bundles-awaiting-signature","trusted-workflow-transfer-not-bound","workflow-run-identity-unavailable"],"outcome":"unavailable","release_qualification":false,"reproduction_sha256":null,"reproduction_transfer_artifact_id":null,"source_commit":"0123456789abcdef0123456789abcdef01234567","version":1,"workflow_run_id":null}
diff --git a/crates/trusted-server-release/tests/fixtures/index/candidate/ts-aarch64-apple-darwin.spdx.json b/crates/trusted-server-release/tests/fixtures/index/candidate/ts-aarch64-apple-darwin.spdx.json
new file mode 100644
index 0000000000..bb6924545e
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/index/candidate/ts-aarch64-apple-darwin.spdx.json
@@ -0,0 +1 @@
+{"SPDXID":"SPDXRef-DOCUMENT","creationInfo":{"comment":"Unqualified candidate fixture; gaps: fictional-coverage-gap","created":"2026-01-01T00:00:00Z","creators":["Tool: fictional-candidate-fixture"]},"dataLicense":"CC0-1.0","documentDescribes":["SPDXRef-Artifact"],"documentNamespace":"https://example.com/spdx/candidate/ts-aarch64-apple-darwin","name":"ts-aarch64-apple-darwin","packages":[{"SPDXID":"SPDXRef-Artifact","checksums":[{"algorithm":"SHA256","checksumValue":"ba83ee6a8918e5d9d50f042f53dc853341d43b36a89e755cce842076b46ecc17"}],"copyrightText":"NOASSERTION","downloadLocation":"NOASSERTION","filesAnalyzed":false,"licenseConcluded":"NOASSERTION","licenseDeclared":"NOASSERTION","name":"ts-aarch64-apple-darwin"}],"relationships":[{"relatedSpdxElement":"SPDXRef-Artifact","relationshipType":"DESCRIBES","spdxElementId":"SPDXRef-DOCUMENT"}],"spdxVersion":"SPDX-2.3"}
diff --git a/crates/trusted-server-release/tests/fixtures/index/candidate/ts-x86_64-apple-darwin.build-evidence.json b/crates/trusted-server-release/tests/fixtures/index/candidate/ts-x86_64-apple-darwin.build-evidence.json
new file mode 100644
index 0000000000..6e3aa770fe
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/index/candidate/ts-x86_64-apple-darwin.build-evidence.json
@@ -0,0 +1 @@
+{"artifact_sha256":"d3866b0e34f91e944be06eba013f25dab3a62d66d2ea6ac1d4b7a035ca4cda9d","artifact_size":49,"asset":"ts-x86_64-apple-darwin","compatibility_tests":[{"facts":{"startup_kind":"fictional-startup"},"name":"native-startup","outcome":"passed"}],"domain":"trusted-server.release.candidate-build-evidence","embedded_modules":[{"filename":"tsjs-core.js","id":"core","sha256":"b206e4e772105ede4afc00a7971ec971b757cfb4f2e2e62975a459f2a6e160ae","size":26}],"gaps":["authenticated-bootstrap-not-established","fictional-coverage-gap","native-reproduction-unavailable","signature-bundles-awaiting-signature","trusted-workflow-transfer-not-bound","workflow-run-identity-unavailable"],"js_inventory_sha256":"64540e73dc3fb484a0fb0e5ee96b54e5ed12fcb34c7038107d7fbf75b59e9796","prepared_modules":[{"filename":"tsjs-core.js","id":"core","sha256":"b206e4e772105ede4afc00a7971ec971b757cfb4f2e2e62975a459f2a6e160ae","size":26},{"filename":"tsjs-prebid.js","id":"prebid","sha256":"429a327f21c12ce0e398855d8c4c992c380a93a973bad5b4778b1a828c3843d6","size":28}],"release_qualification":false,"schema_version":1,"source_commit":"0123456789abcdef0123456789abcdef01234567","target":"x86_64-apple-darwin","transfer_artifact_id":null,"variant":"default","workflow_run_id":null}
diff --git a/crates/trusted-server-release/tests/fixtures/index/candidate/ts-x86_64-apple-darwin.build-recipe.json b/crates/trusted-server-release/tests/fixtures/index/candidate/ts-x86_64-apple-darwin.build-recipe.json
new file mode 100644
index 0000000000..ef49832ed5
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/index/candidate/ts-x86_64-apple-darwin.build-recipe.json
@@ -0,0 +1 @@
+{"asset":"ts-x86_64-apple-darwin","domain":"trusted-server.release.candidate-build-recipe","gaps":["authenticated-bootstrap-not-established","fictional-coverage-gap","native-reproduction-unavailable","signature-bundles-awaiting-signature","trusted-workflow-transfer-not-bound","workflow-run-identity-unavailable"],"inputs":{"cargo_lock_sha256":"0d95b8073b49236f0ec898c9efba2201ee27f00aa64148a74c61990dbdb7eabe","materials_digest":"7edac7b524ebfb25e7d463ed246ec0c6dff3917828e7372b1d8a7ade48d29b54","rust_tools_digest":"3d1bccbc4fde967b6e0724d8e07740e1959bcbc4fbeeb04f53f760aa77bf06bf"},"invocation_sha256":"b3fdb94d7962a986406510a2bc0a7a539f9ec1a27d25714385eacd6141da1886","package":"trusted-server-cli","recipe_definition_sha256":"4d62015ed31382ffa84a7b8d1aa56482ebca46ac93ee3e41f921d2fe051d7380","release_qualification":false,"source_commit":"0123456789abcdef0123456789abcdef01234567","target":"x86_64-apple-darwin","variant":"default","version":1,"workflow_run_id":null}
diff --git a/crates/trusted-server-release/tests/fixtures/index/candidate/ts-x86_64-apple-darwin.rebuild-check.json b/crates/trusted-server-release/tests/fixtures/index/candidate/ts-x86_64-apple-darwin.rebuild-check.json
new file mode 100644
index 0000000000..05e734aff3
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/index/candidate/ts-x86_64-apple-darwin.rebuild-check.json
@@ -0,0 +1 @@
+{"asset":"ts-x86_64-apple-darwin","canonical_sha256":"d3866b0e34f91e944be06eba013f25dab3a62d66d2ea6ac1d4b7a035ca4cda9d","domain":"trusted-server.release.candidate-rebuild-check","gaps":["authenticated-bootstrap-not-established","fictional-coverage-gap","native-reproduction-unavailable","signature-bundles-awaiting-signature","trusted-workflow-transfer-not-bound","workflow-run-identity-unavailable"],"outcome":"unavailable","release_qualification":false,"reproduction_sha256":null,"reproduction_transfer_artifact_id":null,"source_commit":"0123456789abcdef0123456789abcdef01234567","version":1,"workflow_run_id":null}
diff --git a/crates/trusted-server-release/tests/fixtures/index/candidate/ts-x86_64-apple-darwin.spdx.json b/crates/trusted-server-release/tests/fixtures/index/candidate/ts-x86_64-apple-darwin.spdx.json
new file mode 100644
index 0000000000..7eb2ce3994
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/index/candidate/ts-x86_64-apple-darwin.spdx.json
@@ -0,0 +1 @@
+{"SPDXID":"SPDXRef-DOCUMENT","creationInfo":{"comment":"Unqualified candidate fixture; gaps: fictional-coverage-gap","created":"2026-01-01T00:00:00Z","creators":["Tool: fictional-candidate-fixture"]},"dataLicense":"CC0-1.0","documentDescribes":["SPDXRef-Artifact"],"documentNamespace":"https://example.com/spdx/candidate/ts-x86_64-apple-darwin","name":"ts-x86_64-apple-darwin","packages":[{"SPDXID":"SPDXRef-Artifact","checksums":[{"algorithm":"SHA256","checksumValue":"d3866b0e34f91e944be06eba013f25dab3a62d66d2ea6ac1d4b7a035ca4cda9d"}],"copyrightText":"NOASSERTION","downloadLocation":"NOASSERTION","filesAnalyzed":false,"licenseConcluded":"NOASSERTION","licenseDeclared":"NOASSERTION","name":"ts-x86_64-apple-darwin"}],"relationships":[{"relatedSpdxElement":"SPDXRef-Artifact","relationshipType":"DESCRIBES","spdxElementId":"SPDXRef-DOCUMENT"}],"spdxVersion":"SPDX-2.3"}
diff --git a/crates/trusted-server-release/tests/fixtures/index/candidate/ts-x86_64-unknown-linux-gnu.build-evidence.json b/crates/trusted-server-release/tests/fixtures/index/candidate/ts-x86_64-unknown-linux-gnu.build-evidence.json
new file mode 100644
index 0000000000..71dc9910d1
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/index/candidate/ts-x86_64-unknown-linux-gnu.build-evidence.json
@@ -0,0 +1 @@
+{"artifact_sha256":"f1772b30282757aae1e6917cb270a76cccbca4565e9364b3155c1daf7a98e927","artifact_size":54,"asset":"ts-x86_64-unknown-linux-gnu","compatibility_tests":[{"facts":{"startup_kind":"fictional-startup"},"name":"native-startup","outcome":"passed"}],"domain":"trusted-server.release.candidate-build-evidence","embedded_modules":[{"filename":"tsjs-core.js","id":"core","sha256":"b206e4e772105ede4afc00a7971ec971b757cfb4f2e2e62975a459f2a6e160ae","size":26}],"gaps":["authenticated-bootstrap-not-established","fictional-coverage-gap","native-reproduction-unavailable","signature-bundles-awaiting-signature","trusted-workflow-transfer-not-bound","workflow-run-identity-unavailable"],"js_inventory_sha256":"64540e73dc3fb484a0fb0e5ee96b54e5ed12fcb34c7038107d7fbf75b59e9796","prepared_modules":[{"filename":"tsjs-core.js","id":"core","sha256":"b206e4e772105ede4afc00a7971ec971b757cfb4f2e2e62975a459f2a6e160ae","size":26},{"filename":"tsjs-prebid.js","id":"prebid","sha256":"429a327f21c12ce0e398855d8c4c992c380a93a973bad5b4778b1a828c3843d6","size":28}],"release_qualification":false,"schema_version":1,"source_commit":"0123456789abcdef0123456789abcdef01234567","target":"x86_64-unknown-linux-gnu","transfer_artifact_id":null,"variant":"default","workflow_run_id":null}
diff --git a/crates/trusted-server-release/tests/fixtures/index/candidate/ts-x86_64-unknown-linux-gnu.build-recipe.json b/crates/trusted-server-release/tests/fixtures/index/candidate/ts-x86_64-unknown-linux-gnu.build-recipe.json
new file mode 100644
index 0000000000..e8e429a124
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/index/candidate/ts-x86_64-unknown-linux-gnu.build-recipe.json
@@ -0,0 +1 @@
+{"asset":"ts-x86_64-unknown-linux-gnu","domain":"trusted-server.release.candidate-build-recipe","gaps":["authenticated-bootstrap-not-established","fictional-coverage-gap","native-reproduction-unavailable","signature-bundles-awaiting-signature","trusted-workflow-transfer-not-bound","workflow-run-identity-unavailable"],"inputs":{"cargo_lock_sha256":"0d95b8073b49236f0ec898c9efba2201ee27f00aa64148a74c61990dbdb7eabe","materials_digest":"7edac7b524ebfb25e7d463ed246ec0c6dff3917828e7372b1d8a7ade48d29b54","rust_tools_digest":"3d1bccbc4fde967b6e0724d8e07740e1959bcbc4fbeeb04f53f760aa77bf06bf"},"invocation_sha256":"b3fdb94d7962a986406510a2bc0a7a539f9ec1a27d25714385eacd6141da1886","package":"trusted-server-cli","recipe_definition_sha256":"4d62015ed31382ffa84a7b8d1aa56482ebca46ac93ee3e41f921d2fe051d7380","release_qualification":false,"source_commit":"0123456789abcdef0123456789abcdef01234567","target":"x86_64-unknown-linux-gnu","variant":"default","version":1,"workflow_run_id":null}
diff --git a/crates/trusted-server-release/tests/fixtures/index/candidate/ts-x86_64-unknown-linux-gnu.rebuild-check.json b/crates/trusted-server-release/tests/fixtures/index/candidate/ts-x86_64-unknown-linux-gnu.rebuild-check.json
new file mode 100644
index 0000000000..6121407e65
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/index/candidate/ts-x86_64-unknown-linux-gnu.rebuild-check.json
@@ -0,0 +1 @@
+{"asset":"ts-x86_64-unknown-linux-gnu","canonical_sha256":"f1772b30282757aae1e6917cb270a76cccbca4565e9364b3155c1daf7a98e927","domain":"trusted-server.release.candidate-rebuild-check","gaps":["authenticated-bootstrap-not-established","fictional-coverage-gap","native-reproduction-unavailable","signature-bundles-awaiting-signature","trusted-workflow-transfer-not-bound","workflow-run-identity-unavailable"],"outcome":"unavailable","release_qualification":false,"reproduction_sha256":null,"reproduction_transfer_artifact_id":null,"source_commit":"0123456789abcdef0123456789abcdef01234567","version":1,"workflow_run_id":null}
diff --git a/crates/trusted-server-release/tests/fixtures/index/candidate/ts-x86_64-unknown-linux-gnu.spdx.json b/crates/trusted-server-release/tests/fixtures/index/candidate/ts-x86_64-unknown-linux-gnu.spdx.json
new file mode 100644
index 0000000000..dab76caac0
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/index/candidate/ts-x86_64-unknown-linux-gnu.spdx.json
@@ -0,0 +1 @@
+{"SPDXID":"SPDXRef-DOCUMENT","creationInfo":{"comment":"Unqualified candidate fixture; gaps: fictional-coverage-gap","created":"2026-01-01T00:00:00Z","creators":["Tool: fictional-candidate-fixture"]},"dataLicense":"CC0-1.0","documentDescribes":["SPDXRef-Artifact"],"documentNamespace":"https://example.com/spdx/candidate/ts-x86_64-unknown-linux-gnu","name":"ts-x86_64-unknown-linux-gnu","packages":[{"SPDXID":"SPDXRef-Artifact","checksums":[{"algorithm":"SHA256","checksumValue":"f1772b30282757aae1e6917cb270a76cccbca4565e9364b3155c1daf7a98e927"}],"copyrightText":"NOASSERTION","downloadLocation":"NOASSERTION","filesAnalyzed":false,"licenseConcluded":"NOASSERTION","licenseDeclared":"NOASSERTION","name":"ts-x86_64-unknown-linux-gnu"}],"relationships":[{"relatedSpdxElement":"SPDXRef-Artifact","relationshipType":"DESCRIBES","spdxElementId":"SPDXRef-DOCUMENT"}],"spdxVersion":"SPDX-2.3"}
diff --git a/crates/trusted-server-release/tests/fixtures/index/candidate/tsjs-inventory.json b/crates/trusted-server-release/tests/fixtures/index/candidate/tsjs-inventory.json
new file mode 100644
index 0000000000..572cb544f5
--- /dev/null
+++ b/crates/trusted-server-release/tests/fixtures/index/candidate/tsjs-inventory.json
@@ -0,0 +1 @@
+{"modules":[{"contributions":[{"package":"fictional-js"}],"filename":"tsjs-core.js","id":"core","sha256":"b206e4e772105ede4afc00a7971ec971b757cfb4f2e2e62975a459f2a6e160ae","size":26},{"contributions":[{"package":"fictional-js"}],"filename":"tsjs-prebid.js","id":"prebid","sha256":"429a327f21c12ce0e398855d8c4c992c380a93a973bad5b4778b1a828c3843d6","size":28}],"schema_version":1,"source_commit":"0123456789abcdef0123456789abcdef01234567","tools":[]}
diff --git a/crates/trusted-server-release/tests/fixtures/sha-mbles-1.bin b/crates/trusted-server-release/tests/fixtures/sha-mbles-1.bin
new file mode 100644
index 0000000000..5a7c30e976
Binary files /dev/null and b/crates/trusted-server-release/tests/fixtures/sha-mbles-1.bin differ
diff --git a/docs/.vitepress/config.mts b/docs/.vitepress/config.mts
index 4220851797..91d202e064 100644
--- a/docs/.vitepress/config.mts
+++ b/docs/.vitepress/config.mts
@@ -101,6 +101,10 @@ export default withMermaid(
             { text: 'EdgeZero Lifecycle', link: '/guide/edgezero' },
             { text: 'Configuration', link: '/guide/configuration' },
             { text: 'CLI', link: '/guide/cli' },
+            {
+              text: 'Release verification',
+              link: '/guide/release-verification',
+            },
             { text: 'Dev Proxy', link: '/guide/ts-dev-proxy' },
             { text: 'Testing', link: '/guide/testing' },
             { text: 'Auction Testing', link: '/guide/auction-testing' },
diff --git a/docs/guide/cli.md b/docs/guide/cli.md
index 9466e1f3df..0c405648d8 100644
--- a/docs/guide/cli.md
+++ b/docs/guide/cli.md
@@ -52,6 +52,7 @@ commands are shown explicitly.
 | `ts prebid server secrets`       | Linux + macOS | Manage values for existing, explicitly declared Secrets Manager secrets                          | `ts prebid server secrets [OPTIONS] <COMMAND>`                                                                 |
 | `ts prebid server secrets set`   | Linux + macOS | Write a complete JSON credential payload; does not deploy or rotate partner credentials          | `ts prebid server secrets set [OPTIONS] --deployment <DEPLOYMENT> --region <REGION> <BIDDER>`                  |
 | `ts provision`                   | Linux + macOS | Provision platform resources through a target adapter                                            | `ts provision [OPTIONS] --adapter <ADAPTER>`                                                                   |
+| `ts release verify`              | Linux + macOS | Verify one official release asset and its evidence                                               | `ts release verify <TAG> --asset <NAME> --expected-source-commit <COMMIT>`                                     |
 | `ts rollback`                    | Linux + macOS | Roll a service back to a previously active deployment version                                    | `ts rollback [OPTIONS] --adapter <ADAPTER> --service-id <SERVICE_ID> --version <VERSION>`                      |
 | `ts serve`                       | Linux + macOS | Serve the project locally through a target adapter                                               | `ts serve --adapter <ADAPTER>`                                                                                 |
 
@@ -80,6 +81,26 @@ Verify the install:
 ts --help
 ```
 
+## Release verification
+
+Use an independently trusted verifier and gh 2.97.0 to check official release
+assets before running downloaded binaries. See [Release verification](./release-verification.md)
+for trusted bootstrap, required policy joins and offline limits.
+
+```bash
+ts release verify v1.2.0 --asset ts-aarch64-apple-darwin \
+  --expected-source-commit 0123456789abcdef0123456789abcdef01234567
+```
+
+Replace this fictional commit with an independently approved full source commit.
+The command is read-only, uses an explicit read-only `GH_TOKEN` (falling back to
+`GITHUB_TOKEN`), and returns a verification report. It has no deployment, export or
+public offline option.
+
+For manual production consumption of verified Fastly wasm, follow the
+[private-directory packaging and submission procedure](./release-verification.md#manual-fastly-production-consumption).
+Bootstrap the separate package inspector from independently approved source.
+
 ## Common workflow
 
 ```bash
diff --git a/docs/guide/edgezero.md b/docs/guide/edgezero.md
index 2107f95f56..ce61a302e1 100644
--- a/docs/guide/edgezero.md
+++ b/docs/guide/edgezero.md
@@ -71,10 +71,19 @@ store before deletion, especially when using `--store` or `--no-env`.
 4. Run `ts config push --adapter ADAPTER`.
 5. Start or deploy the adapter and verify a non-health publisher route. A
    healthy endpoint alone may not prove that application configuration loaded.
-   Confirm that its `x-ts-version` response header reports the release you
-   deployed.
+   Confirm that its `x-ts-version` response header reports the source identity
+   you deployed. A canonical attested release uses the approved full source
+   commit; its external release tag belongs to the signed release index.
+   Development source builds retain the override/tag/branch/short-commit
+   display fallback. The header alone does not verify artifact provenance.
 
 See [Configuration](/guide/configuration) for the field contract, the
 [CLI guide](/guide/cli) for exact command help, and
 [deployment guides](/guide/integrations-overview#adapter-support) for target
 behavior.
+
+Canonical Fastly release consumption has a separate
+[manual verified-byte procedure](/guide/release-verification#manual-fastly-production-consumption).
+Integrated attested deployment with preactivation checks and staging isolation
+remains separate work; the managed source/application-release path is not proof
+those guarantees exist.
diff --git a/docs/guide/error-reference.md b/docs/guide/error-reference.md
index c2ddcebbd9..14e589c800 100644
--- a/docs/guide/error-reference.md
+++ b/docs/guide/error-reference.md
@@ -620,7 +620,11 @@ TSJS_PREBUILT_DIR="$PWD/crates/trusted-server-js/dist" cargo build-fastly
 ```
 
 `TSJS_PREBUILT_DIR` is checked the same way as a normal build: every expected
-bundle must be present and non-empty. `TSJS_SKIP_BUILD` is no longer supported.
+bundle must be present and non-empty. Inventory-absent development builds keep
+unrelated non-bundle entries such as an external Prebid directory. Rust Cargo
+builds reject ANY presence of `TSJS_SKIP_BUILD`, including empty, `0` and `1`.
+Node development build/Vitest entry points preserve development behavior when
+`TRUSTED_SERVER__RELEASE_BUILD` is absent.
 
 ---
 
@@ -635,14 +639,42 @@ writes.
 | ---------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `tsjs: npm not found on PATH`                                    | Node.js is not installed or not on `PATH`. Install Node.js, or set `TSJS_PREBUILT_DIR` as shown above.                                                                                                                             |
 | `tsjs: TSJS_PREBUILT_DIR must be an absolute path`               | Cargo runs build scripts from `crates/trusted-server-js`, so a relative path would resolve there. Pass an absolute path, for example `"$PWD/crates/trusted-server-js/dist"`.                                                       |
-| `tsjs: TSJS_SKIP_BUILD is no longer supported`                   | `TSJS_SKIP_BUILD=1` no longer skips the build. Unset it and use `TSJS_PREBUILT_DIR` instead.                                                                                                                                       |
+| `tsjs: TSJS_SKIP_BUILD is no longer supported whenever present`  | Any present value, including empty, `0` or `1`, fails Rust Cargo builds. Unset it and use `TSJS_PREBUILT_DIR` instead.                                                                                                             |
 | `tsjs: node_modules is out of date with package-lock.json`       | Dependencies changed, for example after switching branches. Run `npm ci` in `crates/trusted-server-js/lib`. The check compares file times, so a checkout that rewrites an unchanged lockfile also triggers it; `npm ci` clears it. |
 | `tsjs: npm ci failed`                                            | `node_modules` was missing and the automatic install failed. Run `npm ci` in `crates/trusted-server-js/lib` to see the error.                                                                                                      |
 | `tsjs: invalid bundle set ... missing bundles` / `empty bundles` | The Node build or the `TSJS_PREBUILT_DIR` directory did not produce one `tsjs-<id>.js` per `core` and `lib/src/integrations/<id>/index.ts`.                                                                                        |
 | `tsjs: invalid bundle set ... unexpected bundles`                | `TSJS_PREBUILT_DIR` holds bundles from a different source tree. Rebuild it with `npm run build`.                                                                                                                                   |
 
+When `TRUSTED_SERVER__RELEASE_BUILD=1`, the source must be a full lowercase
+40-character `TRUSTED_SERVER__GIT_VERSION`; missing/malformed source and other
+present release-control values fail without Git fallback. Release Cargo builds
+require absolute `TSJS_PREBUILT_DIR` and
+`TRUSTED_SERVER__TSJS_PREBUILT_INVENTORY` paths and do not run npm.
+
+Canonical `x-ts-version` reports that full source commit, while the external
+release tag belongs to the signed release index. Development builds retain the
+override/tag/branch/short-commit display fallback. The header alone does not
+authenticate executable bytes; use [release verification](/guide/release-verification).
+
+| Error message contains                                                                       | Cause and fix                                                                                                                                                   |
+| -------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `tsjs: release builds require TSJS_PREBUILT_DIR` / `TRUSTED_SERVER__TSJS_PREBUILT_INVENTORY` | Supply both absolute paths from the checked producer output.                                                                                                    |
+| `tsjs: TRUSTED_SERVER__TSJS_PREBUILT_INVENTORY requires TSJS_PREBUILT_DIR`                   | An inventory cannot select bundles without a prebuilt directory.                                                                                                |
+| `tsjs: TRUSTED_SERVER__TSJS_PREBUILT_INVENTORY must be an absolute path`                     | Pass the absolute sibling inventory pathname.                                                                                                                   |
+| `tsjs: invalid inventory path`                                                               | Inventory must be outside the exact bundle directory and a regular single-link file.                                                                            |
+| `tsjs: invalid inventory` / `invalid prebuilt inventory inputs`                              | Fix source/module order, byte sizes/digests or unsafe entries. The checked path rejects bundle links, hard links, empty/extra entries and changed copied bytes. |
+
+Inventory-present development builds use the same strict checked path; the
+inventory validates its own source syntax/hash, while the development source
+display label is not compared with its commit. Strict checked-copy support is
+Linux/macOS; inventory-absent development follows the existing portable path.
+The exact raw inventory digest is exposed as
+`TRUSTED_SERVER__TSJS_INVENTORY_SHA256` for composition evidence.
+
 Set `TSJS_TEST=1` to run the TypeScript tests before the build; a failing test
-fails the build.
+fails the build. The default development suite skips only two slow Git collector
+fixtures; `TRUSTED_SERVER__RELEASE_JS_TESTS=1` enables the full registered suite,
+as required in CI and both future release A/B executions.
 
 ---
 
diff --git a/docs/guide/getting-started.md b/docs/guide/getting-started.md
index 8ff0b435cc..37c2871f1f 100644
--- a/docs/guide/getting-started.md
+++ b/docs/guide/getting-started.md
@@ -233,6 +233,16 @@ and a build outside a git checkout omits the header. The value is public on
 every response, so pass a neutral value such as the commit hash when a branch
 name is sensitive.
 
+This is the source-build development path. Canonical attested release builds
+use `TRUSTED_SERVER__RELEASE_BUILD=1` with an approved full 40-character source
+commit and no Git display fallback. Their `x-ts-version` is that source identity;
+the external release tag is recorded separately in the signed release index.
+The header is not a binary checksum or attestation verification.
+
+For canonical Fastly bytes, use the separate
+[manual verified-byte production procedure](/guide/release-verification#manual-fastly-production-consumption).
+The source-build commands above do not establish canonical release provenance.
+
 ## Next Steps
 
 - Learn about [Edge Cookies](/guide/edge-cookies)
diff --git a/docs/guide/release-verification.md b/docs/guide/release-verification.md
new file mode 100644
index 0000000000..d20360667b
--- /dev/null
+++ b/docs/guide/release-verification.md
@@ -0,0 +1,293 @@
+# Release verification
+
+`ts release verify` checks one official release executable and its complete
+attestation graph against an independently approved source commit. It prints a
+read-only report. It does not install, export or deploy the executable.
+
+## Establish the verifier first
+
+Before executing any downloaded `ts`, obtain a trusted verifier independently.
+Use a previously trusted verifier, or inspect and build the verifier from an
+independently approved source checkout with its reviewed lockfile and toolchain.
+For example, in that approved checkout on Apple Silicon macOS:
+
+```bash
+cargo build --locked --package trusted-server-cli --target aarch64-apple-darwin
+TRUSTED_TS="$PWD/target/aarch64-apple-darwin/debug/ts"
+```
+
+Use the corresponding native host target on Linux. An approved-source build
+establishes trust in that verifier's source; it does not establish official binary
+provenance for the verifier itself. Do not run the newly downloaded executable to
+verify itself, and do not treat a checksum downloaded beside it as an independent
+trust anchor.
+
+Install **gh 2.97.0** through an independently trusted package or verified upstream
+distribution, following the [GitHub CLI installation instructions](https://github.com/cli/cli#installation).
+Place that executable in a trusted absolute `PATH` entry. The verifier resolves
+it once and checks the exact version. Version text is a compatibility check; a
+hostile executable can print the same text. The verifier's isolated child
+environment does not use existing gh login state or configuration.
+
+The pinned **gh 2.97.0 / actions/attest 4.2.2** real signed fixtures still require
+an external qualification record. Synthetic tests exercise orchestration and
+policy rejection; they do not qualify those signatures or the pinned tools.
+
+## Verify an official asset
+
+Independently review the release's full, lowercase 40-character source commit.
+Provide an explicit read-only GitHub token through `GH_TOKEN`, or `GITHUB_TOKEN`
+when `GH_TOKEN` is absent. Prefer a token restricted to the reads needed for the
+public repository; never put it in command arguments. The verifier cannot infer a
+token's permissions from its text.
+
+```bash
+"$TRUSTED_TS" release verify v1.2.0 \
+  --asset ts-aarch64-apple-darwin \
+  --expected-source-commit 0123456789abcdef0123456789abcdef01234567
+```
+
+The commit above is fictional; replace it with your independently approved
+commit. The initial cohort accepts exactly these executable names:
+
+- `trusted-server-fastly.wasm`
+- `ts-x86_64-unknown-linux-gnu`
+- `ts-x86_64-apple-darwin`
+- `ts-aarch64-apple-darwin`
+
+All three arguments are validated before token lookup, configuration loading or
+network activity. No provider configuration or build hooks are needed. There are
+no public offline, cache, export, deploy or output-format options.
+
+The verifier obtains producer-policy bytes from the fixed official repository
+Contents API path at the independently approved commit. It checks the index's
+provenance before using index fields, applies its embedded consumer policy, and
+checks selected executable bytes, provenance and SBOM bundles, SPDX document,
+build evidence, recipe, comparison record and JS inventory. A successful primitive
+`gh attestation verify` invocation alone does not establish these document,
+certificate, subject, policy and workflow-run joins.
+
+Online publication checks additionally require the official lightweight tag to
+point to the approved commit, an immutable published release, successful typed
+`gh release verify` evidence, and exact asset-name, size and digest membership.
+The report includes source, asset digest, assurance profile, both policy versions
+and digests, build/publication outcomes and the informational rebuild comparison.
+A comparison result does not grant deployment authorization.
+
+Metadata is limited to 1 MiB, each bundle/build companion to 32 MiB, SPDX to
+16 MiB, and executables to 512 MiB. Executables stream into private retained files;
+they are not buffered through a JSON pipe. Each gh child has a 120-second deadline
+and bounded output; the complete attempt has a 15-minute deadline. Invalid JSON,
+truncation, failed children, changed bytes and timeouts fail closed with nonzero
+exit status. Retained inputs are rehashed before use and discarded afterward.
+
+Policy and publication requests use fixed official HTTPS API paths without
+redirects. Asset URLs are constructed from the fixed official repository, checked
+tag and canonical asset name, independently of JSON download URLs. Public asset
+requests carry no token and accept at most three HTTPS redirects, only to
+`release-assets.githubusercontent.com`, the host
+[documented by GitHub for release downloads](https://docs.github.com/en/actions/reference/runners/github-hosted-runners).
+The client disables inherited proxy settings.
+
+## Manual offline build checks
+
+There is no public offline command in this cohort. A private verifier path checks
+build evidence using the same parsers, policy and graph joins with local bundles,
+independently approved source-policy bytes, a securely transported trusted-root
+snapshot and independently approved artifact/root SHA-256 pins. Its result cannot
+be used as publication evidence or deployment authorization.
+
+Prepare trust inputs through a separate trusted channel. For example, online
+preparation may obtain roots with the independently trusted gh:
+
+```bash
+gh attestation trusted-root --hostname github.com > trusted_root.jsonl
+```
+
+Approve and securely transfer the exact root snapshot digest independently of the
+evidence transfer. Also transfer the approved source-policy snapshot, approved
+source commit, independent executable digest, index and all required companion
+bytes. A digest or root snapshot supplied only by an untrusted evidence package
+is not an independent approval.
+
+Under an operating-system boundary that denies networking, pinned gh supports
+local verification with `--bundle` and `--custom-trusted-root`. It does not have an
+`--offline` flag. Token variables must be absent, and the denial boundary should
+be proved using a successful unconfined socket control and a denied confined
+socket probe. These primitive commands illustrate the certificate/source checks:
+
+```bash
+RELEASE_TAG=v1.2.0
+REVIEWED_COMMIT=0123456789abcdef0123456789abcdef01234567
+ASSET=trusted-server-fastly.wasm
+SIGNER="https://github.com/IABTechLab/trusted-server/.github/workflows/release-build.yml@refs/tags/$RELEASE_TAG"
+COMMON=(-R IABTechLab/trusted-server --hostname github.com
+  --custom-trusted-root trusted_root.jsonl
+  --cert-identity "$SIGNER"
+  --cert-oidc-issuer https://token.actions.githubusercontent.com
+  --source-ref "refs/tags/$RELEASE_TAG" --source-digest "$REVIEWED_COMMIT"
+  --signer-digest "$REVIEWED_COMMIT" --deny-self-hosted-runners --format json)
+
+gh attestation verify release-index.json "${COMMON[@]}" \
+  --bundle release-index.provenance.sigstore.json \
+  --predicate-type https://slsa.dev/provenance/v1
+
+gh attestation verify "$ASSET" "${COMMON[@]}" \
+  --bundle "$ASSET.provenance.sigstore.json" \
+  --predicate-type https://slsa.dev/provenance/v1
+
+gh attestation verify "$ASSET" "${COMMON[@]}" \
+  --bundle "$ASSET.sbom.sigstore.json" \
+  --predicate-type https://spdx.dev/Document/v2.3
+```
+
+Replace the fictional commit and first compare both independent digest pins.
+These exit statuses are only primitive signature checks. Manually enforce the
+same bounds and strict document parsing, exact signed subject sets, certificate
+repository IDs and workflow identity, approved source-policy digest/version,
+embedded cohort and capability policy, common workflow-run attempt, all index
+companion sizes/digests, JS inventory/build-evidence/recipe joins, and equality of
+the signed SPDX predicate to the companion document. No unsigned companion or
+checksum may supply authority. The design specification in the approved source checkout (`docs/superpowers/specs/2026-10-09-1235-release-attestation-design.md`)
+defines the full required joins.
+
+Offline success establishes approved bytes and build evidence. It cannot
+re-establish official immutable release membership, current release state or
+fresh revocation. GitHub release verification requires online publication checks;
+offline official deployment is unsupported.
+
+## Manual Fastly production consumption
+
+This manual route transports inspected, verified wasm bytes while integrated
+attested deployment is pending. It activates production and does not provide the
+integrated preactivation binding check, staging isolation or durable structured
+recovery contract. Existing EdgeZero application-release deployment is a separate
+path; `ts deploy --release` is not an implemented command here.
+
+### Retain trusted inputs and bootstrap the inspector
+
+Complete online release verification for `trusted-server-fastly.wasm` against the
+independently approved source commit. `ts release verify` reports verification and
+discards its retained files; it has no public export option. Separately retain the
+exact wasm bytes using a trusted acquisition procedure, and compare their SHA-256
+with the successful verification context. Stop if trusted retention of matching
+bytes is unavailable. A neighboring checksum or an archive's own digest does not
+establish this trust.
+
+Build the package inspector from the same independently approved repository
+commit, with its reviewed lockfile and toolchain. Do not execute a newly downloaded
+helper to establish its own trust. For example, in that approved checkout on
+Apple Silicon macOS:
+
+```bash
+cargo build --locked --package trusted-server-release --target aarch64-apple-darwin
+TRUSTED_RELEASE="$PWD/target/aarch64-apple-darwin/debug/trusted-server-release"
+```
+
+Use the corresponding native host target on Linux. The source-built inspector is
+not a separately authenticated release asset and does not verify acquisition,
+attestations, provider bindings or live execution.
+
+### Prepare a private deployment directory
+
+Use a fresh private directory for this operation. Copy the retained verified wasm
+there as `trusted-server-fastly.wasm`. Derive a new deployment-only `fastly.toml`
+from the reviewed publisher-owned manifest; leave the original operator manifest
+unchanged. The inspector accepts this deliberately narrow two-line profile:
+
+```toml
+manifest_version = 3
+name = "example-app"
+```
+
+Use exactly these two root keys in this order, this spacing, and a final newline.
+The name must contain 1–64 lowercase ASCII letters/digits, optionally separated
+by single hyphens, and must not be `package`. No comments, descriptions, language,
+service IDs, tables, `[local_server]`, `[setup]`, scripts, build hooks, inline
+fixtures, active app-config payloads or secrets are accepted. This profile does
+not provision resources; select the existing service explicitly at submission.
+Independently approve the exact deployment manifest bytes and their SHA-256 in
+the deployment context before packing. Keep that approved digest and the verified
+wasm digest outside the archive as trusted inputs.
+
+Review the intended existing service and integer base version. Independently
+inspect that exact version's observed Config, KV and Secret Store links, logical
+IDs, selectors and required secret references/presence. Declarations in an
+operator manifest's `[setup]` do not prove or update existing-service bindings;
+this procedure does not push configuration or secrets. Record shared resources
+and serialize changes to the service and those resources across environments.
+
+### Pack, inspect and submit
+
+Use the pinned Fastly CLI **15.1.0** from an independently trusted installation.
+From the private directory containing only the approved deployment inputs, run:
+
+```bash
+fastly compute pack --wasm-binary ./trusted-server-fastly.wasm
+```
+
+At this pin, packing creates both `pkg/<name>.tar.gz` and an unrelated
+`pkg/package.tar.gz`, and can sweep in pre-existing package contents. Fresh
+private directories are required. The selected named archive must contain exactly
+`<name>/`, `<name>/bin/`, `<name>/bin/main.wasm` and `<name>/fastly.toml`.
+Never submit the generic `package.tar.gz` by guessing its name.
+
+Inspect the output directory using the independently approved expected manifest
+and wasm digests. Replace the placeholders with those trusted SHA-256 values:
+
+```bash
+"$TRUSTED_RELEASE" inspect-fastly-package \
+  --package-dir "$PWD/pkg" \
+  --manifest "$PWD/fastly.toml" \
+  --expected-manifest-sha256 '<approved-manifest-sha256>' \
+  --expected-wasm-sha256 '<verified-wasm-sha256>'
+```
+
+The inspector bounds archive processing and rejects traversal, links, duplicate
+or extra entries, mismatched manifest/wasm bytes and malformed or non-core wasm.
+Its JSON report identifies the selected absolute package path and the archive,
+module and manifest hashes, together with its limits. Record those observations.
+The archive SHA-256 identifies this operation's envelope; nondeterministic tar
+metadata means it is not the canonical release identity.
+
+Packing and `compute validate` can accept non-wasm bytes and do not remove private
+fixtures. Neither command proves valid wasm, usable application configuration or
+application execution. Inspector success also does not replace a positive
+publisher-request runtime check; `/health` alone can bypass application settings.
+
+Immediately before submission, recheck the selected base version's bindings and
+selectors and rerun the inspector against the retained package and trusted
+digests. Keep the reviewed manifest, wasm and package unchanged. Use the exact
+package path reported by the inspector and the inspected service/base version:
+
+```bash
+fastly compute deploy --package './pkg/example-app.tar.gz' \
+  --service-id '99999' --version '7' --no-default-domain
+```
+
+The service ID and version above are fictional; replace them with the inspected
+existing service and integer base version. Replace the example package name
+with the inspector-selected name. The working
+directory's manifest takes precedence over the packaged manifest, so retain only
+the inspected deployment-only manifest there. Explicit `--service-id`, integer
+`--version` and `--no-default-domain` are required: omitted version selection can
+resolve active, or latest when no active version exists, and omitted domain
+suppression can create a random default domain. Do not use `compute publish` or
+build from source for this verified-byte route.
+
+At this pin, `compute deploy` clones an active/locked version and activates
+production internally; it has no staging mode. It can also return success while
+skipping deployment when the selected version already has the same package hash.
+Exit zero therefore does not prove upload, allocation of a new version or
+activation. Record the version actually reported and independently inspect its
+bindings, package observations and a non-health publisher response. Preserve
+uncertain outcomes as uncertain; do not infer ownership from the currently active
+or highest version, blindly retry, or guess a rollback target.
+
+This procedure cannot interpose a binding check between upload and production
+activation. It supplies no staging isolation or durable structured recovery.
+These integrated guarantees remain separate work. No live disposable-service
+submission or AC-9 qualification is established by these instructions or by
+provider-free inspector tests; that proof requires a separately authorized
+production submission with submitted-member and returned-version observations,
+including skipped or uncertain outcomes.
diff --git a/docs/superpowers/plans/2026-10-13-attested-release-implementation.md b/docs/superpowers/plans/2026-10-13-attested-release-implementation.md
new file mode 100644
index 0000000000..98c6245138
--- /dev/null
+++ b/docs/superpowers/plans/2026-10-13-attested-release-implementation.md
@@ -0,0 +1,1518 @@
+# Attested release binaries and verified consumption Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Publish and verify the four canonical Fastly/`ts` artifacts required by #1235, with complete evidence and a validated manual Fastly production route.
+
+**Architecture:** A small domain-specific host-only Rust release tool builds and describes bytes; POSIX wrappers select its independently approved native bootstrap; a reusable workflow signs only validated outputs; one caller publishes the complete immutable distribution. A host-only Trusted Server verifier separately establishes build evidence, publication and consumer authorization before retaining verified bytes. Packaging and integrated EdgeZero deployment are separate milestones that consume these boundaries.
+
+**Tech Stack:** Rust 1.95.0/2024, existing workspace serde/serde_json/error-stack/derive_more/clap/sha2/log/tempfile/toml/gix/libc/flate2 as needed, qualified Rust schema/archive/binary parsers, Node 24.12.0/npm 11.6.2, Vite/Rollup, SPDX 2.3, GitHub CLI 2.97.0, actions/attest 4.2.2, Fastly CLI 15.1.0. CLI consumer tasks retain their existing tokio/reqwest architecture.
+
+---
+
+## Authority, baseline and scope
+
+Planning baseline: `44c5b5620bfb1f82e5b959ab5ba8ec69c7091e52`, inspected 2026-10-13. The governing [contract](../specs/2026-10-09-1235-release-attestation-design.md), [feasibility register](../specs/2026-10-12-1235-release-attestation-feasibility.md) and [index schema](../specs/schemas/release-index-v1.schema.json) remain drafts awaiting maintainer approval. Delivery direction on 2026-10-13 is to develop/review the spec, plans and implementation together on `spec/1235-release-attestation` in PR #1262, with no new Trusted Server PR. The reviewed plan guides implementation here; maintainer contract/code approval remains required before merge, and the plan does not qualify a release or authorize live publication/deployment. Task 1 records this delivery contract and the unchanged qualification prerequisites.
+
+#1214 and #1213 are present at this baseline. Extend their merged private JS output/prebuilt interface and source-version mechanism; do not reimplement the historical audit snapshots. Source deployment currently delegates to EdgeZero and no release workflow/verifier exists.
+
+The initial cohort is exactly:
+
+| Canonical asset               | Required assurance                                         | Blocking qualification                                                             |
+| ----------------------------- | ---------------------------------------------------------- | ---------------------------------------------------------------------------------- |
+| `trusted-server-fastly.wasm`  | `provenance-sbom-repeatable`; default, no reusable sandbox | Final complete-byte A/B equality, real SBOM/runtime and verified manual submission |
+| `ts-x86_64-unknown-linux-gnu` | `provenance-sbom`                                          | glibc ceiling 2.34; clean UBI 9, Ubuntu 22.04, Debian 12 startup                   |
+| `ts-aarch64-apple-darwin`     | `provenance-sbom`                                          | Explicit loader floor 13.0; actual macOS 15 ARM execution                          |
+| `ts-x86_64-apple-darwin`      | `provenance-sbom`                                          | Same loader floor; actual macOS 15 Intel execution                                 |
+
+Every selected canonical Build A, SBOM, signature and publication check is mandatory. CLI Build B is a bounded measurement, not a shipping equality requirement. No Linux ARM64, installer packages, other adapter releases, retained-input archive, operator reconstruction or official offline deployment is added by this plan.
+
+Two linked plans keep independent work out of these closure criteria:
+
+- [CLI packaging attestation integration](2026-10-13-cli-packaging-attestation-integration.md): reconcile #1292, package exact canonical bytes and authenticate member identities. Later releases only after the required spec/schema amendments are approved.
+- [Fastly prebuilt EdgeZero integration](2026-10-13-fastly-prebuilt-edgezero-integration.md): upstream prepared payload, integrated online production/staging and durable recovery; AC-8 is separate from initial #1235 closure.
+
+## Rust migration and current execution boundary
+
+The user's 2026-10-14 correction prohibits introduced Python release tooling. The [migration design addendum](../specs/2026-10-14-release-tooling-rust-migration.md) selects `crates/trusted-server-release`: a Rust 2024/1.95.0 host-only workspace member, excluded from default members and independent of core, CLI and JS crates. The existing host-only codegen member is the precedent. The tool is internal producer tooling, not a fifth canonical asset, a generic attestation framework or a publisher abstraction. `ts` remains the consumer in Tasks 17–20: CLI → core → JS makes the CLI unsuitable as the JS/bootstrap producer.
+
+Preserve `collect-js.mjs` and the implemented Node composition hook. POSIX wrappers use an independently approved-source, OS-native Rust toolchain to build/select the release tool before executing it; a colocated SHA file or self-reported source label supplies no authority. Developer Cargo commands below establish local behavior only. Production needs the authenticated bootstrap, full qualified source/dependency/tool closure and reviewed native OS adapters. No language migration waives native SDK/tool acquisition or authenticating the original Fastly CLI archive through independently reviewed vendor-source evidence.
+
+- [x] **M0: Remove superseded tooling.** Introduced Python release code and validator requirements are removed. Deleted prototype behavior is not implemented or fixed by removal; pending Rust regressions below remain mandatory.
+- [ ] **M1: Port primitives and preflight (Tasks 2–3).** Strict document/schema utilities, fixed policy/environment checks, local Git object/worktree authentication and the helper-closure fingerprint are implemented. Git commands use bounded process supervision and a shared command deadline. Independently authenticated bootstrap/tool acquisition and qualification remain incomplete; the closure fingerprint supplies no acquisition authority. Register each private test module before applying the nonzero-selection guard.
+- [ ] **M2: Port material/process/OS boundaries (Tasks 7–9).** Establish original archive/Git identities, bounded child execution, kill/reap/cleanup, private staging, source/object read-only protections and real native denial controls. Preserve independent all-cohort remote receipts separately from rehashing tools actually installed in the current execution environment.
+- [x] **M3: Restore real JS orchestration (Task 7).** Perform two fresh offline installations, actual lifecycle observations and denied missing-tool probes, all tracked bundle comparisons and both full registered JS/type-check suites. Only actual successful execution constructs a private typed completion bound to source, tools, settings and retained A bytes; parsed JSON, paths or booleans cannot construct it. The full Linux A/B execution test passed in ordinary PR CI on 2026-10-15 (1,275/1,275 tests per side, 13 byte-identical modules, six private roots removed); see the [two-build evidence report](../../../scripts/release/qualification/2026-10-15-js-two-builds.md). This is candidate CI execution, not hosted release qualification.
+- [ ] **M4: Restore canonical recipes and inspection (Tasks 8–9).** Candidate recipes are implemented for all four assets and pass ordinary CI with `release_qualification: false`; qualification, the closed `build.sh` interface and the production reproduction profile remain pending. Compose actual Cargo preparation, compile, final acceptance and copying; collect Task 10 metadata/tree/native evidence through that same boundary before hosted qualification. Local tiny artifacts cannot qualify the full product or actual macOS 15/GNU cohort.
+- [ ] **Then Tasks 10–22.** Implement the remaining Rust producer modules, workflow contracts, consumer verification and manual route in dependency order. Complete every selected qualification and full CI gate before release enablement/handoff.
+
+The producer helper MUST itself be built and executable inside the selected GNU builder at glibc <=2.34, using an independently approved image/toolchain/material channel. An ambient Ubuntu 24 build cannot be assumed to load in UBI 9. Bind helper target, loader/runtime, source/dependency closure and actual native executable identity before execution. macOS helpers require the approved native CPU/SDK/floor-compatible chain. Initial shell/hash/Rust/Cargo authority is independent of the tool; record and authenticate rustup only if it is actually used (direct signed-component installation does not require it); the tool cannot authenticate itself. Native Rust helper/staged POSIX drivers implement socket and lifecycle probes, without language substitutions.
+
+Current implementation includes strict documents/policy, local source/preflight checks, bounded process supervision, owning build facts, checked JS inventory and Node composition. Original archive authentication, bounded private extraction and lifecycle declaration review are implemented. Final-artifact inspection and experimental native boundaries are implemented, with separate consumer evidence verification. The experimental macOS profile now kills and rejects descendants that escape the process group, including with a scrubbed environment, by identifying its sandbox instance after each run; it remains unqualified and does not own descendant cleanup the way a container does. Native boundary controls pass ordinary Ubuntu 24.04 and macOS 15 CI; they do not qualify complete release recipes or authenticated tool selections. Original npm and Cargo Git material verification and two-installation JS orchestration are implemented; the full Linux A/B execution test passed in ordinary PR CI. Candidate recipes for all four assets are implemented and pass ordinary CI (unqualified, `release_qualification: false`). Qualification, the closed `build.sh` interface, the production reproduction profile, authenticated bootstrap/acquisition and hosted qualification remain incomplete. Production wrappers and qualified selection remain closed.
+
+## Current task status — 2026-10-21
+
+Count complete task exits separately from implemented code awaiting external
+qualification. There are **8 complete tasks and 14 open tasks**. One open task
+has its implementation finished; nine tasks therefore have completed code.
+Task counts do not measure remaining effort.
+
+Task 10 remains partial after the 2026-10-21 native archive identity hardening
+and GNU gap reporting increment. Existing source/archive/unit/JS collectors are
+implemented, but full native/tool closure and authenticated acquisition are not
+established. The task counts below do not change for this increment.
+
+| Status                                         | Count | Tasks                     | Remaining exit work                                                                                                                                                                       |
+| ---------------------------------------------- | ----- | ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Complete                                       | 8     | 2, 4, 5, 6, 7, 17, 18, 20 | Implementation, local verification, real pinned-verifier public-fixture validation where required, and independent review completed                                                       |
+| Implementation complete; qualification pending | 1     | 19                        | Official Trusted Server signed-release first-use verification; upstream provenance/SPDX format compatibility has been measured                                                            |
+| Partial or prerequisite approval pending       | 9     | 1, 3, 8–13, 21            | Maintainer scope approval; authenticated bootstrap/tool selection; platform qualification; complete composition/SPDX, trusted transfers and real index assembly; live manual Fastly proof |
+| Pending implementation                         | 4     | 14–16, 22                 | Trusted same-commit validation/signing workflows, immutable publication and final qualification                                                                                           |
+
+Task 7's Linux JS exit (M3) passed: an actual ordinary-CI run completed both
+fresh offline installations, lifecycle observations, missing-tool and download
+controls, both full suites and final-byte equality before constructing
+`JsBuildCompleted`. Task 7's macOS regression ports then passed on macOS 15
+CI, including the formerly residual scrubbed process-group escape. That
+candidate evidence is not hosted qualification and opens no production
+selector. Task 9 now has ordinary-CI Fastly canonical/reproduction equality,
+final-byte publisher acceptance, Linux CLI startup evidence, and Apple ARM CLI
+startup with byte-identical canonical/reproduction output. Intel canonical
+runtime validation also passed; its optional reproduction failed on time bounds in runs 39273777887 and 39290139247 and was identical in later runs 39417433680 and 39420011152 (a measurement with a thin timing margin, not a gate). Authenticated selections remain open. Ordinary CI passes do not change the pending
+qualification pins or authorize release publication.
+
+Follow-up (2026-10-21): run 39540057202 passed all four canonical candidates,
+but Intel's optional reproduction again exhausted the 25-minute confined-build
+wall. `3e3e30996` defers native reproduction on ordinary push/PR runs and measures
+it on scheduled/dispatched or appropriately labelled PR runs; Fastly equality
+remains mandatory. `b4c8e0c0f` raises only the ordinary-CI per-build wall to
+45 minutes. The [schedule/cache report](../../../scripts/release/qualification/2026-10-21-native-reproduction-schedule.md)
+records exact jobs, source, trigger availability and pending validation. Earlier
+Intel equality observations do not establish equality under this new selection.
+
+## Work breakdown and ownership
+
+Use successive focused commit/review groups within PR #1262: (1) input/fact/JS guards, (2) qualified recipes and composition, (3) collection/signing/publication, (4) verifier/manual route/docs. Each depends on its predecessor; tag enablement waits for all four. No new Trusted Server implementation PR is created. Build scripts can be proved locally before production YAML exists. No intermediate PR may enable an incomplete release trigger.
+
+| File group                                                                                                                    | Responsibility                                                                                           |
+| ----------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
+| `scripts/release/release-cohort.json`, `release-tools.json`                                                                   | Reviewed fixed identities, profiles, approved RC branches and qualified environment pins                 |
+| `crates/trusted-server-release/Cargo.toml`, `src/main.rs`                                                                     | Host-only producer dispatch, with no product-crate dependencies                                          |
+| Release tool `src/documents.rs`, `policy.rs`, `preflight.rs`, `source.rs`                                                     | Strict bounded JSON, fixed contracts, authenticated source and explicit environment                      |
+| Release tool `src/materials.rs`, `process.rs`, `boundary.rs`, `preparation.rs`, `javascript.rs`, `qualification.rs`           | Original acquisitions, bounded execution, real OS isolation, fresh JS and native qualification           |
+| `scripts/release/bootstrap.sh`, `build-js.sh`, `build.sh`, `collect-js.mjs`                                                   | Approved native Rust bootstrap, fixed POSIX adapters and retained Node observer                          |
+| Release tool `src/recipe.rs`, `inspect.rs`, `composition.rs`, `spdx.rs`, `collection.rs`, `distribution.rs`, `publication.rs` | Fixed recipes, actual composition, SPDX, transfers, distribution and sole-owner publication support      |
+| Release tool `src/package.rs`                                                                                                 | Bounded trusted-source manual Fastly inspection; later approved packaging adapters                       |
+| `.github/workflows/release-validation.yml`, `release-build.yml`, `release.yml`                                                | Same-commit gates; isolated builds/signing; sole draft/publication owner                                 |
+| `crates/trusted-server-cli/src/release/`                                                                                      | Host-only consumer verifier: policy, strict documents, bounded gh, GitHub publication and evidence graph |
+| `crates/trusted-server-cli/src/commands/release.rs`                                                                           | Public read-only `ts release verify` adapter                                                             |
+| Release tool private tests, `tests/commands.rs`, `tests/fixtures/`; CLI/core/JS tests                                         | Producer negatives, public-command process tests, consumer fixtures and actual qualification             |
+
+Execute each listed negative fixture as a separate red/green microcycle: write one case, run its focused filter, implement the smallest relevant behavior and rerun it, then move to the next case. A task groups related work for review/commit; its fixture list is not one giant implementation step.
+
+Task 2 utilities and the retained Rust/Node guard work are implemented. Remaining Rust module names below are proposed, not existing APIs. Create only modules needed by the current stage, without placeholder files. Private unit tests live alongside `src/<module>.rs` under `#[cfg(test)]`, or in registered `src/<module>/tests.rs`; fixture data lives in `crates/trusted-server-release/tests/fixtures/`. `tests/commands.rs` drives the public binary. Do not make internal APIs public merely for integration tests. Use concrete error-stack reports, top-level imports, descriptive assertions, documentation on public APIs and project commit conventions.
+
+Keep direct dependency features minimal. Reuse workspace dependencies only where an actual stage needs them; the producer has no dependency on core, CLI or JS. Maintained TAR/ZIP, schema and binary-format parsers are justified by existing bounded archive, Draft 2020-12/Draft 7 and ELF/Mach-O/core-Wasm requirements. Research exact maintained versions from primary sources and qualify semantics/acquisition before pinning; this plan invents no replacement version or digest. Library parsing does not replace archive limits or source authentication.
+
+### Task 1: Freeze approved scope and reconcile the packaging owner
+
+**Files:** Modify this plan and the governing spec only for approved corrections; reference PR #1292's `docs/superpowers/specs/2026-10-12-863-cli-release-packaging-design.md` and `docs/superpowers/plans/2026-10-12-cli-release-packaging.md` after their owning branch is available.
+
+- [ ] Read the current spec revision; record its commit and the same-branch/same-PR delivery direction. Work through reviewed tasks in PR #1262; obtain maintainer contract/code approval before merge. Do not require a separate spec merge or open another implementation PR.
+- [ ] Record one publication owner, `.github/workflows/release.yml`, and one signing identity, same-revision `release-build.yml`. #1292 MUST NOT independently publish an overlapping immutable tag while #1235 assets are still pending.
+- [ ] Confirm the current four-artifact cohort and three CLI baselines. Initial #1235 delivery may precede packaging on a different new tag. Adding package records or ARM64 requires the linked plan's approved delta, never a covert schema expansion here.
+- [ ] Settle one strict producer control channel: `TRUSTED_SERVER__RELEASE_BUILD=1`, injected by trusted recipe after environment sanitation, recorded as an input, rejected if present with another value. This is a fact/input guard, not the prohibited parallel JS fallback mode. Name the checked prebuilt inventory input `TRUSTED_SERVER__TSJS_PREBUILT_INVENTORY`.
+- [ ] Confirm permission policy remains runtime-variable; conflicting #1045/#1084 code blocks release enablement. Record the owner and dependency rather than designing a new permission transport.
+- [ ] Review milestone exits with maintainers in PR #1262. Commit any approved documentation delta as a focused commit on this branch with `Clarify release implementation prerequisites`.
+
+**Exit:** An engineer can identify approved source, scope, producer controls and the single release authority; no unspecified cross-PR ownership decision remains.
+
+### Task 2: Establish Rust producer fixtures and strict document utilities
+
+**Create:** `crates/trusted-server-release/Cargo.toml`, `src/main.rs`, `src/error.rs`, `src/documents.rs`, private registered `documents::tests`, `tests/commands.rs`, `tests/fixtures/README.md`.
+**Modify:** workspace `Cargo.toml` membership only; keep default members unchanged. Retain `scripts/release/tests/fixtures/README.md` as the migration pointer.
+
+- [x] Write private Rust tests for duplicate keys at every depth, nonfinite/out-of-range JSON, invalid UTF-8/surrogates/BOM/trailing controls, unsafe names, depth 65, oversized role inputs, negative/noninteger lengths and ambiguous duplicate identities. Include lexical integer overflow in opaque nested fields and top-level values (`18446744073709551616`, `-9223372036854775809`), decimal and exponent float overflow, exact integer boundary controls, and large number-like text inside strings with escaped quotes/backslashes that MUST NOT be rejected as a numeric token.
+- [x] Register tests, derive the host target as below, and run `cargo test -p trusted-server-release --target "$HOST_TARGET" documents::tests` with the nonzero-selection guard. Expect compilation/assertion failure for absent behavior, not an empty successful selection.
+- [x] Implement bounded byte-first loading, SHA-256 of original bytes, safe flat names, deterministic output and atomic writes. Use a recursive Serde visitor/seed that rejects duplicate object keys **before insertion**, rather than deserializing into `serde_json::Value` first. A representative parser core is:
+
+```rust
+use std::fmt;
+
+use serde::de::{DeserializeSeed, Error as _, MapAccess, SeqAccess, Visitor};
+use serde_json::{Map, Number, Value};
+
+struct StrictSeed {
+    depth: usize,
+}
+
+impl<'de> DeserializeSeed<'de> for StrictSeed {
+    type Value = Value;
+
+    fn deserialize<D>(self, deserializer: D) -> Result<Value, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        deserializer.deserialize_any(self)
+    }
+}
+
+impl<'de> Visitor<'de> for StrictSeed {
+    type Value = Value;
+
+    fn expecting(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("bounded unambiguous JSON")
+    }
+
+    fn visit_map<A>(self, mut access: A) -> Result<Value, A::Error>
+    where
+        A: MapAccess<'de>,
+    {
+        if self.depth > 64 {
+            return Err(A::Error::custom("JSON container depth exceeds 64"));
+        }
+        let mut object = Map::new();
+        while let Some(key) = access.next_key::<String>()? {
+            if object.contains_key(&key) {
+                return Err(A::Error::custom("duplicate JSON key"));
+            }
+            let value = access.next_value_seed(StrictSeed {
+                depth: self.depth + 1,
+            })?;
+            object.insert(key, value);
+        }
+        Ok(Value::Object(object))
+    }
+
+    fn visit_seq<A>(self, mut access: A) -> Result<Value, A::Error>
+    where
+        A: SeqAccess<'de>,
+    {
+        if self.depth > 64 {
+            return Err(A::Error::custom("JSON container depth exceeds 64"));
+        }
+        let mut values = Vec::new();
+        while let Some(value) = access.next_element_seed(StrictSeed {
+            depth: self.depth + 1,
+        })? {
+            values.push(value);
+        }
+        Ok(Value::Array(values))
+    }
+
+    fn visit_bool<E>(self, value: bool) -> Result<Value, E> {
+        Ok(Value::Bool(value))
+    }
+
+    fn visit_str<E>(self, value: &str) -> Result<Value, E> {
+        Ok(Value::String(value.to_owned()))
+    }
+
+    fn visit_string<E>(self, value: String) -> Result<Value, E> {
+        Ok(Value::String(value))
+    }
+
+    fn visit_i64<E>(self, value: i64) -> Result<Value, E> {
+        Ok(Value::Number(Number::from(value)))
+    }
+
+    fn visit_u64<E>(self, value: u64) -> Result<Value, E> {
+        Ok(Value::Number(Number::from(value)))
+    }
+
+    fn visit_f64<E>(self, value: f64) -> Result<Value, E>
+    where
+        E: serde::de::Error,
+    {
+        Number::from_f64(value)
+            .map(Value::Number)
+            .ok_or_else(|| E::custom("nonfinite JSON number"))
+    }
+
+    fn visit_unit<E>(self) -> Result<Value, E> {
+        Ok(Value::Null)
+    }
+}
+```
+
+The implemented utility chooses the mandatory role byte limit before reading/allocating and reject BOM/invalid encoding. Before `deserialize_any`, validate numeric tokens across the **whole document**, including opaque fields and top-level values, with a string-aware lexical scanner that skips quoted text and handles escapes. Negative integer tokens MUST fit `i64`; nonnegative integer tokens MUST fit `u64`. Decimal/exponent tokens MUST parse as finite `f64`; overflow fails. `serde_json` otherwise converts some overflowing integer tokens to finite floats, so the visitor's finite-float check alone is insufficient. Use the existing scanner in `crates/trusted-server-js/build/inventory.rs` as a behavioral reference without adding a JS-crate dependency. Then start with `StrictSeed { depth: 1 }` and require `serde_json::Deserializer::end()` so grammar/trailing data fails. Closed role validators additionally enforce stricter safe-integer limits and reject negative/noninteger lengths. The representative visitor above is the ambiguity parser, not the complete strict front end; schema validation never substitutes for lexical prevalidation, byte bounds, exact-original hashing or semantic joins.
+
+- [x] Qualify a maintained Rust schema evaluator. The locked `jsonschema` 0.58.6 is a locally checked evaluator candidate, not an approved production tool pin: use minimal features, explicit dialect and offline construction, with only known retained schemas and no arbitrary schema-file CLI override. Governing schemas require Draft 2020-12 `prefixItems`/`items` positive/negative cases; the official SPDX 2.3 schema uses Draft 7. Disable remote/file retrieval and reject unregistered references.
+- [x] Retain the official SPDX schema at source commit `aadf3b0b8dbbabdb4d880b0fc714255fea436ff7`, path `schemas/spdx-schema.json`, 45,312 bytes and SHA-256 `239208b7ac287b3cf5d9a9af23f9d69863971102a5e1587a27a398b43490b89b`. Confirm raw-byte identity and dialect before use. Candidate compatibility or a schema-valid toy document does not establish complete real-artifact coverage.
+- [x] Rerun documents/private atomic-write negatives and command-process tests; run host-target clippy/format. Commit only after authorized review with `Add strict Rust release document utilities`.
+
+### Task 3: Encode cohort, tools and fail-closed release preflight
+
+**Retain:** `scripts/release/release-cohort.json`, `release-tools.json`, `crates/trusted-server-cli/release-policy.json`.
+**Create as needed:** release tool `src/policy.rs`, `preflight.rs`, `source.rs` and private registered tests; wire the approved POSIX bootstrap adapter without weakening pending selections.
+
+- [ ] Port cases for missing/extra artifacts, profiles changed after failure, unknown target/feature, missing pins and every skip value (`""`, `"0"`, `"1"`). Include wrapper, Cargo config, NODE_OPTIONS, native selectors, unexpected ignored/nested validation files, modes/links and source mutation.
+- [ ] Run `cargo test -p trusted-server-release --target "$HOST_TARGET" preflight::tests` and `source::tests` separately with the nonzero-selection guard; expect the missing Rust behavior to fail.
+- [ ] Preserve exact tracked producer/consumer policy bytes, concrete fixed identity/profile/action/bounds and the raw source-owned tools input. Runtime consumer enforcement remains Tasks 17–20. No downloaded policy override or silent schema/cohort/capability amendment is permitted.
+- [ ] Map four asset IDs to fixed package/bin/target/features; never accept JSON commands. Preserve Rust/Node/npm, gh 2.97.0, attest 4.2.2/full SHA and Fastly 15.1.0. Populate binary/image/SDK digests only from authenticated acquisition and Task 8 measured review. The production preflight/selector requires all qualifications by default and MUST fail on pending/null pins; omitting a flag MUST NOT return success. A separately named audit diagnostic MAY describe incomplete inputs but MUST NOT construct authorization state. No JSON qualified boolean or dummy digest is accepted.
+- [ ] Audit the actual inherited environment before clearing it; reject skips and unreviewed channels, then build an allowlisted child environment. Do not hide hosted/setup overrides under `env -i`. Accept vetted setup exports such as `RUSTFLAGS`/`VCPKG_INSTALLATION_ROOT` only with explicitly reviewed, qualified values and path identities; otherwise reject. Remove publisher prefixes and inject only approved commit/control facts. Derive epoch from approved Git committer time. Check tracked and unexpected source-only files, including the full JS validation library, modes/links before and after execution; preserve narrow reviewed coordination exceptions.
+- [ ] Select generic and target-suffixed AWS-LC settings, bundled SQLite, Cargo config/home layers, sysroot/tool paths and Vite mode. Set `AWS_LC_SYS_USE_SYSTEM=0`, `LIBSQLITE3_SYS_USE_PKG_CONFIG=0`; reject alternate selectors rather than setting weaker defaults.
+- [ ] Authenticate approved source and acquisitions into private typed states. Keep independent all-cohort remote qualification receipts separate from current-environment installation identity: rehash the actual selected native binaries/SDK inputs immediately before use. Serialized `authenticated`/`qualified`/`completed` booleans, source labels or checksum files cannot construct either state.
+- [ ] Rerun negatives, including fictional operator-config independence and wrong-bootstrap source; run host lint/format. Commit `Define fixed Rust release inputs and preflight policy`.
+
+**Interface:** after independently approved native bootstrap, `trusted-server-release preflight --cohort scripts/release/release-cohort.json --source-commit <approved-commit> --require-qualified`; exit 0 only for a complete selected contract, otherwise fail before preparation/signing. A developer may exercise it with `cargo run -p trusted-server-release --target "$HOST_TARGET" -- preflight --cohort scripts/release/release-cohort.json --source-commit "$APPROVED_SOURCE_COMMIT" --require-qualified`, which provides no official tool or release assurance.
+
+- [ ] Reject unlisted RC branches and a malicious candidate cohort that lists itself; require independently reviewed tracked branch/governance inclusion, actual remote-tip ancestry and active ruleset/bypass validation. Current eligibility is exactly `["main"]`; reject local remote-ref substitutions.
+- [ ] Audit the true Git common directory, including linked worktrees, for alternates, grafts, shallow/replacement/config/environment channels. Explicitly reject unsupported linked indirections rather than partially checking them. Preserve bounded detailed Git errors. Reject an untracked extensionless `rust-toolchain` before bootstrap/rustup selection, including alongside the tracked TOML pin. Join approved source to the original JS inventory commit.
+
+### Task 4: Reconcile immutable build facts and CLI source resources
+
+**Modify:** `crates/trusted-server-core/build.rs`, `build_support/git_version.rs`, `tests/git_version_resolve.rs`, `src/lib.rs`; `crates/trusted-server-cli/src/run.rs`, `src/prebid_bundle.rs`.
+**Create:** core `src/build_info.rs`; CLI `build.rs`, `tests/release_build_facts.rs`.
+**Modify when adding the owning facts surface:** `crates/trusted-server-adapter-fastly/src/main.rs`; retain existing version-header/service-version behavior.
+
+- [x] Add strict full-commit tests: missing/malformed/branch/tag values fail in release mode without local-git fallback; development behavior stays covered. Add two external tags/same source yielding identical facts, owning-target/variant checks and compiled-path fallback rejection.
+- [x] Run `cargo test -p trusted-server-core --test git_version_resolve` and `cargo test -p trusted-server-cli --target "$HOST_TARGET" --test release_build_facts`; expect the new behavior to fail.
+- [x] Extend the merged #1213 helper using the approved release control. Derive target from Cargo `TARGET` through `TRUSTED_SERVER__BUILD_TARGET`, package version from the owning product, and default/reuse variant at the Fastly owner. Expose typed immutable facts without importing verifier/publisher keys into core. Do not embed tag, run ID, time or final checksum.
+- [x] Set clap's version text to `ts package=<pkg> source=<identity> target=<triple> variant=default`. Read Fastly owning package/target/variant facts through existing startup diagnostics. Remove unread variant and source-owner re-emissions; core remains the source identity owner. Official releases compile out `find_js_lib_dir`'s literal developer checkout fallback; preserve explicit/current-checkout resource discovery. Keep the tracked example config as a fictional scaffold, never active settings.
+- [x] Run core fact/template tests, CLI tests/clippy and Fastly version-header tests. Outside-checkout help/version/config-init MUST pass; Prebid source-dependent commands return documented prerequisites. Commit `Derive immutable release build facts`.
+
+### Task 5: Authenticate the existing prebuilt JS interface
+
+**Modify:** `crates/trusted-server-js/build.rs`, `build/bundle_set.rs`, `src/lib.rs` test inclusion.
+**Create:** `crates/trusted-server-js/tests/release_prebuilt.rs`.
+
+- [x] Write process/fixture tests for prebuilt mode plus any skip presence, absent inventory, wrong source/digest/size, duplicate IDs, unsafe filenames, missing/empty/extra modules and source changed during copy.
+- [x] Run `cargo test -p trusted-server-js --target "$HOST_TARGET" --test release_prebuilt` with the nonzero-selection guard; expect current prebuilt behavior to fail these guards.
+- [x] Extend the existing bundle-set validator; require `TRUSTED_SERVER__TSJS_PREBUILT_INVENTORY` in release mode and validate exact input and private copied bytes. Track both paths/control values with Cargo rerun directives. Reject skip before selecting prebuilt/source path; no TSJS_RELEASE_BUILD parallel mode and no read from old `dist/`.
+- [x] Preserve ordinary development's supported fresh source build and #1214's inventory-absent prebuilt path, including unrelated non-bundle extras and supported directory aliases. An inventory-present development build validates inventory source syntax/hash but MUST NOT compare it with the override/tag/branch display label. In release Rust jobs require prebuilt inputs and prohibit npm invocation; a fake failing npm proves it is never run.
+- [x] Run JS crate tests, Fastly/CLI target checks and prebuilt negatives. Commit `Bind release JS inputs to a checked inventory`.
+
+### Task 6: Collect JS contributions without changing bundle bytes
+
+**Modify:** `crates/trusted-server-js/lib/build-module-options.mjs`, `build-all.mjs`.
+**Create:** `lib/test/release-composition.test.mjs`, `scripts/release/collect-js.mjs`.
+
+- [x] Write temporary IIFE fixtures for type-only/external Prebid import, eliminated module, transitive npm contributor and plugin/virtual helper. Build with/without recording and assert identical final JS bytes.
+- [x] Run `cd crates/trusted-server-js/lib && npx vitest run test/release-composition.test.mjs`; expect missing recording behavior.
+- [x] Add an opt-in Rollup contribution hook at `moduleBuildOptions()`. Join source/package origins to the lockfile, retain installed/lifecycle/build-tool materials separately, and hash final files after Vite/esbuild. Suppress ambient `.env` loading through the reviewed release invocation; explicit production mode alone is not sufficient.
+- [x] Emit sorted version-1 inventory with source, module names/lengths/digests and origins; ambiguous contributing ownership fails. State conservative post-Rollup reachability limits.
+- [x] Run byte-preservation and ownership negatives plus the full JS test/format checks. Commit `Record release JS composition evidence`.
+
+### Task 7: Prepare and compare two independent JS builds
+
+**Retain/modify:** `scripts/release/build-js.sh`, `bootstrap.sh`, `collect-js.mjs`. **Create:** release tool `src/materials.rs`, `process.rs`, `boundary.rs`, `preparation.rs`, `javascript.rs` and private registered tests; add public process fixtures to `tests/commands.rs`.
+
+- [x] Write tests for archive/revision mismatch, stale extracted tree, prohibited install download, two bundles differing by one byte, test failure and changed source. Assert no generated output exchange between A/B. Prohibited download and missing-tool denial are actual runtime controls exercised in the full Linux fixture; that fixture also asserts each side exposes only its own private roots and shares only read-only originals and tools.
+- [x] Run `cargo test -p trusted-server-release --target "$HOST_TARGET" materials::tests`, `process::tests`, `boundary::tests`, `preparation::tests` and `javascript::tests` separately with the nonzero-selection guard; expect missing Rust orchestration.
+- [x] Preparation verifies registry/git/npm materials and required native esbuild package archives, then freshly materializes each installation. Run pinned `npm ci --offline --include=dev --no-audit --no-fund` with verified freshly prepared caches in two independent workspaces under the selected denial boundary; review/record lifecycle scripts and fail any lifecycle tool fetch. Rust migration MUST reprove this with actual full local execution and fresh fixtures; Task 8 MUST qualify the actual hosted JS boundary before Task 15 may use it officially. No restored node_modules/generated JS. Read-only original sources/object stores and authenticated archive/tool inputs remain outside private installation outputs. Timeouts/cancellation/pipe limits kill and reap descendant process groups; bounded Docker stop/remove and all temporary-profile/resource cleanup run on success and failure. Bundle under qualified network denial; compilation-time downloads fail. The passing run used an ordinary-CI Docker denial boundary; qualifying that boundary remains Task 8.
+- [x] Compare final core and all tracked integration files byte-for-byte. Retain only A plus its original inventory after equality. Construct a private typed `JsBuildCompleted` only from the actual successful two-install/test/build/control/comparison path, binding authenticated source/tools/settings, inventory raw digest and retained module bytes. Rehash at handoff; a checked inventory or JSON completion assertion cannot substitute. Unconditionally inject `TRUSTED_SERVER__RELEASE_JS_TESTS=1` into BOTH actual A/B Vitest processes, independent of inherited developer flags; run every registered test/type check and reject a zero selected suite; verify source-only trees remained intact.
+- [x] Prove a missing prepared tool cannot fetch a substitute; rerun negatives and full JS suite. Require both actual fresh full registered JS/type-check suites and all tracked final bundles before `Build and compare shared Rust release JS inputs`; fixture-only counts remain separate. Landed as `Build and compare two fresh offline JavaScript installations` plus follow-up fixes; Linux CI evidence is in the [two-build evidence report](../../../scripts/release/qualification/2026-10-15-js-two-builds.md).
+
+- [x] Port actual regressions for immutable macOS source/object regular files with `nlink == 1`; reject pre-existing hard links and prove write-through/restoration cannot bypass the boundary. Restrict signals to `same-sandbox`: own-child positive, outside same-user sibling and orchestrator denial negatives. Parent/child/grandchild install lifecycle, Cargo/compiler/proc-macro/native children MUST inherit the same OS-denied controls. `nlink == 1` scans, pre-existing hard-link rejection, run-time hard-link denial, run-time mutation detection, `same-sandbox` signal positives/negatives, grandchild socket denial and escaped-descendant socket denial pass on macOS 15 CI. A descendant that leaves its process group, even with a scrubbed environment, is identified by its per-run sandbox instance, killed and the run rejected; only processes started during the run are eligible. R-JS uses the single shared Linux JS job, so no macOS install-lifecycle path exists; Task 9 must reprove Cargo/compiler/proc-macro/native child inheritance through its actual recipes.
+- [x] Port Docker boundary regressions: use Docker's default private PID namespace (no invalid `--pid=private`), and actually execute positive/denial/recipe controls instead of testing argv alone. Keep BOTH host seccomp profiles and an empty Docker config disjoint from every container-writable root; scan before creating them and rehash BOTH before EVERY host command. Select fixed authenticated Docker client/config/Unix daemon, no TTY/plugins/context or environment overrides, and read-only anchors. Reject escaping and dangling aliases in the CONTAINER namespace. Linux container tests execute actual positive, denial and confined commands in ordinary CI. Cleanup `stop`/`rm` still rehashes every input first: a changed client or config blocks the command, while a changed seccomp profile (which those commands do not read) is recorded as a failure and cleanup proceeds.
+- [x] Bound child pipes/deadlines; timeout/cancellation/group kill MUST reap descendants and clear token/provider/injection environment. Record real errno without inventing `ETIMEDOUT`. Use host-independent tool/path/environment fixtures; no ambient shim or interpreter supplies trust.
+
+### Task 8: Qualify real platform environments before fixing recipes
+
+**Retain:** `scripts/release/qualification/results.schema.json` and reviewed seccomp baseline/license. **Create:** release tool `src/qualification.rs`, native probe dispatch in `src/boundary.rs`, private registered tests; update `release-tools.json` only with authenticated measured pins.
+
+- [ ] Write schema/preflight fixtures rejecting wrong architecture, missing SDK/tool digest, failed startup, permitted confined sockets and invented host compatibility.
+- [ ] Run `cargo test -p trusted-server-release --target "$HOST_TARGET" qualification::tests` with the nonzero-selection guard; expect unimplemented Rust qualification checks.
+- [ ] Execute throwaway full recipes on the actual proposed GitHub-hosted environments: digest-pinned GNU builder <=2.34, matching macOS 15 ARM/Intel, explicit loader floor 13.0. Record host, rustup paths, compiler/linker/SDK/native identities. Docker absence on a developer Mac is not replaced by an inferred Linux result.
+- [ ] On each recipe run an unconfined socket success control and a confined denied socket probe, then full compilation under the same qualified boundary. Linux container uses process network isolation; macOS profile MUST permit required filesystem/process/tool activity while denying sockets. Archive/tool acquisition is separate and authenticated; actual offline install lifecycle hooks execute under denial.
+- [ ] Record actual startup/link evidence and complete Fastly runtime request, not only host health. Missing Intel execution or GNU baseline stops qualification. A different platform/cohort requires reviewed spec changes, not a silent downgrade.
+- [ ] Pin authenticated observed digests/bootstrap data and add result validation; commit `Qualify controlled release build environments`.
+
+**Gate:** This task produces measured pins, not placeholder configuration. It can run only with the separately authorized disposable hosted resources. It does not publish official tags or deploy a real publisher service.
+
+Implementation sequencing: review the local validation framework and candidate boundaries first, then implement the shared Task 9 recipes and Task 10 composition captures. Complete the authenticated candidate/production adapters and shared-JS producer binding before measuring the executable closure. Hosted qualification MUST invoke those same recipes with independently authenticated candidate selections; it cannot require its own future qualification result. Production selection remains closed until the hosted evidence and measured pins are reviewed. Local framework completion does not satisfy the hosted checkboxes above.
+
+- [ ] Join observations to the reviewed catalog at the approved source: exact selection digest, tool versions/authentication methods, complete helper compiled closure and every path-dependency manifest, including `crates/trusted-server-openrtb/Cargo.toml`, tool-version files, authenticated executable digests, SDK identities and raw receipts. A code change invalidates the closure; labels/checksums cannot self-qualify. Hash the actual selected shell; do not assume `/bin/sh --version` works on dash. Unsupported pending selections keep production closed.
+- [ ] Derive container resource limits no higher than actual host capacity (a private Ubuntu runner may have two vCPUs). A Cargo jobs A=4/B=2 variation does not authorize `--cpus 4` on that host. Use actual controls and whole-product builds, not deleted prototype claims.
+
+### Task 9: Implement fixed fresh Rust recipes and native inspection
+
+Fastly host-tool selection increment (2026-10-22): the Linux x86_64 candidate
+plan explicitly selects `/usr/bin/cc` as its host Rust linker driver and
+`HOST_CC`, `/usr/bin/ar` as `HOST_AR`, and the measured Rust tree's
+`lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld` as the Wasm linker.
+The host-triple Cargo linker setting applies to host artifacts during an
+explicit-target build; no unstable host configuration or compiler wrapper is
+introduced. Host C selectors do not establish target C compilation or prove
+that the selected drivers executed. Existing GNU and Apple selections stay
+separate.
+
+The existing staged measurement helper gains a fixed private Fastly mode,
+without a new command in `main.rs`. It runs before and after Cargo in the
+existing denied sibling sandbox, excluding the writable target root. It checks
+the actual Rust host, resolves and hashes selected files inside the image,
+and independently hashes the compiler's reported assembler candidate. The
+receipt binds the helper, exact plan and build/measurement boundary identities;
+changed before/after observations fail. This changes only the opaque
+`platform.native_tools` receipt payload, not the checked composition fields or
+candidate-index companion formats. Production selection remains closed.
+
+**Retain/modify:** `scripts/release/build.sh` and approved native bootstrap. **Create:** release tool `src/recipe.rs`, `inspect.rs`, private registered recipe/native/final-Fastly tests and public-command process fixtures.
+
+- [ ] Test unknown asset/variant, reused target output, source/material mutation, unselected native library, GLIBC symbol ceiling violations, runner-only paths and Mach-O deployment-target mismatch. Add role-specific variation fixtures: missing selected B variation, normalized values misreported as varied, unsupported user variation claimed as passed and incorrect observed concurrency/umask.
+- [ ] Run `cargo test -p trusted-server-release --target "$HOST_TARGET" recipe::tests` and `inspect::tests` separately with the nonzero-selection guard; expect missing Rust recipe/inspection behavior.
+- [ ] Implement a closed interface: `build.sh --asset <fixed-id> --role A|B --source-commit <approved> --js-dir <absolute> --js-inventory <absolute> --materials <fresh-root> --output <fresh-root>`. Select package/target/features from reviewed source; JSON never supplies executable commands.
+- [ ] Implement checked A/B ambient profiles in the recipe and record them in `release-tools.json`: different external checkout roots, A umask 022/B umask 027, UTC versus a qualified alternate timezone, distinct qualified locale settings, different observed start times and A jobs 4/B jobs 2 within the qualified insensitive envelope. Vary execution user only where Task 8 proves support; otherwise record it unsupported without claiming it changed. Capture both ambient inputs and effective compiler values after sanitation/remapping; fixed internal locale/path/epoch values are normalized, not varied. No unreviewed caller overrides can choose profiles. Tests assert genuinely observed supported differences and reject dishonest/omitted records.
+- [ ] Apply Task 8's qualified OS/container denial profile in the actual production `build.sh`, not just the qualification prototype. Every production invocation MUST record a successful unconfined socket control and denied confined socket probe, then execute Cargo, compiler, proc-macro, build-script and native-tool children inside that same denied boundary. Authenticated archive/tool acquisition alone may fetch materials; offline installation lifecycle hooks and all compilation run under denial. A build-script/lifecycle download-attempt fixture MUST fail, and a missing or ineffective confinement proof rejects the output; `--frozen` is not the boundary.
+- [ ] Build explicit packages with `--release --frozen --message-format=json-render-diagnostics` after preparation. Keep `debug = 1`. Capture compiler/build-script output separately from diagnostic stderr; copy only final output after any reviewed transformations. Do not invoke Fastly source build/annotation. Never strip after evidence/signing.
+- [x] Enforce final-byte path checks inside recipe completion using its own bound host/execution roots, not only candidate fixtures. Require bounded nofollow size/hash verification, reject `/boundary/` and actual build roots, and require a remapped prefix. For GNU builds, close unbound writable `/tmp` and shared-memory storage and reject image-declared volumes. Keep macOS's temporary-path inspection unchanged. Docker execution starts only an acknowledged full container ID and confirms cleanup by that ID.
+- [x] Prove the refined GNU boundary with actual denied writes, successful bound-`TMPDIR` write/read/removal, the real timeout-cleanup regression, full fresh JS and Cargo builds, final CLI inspection and all three clean startup images. The observed Chromiumoxide `/tmp/aws/lib` lookup constant is runtime data, not evidence of build identity; its actual ELF context was measured before refining the GNU-only path policy. Passed in ordinary PR CI with identical Linux CLI canonical/reproduction bytes and all three startups; see the [Linux CLI candidate report](../../../scripts/release/qualification/2026-10-16-linux-cli-candidate.md). These ordinary-CI results do not qualify production pins or authenticated acquisition.
+- [ ] Inspect ELF/Mach-O libraries and paths, run clean Linux startup fixtures and real ARM/Intel macOS startup outside checkout. With differing fictional operator config removed by preflight, require identical sanitized effective source/tool/build inputs for every artifact and reject embedded operator sentinels/config fallback. Require complete executable equality for Fastly; preserve native nonmatching outcomes as measurements rather than adding a native repeatability shipping gate. Separately show runtime configuration can change without rebuilding.
+- [x] Before accepting each final Fastly A/B output, validate actual core-Wasm format with a pinned maintained validator and run a positive publisher-origin response/injection fixture through Viceroy using those exact final bytes. The fixture MUST NOT invoke Cargo/Fastly build or modify the wasm. Assert final hash unchanged, retain runtime outcome, and test non-wasm/component/wrong-ABI/health-only success rejection. These are required producer gates, separate from Task 8 throwaway qualification and later live deployment. Implemented and accepted for both canonical and reproduction outputs in ordinary PR CI, with a closed-origin control rejected; see the [runtime gate report](../../../scripts/release/qualification/2026-10-16-fastly-runtime-gate.md). The Viceroy digest is recorded, not yet independently pinned.
+- [ ] Run recipe/native negatives and one actual artifact per selected environment. Commit `Build and inspect canonical release executables`.
+
+Progress (2026-10-16, no Task 9 exit yet): the closed recipe, checked A/B ambient profiles, role umasks, path translation, source replacement, strict Cargo message selection and `RecipeCompleted` are implemented. Ordinary PR CI built `trusted-server-fastly.wasm` role A through `PreparedRecipe::execute` inside the Linux denial boundary and proved build-script, grandchild and procedural-macro denial; see the [confined Cargo candidate report](../../../scripts/release/qualification/2026-10-16-confined-cargo-candidate.md). That first build used unauthenticated acquisition and `cargo vendor` manifests. The producer now normalizes Git package manifests itself from the verified Git tree; later builds record eight producer-normalized and zero caller-derived manifests, and an evidence-only differential against `cargo vendor` found no differences (see the [producer-normalized manifests report](../../../scripts/release/qualification/2026-10-16-producer-normalized-manifests.md)). Acquisition remains unauthenticated. The plan now remaps the checkout, vendor, Cargo home, Rust tool (sysroot) and target roots to fixed prefixes through one `--config target.<triple>.rustflags` entry, which merges after reviewed target rustflags (environment rustflags stay rejected, a tracked `build.rustflags`, which target rustflags would supersede, is refused, as is any extensionless `.cargo/config`). The remapped roots must be pairwise disjoint, because rustc applies the last matching prefix, and the remap is bound by the plan digest. On Linux both roles see identical container paths (`/boundary/...`), so the checkout-root variation is host-only; the remap is proven on the final Fastly bytes by a scan that rejects `/boundary/` and every host build root and requires a fixed remapped prefix. Literals built from `env!("OUT_DIR")` or `env!("CARGO_MANIFEST_DIR")` are not remapped by rustc and are caught by the same scan. A pure comparison requires one role A and one role B Fastly build over identical source, lock, materials, JS handoff and tools, an honest ambient pairing and complete final-byte equality, reporting sizes, digests, the first differing offset and its Wasm section otherwise. The ordinary CI job now builds roles A (umask 022, four jobs) and B (test-only alternate profile: umask 027, two jobs, distinct checkout root and start time) from one JS handoff and compares them. Both builds were byte-identical in ordinary PR CI, and the scan found the remapped prefixes and no host or container paths; see the [canonical and reproduction equality report](../../../scripts/release/qualification/2026-10-16-fastly-canonical-reproduction-equality.md). The Linux `ts` candidate now builds through the GNU baseline, passes final-path/ELF inspection and all three clean startup images, and has a byte-identical reproduction; see the [Linux CLI candidate report](../../../scripts/release/qualification/2026-10-16-linux-cli-candidate.md). Viceroy final-byte acceptance is also proven in ordinary CI as recorded above. The two Apple `ts` candidate recipes and native startups have since passed in ordinary CI (runs 39273777887 and 39290139247, recorded below); qualified pins remain open, and production role B stays unqualified. Qualified and production selections stay rejected by the execute gate. Only the `cfg(test)` ordinary-CI candidate selection accepts the macOS boundary, which uses post-run-reaped descendant cleanup (approved 2026-10-19); that is candidate evidence, not Task 8 qualification, and production code cannot name that selection. In code, role A is `Role::Canonical` (Build A) and role B is `Role::Reproduction` (Build B); only `Role::parse` and `Role::spec_label` keep the external `A`/`B` spelling used by `--role` and the tracked `ambient_profiles` keys.
+
+### Task 10: Record selected Cargo units and native materials
+
+Fastly selected-file evidence (2026-10-22, local implementation; hosted proof
+pending): the receipt retains selected and resolved paths, SHA-256 and size for
+the host C compiler driver, host archiver, configured host assembler candidate
+and selected Wasm Rust linker. The host Rust linker selects the same measured
+C driver. SPDX projects these four raw files only as build tools, with no
+invented acquisition, download, license or executed-helper claims. The bound
+Rust installed-tree measurement remains separate.
+
+After successful denied measurement, the compiler, archiver and linker
+host-path gaps can be removed for this explicitly selected Linux profile.
+The assembler is merely compiler-configured, so its role gap remains. Expected
+candidate SPDX gaps are exactly `fastly-original-acquisition-unverified`,
+`fastly-tool-closure-unmeasured`, `native-material-coverage-incomplete`,
+`native-tool-host-path-unresolved:assembler` and
+`native-tool-host-path-unresolved:build_tools`. Missing or inconsistent required
+measurements fail rather than manufacturing evidence. Other profiles retain
+their existing gaps. This does not complete Task 10, original acquisition,
+qualification or qualified SPDX generation. The next hosted Fastly candidate
+must confirm these gaps and the unchanged real producer-receipt check before
+this increment is described as integrated.
+
+Local verification passed 216 pure tests: 70 SPDX, 68 composition, seven Fastly
+tool tests, 18 GNU measurements, 14 recipe-plan, 13 tool-selection, four
+source-replacement, 20 completion and two unchanged candidate-index golden
+tests. The explicit-selection assertion failed against the previous bare
+driver selection and passed after restoring the implementation. Filesystem
+tests independently check raw SHA-256/size, changed bytes and escaping aliases;
+parser tests reject malformed compiler queries. Strict host-target
+all-target/all-feature Clippy, all-feature documentation and formatting passed.
+Independent specification and quality reviews found no remaining blockers.
+The minimal Fastly expectations in `recipe/tests/plan.rs` were explicitly
+authorized; their Linux branch and real boundary execution remain hosted checks.
+No process-spawning or ignored tests were run locally.
+
+Remaining dependency audit (2026-10-22, `41560cfd9`): the open capture exit
+below requires conservative native/tool coverage. The specification does not
+require an exact compiler DAG or mandatory execution tracing: an inventory of
+all permitted relevant inputs, coupled with enforced access containment, can
+also establish closure. The current recipes do not establish that containment.
+The next implementation must address these dependencies rather than treating
+another successful snapshot hash as closure:
+
+| Remaining evidence                      | Dependency and current limitation                                                                                                                                                                                                                                                                                                                                    |
+| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Fastly host tools and supporting inputs | At audit head `41560cfd9`, five host-tool roles were unresolved. The increment above measures selected Linux host compiler/archiver/linkers while retaining assembler, build-tools and full-closure gaps. Other Fastly profiles keep all five role gaps. Supporting inputs still require Task 9/10 closure work; GNU CLI receipts do not cover Fastly automatically. |
+| GNU tool/input closure                  | Task 9 must constrain or account for relevant inputs beyond the inventory roots; Task 10 must inventory and join that closure. `recipe/gnu/image.rs` explicitly leaves other files available. Configured helper paths are observations, not exhaustive dependency coverage.                                                                                          |
+| Apple tool/library closure              | Task 9 must constrain or account for relevant inputs outside measured directories; Task 10 must measure and join them. `recipe/apple.rs` permits broad developer-directory access. Measuring the selected toolchain's entire `usr/lib` does not resolve outside-directory or transitive dependency inputs.                                                           |
+| Unreadable GNU privileged helpers       | Tasks 9/10 must obtain measured content or establish reviewed, enforced noncontribution/exclusion treatment for the three helpers. Acquisition evidence alone cannot close their content gap. Retain metadata-only observations and the gap until proven; do not infer hashes or expand privileges.                                                                  |
+| Original acquisition                    | Tasks 3/8 must bind authenticated Rust/tool/SDK/image distributions to the selected inputs. Installed-tree hashes do not authenticate original acquisition; pending pins in `scripts/release/release-tools.json` remain pending.                                                                                                                                     |
+| Platform qualification                  | Task 8 must qualify the actual platform, boundary and recipes against the selected closure. Passing ordinary-CI candidates does not construct the closed qualified tool or sandbox types.                                                                                                                                                                            |
+| Complete owning composition             | Task 10 must resolve the first four material-coverage rows before supplying complete composition evidence. Acquisition and production qualification are independent additional requirements; complete measured coverage alone would not open `spdx::generate_from_completed`, which deliberately rejects current candidates.                                         |
+
+Paths in the table are relative to `crates/trusted-server-release/src/` unless
+shown otherwise. Content measurement, dependency closure, authenticated original
+acquisition and qualification are distinct proofs. Acquisition and qualification
+rows describe production dependencies, not prerequisites for measuring complete
+material coverage. None is substituted for another, and this audit changes no
+completeness or qualification state.
+
+**Create:** release tool `src/composition.rs`, private `composition::tests`, `crates/trusted-server-release/tests/fixtures/composition/`.
+
+- [x] Add fixtures for host/target dual-role packages with different unit features, ambiguous source IDs, dev-only graph entries, unknown native origin, system substitution and prepared-but-discarded CLI JS.
+- [x] Run `cargo test -p trusted-server-release --target "$HOST_TARGET" --bin trusted-server-release composition::` with the nonzero-selection guard; the scoped 2026-10-21 run selected and passed 63 pure tests.
+- [x] Join explicit-target compiler/build-script messages with metadata/tree and selected material identities; preserve each observed unit's features/context. Package union features cannot stand in for effective per-unit features. Retain raw observations for audit; do not claim an exact compiler dependency DAG.
+- [ ] Capture AWS-LC/ring/SQLite native source and output archive hashes/link directives, Rust sysroot and external platform libraries. Validate generic/target-specific selection against the recipe. Distinguish embedded components, external requirements and build tools.
+- [x] Inspect final files conservatively for complete JS module strings. Record absence explicitly; Fastly and CLI do not need the same retained set. Do not force unused JS into CLI.
+
+Scoped audit and hardening (2026-10-21): the checked items above describe existing
+implemented collectors, not newly established full coverage. Named fixtures in
+`composition/tests.rs`, `graph/tests.rs`, `native/tests.rs` and
+`javascript/tests.rs` already exercise the listed cases. The dual-role feature
+cases are synthetic; retained real cross-build fixtures establish host-only
+membership, not a captured dual-role build or exact compiler dependency DAG.
+AWS-LC/ring/SQLite observations already bind verified original distributions,
+prepared source/subtrees, consuming contexts/features, static output archives
+and link directives. Rust installed-tree measurements and logical external
+runtime requirements remain distinct from original acquisition and complete
+native/tool coverage; that capture exit stays unchecked.
+
+A new negative fixture replaces a native archive between checking its magic and
+hashing its path. The previous implementation accepted a valid header from one
+inode and a digest from a different non-archive file. The collector now hashes
+the checked header and remaining bytes through the same held descriptor, with
+bounded reads, owning-attempt checks and matching final descriptor/path metadata.
+No reported path or digest becomes trusted without local measurement.
+
+GNU receipts already record incomplete closure and unqualified acquisition.
+Candidate SPDX now names both limitations as `gnu-tool-closure-unmeasured` and
+`gnu-original-acquisition-unverified`, independently of the existing
+`gnu-privileged-helper-content-unmeasured` gap. These names are absent for
+non-GNU receipts and remain sorted/unique. No serialized receipt fields, schemas,
+workflow assertions, completeness flags or production constructors changed.
+Hosted Fastly/Linux/Apple candidate validation and emitted-gap inspection are
+recorded below for `e91d75b74`. Complete coverage and qualification stay
+false; this does not complete Task 10 or touch the parallel Task 12 adapter.
+
+Local verification for this increment passed 63 composition tests with the
+nonzero-selection guard and 62 SPDX tests, strict native all-target/all-feature
+Clippy, documentation generation and formatting. The inode-swap regression and
+each new GNU gap assertion failed before its corresponding fix and passed after.
+Independent spec and quality review approved the scoped changes; plan wording
+was corrected to distinguish the implemented collector from the historical
+missing-collector test step. No child-process or ignored tests were run locally.
+
+Hosted gap follow-up (2026-10-21): [run 39565110219](https://github.com/IABTechLab/trusted-server/actions/runs/39565110219)
+has head `7ab7f96e71c896b214e6d09e760b7da7ea22d1b4`. Completed candidate logs
+for Fastly [119105403584](https://github.com/IABTechLab/trusted-server/actions/runs/39565110219/job/119105403584),
+Linux CLI [119105404005](https://github.com/IABTechLab/trusted-server/actions/runs/39565110219/job/119105404005)
+and Apple ARM [119111703005](https://github.com/IABTechLab/trusted-server/actions/runs/39565110219/job/119111703005)
+record built PR merge source `f5bac2786585169cf597139069d05dd47513d9f1` and
+`material_native_coverage_complete: false`. Linux alone reports both
+`gnu-tool-closure-unmeasured` and `gnu-original-acquisition-unverified`, alongside
+its existing privileged-helper and incomplete-native-material gaps. Fastly and
+ARM report neither new GNU gap; their existing host-tool/Apple exclusions remain.
+At this evidence check Intel [119111702865](https://github.com/IABTechLab/trusted-server/actions/runs/39565110219/job/119111702865)
+was still running its denial fixture. Its final candidate gap list and the overall
+run result remain pending; no all-four confirmation is inferred.
+
+Intel follow-up (2026-10-21): successful [run 39577910126](https://github.com/IABTechLab/trusted-server/actions/runs/39577910126),
+head `d774ee47c274257fa0a088280f7df37ed530020c` (including `04be89638`),
+completed Intel candidate [119154065062](https://github.com/IABTechLab/trusted-server/actions/runs/39577910126/job/119154065062).
+Its built PR merge source is `fb42d8268af93c011959d032c81bfa581306c7c2`.
+The final candidate SPDX reports only `apple-coverage-excluded:toolchain_libraries`,
+`apple-tool-closure-unmeasured` and `native-material-coverage-incomplete`;
+neither GNU closure/acquisition gap appears, and
+`material_native_coverage_complete` and `release_qualification` remain false.
+Together with the three completed logs above, this closes the four-platform
+gap-placement follow-up across the recorded runs, not complete native coverage.
+
+Progress (2026-10-19, partial Task 10 only): candidate recipes retain an unfiltered Cargo metadata identity catalog and run an explicit-target tree query under the same denied boundary and selected tool/environment/source replacements as the build. Completion joins actual compiler messages to exact metadata package/target identities, preserves observed host/target unit features and build-script outputs, and requires the selected final executable to appear exactly once. Raw metadata/tree and normalized observations, including query plan digests, are retained privately and rehashed at handoff; candidate measurements keep `material_native_coverage_complete: false`. Ordinary CI at `456d15005` passed Fastly A/B equality and final-byte Viceroy acceptance with 255 observed packages, 377 units and 39 build-script executions per side, and Linux CLI capture/startup with 486 packages, 649 units and 62 build-script executions. Those runs precede the new component receipts below; they do not validate their full-product integration (later runs 39273777887, 39290139247 and 39417433680 do, as an ordinary-CI candidate). Apple full-product acceptance has since passed in ordinary CI (runs 39273777887 and 39290139247, recorded under Task 9 and below).
+
+The candidate completion path now also reconciles normal/build metadata and tree edges against observed compiler membership, rejects ambiguous source joins and dev-only paths, and keeps potential graph membership separate from actual compiled units. It does not claim an exact compiler unit dependency DAG. Verified package origins join opaque compiled IDs to approved workspace manifests or original registry/Git materials. Reviewed AWS-LC, ring and bundled SQLite collectors bind original source, prepared source trees, static output archives, observed features and link directives; unknown native contributors and system substitutions fail. Final-byte JS checks classify complete retained modules conservatively: Fastly requires every prepared module, while CLI absence remains build-material evidence. Bound source checks cover every tracked input before/after execution and immediately before sealing. Native working inputs are rehashed at sealing; retained immutable receipt bytes are verified before cleanup and at subsequent handoffs. No retained-input archive is implied. Tool/sysroot/SDK/external-requirement coverage, all-cohort real component validation and qualification remain open, so these components do not complete Task 10.
+
+The verified vendoring path records a read-only package index on `PreparedCargoMaterials`, keyed by vendor directory. Registry entries retain the locked source, original archive SHA-256 and prepared manifest SHA-256; Git entries additionally retain the complete selector/revision, repository/package trees, package path, committed manifest blob/SHA-256 and any producer-normalized manifest SHA-256. Entries are constructed only after package writing succeeds. The origin join selects only observed packages from this larger prepared-material index; preparation alone never establishes contributor membership.
+
+A read-only full-workspace graph check caught and fixed a real input-size mismatch: the CLI's `--no-dedupe` tree contains 163,493 occurrences, exceeding the separate 65,536 compiler-message limit. Trees now have their own 1,048,576-occurrence bound within the unchanged 16 MiB byte bound. An indexed name/version lookup preserves conservative ambiguity rejection. The actual Fastly and Linux CLI potential trees parse successfully; this parser check uses synthetic selected-root membership and does not establish actual full-product compiled membership for the new receipts.
+
+Candidate platform receipts additionally retain the measured installed Rust tree digest and explicit Cargo/compiler/selected target standard-library roles. Typed Apple exports retain the measured clang, archiver, linker and SDK-settings identities and versions, with explicit exclusions for SDK headers, stubs, frameworks, helper tools, libLTO and compiler resources (narrowed for measured selections; see the 2026-10-21 Apple toolchain note below). Accepted ELF/Mach-O/Wasm facts supply artifact-bound observed runtime requirements; these are logical dependencies, not installed runtime-library hashes or provenance. The collector independently checks artifact, target and Apple SDK agreement, compares the retained Rust digest with its bound identity, and rechecks inputs before retaining evidence. Linux host-PATH native tools remain unresolved, original acquisition is not inferred, and coverage remains incomplete. The component/integration verification batch passes 252 focused tests, native and Linux cross-target Clippy, formatting and documentation generation; independent review passed. All four candidate cohorts have since executed these receipts in ordinary CI (runs 39273777887 and 39290139247, recorded below); qualification remains pending.
+
+Ordinary CI at `3fef2c5f0` subsequently passed the complete Fastly composition/platform receipt path, A/B byte equality and Viceroy acceptance. Its Linux CLI candidate stopped at a generic native-feature rejection. Investigation found a concrete mismatch with the locked AWS sources and resolved CLI feature graph: `all-bindings` is optional, and the selected `prebuilt-nasm` feature cannot activate prebuilt objects on the selected Linux/macOS platforms. The narrowly corrected policy accepts these reviewed profiles while retaining original-source, archive, environment and static-link checks. New regressions cover the profiles and bounded package/context/feature diagnostics. Full native candidate reruns remain required; the original generic error did not identify the exact failing unit.
+
+The corrected receipt path subsequently passed all four ordinary-CI candidate recipes in [run 39273777887](https://github.com/IABTechLab/trusted-server/actions/runs/39273777887), over merge source `cace4c508159bc7502d359e0cce49fef47d61f8b`. Fastly, Linux CLI and Apple ARM completed byte-identical A/B builds and their required runtime checks. Intel completed its mandatory canonical build, inspections and native startup; its optional reproduction exhausted the confined 25-minute wall budget while compiling and was recorded as a measurement-only build failure. No Intel equality result is inferred. These are candidate integration results for that source, not authenticated acquisition, complete composition coverage or qualification of subsequent changes.
+
+Typed owning access now rechecks retained observations and requires sealed component receipts before exposing observed units, verified package origins and potential graph facts. The typed view borrows its owner and exact normalized-receipt digest; it changes no raw receipt bytes and grants no completeness capability. Its real recipe checks run after source/target cleanup. Selected SDK-content enforcement now stages a separately owned copy with independent regular files, preserves safe internal aliases and modes, binds a structured-tree digest into Apple identity, and selects that copy through explicit C/Rust sysroot arguments, immutable boundary roots, remaps and final-byte path rejection. The [SDK input audit and smoke](../../../scripts/release/qualification/2026-10-19-apple-sdk-inputs.md) records the local installed-SDK pass and subsequent hosted ARM/Intel candidate acceptance. Compiler/helper/sysroot and original-acquisition closure remain separate work.
+
+Hosted follow-up (2026-10-20): [run 39290139247](https://github.com/IABTechLab/trusted-server/actions/runs/39290139247) finalized success for head `df4a6e5c30fe8c93df68748ead77a3bc559d16b2`, building merge source `506d8ead69757556e1bd8ed29b578d0257d05169`. All four actual candidate fixtures accepted sealed typed composition, verified Rust-package SPDX projection and retained candidate exports that survive build-root cleanup. Fastly, Linux CLI and Apple ARM reproduced identically; Fastly also passed final-byte Viceroy acceptance. Intel canonical inspection/startup/export passed, while optional reproduction failed on its time bound, so no Intel equality evidence exists. Observed package/unit/build-script counts were Fastly `255/377/39`, Linux and ARM `486/649/62`, and Intel canonical `487/650/62`. Both Apple recipes used the detached SDK. This closes the previously pending hosted integration checks for these specific increments; full native/tool closure, complete SPDX generation, authenticated acquisition and release qualification remain open. The receipts retain both completeness and qualification as false.
+
+Apple and Intel candidate details (2026-10-20, verified from job logs; see the [Apple CLI candidates report](../../../scripts/release/qualification/2026-10-20-apple-cli-candidates.md)): in both runs the ARM recipe built byte-identical canonical and reproduction executables and every canonical Apple build, inspection and native startup passed. The Intel optional reproduction failed in both runs, for different recorded reasons: run 39273777887 exceeded the confined build wall-clock deadline while compiling, and run 39290139247 recorded "source preparation cancelled or timed out". The later runs 39417433680 (`bfab8ef20`) and 39420011152 (`1719cf15f`) recorded Intel reproduction `identical`, with the Intel candidate test taking 3,552 and 3,305 seconds against its 60-minute test deadline. Because the timing margin is thin and no code change addressed it, this is a measurement, not a resolved Intel equality gate; native B stays optional. All of this is ordinary-CI candidate evidence with `release_qualification: false`. The macOS boundary reports `descendant_cleanup: "post-run-reaped"`, which only the `cfg(test)` ordinary-CI selection accepts.
+
+The subsequent GNU increment replaces ambient compiler selection for the Linux CLI candidate with source-owned `/usr/bin/gcc` and `/usr/bin/ar` selectors for both host and target C builds, an explicit Rust linker driver, and exact AWS-LC cc-backend controls that prevent fallback to CMake. A staged Rust helper runs inside the same denied Docker boundary before and after Cargo. It records selected/configured compiler, assembler, archiver, linker and compiler-resource identities plus a bounded conservative installed-image file inventory, including headers/libraries and reviewed loader/alternatives configuration. Image hardlinks use a separate held-descriptor policy; strict owned-tree and host-document policies remain unchanged. The receipt binds the helper, boundary, profile and invocation, rejects drift, and remains retained through composition sealing. Installed-file coverage does not establish which helpers executed, authenticated acquisition, or complete native closure. Those flags remain false, and the actual GNU helper/profile integration has since run in hosted CI, passing at `bfab8ef20` after two fixes (see the GNU snapshot and measurement notes below).
+
+GNU snapshot of reviewed root-only helpers (2026-10-20, `e5a780d5c`): the hosted Linux CLI candidate at `7be86d935` failed with "cannot open image file: Permission denied" (job 118460869596, run 39371724671), because the unprivileged helper cannot open three root-only privileged helpers in the UBI 9 builder. The snapshot now accepts a permission-denied file only at the exact reviewed paths `/usr/libexec/utempter/utempter` (setgid), `/usr/sbin/unix_update` and `/usr/sbin/userhelper` (setuid), owned by root with no group/other write and no other-read bit and unchanged since first inspection. Each is recorded by mode, owner and size rather than content and listed as `content_unmeasured_files`, which must be a sorted subset of the reviewed paths. Every other unreadable file, including an execute-only compiler helper, still fails closed, and selected build tools must stay readable and hashed. This records a coverage gap; it measures no helper content and qualifies nothing.
+
+GNU measurement in a sibling sandbox (2026-10-20, `bfab8ef20`): the next hosted run, at `e5a780d5c`, failed because the post-build image measurement ran in the build boundary, whose unchanged pre-run writable scan rejects Cargo hard links inside the target directory ("has 2 hard links; a link outside the root would bypass write denial", job 118494982595, run 39382624785). Both GNU measurements now run in a sibling Linux container boundary derived from the build boundary with the same image, settings, read-only and tool roots and every writable root except the target directory. The sibling gets a fresh fingerprint, records the boundary it derived from and proves denial with the staged probe. Cargo queries and the build keep the build boundary and proof; receipts record both fingerprints. Ordinary-CI run 39417433680 (head `bfab8ef20`) passed the Linux CLI candidate (job 118609761876): byte-identical reproduction and three clean startups, recorded in the [GNU follow-up report](../../../scripts/release/qualification/2026-10-20-linux-cli-gnu-follow-up.md). This is candidate evidence only.
+
+Apple toolchain identity (2026-10-21, uncommitted, Tasks 9/10 candidate only): the ordinary-CI Apple selection now also measures, in place below the selected `clang`'s toolchain `usr` directory, a structured-tree digest of the helper directory beside `clang` (files, modes and relative alias targets), the single versioned clang resource directory (`lib/clang/<version>`; any second real version directory, foreign alias or other entry fails closed) and the SHA-256 of `lib/libLTO.dylib` (missing, aliased or non-regular fails closed). The trees are bounded by entry, file and total byte limits and reject special files and absolute, dangling or escaping aliases. Vendor hard links are accepted because the tree is not owned; every file is rehashed instead. Nothing is copied, executed or resolved through `xcrun`. The receipt is part of the Apple identity record and therefore the plan digest, and it is rechecked at every Apple verification point and at evidence sealing. Candidate exports drop the `tool_helpers`, `liblto` and `clang_resource_directory` exclusions only when the receipt is present, and add a `toolchain_libraries` exclusion for other toolchain libraries such as `libtapi`. The `apple-tool-closure-unmeasured` gap stays: which helpers clang actually ran is unmeasured, and the developer directory remains a broad read/execute system root. The platform SPDX projection adds `libLTO` and the two trees as components. Pure fictional fixtures cover this locally; the real Xcode layout is exercised only by the ordinary-CI macOS jobs, which have not yet run it. It grants no qualification.
+
+Apple measurement follow-up (2026-10-21): the earlier uncommitted/unexecuted
+status above is superseded by committed `7d045ac83` and the successful ARM/Intel
+candidate jobs in run 39540057202. Their candidate entries retain
+`apple-coverage-excluded:toolchain_libraries` and `apple-tool-closure-unmeasured`;
+passing the measurement path does not establish complete closure or acquisition
+authenticity. See the [candidate index report](../../../scripts/release/qualification/2026-10-21-candidate-release-index.md).
+
+Timing follow-up (2026-10-21): the Intel optional reproduction timeout recorded
+in run 39273777887 recurred in run 39540057202, after historical successful
+Intel comparisons. The ordinary-CI selection now supplies a 45-minute confined
+Cargo wall through `ToolSelection::build_wall` (`b4c8e0c0f`), rather than the fixed
+25 minutes. See the [schedule/cache report](../../../scripts/release/qualification/2026-10-21-native-reproduction-schedule.md).
+The running speedup CI is not yet a completed acceptance result; neither deferral
+nor the changed budget establishes repeatability, complete coverage or qualification.
+
+GNU receipt follow-up (2026-10-21): capture now validates the exact nine selected
+file roles and eight compiler-query identities, not only their counts. Selected
+drivers match the fixed profile; configured cc1, collect2, assembler, linker and
+compiler-runtime files join their recorded query paths. The raw sysroot response
+is rechecked against the supported image-root forms. Bare assembler/linker names
+must match the fixed image candidate's resolved path, digest and size; `/bin`
+aliases of the same file and explicit alternative image-helper paths remain
+supported. These are installed/configured observations, not execution tracing or
+general PATH-resolution proof; tools-root helpers remain outside this profile.
+
+The audit found existing AWS-LC/ring/SQLite collection already retains original
+registry archive identities, prepared source/subtree hashes, static-link
+directives and rehashed output archives. Rust tool trees, measured Apple tools/
+SDK inputs and GNU installed/configured files already project into SPDX. No new
+native source fact, external-library identity or authenticated acquisition is
+invented by strengthening the receipt checks. Native material coverage stays
+incomplete. The existing Fastly unresolved-host-tool, GNU closure/acquisition/
+privileged-helper-content and Apple closure/toolchain-library gaps remain open;
+complete sysroot/tool execution closure and external platform inputs still need
+additional owner measurements and qualification. Hosted acceptance of this
+guard is recorded below; none of these changes completes Task 10.
+
+Scoped verification: nonzero guards selected 18 pure GNU tests, 67 pure SPDX
+tests and two unchanged producer golden checks; all passed. Strict host clippy,
+documentation and owned-file formatting pass. Independent spec and quality
+reviews approve this increment without blockers, including preservation of
+explicit GCC paths and same-identity aliases. No child-process or ignored tests
+were executed locally. The earlier Task 14 run is not evidence for this guard.
+
+Hosted guard acceptance (2026-10-21): [Run Tests 39616416485](https://github.com/IABTechLab/trusted-server/actions/runs/39616416485)
+and [Run Format 39616416604](https://github.com/IABTechLab/trusted-server/actions/runs/39616416604)
+succeeded at head `e91d75b7447c9611d6e1ccb5dc7c2dce07377ff6`. Candidate
+logs record built PR merge source `624cef618ffadbfad72c41c9072d8c5f5c1f4f64`.
+Actual SPDX gaps were inspected for all four assets:
+
+- Fastly [119278571153](https://github.com/IABTechLab/trusted-server/actions/runs/39616416485/job/119278571153):
+  `native-material-coverage-incomplete` and `native-tool-host-path-unresolved:`
+  for `archiver`, `assembler`, `build_tools`, `compiler` and `linker`.
+  Canonical and reproduction SPDX report the same gaps and identical document
+  bytes; document equality remains a measurement.
+- Linux CLI [119278571303](https://github.com/IABTechLab/trusted-server/actions/runs/39616416485/job/119278571303):
+  `gnu-original-acquisition-unverified`, `gnu-privileged-helper-content-unmeasured`,
+  `gnu-tool-closure-unmeasured` and `native-material-coverage-incomplete`.
+- Apple ARM [119287733613](https://github.com/IABTechLab/trusted-server/actions/runs/39616416485/job/119287733613)
+  and Intel [119287733492](https://github.com/IABTechLab/trusted-server/actions/runs/39616416485/job/119287733492):
+  `apple-coverage-excluded:toolchain_libraries`, `apple-tool-closure-unmeasured`
+  and `native-material-coverage-incomplete` on each asset.
+
+Every candidate keeps `material_native_coverage_complete: false` and SPDX
+`release_qualification: false`; optional native reproductions are absent, not
+invented successes. No unexpected gap difference was found. This closes hosted
+acceptance of `e91d75b74`, not Task 10/11 completeness. That run predates
+`5a98c18ad`'s strict real-receipt parser; parser-inclusive acceptance is recorded
+in the 2026-10-22 note below.
+
+Cargo script presence hardening (2026-10-21): graph sealing now requires every
+observed custom-build package to have execution evidence, and the execution
+package/context set to match the observed non-custom consumers of those
+packages. A compiled host script cannot substitute for its target execution;
+dual-role packages need evidence in both consuming contexts. Multiple executions
+within one context remain permitted, and effective unit features remain separate.
+This is package/context presence consistency, not proof that every feature-specific
+execution within a context was retained or an exact compiler dependency DAG.
+No serialized receipt field, SPDX rendering, completeness flag or collector
+fixture changes. Coverage remains incomplete.
+
+Two negative fixtures were observed failing for their intended reasons before
+the production checks: missing execution evidence and a host execution with only
+a target consumer. A dual-role regression also covers a missing second context,
+matching host/target executions and multiple executions in one context. Scoped
+nonzero guards passed 66 composition tests, 67 SPDX tests, 18 GNU tests, 46
+collection tests and two unchanged producer golden checks. The collection
+transfer module was excluded because it includes subprocess/network fixtures;
+one other ignored collection test was not executed. Strict host clippy,
+documentation and owned-file formatting passed. Independent review found no
+blocker and confirmed the package/context limitation stated above. Real-build
+acceptance of this graph guard is recorded in the 2026-10-22 note below.
+
+Selected Apple library measurement (2026-10-21): the in-place toolchain receipt
+now records the SHA-256 of the exact `usr/lib/libtapi.dylib` when present,
+alongside the existing `libLTO`, helper and resource measurements. A missing
+leaf is recorded explicitly as `libtapi_sha256: null`; unreadable files, aliases,
+special files and exhausted bounds are errors. Present files use the existing
+no-follow descriptor/stamp checks, a 128 MiB limit and the attempt's cancellation
+and deadline. Remeasurement rejects content changes, appearance and disappearance.
+The new field is inside the collector's opaque `platform.apple.toolchain`
+subtree; all strictly checked receipt fields remain unchanged.
+
+This measures one selected toolchain library, not its execution or loading.
+Other toolchain libraries, runtime inputs, original acquisition and the full
+tool closure remain unresolved. The existing `toolchain_libraries` exclusion,
+`apple-tool-closure-unmeasured` gap and incomplete coverage flags are retained.
+Hosted acceptance of this additional measurement is recorded below for
+`39639053390`; run `39637275502` contains the preceding graph checks only.
+
+Verification of this increment selected and passed 66 composition, 68 SPDX,
+19 Apple toolchain, 18 GNU, 46 collection and two unchanged producer golden
+tests with nonzero guards. The collection transfer module and ignored tests
+were excluded under the local execution restrictions. Strict host clippy,
+documentation and owned-file formatting passed. Independent spec and code
+quality reviews approved the increment. Review also strengthened the absence
+check: a missing or aliased parent cannot be recorded as a missing library.
+The existing vendor-tree intermediate-directory swap limitation still applies;
+no stronger isolation guarantee is claimed.
+
+Hosted receipt acceptance (verified 2026-10-22): [Run Tests 39637275502](https://github.com/IABTechLab/trusted-server/actions/runs/39637275502)
+succeeded at head `416b43f43c5d7e69c08bca32753240abded8523c`, building PR
+merge source `17251a872e295e4f13047efd14b10077944620fb`. [Run Tests 39639053390](https://github.com/IABTechLab/trusted-server/actions/runs/39639053390)
+succeeded at head `b6f5d92e4bc4483f81b1e0d8a376e7d67c9da8fd`, building PR
+merge source `c7b1a9cb04ab8abf8e4fa2d5198c4c1337a96b1f`. Format,
+Integration Tests and CodeQL also succeeded at both heads. All four actual
+candidate fixtures selected and passed one test each in both runs. Each invokes
+the unconditional real-receipt check in `check_owned_export_after_cleanup`;
+none of the eight job logs contains the receipt-check panic. This establishes
+producer/collector receipt acceptance for these builds, not complete coverage.
+
+The full job logs were inspected for exact candidate SPDX gap lists:
+
+- Fastly: [416 job 119351108924](https://github.com/IABTechLab/trusted-server/actions/runs/39637275502/job/119351108924)
+  and [b6f job 119357467783](https://github.com/IABTechLab/trusted-server/actions/runs/39639053390/job/119357467783).
+  Both roles report `native-material-coverage-incomplete` and
+  `native-tool-host-path-unresolved:` for `archiver`, `assembler`, `build_tools`,
+  `compiler` and `linker`.
+- Linux CLI: [416 job 119351108938](https://github.com/IABTechLab/trusted-server/actions/runs/39637275502/job/119351108938)
+  and [b6f job 119357467960](https://github.com/IABTechLab/trusted-server/actions/runs/39639053390/job/119357467960).
+  Exactly `gnu-original-acquisition-unverified`,
+  `gnu-privileged-helper-content-unmeasured`, `gnu-tool-closure-unmeasured`
+  and `native-material-coverage-incomplete`.
+- Apple ARM: [416 job 119360930044](https://github.com/IABTechLab/trusted-server/actions/runs/39637275502/job/119360930044)
+  and [b6f job 119367262345](https://github.com/IABTechLab/trusted-server/actions/runs/39639053390/job/119367262345).
+  Apple Intel: [416 job 119360930038](https://github.com/IABTechLab/trusted-server/actions/runs/39637275502/job/119360930038)
+  and [b6f job 119367262261](https://github.com/IABTechLab/trusted-server/actions/runs/39639053390/job/119367262261).
+  Each reports exactly `apple-coverage-excluded:toolchain_libraries`,
+  `apple-tool-closure-unmeasured` and `native-material-coverage-incomplete`.
+
+No GNU gaps leak onto Fastly or Apple. Every candidate retains
+`material_native_coverage_complete: false` and SPDX `release_qualification: false`.
+Fastly canonical/reproduction SPDX documents are byte-identical in each run;
+SPDX equality remains measurement-only. Native reproductions are deferred and
+their SPDX comparisons remain null. Both Apple jobs in the `b6f` run record a
+non-null `apple_developer_tools.toolchain.libtapi_sha256`, confirming the new
+measurement ran on both architectures. The unqualified four-asset candidate
+index job also succeeded in the `b6f` run. No collector edits or field-mismatch
+workaround was needed. Tasks 10/11 remain partial.
+
+Selected Apple library-directory inventory (2026-10-22): extend the in-place
+toolchain receipt to the entire selected `usr/lib` directory. A read-only
+metadata inventory of local Xcode 16.4 (the version recorded by both hosted
+Apple candidates) found 6,205 entries, 2,601,020,072 regular-file bytes, a largest
+file of 354,743,440 bytes and 41 contained relative aliases. This establishes
+local sizing only, not hosted performance or qualification.
+
+The existing vendor-tree collector measures every file, directory, mode and
+alias target under that root with its own `toolchain-library-directory` digest
+domain. Limits are 512 MiB per file, 4 GiB per tree and 20,000 entries. Reads
+retain the existing cancellation/deadline, no-follow, stable-descriptor and
+alias-containment checks. The receipt's new `library_tree` stays inside opaque
+`platform.apple.toolchain`; strictly checked collector fields are unchanged.
+Every verification rehashes the tree: prior metadata equality cannot substitute
+for fresh content measurement. No digest cache or extra attempt time is added.
+
+The `toolchain_libraries` exclusion now denotes unresolved dependency/loading
+coverage and libraries outside the measured selected directories. It does not
+mean the selected `usr/lib` files are unhashed. Host runtime, dynamic loading,
+original acquisition and full closure remain unresolved, so no completeness
+or qualification flag changes. This inventory deliberately overlaps the
+separate LTO/TAPI/resource identities and proves neither which files the tools
+read nor which bytes contributed to the final artifact. Its extra hashing cost
+must be accepted by a later hosted run under the existing attempt budgets;
+the earlier green runs do not validate this increment.
+
+Local verification passed 66 composition, 68 SPDX, 25 Apple toolchain, 18 GNU,
+46 collection and two unchanged producer golden tests, each with a nonzero
+selection guard. The collection transfer module and ignored tests were excluded
+under the local execution restrictions. The added-library regression first
+failed against the previous collector and then passed with the full inventory.
+Fixtures also cover nested entries, edits/removals, alias targets, unsafe files,
+limits, cancellation, expiry and structured SPDX rendering. Strict host clippy,
+documentation and owned-file formatting passed. Spec review corrected two stale
+comments so exclusions describe unresolved coverage rather than claiming the
+newly inventoried files are unhashed. Independent code quality review found no
+blocking findings and confirmed that hosted read-cost acceptance is still needed.
+
+Main-merge candidate compatibility (2026-10-22): main `43a25619a` upgrades Rust
+to 1.98.1, Node to 24.20.0, Viceroy to 0.21.0 and `libsqlite3-sys` to 0.38.2.
+Run `39716862538` failed before the real candidates could complete: three
+preparation jobs rejected the old Node pin, nine npm-observer tests rejected
+the old Node/npm pins, and both native release-tool suites detected the stale
+Viceroy pin. These failures provide no acceptance of the library-directory
+inventory above.
+
+Align the pending compiled/JSON tool and recipe pins with main, including npm
+11.19.0 observed in the source-selected Node distribution. Original acquisition,
+digests and qualification remain pending/null. The JS execution/settings checks,
+fixture preparation and paired producer/collector Viceroy checks remain exact
+version checks; no range, bypass or fallback is introduced. The user authorized
+the minimal collector version check and fixture update. Receipt fields, nullable
+members and enum tags are unchanged, and candidate index goldens are untouched.
+
+Review of the new SQLite wrapper confirms the bundled `sqlite3` archive and
+source subtree remain the same selection, with default feature
+`min_sqlite_version_3_34_1` replacing `min_sqlite_version_3_14_0`. Update only its
+reviewed wrapper version/features; AWS-LC 0.42.0 and ring 0.17.14 stay fixed.
+The native implementation version and native license are not inferred from the
+wrapper version. Source-lock and source-tool-pin regressions first fail against
+the stale rules, then guard the aligned cohort.
+
+Source review of npm 11.19.0 found the intercepted lifecycle entry points and
+spawn adapter byte-identical to npm 11.6.2; the new script-policy defaults leave
+the current reviewed hooks enabled. Do not add an `--allow-scripts` override.
+Actual lifecycle, runtime, native-source and receipt acceptance require a new
+hosted run; no local process-spawning tests are authorized by this migration.
+
+Migration verification: 370 selected pure tests pass, including unchanged
+candidate-index goldens and rejection of the previous Viceroy version. Strict
+host-target clippy, documentation, read-only workspace rustfmt, changed-file
+Prettier, JavaScript syntax and diff checks pass. Independent specification/security
+and code-quality reviews found no blocking findings. Hosted validation remains
+pending for the actual npm lifecycle, four candidate builds and their receipts.
+
+Git dependency compatibility (2026-10-22): run `39720199554` at `0bf452370`
+passes ordinary/native suites and the Linux JS handoff, but candidate jobs
+`119631656292`, `119631656310` and `119635856319` reject the Git-sourced `esi`
+dependency introduced by main. Its locked commit contains package-local LICENSE
+and README.md links to regular files in the repository parent. Both the original
+Git closure parser and the package vendorer previously rejected mode `120000`.
+
+Retain canonical link blobs as inert authenticated objects in the complete
+locked commit closure. During package vendoring, resolve only direct relative
+file links through the same repository tree, rehashing every traversed object
+and the target under existing budgets. Copy target bytes and executable mode
+into regular files through the existing checksum writer; never create or follow
+filesystem links. Reject absolute/escaping targets, malformed or oversize text,
+missing targets, directory or chained aliases, aliased manifests and submodules.
+Reject parent traversal after descending into a target component rather than
+collapsing paths with potentially different link semantics. This changes no
+receipt fields, origin identities, acquisition authority or qualification claims.
+
+The positive pure vendoring regression first fails at the original unsupported
+mode check, then passes with authenticated parent-file bytes. Pure regressions
+also cover unsafe targets, manifest aliases, target executable mode and object
+tampering. Full original-object collection and actual four-candidate builds
+remain hosted checks; local process-spawning tests are not run.
+
+Local verification selects and passes 186 pure tests: 42 vendoring, 67
+composition, 68 SPDX, two candidate-index goldens, four authentication and three
+entropy-reader tests. Strict host-target clippy, documentation, read-only
+workspace formatting and changed-document Prettier pass. Independent
+specification/security and code-quality reviews report no blocking findings.
+
+Hosted follow-up: run `39724280588` at `0c67be66e` exposes an outdated
+whole-tree rejection fixture in macOS job `119644526058`: it still labels mode
+`120000` as unsupported. Keep its unrelated-subtree rejection assertion and
+replace that entry with a still-forbidden `160000` submodule. The separate new
+collection fixture requires retention of authenticated inert link blobs. This
+process-spawning collection regression remains a hosted check.
+
+Security verification: CodeQL run `39723446088` scans merge `eca28ba934`,
+containing entropy correction `d4408d2e0`. All analyses pass and alerts 224–230
+are fixed, with no relocated entropy warning or open release-tool finding.
+Existing core/adapter/JS baseline findings are separate. This is security
+acceptance of the entropy correction, not candidate-build qualification.
+
+Cargo 1.98 compatibility (2026-10-22): run `39725113066` rejects canonical
+Linux (`119647122855`) and Fastly (`119647122894`) candidates solely because a
+`registry` directory exists in their private Cargo homes. Source review of
+Cargo's 1.98 registry constructor and source-replacement loader shows that the
+original registry is initialized before replacement with the vendor source.
+Its backup-exclusion helper may create an empty directory or the exact
+177-byte `CACHEDIR.TAG`, without fetching registry data. Directory presence
+alone therefore cannot establish a source bypass.
+
+The recipe now admits only an absent registry, a direct empty directory or a
+direct directory holding only that exact tag. A held directory and matching
+before/after inode and metadata checks bind inspection; the existing bounded
+no-follow hasher requires a stable, single-link regular tag with the exact size
+and SHA-256. Registry `index`, `cache`, `src`, unexpected children, aliases,
+changed tags and all Git state remain rejected. No state is deleted or repaired;
+offline execution, source replacement and verified package-origin joins remain
+unchanged. The tag's upstream URL is runtime compatibility bytes, with a narrowly
+reviewed domain suppression; it is never fetched.
+
+The empty-directory regression first fails at the former presence-only gate,
+then passes. Verification selects 177 pure tests, including eight dedicated
+bookkeeping cases and 13 recipe tool tests, with nonzero-selection guards.
+Strict host-target clippy, documentation and read-only workspace formatting
+pass. Independent specification/security and code-quality reviews find no
+blockers. Actual candidate builds and their receipts still require hosted
+validation after this correction.
+
+Hosted native acceptance (2026-10-22): run `39729655151` at `5d194d00f`
+builds merge `a8c33bcc9990a4eb6520a8afd0f7dd2641c25111`. Linux CLI job
+`119661528635`, Apple ARM job `119667144194` and Apple Intel job `119667144562`
+all pass their actual producer fixtures, retaining composition receipts with
+native completeness and release qualification false. Linux/ARM record
+495 packages, 659 units and 61 build-script executions; Intel records
+496 packages, 660 units and 61 executions. The real-receipt assertions pass.
+
+Both Apple legs measure 6,205 selected toolchain library entries and
+2,601,020,072 regular bytes, with digest
+`da141ea11bf363ffcf61e620ccf28cf72224a7439d3e08e5cc945df01eb2333e`.
+Their fixtures complete in 1,277.15 and 2,279.81 seconds respectively. This
+accepts the inventory increment under the existing cohort budgets; no separate
+inventory timing is logged, so its isolated cost is not established. Both
+retain exactly `apple-coverage-excluded:toolchain_libraries`,
+`apple-tool-closure-unmeasured` and `native-material-coverage-incomplete`.
+Linux retains exactly `gnu-original-acquisition-unverified`,
+`gnu-privileged-helper-content-unmeasured`, `gnu-tool-closure-unmeasured` and
+`native-material-coverage-incomplete`. These results do not complete Tasks 10/11.
+
+The same run's only failing job is Fastly `119661528580`: canonical Wasm
+inspection rejects `fastly_async_io`. The Cargo bookkeeping barrier is passed;
+no Fastly runtime, reproduction, SPDX or four-asset index acceptance is inferred.
+Review of locked `fastly-sys` 0.13.1 and project async request call paths binds
+this module to `select`/`is_ready`; pinned Viceroy 0.21.0 registers it. Admit only
+that exact module. Other unreviewed SDK modules and component-style imports stay
+rejected, along with non-function imports, invalid Wasm, wrong entry ABI and
+missing debug information. A pure two-function regression first reproduces the
+failure and passes after the policy update. Actual Fastly acceptance remains
+a hosted check after the fix.
+
+The scoped ABI verification passes 223 pure tests, including all 68 artifact
+inspection tests, plus strict host-target clippy, documentation, read-only
+workspace formatting and plan Prettier. Independent specification/security and
+code-quality reviews find no blockers. No runtime gate, receipt field,
+qualification flag or companion golden changes.
+
+### Task 11: Generate complete artifact-specific SPDX
+
+JavaScript declaration guard (2026-10-22): projected JavaScript facts contain no
+measured declared-license evidence. Reject any supplied declaration at the
+JavaScript origin boundary, matching the existing native-origin restriction,
+instead of allowing a renderer input to manufacture a declaration. A pure
+red/green regression injects MIT into all six supported original/role pairs;
+the existing valid-document byte digest remains unchanged. Unknown JS licenses
+continue to render as `NOASSERTION`; no new license measurement, receipt field,
+companion format or completeness claim is introduced.
+
+Scoped verification passes 187 pure tests, including all 69 SPDX tests and
+unchanged candidate-index goldens, plus strict host-target clippy, documentation,
+read-only workspace formatting and plan Prettier. Independent specification and
+code-quality reviews find no blockers. The corrected Git collection fixture is
+compiled locally but is run only in hosted CI under the process-test restriction.
+
+**Create:** release tool `src/spdx.rs`, private `spdx::tests`, `crates/trusted-server-release/tests/fixtures/spdx/`.
+
+- [x] Write cases for incorrect root digest, missing native coverage, ambiguous package identity, unknown license, duplicate SPDX IDs, dangling relationships, uncompiled dev dependencies, type-only/virtual JS and oversize predicates.
+- [x] Run the pure `spdx::` suite with the nonzero-selection guard. The scoped 2026-10-21 run selected and passed 66 tests; this validates renderer/candidate behavior, not the closed qualified generator.
+- [ ] Emit SPDX 2.3 JSON from Task 10 normalized evidence. Root checksum is final executable SHA-256; contributors/materials/tools/external requirements have distinct relationships. Unknown licenses use NOASSERTION; missing contributing origin/coverage fails. Validator uses a pinned authoritative SPDX schema.
+- [ ] Generate full real Fastly and all three CLI SBOMs; schema-valid toy fixtures are not sufficient. Validate size <=16 MiB and document equality semantics: reject duplicate keys, ignore object order, preserve array order.
+- [ ] Re-run fixtures plus actual coverage inspection. Commit `Generate validated per-artifact SPDX evidence`.
+
+Fixture exit audit (2026-10-22, `41560cfd9`): the first checkbox records existing
+written regression cases, not complete qualified generation. The cases span
+owner validation, projections, rendering and the JS collector:
+
+| Required case                                                       | Existing regression                                                                                                                                                                                                                                                                                                                                               |
+| ------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Incorrect root digest, duplicate SPDX IDs and dangling relationship | `spdx/tests.rs::rejects_root_digest_changes_duplicate_identities_missing_origins_and_dangling_edges` rejects each input mutation. `stable_ids_and_document_bytes_do_not_depend_on_input_component_order` checks unique emitted package SPDX IDs. Candidate merge tests additionally reject cross-part duplicates and dangling/cross-part edges.                   |
+| Missing measured native coverage                                    | `composition/native/tests.rs::native_spdx_requires_each_reviewed_consuming_context_and_unambiguous_features` clears measured contributors and requires projection rejection. `rejects_unknown_native_scripts_and_missing_native_execution` rejects missing captured build-script output. These tests do not establish complete platform coverage.                 |
+| Ambiguous package identity                                          | `composition/tests.rs::ambiguous_or_missing_package_and_target_joins_are_rejected` rejects duplicate metadata. `identical_names_and_versions_from_distinct_sources_remain_separate` and `spdx/cargo/tests.rs::original_identity_distinguishes_complete_registry_and_git_facts` preserve distinct source identities. Native tests reject original/context aliases. |
+| Unknown license                                                     | `spdx/tests.rs::unknown_licenses_use_noassertion_and_never_become_unsupported_expressions` verifies `NOASSERTION` for absent and unknown declarations. Native and JS origin tests reject manufactured declarations.                                                                                                                                               |
+| Uncompiled dev dependencies                                         | `composition/graph/tests.rs::catalog_dev_only_entries_never_create_contributors` excludes potential-only packages; `spdx/cargo/tests.rs::package_edges_require_both_observed_endpoints_and_skip_dev_kinds` excludes their projected dependency edges.                                                                                                             |
+| Type-only JS                                                        | `crates/trusted-server-js/lib/test/release-composition.test.mjs` checks that a type-only import and a zero-length rendered namespace are omitted. `javascript/contributions/tests.rs` rejects a zero rendered-length contribution.                                                                                                                                |
+| Virtual JS                                                          | The same JS collector file rejects an unknown virtual producer and checks recognized CommonJS helper ownership. `spdx/tests.rs::generated_js_requires_a_known_producer_and_retains_generated_bytes_identity` rejects a missing producer while preserving generated-byte identity.                                                                                 |
+| Oversize predicates                                                 | `spdx/tests.rs::rejects_an_spdx_document_exceeding_the_attestation_byte_limit` and `spdx/candidate/tests.rs::candidate_bounds_reject_documents_over_sixteen_mebibytes` enforce the output bound.                                                                                                                                                                  |
+
+Rust paths above are relative to `crates/trusted-server-release/src/`. Running
+only the SPDX and composition selections does not execute the JS collector
+cases. No new test API, duplicate fixture, schema change or candidate-index
+golden change is needed to close the written-cases checkbox. Complete native/tool
+coverage, qualified generator integration, the producer/consumer contract and
+full real four-asset SBOM exits remain open.
+
+Audit verification: fresh pure selections passed 69 SPDX and 67 composition
+tests, each with a nonzero selected count. Strict host-target all-target/all-feature
+Clippy, all-feature documentation, read-only workspace formatting and this plan's
+Prettier check passed. JS collector cases were inspected, not rerun locally.
+Independent specification and quality reviews supported the fixture checkbox;
+their corrections explicitly separate acquisition/qualification from material
+coverage and identify the emitted-ID uniqueness assertion.
+
+Progress (2026-10-19, partial renderer foundation): a private pure renderer validates executable root identity, component origins and roles, stable package/relationship identities, license declarations and bounded output against the existing pinned SPDX 2.3 schema. Structured-tree evidence stays in explanatory source information rather than raw-file checksums. Fictional fixtures exercise structural/semantic acceptance; schema validity supplies no signing or qualification authority. The closed (qualified) generator entry point still rejects every current candidate; a separate private candidate-only assembly (see the 2026-10-20 notes below) renders an unqualified document that cannot become the closed type. There is no functioning generation command, no caller-controlled completeness flag and no JSON constructor for complete inputs. Typed Cargo/JS contributor export, complete native/tool coverage, producer/consumer contract fixtures and full real Fastly/three-platform CLI SBOMs remain required; the renderer does not satisfy those exits.
+
+The owning JS handoff now exports typed conservative source/npm/generated contributions, material observations and tool joins after rehashing all retained files before and after export. The export preserves the original inventory digest, distinguishes npm archive integrity from installed-tree evidence, checks generated producer identities and rejects conflicting source hashes. It supplies no license inference, final-function attribution or complete-coverage capability. The real two-installation JS fixture exercises this export after its private working roots are removed; the full two-installation test (`preparation::tests::full::real_two_fresh_js_builds`) that carries the new export assertion passed in ordinary CI, run 39290139247 (job 118188353041, 680.82 seconds; head `df4a6e5c3` descends from `b99a17695`). Complete native/tool closure and qualified SPDX generation remain open; typed Cargo, native and platform projections and the candidate-only whole-document assembly are recorded below.
+
+The Cargo adapter now derives renderer component identities from approved workspace paths or verified original registry/Git identities, excluding opaque Cargo IDs and temporary roots. Host proc macros and build scripts have build-tool roles; supporting host libraries remain build materials, while target units have conservative Rust-contributor roles. Only package roles are combined; effective unit features remain separate borrowed observations. Potential graph edges are emitted only between observed endpoints and retain their potential-package meaning. Registry archive SHA-256 values identify actual original archives; registry index locations are not invented download URLs, and Git object/tree identities remain provenance information rather than raw SHA-256 checksums. The complete generator stays closed while the remaining native/tool and whole-artifact integrations are unavailable. The shared real-candidate helper exercises the owner adapter; all four canonical cohort checks passed in run 39290139247, as recorded under Task 10.
+
+The next JS adapter joins that sealed final-byte membership to checked original source/npm/generated facts. Complete bundles receive a containment relationship; positive Rollup-rendered inputs remain conservative observations before esbuild minification, and absent CLI bundles remain build materials. npm archive SHA-512 integrity is separate from installed-tree SHA-256 provenance. Generated wrappers retain their checked Vite producer, and unknown licenses remain `NOASSERTION`. The adapter consumes the completed recipe's frozen original inventory, without depending on the preparation attempt's later lifetime. The JS projection ran inside the shared real-candidate checks of ordinary-CI run 39417433680 (head `bfab8ef20`, every candidate job succeeded; verified from job conclusions, as per-assertion output is not logged). The complete generator stays closed.
+
+Native and platform adapters now also borrow the sealed completed owner. Native projection requires exact observed wrapper/context/features and verified original-source joins, rejects missing contexts and duplicate aliases of the same original, and keeps original registry archive checksums separate from structured source trees and measured static output archives. Wrapper versions do not assert native implementation versions. Platform projection preserves measured Rust trees, Apple tool files/SDK materials and GNU installed/configured identities with their acquisition and coverage limitations. Logical runtime requirements retain accepted artifact/target/format facts without invented installed-runtime checksums. Source, artifact, target, tool-tree, GNU boundary/plan/profile and Apple SDK joins are checked. Private working paths and opaque Cargo IDs stay out of projected identities. The shared real-candidate helper exercises both adapters, with hosted validation of these assertions in ordinary-CI run 39417433680 (all candidate jobs succeeded; verified from job conclusions, not per-assertion output). Complete generation remains closed until full owning composition coverage and whole-document integration are available.
+
+Candidate whole-document SPDX (2026-10-20, `1719cf15f` and `073704cc7`): a private `candidate_from_completed` joins the Cargo, JS, native and platform projections of one completed recipe into a single validated SPDX 2.3 document, returned as a separate `CandidateSpdx` with no conversion into the closed `GeneratedSpdx` and no generation command. The source commit must match the build, the platform receipt must equal the composition view's, and the root package must be the policy asset's verified workspace package at the same commit and version. Parts merge only with unique identities and edges inside their own part. The creation comment marks the document as an unqualified candidate and lists the platform coverage gaps, which must not be empty. The root checksum equals the rehashed artifact, the creation time derives from the source epoch and documents stay within the SPDX size bound. `073704cc7` runs it on every real completed artifact in the Fastly, Linux CLI and Apple candidate tests, checks the gaps each platform must report (unresolved Fastly host tools, the reviewed GNU privileged helpers, the Apple exclusions and unmeasured tool closure) and retains document digests and sizes as measurements; Fastly canonical-versus-reproduction document identity is a measurement only. Hosted status: ordinary-CI run 39420011152 passed for `1719cf15f`, which contains the assembly but not the real-build checks. The run for `073704cc7` (Run Tests 39452090186) was still in progress when this note was written, so no hosted result exists for the real-artifact SPDX checks yet. Task 11 remains open: complete native/tool coverage, qualified generation, the producer/consumer contract and full real SBOMs for all four assets are still required.
+
+Renderer validation follow-up (2026-10-21): JavaScript originals now require
+exactly one compatible role before rendering relationships. A complete bundle
+may be retained or build material; a rendered contribution may be conservative
+input or build material; preparation/tool material may be a build tool or build
+material. Crossed, empty, duplicate and mixed roles fail. This prevents a material
+record or pre-minification contribution from manufacturing `CONTAINS` evidence.
+The normal completed-owner projection already selects these roles correctly;
+this is validation hardening, not evidence of a real recipe misclassification.
+
+An integrated negative fixture rendered unsupported containment before the guard
+and rejects it afterward. All six accepted pairs are covered. A fixed valid
+document retains its pre-change SHA-256
+`2a79890ec323d58b8c6b8f304b06977c8355c8a5c341301b9782a82ddc489ee8`.
+Both pure producer golden checks pass against the unchanged candidate index and
+companions; no golden, schema or companion format was rewritten.
+
+License regression tests confirm the existing conservative behavior: the four
+explicitly reviewed exact declarations retain their original spelling/order;
+missing or unreviewed declarations, unsupported expressions and an observed
+`NONE` use `NOASSERTION`, preserving bounded observed text in license comments.
+No license conclusion, file-license analysis, wrapper-to-native license inference
+or complete SPDX license-catalog support is asserted. This change does not add
+license facts or infer missing origins. Existing named native/tool/acquisition
+gaps remain present, and complete qualified generation remains closed.
+
+The local suite passes 66 pure SPDX tests plus the two pure golden checks.
+Real-artifact acceptance is recorded under Task 10 for `e91d75b74`. Complete
+native/tool coverage, complete qualified per-artifact SBOMs and the remaining
+Task 11 exits stay unchecked. Parallel Task 12 code and its fixtures are untouched.
+Task 11 resumes after recording Task 14's hosted preservation result and open
+maintainer decision below. Task 14 remains open; this ordering does not waive
+either task's coverage, authority or qualified-generation requirements.
+
+Native license boundary follow-up (2026-10-21): the renderer rejects a native
+implementation license declaration when the measured native original has no
+such license fact. The owning adapter already supplies no declaration; this
+closes an invalid-input path rather than correcting a demonstrated real-build
+misclassification. The integrated regression covers all three reviewed wrappers
+in host and target contexts. Native license declarations and conclusions remain
+`NOASSERTION`; wrapper declarations cannot substitute for native license evidence.
+No license catalog is expanded and no existing measured package or relationship
+was found missing from its projection. Complete artifact-specific generation
+still requires the unmeasured closure/input facts and qualified owning adapters.
+Valid rendering, companion formats and candidate golden fixtures are unchanged;
+all four candidate jobs accepted the strengthened guard in the `e91d75b74`
+run recorded under Task 10. Complete generation remains closed.
+
+Selected Apple library projection (2026-10-21): a present measured `libtapi`
+digest projects as a build tool with a raw-file SHA-256. Recorded absence
+creates no package. The projection asserts no original download, license,
+runtime bytes or execution, and retains `NOASSERTION` through the existing
+renderer. Other package projections, relationship policies and candidate golden
+fixtures are unchanged. This adds measured bytes to candidate SPDX without
+opening complete qualified generation or closing Task 11. Hosted receipt and
+candidate SPDX acceptance for both increments is recorded under Task 10 in the
+2026-10-22 note; all named coverage gaps remain present.
+
+Selected Apple library-directory projection (2026-10-22): retain the new
+structured inventory as a build material with no raw-file checksum, original
+download or license claim. Candidate SPDX retains the same named coverage gaps.
+The measured directory is an input inventory, not an asserted executable
+dependency set; complete qualified SPDX generation remains closed.
+
+### Task 12: Bind transfers and enforce selected comparisons
+
+**Create:** release tool `src/collection.rs`, private `collection::tests` and exact transfer fixture data.
+
+- [ ] Test stale/wrong-run/source transfers, reused A/B artifact IDs, transfer hash warning, traversal/duplicate ZIP members, missing A, changed inventory, missing supported B variation or dishonest normalized/unsupported claims, absent final-byte runtime proof, missing/failed production socket controls or an unconfined build invocation, and a one-byte final wasm difference.
+- [ ] Run `cargo test -p trusted-server-release --target "$HOST_TARGET" collection::tests` with the nonzero-selection guard; expect missing validator.
+- [ ] Accept only expected upload-step outputs: IDs/archive digests mapped by trusted workflow dependencies to job/attempt/role/recipe. Re-download exact current-run artifacts and validate REST repository/run/source plus transfer bytes. Artifact API does not independently identify the producing job/attempt. Verify bounded declared ZIP members before extraction.
+- [ ] Match expected role-specific ambient profiles from the approved recipe against observed A/B records before signing. For mandatory Fastly A/B, all qualified supported dimensions MUST differ as selected; normalized values remain explicitly identified and omitted supported dimensions fail. Successful native comparisons use their selected observed profile and result binding, but a bounded native B failed/unavailable before environment setup records unavailable fields honestly and cannot be rejected for lacking observations it never produced. Add that exact nonblocking fixture; all native A qualification/composition remains mandatory. Verify final-byte core-format/publisher-request results for both Fastly outputs. Fresh-job identity alone cannot satisfy the variation or runtime contract.
+- [ ] Compare complete final Fastly files with no normalized/excluded regions. For native B produce exactly matched/mismatched/failed/unavailable within its deadline; native A failures always block. Record ambient variations and normalized internal values honestly.
+- [ ] Preserve A as canonical only after all mandatory requirements pass. Add explicit tests that optional B failure cannot hide any A/composition/JS failure. Commit `Validate release transfers and comparison outcomes`.
+
+Progress (2026-10-19, partial candidate implementation): 18 focused tests cover trusted exact-ID transfer tuples, raw artifact REST corroboration, complete mandatory A/Fastly B records, bounded optional native B outcomes, ambient/runtime/composition bindings and adversarial ZIP32 inputs. The in-memory ZIP reader checks declared flat members, exact lengths/digests, CRCs, central/local agreement and complete DEFLATE stream termination. Independent spec and quality review passed after fixing a truncated-stream acceptance finding. Imported records remain diagnostic data and cannot construct local recipe, confinement, runtime or signing capabilities. A qualified dependency constructor is deliberately uninhabited. Superseded in part (2026-10-20): the bounded HTTP transport and a candidate producer export now exist (see below), and upload-action ZIP interoperability passed in ordinary CI. The trusted workflow dependency adapter and hosted qualification remain required before this task can close.
+
+A subsequent exact-ID, read-only audit checked one actual ordinary-CI upload archive (242,907 bytes; SHA-256 `ef2714df5e38c09a011cf25fb37268830de2f03426b81ee646b7b287989401cc`) against unchanged REST metadata and its archive digest. Its 16 regular files use version-needed 2.0, DEFLATE, signed ZIP32 descriptors, Unix regular-file mode and no extras/comments/ZIP64. These observed header properties now have a synthetic regression, bringing collection tests to 19. The JS handoff's nested bundle/inventory paths violated the intentional flat-member policy when this was written; the candidate producer described below since exports the declared flat layout. One small archive's format compatibility does not authenticate its producing job, qualify the trusted dependency adapter or prove every upload size/profile.
+
+The owning recipe now retains typed socket-control/probe observations after successful denial evaluation, with boundary-instance fingerprint checks at capture, completion and checked access. Diagnostic receipts cannot reconstruct local denial capabilities; explicit pure-test fixtures have no measured receipt. A separate approved-source recipe-definition identity is shared across A/B, while the typed exact invocation digest preserves role-specific paths, jobs, environment and umask. Both retained getters rehash owned outputs, and real candidate helpers exercise them after source/target cleanup. This closes two producer-export prerequisites without implementing the final export/transport adapter or granting release authority. The combined verification batch passes 322 focused tests with independent review; actual hosted validation of these new prerequisites remains pending.
+
+A candidate producer now copies four flat files into owned storage: `artifact`, `composition.json`, the original `tsjs-inventory.json` and `candidate-build-record.json`. Checked access requires sealed composition receipts, the approved-source recipe definition and measured socket observations; it records actual single-build ambient conditions and keeps the shared recipe digest separate from the exact invocation digest. The recipe freezes checked JS facts and exact original inventory bytes while the preparation owner is valid, retains them independently at completion, and verifies their source/digest and retained file at subsequent handoffs. This prevents a later optional native B timeout from invalidating A's evidence through an expired JS preparation lease. Every copied file is rehashed, and altered, extra, missing or linked members are rejected. This explicitly unqualified diagnostic format still differs from the strict collector's contract: runtime acceptance, ambient pair claims, complete composition closure, authenticated bootstrap and trusted workflow producer identity remain declared gaps. All four canonical recipes proved the previous three-file export's lifetime in run 39290139247; the fourth member (`candidate-build-record.json`, introduced in `7bcf93e50`) and JS projection assertions have since passed in the candidate jobs of ordinary-CI runs 39417433680 and 39420011152 (verified from job conclusions, not per-assertion output). Pure diagnostic fixtures do not establish collector compatibility. No strict collector rule or qualified dependency constructor is relaxed.
+
+The Fastly path can additionally retain its actual final-byte Viceroy acceptance in the diagnostic record. Acceptance now binds the build role as well as approved source and final artifact size/hash, so equal A/B bytes cannot substitute one role's runtime run for the other's. Checked export rehashes the completed owner before/after formatting bounded observations, including actual Viceroy/fixture/configuration and publisher-response identities; JSON remains output only. Both real Fastly runtime owners are retained through export and cleanup checks. This removes the Fastly runtime-export gap only when the actual owning acceptance is supplied. Native startup export, ambient pair claims, strict collector integration, qualification and workflow authority remain open; native records continue to declare absent runtime acceptance. The Fastly job passed in ordinary-CI run 39417433680 (job conclusions verified).
+
+Further candidate implementation (2026-10-20): native startup now produces an owning acceptance after executing and cleaning up the exact copied final CLI. Its expected version output derives from the selected package's verified approved workspace origin and sealed composition, rather than the release helper's package version. Linux acceptance requires the three selected distributions and distinct actual local image identities; these images remain unqualified. Apple acceptance checks the actual host cohort, CPU and final Mach-O minimum OS before execution. Checked diagnostic export binds source, role, asset, final size/hash and package version, retaining actual bounded startup observations after build-root cleanup. Optional native B without a successful startup retains an explicit missing-acceptance gap. Independent spec and quality review found no outstanding native-startup findings; these assertions ran in the native candidate jobs of ordinary-CI run 39417433680 (job conclusions verified; not per-assertion output). Both Linux and Apple startup accepted outputs are recorded in the dated reports.
+
+The read-only HTTP backend now binds exact selected IDs/names/archive digests to strict raw REST repository/run/head metadata. It uses fixed-origin authenticated API requests and one manually checked, credential-free redirect to the supported Azure Blob storage host subset, with compiled WebPKI roots, no proxy or automatic redirects, asynchronous DNS, bounded streaming, cancellation and per-response/attempt deadlines. The unchanged flat ZIP reader remains the extraction gate. Local fictional TCP/TLS tests cover credential separation, changed metadata, denied redirects, transformed/truncated/oversized bodies, cancellation and injected-CA rejection. A test-only ordinary-CI hook exercises this backend without constructing trusted dependencies. Real upload-action interoperability, the trusted workflow dependency adapter, ambient pair claims, strict producer/collector integration, complete composition coverage and hosted qualification remain required; Task 12 is still open.
+
+An ordinary-CI producer/receiver fixture now uploads four inert fictional flat members using the pinned upload action and passes its exact ID/name/archive digest through job outputs. A separate read-only receiver downloads that original archive twice through the actual backend, corroborates current-run REST metadata and verifies every member's bytes using the unchanged ZIP reader. Fork PRs skip these jobs. The fixture distinguishes the API's PR head from checkout's synthetic merge and grants neither source approval nor release authority. The guarded test has since passed in hosted CI: `collection::transfer::ordinary::real_uploaded_archive` in job 118609812109 of run 39417433680 (0.77 seconds), with the producer job 118609761722 also succeeding. Independent transport spec review and transport/workflow quality review found no actionable findings. This small upload is interoperability evidence only; it cannot establish large-artifact coverage, complete composition or qualified producer identity.
+
+Local verification of this batch passed 853 native unit tests (seven ignored external/helper fixtures), 13 command tests, strict native Clippy, documentation generation, Rust/Markdown/YAML formatting, actionlint and staged domain lint. A full-suite failure exposed inherited nonblocking accepted sockets in the fictional macOS HTTP fixture; fragmented-header red/green and aborted-header regressions now cover the corrected test server. Independent review found no remaining findings. Linux cross-target Clippy on this Mac cannot compile the newly needed TLS C dependencies without a Linux C cross-compiler; hosted Linux validation remains required. No candidate or release qualification is inferred from these local checks.
+
+Cross-job candidate-entry transfer (2026-10-21, implemented; first hosted pass in run 39577910126): each real candidate job (Fastly, Linux CLI and both macOS legs) now exports its rechecked entry as six flat files: the final executable `artifact`, `tsjs-inventory.json` and the four unsigned companions. It writes a separate CI-internal transfer file and uploads the files with the pinned upload action under `candidate-entry-<asset>-<run_id>-<run_attempt>` (1-day retention, fork PRs skipped). A describe step merges the exact upload ID, name and archive digest with the producing job's own run attempt into a job-output descriptor; the macOS matrix uses per-leg keys. The new `test-release-candidate-index` job (`contents`/`actions` read only, token only in the download step, restore-only cache) runs the ignored `distribution::ordinary::real_four_job_candidate_index`. It strictly parses the four descriptors, retrieves each exact upload through the unchanged bounded backend and ZIP reader with REST run/head/name/digest corroboration, and rehashes the executable against build-evidence `artifact_sha256`/`artifact_size`. Existing bounds cover the largest measured executable (Linux CLI about 285 MB; 512 MiB member, 768 MiB archive). The descriptor is not a release schema and grants no trusted workflow dependency: companions keep `null` workflow/transfer identities and the `trusted-workflow-transfer-not-bound` gap. Pure tests cover descriptor parsing, export writing and transfer rejections. The trusted dependency adapter, ambient pair claims and qualification remain open, so Task 12 stays open.
+
+### Task 13: Assemble and validate the exact evidence graph
+
+**Create:** release tool `src/distribution.rs`, private `distribution::tests`, `crates/trusted-server-release/tests/fixtures/index/`.
+**Schema boundary:** governing index v1 raw bytes remain immutable; any change requires an explicit reviewed amendment.
+
+- [ ] Port positive and adversarial schema fixtures: exact four artifacts, unknown capabilities and structurally compatible but currently forbidden `fastly-staging`, duplicate names/keys, source/cohort/recipe mismatch, unsafe names/newlines, altered lengths/digests and role-specific limits.
+- [ ] Run `cargo test -p trusted-server-release --target "$HOST_TARGET" distribution::tests` with the nonzero-selection guard; expect missing assembly/semantic checks.
+- [ ] Assemble unsigned companions from successful observed outputs, then artifact provenance/SBOM bundles, then the signed index. Index names/hashes all companions and shared JS inventory; exclude own digest/bundle. Recipe/rebuild records are authenticated informational data, not executable programs or independent trust.
+- [ ] Require SPDX parsed predicate/document equality plus separate file hashes. Producer verifies every exact expected provenance subject; no additional unapproved code subject. SHA256SUMS covers every other published asset and not itself.
+- [ ] Cross-check schema and semantic joins on all real artifacts before signing/rehearsal. Commit `Assemble the authenticated release distribution`.
+
+Progress (2026-10-20, partial candidate index): a private `distribution` module assembles an unqualified candidate release index. `candidate_entry_from_completed` accepts only a canonical completed build at its approved source with the matching actual acceptance (Fastly runtime plus canonical/reproduction equality, or native startup), renders the candidate SPDX itself and renders build-evidence, build-recipe and rebuild-check companions. Each companion carries `"release_qualification": false`, sorted non-empty gaps and `null` workflow run and transfer IDs. Fastly records `matched` only from the checked equality; native assets record `unavailable`. `assemble_candidate_index` requires each fixed asset exactly once with one source commit, producer policy identity and inventory, emits artifacts sorted by name with no timestamps, and rechecks the rendered bytes against the retained v1 schema plus mirrored consumer semantics. Fixed per-asset identity comes from a compiled accessor equal to the schema row, so `fastly-staging` cannot appear. The tag is the sentinel `v0.0.0-unqualified-candidate`, the bytes are named only `candidate-release-index.json`, and both signature bundle slots are `AwaitingSignature`: they render the true empty-file record and their `Signed` variant is uninhabited. There is no command, writer or signer. Golden fixtures under `crates/trusted-server-release/tests/fixtures/index/candidate/` are byte-compared by the producer and run through the CLI's unsigned consumer joins. Each entry derives `policy_version` and `policy_sha256` from the same approved policy bytes, as the consumer does, and rejects a version other than the compiled one. The CLI verifier now rejects size-0 provenance and SBOM bundle records for every indexed artifact immediately after parsing the index, and again for each consumed artifact, so the candidate cannot pass full verification. Follow-up (see Task 15): once real signing exists, the consumer must also reject the sentinel tag and `"release_qualification": false` documents. Pure fixtures cannot exercise a successful completed-build entry, because they have no composition receipts or actual acceptances. Only owner wiring rejections are covered locally, and real four-asset assembly is deferred to Tasks 12 and 15. Signing, SHA256SUMS, provenance subject checks and qualification remain open.
+
+Hosted candidate-entry follow-up (2026-10-21): `4483e8256` wires independent
+real canonical-entry checks into the candidate jobs. Run 39529922087 completed
+Fastly, Linux CLI and Apple ARM jobs, but Intel and the overall run were cancelled.
+Run 39540057202 subsequently passed all four per-asset entry checks for source
+`d0cd53343fcbe1fb6f06eafc009e306e24b1245d`, with the same JS inventory digest
+in all four jobs. The [candidate index report](../../../scripts/release/qualification/2026-10-21-candidate-release-index.md)
+retains exact job/entry identities and distinguishes native measurement results
+from the entries' deliberately `unavailable` rebuild outcome. This establishes
+per-asset integration, not real cross-job four-entry assembly. Task 12's trusted
+transfer adapter is the next join prerequisite; complete native/tool coverage,
+authenticated acquisition, signing, publication and qualification remain separate
+unfinished exits. Task 13 remains partial.
+
+Real cross-job assembly (2026-10-21, implemented; first hosted pass in run 39577910126): the
+collector job rebuilds each transferred entry with the test-only
+`CandidateArtifactEntry::from_ordinary_ci_transfer`, the one documented
+exception to the production-only constructor. Production is unchanged. The
+rebuild reruns every producer join over the transferred bytes and derives
+`policy_version`/`policy_sha256` from the consumer policy read out of a
+retained clean clone authenticated at `github.sha`. Fastly must be `matched`
+with reproduction equal to canonical, native assets `unavailable`. Gaps must be
+sorted, unique, a superset of the fixed entry gaps and identical across
+companions. Every companion is rehashed, and each rebuilt entry must recheck to
+the producing job's entry digest. The unchanged `assemble_candidate_index` then
+writes `candidate-release-index.json`, the inventory and sixteen companions. The
+collector prints the index and its SHA-256, the CLI's ignored
+`ordinary_ci_assembled_candidate_passes_unsigned_consumer_joins` runs the
+consumer's unsigned joins and empty-bundle rejection over those files, and the
+directory is uploaded as 7-day unqualified candidate evidence. It runs only when
+all four candidate jobs succeed and is not a required check. A pure round trip
+reproduces the golden index byte for byte, alongside rejection, descriptor and
+writer tests. The first hosted all-four assembly passed in run 39577910126 at
+merge source `fb42d8268`: index SHA-256
+`4872ef96086e93f720187f363e7262ae2921e663fbc9a531f2a42cc5d803b14d`, accepted by
+the consumer's unsigned joins (see the
+[four-asset candidate join report](../../../scripts/release/qualification/2026-10-21-four-asset-candidate-join.md)).
+The preceding run 39567710071 rejected its first download because the collector
+passed one 20-minute deadline to a transport capped at 15 minutes;
+`d774ee47c` bounds each download separately. Signing, publication and
+qualification stay open.
+
+Pair comparison (2026-10-21, `de52e66fd`): the collector also rejects a
+canonical/reproduction pair sharing one boundary instance and treats an equal
+host locale or timezone as a missing supported variation. New pure tests
+isolate the pair check per dimension, record every optional native
+reproduction outcome, show no reproduction state hides a mandatory canonical
+failure, and require Fastly runtime proof for both roles.
+
+Collector follow-ups (2026-10-21):
+
+- `f17377a4e`: an optional native reproduction without an upload is an
+  observed job (started flag, terminal conclusion, bounded elapsed/deadline)
+  with no upload identity fields; the collector derives `unavailable` (queued
+  at the deadline, skipped, cancelled before any step) or `failed` (started
+  then cancelled or still running, failure, timed out, success without an
+  upload) and rejects contradictory, premature or unbounded observations. Each
+  dependency channel accepts only its own build roles before any fetch, and the
+  Fastly runtime record must carry its record's role. That role is
+  producer-asserted, so it guards an honest pipeline; a per-run Viceroy
+  identity remains open.
+- `15893ef1e`: the earlier "exact invocation" check compared a fingerprint
+  forced equal to the boundary instance, so it only proved distinct instances.
+  Records now carry `execution_fingerprint` (boundary instance, bound to the
+  denial receipt) and a separate `invocation_digest` from the exact Cargo plan
+  digest (program, arguments including jobs, environment, role checkout root,
+  umask); the pair must differ in both. A test-reachable producer renderer
+  emits this strict record from producer-owned facts.
+- `5a98c18ad`: the collector parses the producer's real sealed composition
+  receipt instead of a fixture-only summary, keeping every earlier check and
+  adding materials, target, package-join, Fastly embedding, coverage-claim and
+  platform-shape bindings. Real candidate tests feed each real receipt through
+  the same check, so producer/collector drift fails ordinary CI.
+
+Still open: the trusted workflow adapter that fills observed job states and
+upload identities; job/attempt identity supplied by the workflow; native
+startup acceptance has no collector slot; native canonical input digests are
+only compared against a reproduction; an invalid uploaded native reproduction
+rejects the whole collection rather than recording `failed`; and the
+`failed`/`unavailable` mapping is not yet normative in the spec.
+
+### Task 14: Expose trusted same-commit validation
+
+**Create:** `.github/workflows/release-validation.yml`, release tool private workflow-contract tests (register alongside the production policy/dispatch module; do not expose a test-only public API).
+**Modify:** `.github/workflows/test.yml`, `format.yml` only to extract/reuse existing required jobs without losing existing triggers/gates.
+
+- [ ] Add static workflow fixtures for wrong SHA/event/ref, unlisted RC branch, malicious candidate allowlist, forged local remote refs, missing governance/ruleset/bypass approval, skipped/path-filtered gates, arbitrary commands, excessive permissions and any floating external action ref in the complete release/validation invocation.
+- [x] Run the pure `workflow_contract` suite with the nonzero-selection guard. The scoped 2026-10-21 run selected and passed 19 tests; three release-binary-only command tests and 45 pure Node tests also passed. These checks do not establish hosted release eligibility.
+- [ ] SHA-pin every external action in release.yml, release-build.yml and all called release validation jobs, including checkout/setup/cache/upload/download and attest. Preserve readable version comments, audit dependencies and reject floating @v\*/main refs. Local workflow calls are allowed only at the caller's checked source revision. Existing test/format action refs MUST NOT be inherited unreviewed into this path.
+- [ ] Expose reviewed workflow_call or explicit jobs running every current AGENTS gate at the tag SHA. Maintain PR/main tests; RC is permitted only by exact reviewed cohort branch entries. Validate strict SemVer/lightweight tag independently; annotated tags fail.
+- [ ] Wait up to 90 minutes for this invocation's required terminal validation results; fail cancelled/skipped/timeout results with rerun guidance. Do not trust arbitrary named successful checks or unrelated main commits.
+- [ ] Include JS build/tests/format, all Rust aliases/parity/CLI/build-digest, the explicit host-only release-tool test/clippy gate (or reviewed aliases), docs/Markdown and `scripts/lint-wasm-clock.sh`. Commit `Validate release source at the exact tag commit`.
+
+Progress (2026-10-21, partial Task 14): `release-validation.yml` exposes only
+`workflow_call` with one required source SHA. Its explicit jobs cover the current
+AGENTS gates, host release-tool Linux/macOS tests and clippy, and existing parity,
+codegen, JS prebuilt, documentation and trust-test checks. Every checkout selects
+the supplied SHA with persisted credentials disabled. Both external actions use
+reviewed commit pins and version comments; no composite or local workflow is
+inherited. Shell Rust setup follows the existing native release-tool approach
+without introducing a floating action or shared cache.
+
+The read-only `check-workflow-contract --workflow <path>` command checks exactly
+one reviewed workflow and its fixed sibling helper. It executes nothing, performs
+no network access and reports both source eligibility and release qualification
+as false. Inputs are bounded to 1 MiB before parsing; held regular-file reads use
+no-follow/nonblocking open. Raw workflow, canonical parsed structure and helper
+digests bind commands, permissions, conditions, action pins and each version
+comment. YAML references, merge keys, duplicate/non-string keys, tags and
+unsupported ambiguous spellings fail. The restricted parser conservatively
+rejects reference indicators outside literal run blocks, even in quoted scalars.
+Formatting or helper changes require explicit review and pin updates. Additional
+files and local invocation graphs remain unsupported; Tasks 15–16 must extend
+this closed contract when their actual caller/signing workflows exist. The YAML
+dependency reuses the workspace package; the lockfile adds only its dependency
+edge, with no new package.
+
+The runtime helper requires the same full source/workflow SHA, official repository
+identity, tag-push event, exact caller/ref and strict bounded SemVer. Fixed-origin
+bounded read-only REST requests observe the unpeeled lightweight tag, actual
+remote `main` tip and ancestry; neither local refs nor candidate branch entries
+provide authority. No RC branch is approved. Admission records observations and
+`source_eligibility: false`, allowing quality checks to run without authorizing a
+release. The parallel waiter enumerates this run attempt's required terminal jobs,
+rejects missing/duplicate/wrong-source results and non-success conclusions, and
+uses an original-run, queue-inclusive 90-minute window with monotonic remaining
+budgets for requests and polling. The first bounded REST read obtains the trusted
+run creation time. Rerunning jobs cannot reset that window; diagnostics distinguish
+reruns within it from an expired window requiring a fresh trusted invocation.
+
+Even if every quality gate succeeds, the terminal helper fails because an
+independently approved governance/ruleset/bypass profile is not established.
+No approval schema, ruleset identity or bypass actor is invented. Consequently
+Task 14 remains open for independent governance authority and live callable
+acceptance, and the remaining checklist exits stay unchecked. No tag/release
+trigger, signing, publication, settings change or qualified capability is added.
+
+Preservation check: all 16 pre-existing `test.yml` jobs and five `format.yml` jobs
+retain their exact names, conditions, dependencies and matrices. `test.yml` only
+appends the pure helper-contract job; `format.yml` is byte-identical. Thus existing
+triggers, path classification, caches, native-reproduction selectors, four
+candidate legs and the candidate-index collector remain unchanged. The before/
+after listing was compared against `d774ee47c` before editing.
+
+Local verification passes the 19 pure Rust cases, three checker command cases,
+45 pure Node tests, strict host clippy, documentation, owned-file rustfmt and
+Prettier, and the forbidden-action guard. Modified workflows pass actionlint.
+The all-workflow actionlint run reproduces three existing diagnostics in unchanged
+`deploy-docs.yml`/`docs-proposal.yml` (unquoted output path and locally unsupported
+concurrency/permission keys); the baseline at `d774ee47c` reports the same three.
+The broad `.github` Prettier check also reports ten unchanged baseline files;
+the owned workflow/helper files pass the pinned docs configuration. No unrelated
+workflow or shared-tree formatting is changed. Hosted preservation/contract
+results after this push remain pending; pure fixtures are not a live invocation.
+Independent spec and quality reviews approve this scoped foundation; the narrow
+official REST-host suppression also received explicit review. Review fixes cover
+Node extraction quoting, least-privilege permissions, documented REST attempt
+responses, tag bounds, per-request remaining budgets and composed source-API
+coverage. Task 14 is not marked complete by those approvals.
+
+Hosted preservation follow-up (2026-10-21): successful [Run Tests 39596973649](https://github.com/IABTechLab/trusted-server/actions/runs/39596973649)
+has head `ac07047ed2b4f1bbe0e1f2e4aac9f845e70b7c7c`, including `2b642b509`.
+All 20 expanded test jobs succeeded, including Fastly candidate
+[119211581826](https://github.com/IABTechLab/trusted-server/actions/runs/39596973649/job/119211581826),
+Linux CLI [119211581675](https://github.com/IABTechLab/trusted-server/actions/runs/39596973649/job/119211581675),
+Apple ARM [119219615235](https://github.com/IABTechLab/trusted-server/actions/runs/39596973649/job/119219615235),
+Apple Intel [119219615180](https://github.com/IABTechLab/trusted-server/actions/runs/39596973649/job/119219615180),
+the index collector [119250788447](https://github.com/IABTechLab/trusted-server/actions/runs/39596973649/job/119250788447)
+and helper contracts [119211581539](https://github.com/IABTechLab/trusted-server/actions/runs/39596973649/job/119211581539).
+The collector's built source is PR merge `1c78dd4556b03ddaa369680f2248edac1761bcd8`,
+distinct from the run head. Matching [Run Format 39596973672](https://github.com/IABTechLab/trusted-server/actions/runs/39596973672)
+passed all five jobs. Comparison with `d774ee47c` confirms the same 16 original
+test and five format definitions, names, conditions, dependencies and matrices;
+only the helper job was appended. Matrix expansion accounts for 19 original test
+instances plus the helper. This establishes ordinary-CI preservation, not a live
+release-validation invocation or governance/source authority.
+
+**Unresolved maintainer decision before Task 14 can advance:**
+
+1. Select an independently governed approval record and its approving maintainers.
+   Approve exact repository/organization ruleset identities, active enforcement,
+   ref inclusions/exclusions and restrictions covering `refs/tags/v*`, `main`
+   and every future exact reviewed RC branch. Specify release-tag creation
+   authority and effective update/deletion restrictions. Eligible branches remain
+   exactly `["main"]`; a candidate entry or name pattern cannot approve an RC.
+2. Approve exact branch-required check identities, their expected reporting
+   applications and branch update policy. Separately approve the release
+   invocation's mandatory same-commit gates: admission, Fastly, native/parity,
+   Cloudflare/Spin, both host release-tool jobs, JavaScript, docs and terminal
+   eligibility. Record actual caller-qualified names when Tasks 15/16 define the
+   caller. Another source/run/attempt or reporting application cannot satisfy
+   these gates by reusing a successful check name.
+3. Approve an empty bypass list or exact actor IDs, actor types, modes and scope
+   of every exception, including inherited organization rules and tag creation
+   authority. Record who reviews changes and approves exceptions. Administrator
+   status, visible settings and candidate assertions do not establish approval.
+4. Approve the independent trust root and read-back evidence. Validation must
+   obtain bounded official API observations of repository identity, applicable
+   repository/inherited ruleset details, active enforcement and ref scope,
+   effective required-check/application bindings and exact bypass actors/modes.
+   Compare with the independently approved record, binding its reviewed revision
+   and approvers. Retain the unpeeled remote tag, actual approved branch tip and
+   ancestry, and this source/workflow/run/attempt's complete terminal gate results.
+   Missing, unreadable, truncated, ambiguous or changed approval/settings
+   evidence must deny eligibility; settings cannot approve themselves.
+
+These are decisions to obtain, not an implemented approval profile or settings
+mutation. No ruleset ID, check configuration, bypass actor or approver is selected
+here. GitHub describes rule applicability and application-bound checks in
+[available rules](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets).
+The terminal job continues refusing eligibility. Stop governance work here until
+maintainers approve the record and Tasks 15/16 supply the reviewed caller and an
+authorized live invocation; bounded Tasks 11/10 resume meanwhile.
+
+### Task 15: Orchestrate independent builds and isolated signing
+
+**Create:** `.github/workflows/release-build.yml`; extend workflow contract fixtures.
+
+- [ ] Test never-started/queued or scheduler-cancelled optional native B jobs as well as pre-step failure: the trusted collector MUST emit a bounded failed/unavailable measurement with absent observations represented honestly and no fabricated upload identity. Confirm the workflow cannot wait indefinitely or hide a mandatory A failure.
+- [ ] Test topology: shared JS A/B, separate fresh Fastly A/B, three mandatory native A jobs, bounded optional native B jobs, validated current-run collector and no signing credentials in executable/lifecycle jobs. Require job configurations to apply Task 9 role profiles and publish observed variation/runtime records; tests reject default-only A/B jobs or collectors that bypass these gates.
+- [ ] Run `cargo test -p trusted-server-release --target "$HOST_TARGET" workflow_contract` with the nonzero-selection guard; expect absent graph.
+- [x] (from Task 13) The consumer rejects the candidate sentinel tag `v0.0.0-unqualified-candidate` (exact match) as the first check of `verify_index` and `verify_build_evidence`, which every online and offline path reaches. It also rejects any consumed build-evidence, build-recipe or rebuild-check companion declaring `"release_qualification": false` or a non-boolean value, after the companion bytes are authenticated against the signed index; an absent field or `true` is accepted because the R-INDEX contracts do not define the field. Both rules hold independently of the empty-bundle rule: a golden candidate index with non-empty bundle records is still rejected (`ac07047ed`). Making the field normative in the spec's companion contract needs a reviewed amendment.
+- [ ] Call local reusable workflow at source revision. Build jobs are read-only. Collector uses Task 12 outputs; signing grants only contents-read/id-token-write/attestations-write, plus actions-read when needed. No artifact-metadata write for file attestations. Caller grants enough permissions for called signing jobs but its own build jobs explicitly narrow them.
+- [ ] Invoke pinned attest 4.2.2 twice per canonical asset: exact executable/SBOM/evidence/recipe/rebuild provenance subjects, then executable subject + SPDX predicate. Save named bundles, validate all proofs/joins and sign index after collection. Do not construct caller predicates or sign source supplied commands.
+- [ ] Rehearse actual certificates/toolkit fields in a disposable repository with test-only policy fixtures. Verify repository IDs, exact SAN, issuer, build/caller/source/event/run fields for both predicate types. Commit `Sign validated release outputs through the reusable builder`.
+
+Progress (2026-10-21, partial, collector logic only): `f17377a4e` implements
+the collector side of the never-started/queued/cancelled and pre-step-failure
+bullet as pure logic (see Task 12 collector follow-ups): no upload identity can
+exist for such a job, outcomes are derived from bounded observed job states,
+and a missing mandatory canonical rejects collection under every optional
+state. The bullet stays open until the trusted workflow adapter supplies real
+job observations and `release-build.yml` bounds the wait; no workflow, signing
+or publication was added.
+
+### Task 16: Publish through one immutable-release owner
+
+**Create:** `.github/workflows/release.yml`, release tool `src/publication.rs` and private `publication::tests`.
+
+- [x] Add fake API cases for matching/conflicting draft, missing/altered asset, concurrent rerun, lost response, already published tag, mutable/unknown final state and permission differences on approved RC commits.
+- [ ] Run `cargo test -p trusted-server-release --target "$HOST_TARGET" publication::tests` and `workflow_contract` separately with the nonzero-selection guard; expect absent publication owner.
+- [ ] Keep tag-scoped concurrency without cancellation. Draft, upload, re-download and validate the exact asset set before publication. Match source/bytes for draft resume; never overwrite published assets/tags. Publication has contents-write only, no OIDC/provider/settings token.
+- [ ] Require maintainer governance approval and immutable/tag-rule setup before enabling tags; afterward read immutable=true and verify GitHub release statement/membership with the normal token. A confirmed mutable release fails publication, is removed only when the workflow release-write role authorizes that still-mutable cleanup, and produces an incident with the cleanup outcome. Never delete an immutable release. Unknown state produces an incident and read-only reconciliation; it MUST NOT trigger blind deletion. A lost publish response also triggers read-only reconciliation before another mutation.
+- [ ] Exercise all failure paths in an authorized disposable public repository and record measured evidence. Production tag/permissions require separate release authorization. Commit `Publish complete immutable attested releases`.
+
+Progress (2026-10-21, `9bd8be2c2`, closed pure owner): `src/publication/`
+implements the sole-owner state machine against a `ReleaseApi` trait with an
+in-process fake (33 tests). It refuses a tag that has a published release or
+points at another commit, resumes a draft only on matching tag, commit and
+bytes, re-downloads and validates the exact asset set within bounds derived
+from the index asset set and role limits, re-checks the tag and draft before
+publishing, and reconciles lost responses read-only. After publication it
+requires an immutable release whose observed tag, commit and statement
+membership equal the intended release; a confirmed mutable release is removed
+only with cleanup authority after a fresh read, with an incident carrying the
+API failure. Immutable or unknown releases are never deleted. Publication holds
+only a contents-write marker built from the caller-attested job permissions.
+There is no real API adapter, `release.yml`, `workflow_contract` publication
+fixture, command or token handling, so the remaining bullets stay open; partial
+uploads after lost responses need a manual recovery runbook.
+
+### Task 17: Implement strict consumer documents and embedded policy
+
+**Modify:** CLI `release-policy.json` from Task 3.
+**Create:** CLI `src/release/mod.rs`, `error.rs`, `policy.rs`, `documents.rs`, `src/release/tests/mod.rs`, `src/release/tests/documents.rs`, `tests/fixtures/release/`.
+**Modify:** CLI `src/lib.rs`, `Cargo.toml` (host-only sha2/schema validator with justification).
+
+- [x] Before the first filtered run, wire the host-only `mod release` in CLI `src/lib.rs`, the production child modules in `src/release/mod.rs`, `#[cfg(test)] mod tests` there, and `mod documents` in `src/release/tests/mod.rs`. Add the test cases before checking selection; Rust does not discover this directory automatically. Keep these internals private.
+- [x] Test closed schema/kind/profile/action combinations, structurally valid but policy-forbidden `fastly-staging`, duplicate/deep/oversize JSON, self-selected policy, historical policy acceptance/retirement, altered approved-source policy bytes, allowlisted digest paired with the wrong source, unsupported tool and CLI-as-server substitution.
+- [x] Run `cargo test -p trusted-server-cli --target "$HOST_TARGET" release::tests::documents`; expect the intended missing implementation or assertion failure. When it compiles, use the nonzero-selection guard below before accepting red or green; a successful run selecting zero tests is a failure of this plan, not a pass.
+- [x] Implement byte-first duplicate-rejecting parsers and the same schema/semantic fixtures as producer. Embed reviewed policy bytes; compute their SHA-256 externally at runtime. Policy contains no own digest. First bind producer-policy bytes to the independently approved source commit through the fixed official repository path `crates/trusted-server-cli/release-policy.json` (independently approved source snapshot or fixed official GitHub Contents API acquisition from that exact independently approved full commit); never obtain this authority from the release index or an arbitrary supplied path. Match its exact-byte digest/version, then accept only current policy bytes or the reviewed historical allowlist. For offline checks, independently transfer the approved source-policy snapshot alongside other trust inputs. Downloaded metadata never changes consumer policy.
+- [x] Follow [R-POLICY](../specs/2026-10-09-1235-release-attestation-design.md#r-policy): fetch only `https://api.github.com/repos/IABTechLab/trusted-server/contents/crates/trusted-server-cli/release-policy.json?ref=<approved-full-commit>`, `Accept: application/vnd.github.raw+json`, explicit read-only credential, 1 MiB maximum and attempt deadline. Reject arbitrary host/path or credential-forwarding redirects. Add source/API mismatch, unsupported producer v2 under consumer v1, reviewed historical v1 under newer consumer, and current-consumer-bound enforcement negatives. <!-- allow-domain: api.github.com -->
+- [x] Keep the already registered tests active and require nonzero selected counts on every focused rerun; process tests use public CLI dispatch rather than making internals public. Keep concrete release errors as Report<ReleaseError>; convert to the existing String dispatch boundary only at the command adapter. Do not introduce a new generic attestation crate or publisher types.
+- [x] Fix repository/owner IDs, supported combinations, exact gh/action contract and all R-BOUNDS limits. Re-run tests/clippy. Commit `Parse release evidence under embedded consumer policy`.
+
+### Task 18: Implement the bounded isolated gh runner
+
+**Create:** CLI `src/release/gh.rs`, `src/release/tests/gh.rs`.
+
+**Modify:** CLI `src/release/mod.rs`, `src/release/tests/mod.rs`.
+
+- [x] Register the new gh production modules and `mod gh` test module before the first focused run. Apply the nonzero-selection guard; missing module registration or zero matches MUST never report a passing security check.
+
+- [x] Write fake-child tests for hangs/cancellation, simultaneous stdout/stderr saturation, malformed/truncated JSON, exit failure, multiple attestations, token precedence, host/config overrides and log redaction.
+- [x] Run `cargo test -p trusted-server-cli --target "$HOST_TARGET" release::tests::gh`; expect absent runner.
+- [x] Resolve gh once through trusted PATH/explicit trusted installer configuration, require 2.97.0, and retain that executable target. Pass fixed argument vectors with exact certificate identity; never arbitrary forwarded verifier flags. Accept explicit GH_TOKEN then GITHUB_TOKEN, pass only GH_TOKEN, isolate home/config/state, disable prompts, reject loader injection and keep provider credentials out.
+- [x] Concurrently drain bounded pipes: 120 seconds per child, 15 minutes per attempt, 128 MiB stdout/1 MiB stderr. Kill/reap on either limit/cancellation. Use real OS fake-child fixtures, not mocks that omit pipe pressure. Failed exit never yields trusted parsed claims.
+- [x] Re-run runner negatives and an approved signed public fixture under the pinned gh binary. Actual attest 4.2.2 provenance and SPDX signatures, isolated token-free replay, offline SPDX replay and signed release output were measured; see [consumer qualification report](../../../scripts/release/qualification/2026-10-15-consumer-real-fixtures.md). Commit `Bound and isolate release verification subprocesses`.
+
+### Task 19: Verify signatures, evidence joins and official publication
+
+**Create:** CLI `src/release/evidence.rs`, `github.rs`, `artifact.rs`, `src/release/tests/verification.rs`.
+
+**Modify:** CLI `src/release/mod.rs`, `src/release/tests/mod.rs`.
+
+- [x] Register the new evidence/github/artifact production modules and `mod verification` test module before the first focused run. Apply the nonzero-selection guard; missing module registration or zero matches MUST never report a passing security check.
+
+- [x] Add a valid graph and independently altered edges for index, all provenance subjects, SPDX subject/document/root, JS prepared/retained records, policy/source/run/caller identities, signed names, REST lengths/immutability and tag object type.
+- [x] Run verification tests; expect no implemented evidence graph.
+- [x] Verify index provenance before trusting fields. Obtain only approved official GitHub host/repository data with explicit read-only credential and bounded responses. Validate lightweight source target, source approval, independently acquired fixed-path producer policy bytes at that commit, exact signed release names/digests and actual/index/REST sizes. Primitive gh success is insufficient.
+- [x] Check verified certificate numeric IDs, exact SAN/issuer/build config/digest/trigger/run URI in both proofs, and provenance build type/caller/external parameters/resolved source/invocation. SPDX lacks SLSA caller fields; use its certificate plus subject/document constraints.
+- [x] Separate BuildEvidenceVerified, PublicationVerified and consumer ActionAuthorized states; constructors remain private. A retained verified-release-asset owns private bytes/handle and source/policy/role evidence. Read-only CLI verification returns a VerificationReport, not deployment authorization. The linked integration plan adds the private action-scoped VerifiedArtifact only after concrete context approval; an asserted path/hash cannot construct it. Stream bounded asset responses into retained files, enforcing each role limit while downloading; do not buffer a 512 MiB executable through the gh JSON pipe or check limits only after writing it. Rehash before later use and reject offline official-deploy construction.
+- [ ] Official project first-use remains pending: upstream attest 4.2.2 formats and both real predicate signatures are measured in the report above, but third-party fixtures cannot satisfy the official repository/index policy. Exercise first-use verification using an independently trusted previous verifier or source-built verifier from independently approved source, never the downloaded executable verifying itself. Commit `Verify complete official release evidence before authorization`.
+
+### Task 20: Expose read-only CLI verification and bootstrap instructions
+
+**Create:** CLI `src/commands/release.rs`, `tests/release_cli.rs`, `src/release/offline.rs`, `src/release/tests/offline.rs`, `docs/guide/release-verification.md`.
+**Modify:** CLI `src/commands/mod.rs`, `src/run.rs`, `src/release/mod.rs`, `src/release/tests/mod.rs`; `docs/guide/cli.md`, `.vitepress/config.mts`.
+
+- [x] Register `mod offline` in both the private production and test roots before its first focused run. Register the public command module/dispatch before process tests; run `release::tests::offline` with the nonzero-selection guard in addition to the CLI process target.
+- [x] Test the required parse path `ts release verify v1.2.0 --asset ts-aarch64-apple-darwin --expected-source-commit <approved-commit>`, invalid source/asset/unsupported offline-deploy flags and no provider/config/build hooks on all failure paths.
+- [x] Run `cargo test -p trusted-server-cli --target "$HOST_TARGET" --test release_cli`; expect unknown command.
+- [x] Add the command adapter to the reusable host verifier. The initial public surface stays the spec's verify/tag/asset/expected-source contract; any cache/export/output flag MUST be documented and reviewed, not smuggled into an implementation example.
+- [x] Document trusted gh installation and independent source/previous-verifier bootstrap before first executing downloaded ts. A source-built verifier provides approved-source trust, not official binary provenance for itself. Describe exact policy checks after primitive gh signatures; do not instruct self-verification or checksum-only installation.
+- [x] Add an internal build-evidence-only offline verification path, reusing parser/policy/subject/SPDX joins and bounded gh runner with independently approved roots/source/digest. Test it with networking denied and token absent; its result cannot construct publication/deployment authorization. No initial public offline flag is added. Document the pinned primitive commands and the manual companion/document/policy checks needed beyond their exit status; offline success is build evidence only, no official release membership or offline deploy. Run CLI helper, docs lint/format/build and malformed/timeout/zero-provider-write fixtures. Commit `Expose official release verification and trusted bootstrap`.
+
+### Task 21: Validate and document manual Fastly production consumption
+
+**Create:** release tool `src/package.rs`, private `package::tests`, bounded manual Fastly archive fixtures and public command tests.
+**Modify:** `docs/guide/release-verification.md`, `docs/guide/cli.md`, `CHANGELOG.md`; correct obsolete config-embedding comments in source/test/setup files identified below.
+
+- [x] Test accepted four-member layout, generic manifest-only archive, swept-in files, reserved/empty package name, traversal, links, duplicates, wrong module/manifest, malformed/non-core wasm and max-size bounds.
+- [x] Run `cargo test -p trusted-server-release --target "$HOST_TARGET" package::tests` with the nonzero-selection guard; expect absent inspector.
+- [ ] Use a fresh private directory, independently bootstrapped approved-source `trusted-server-release inspect-fastly-package`, an allowlisted deployment-only manifest and verified wasm. `compute pack --wasm-binary` has two output archives; select named archive only after exact layout/content checks. Pack/validate accepting a file does not prove valid Wasm or application execution. Verify valid core format and positive publisher-request fixture separately.
+- [x] Inspector takes the approved expected executable digest and manifest identity from the successful verification/context procedure, rehashes both the retained archive and its actual module member immediately before submission, and never trusts a digest supplied by the archive. Document trusted-source acquisition for the helper; it is not a separately authenticated release asset.
+- [x] Document observed service/base-version bindings and explicit production command with --service-id, --version and --no-default-domain. Explain manifest precedence, automatic clone/activation, possible same-hash skip and inability to supply integrated staging/preactivation guarantees. Serialize manual operator changes. No compute publish/source build is permitted.
+- [ ] Run a separately authorized disposable Fastly service submission; compare submitted member and actual returned version, including skip/uncertain cases. Record live proof before declaring AC-9 passed. No customer context or provider credentials enter producer jobs.
+
+  This exit remains unchecked: no live service submission is authorized in the
+  local Task 21 increment. Inspector/command tests and instructions do not supply
+  submitted-member, returned-version or application-runtime observations.
+
+- [x] Correct false config-embedding text in `.github/actions/setup-integration-test-env/action.yml`, `.github/workflows/test.yml`, integration runtime/framework/parity helpers, browser infra helper and Spin app/middleware/route comments; behavior changes remain separate. Commit `Document and validate verified-byte Fastly deployment`.
+
+- [x] Update `docs/guide/getting-started.md`, `edgezero.md` and `error-reference.md`: canonical `x-ts-version` is full source identity, external tag belongs to the index, and development retains #1213 display fallback. Annotate the historical #1213 goals. Validate manual retained-byte packaging/submission as AC-9/D6 and operator guidance as AC-9/D8; upstream EdgeZero delay MUST NOT block this manual route. Context/preactivation/staging/recovery remain AC-8.
+
+Local implementation (2026-10-21): `inspect-fastly-package` selects only the
+named archive derived from a separately approved manifest, checks its four raw
+TAR members without extraction and validates actual module bytes with the pinned
+core-Wasm inspector. The initial manifest profile is deliberately narrow: exactly
+`manifest_version = 3` and a portable nonreserved `name`, in canonical two-line
+form without comments. It accepts no build hooks, setup payloads or local fixtures.
+Held-file/path identity checks and repeated archive/member hashes precede the
+diagnostic report; expected hashes are independent inputs and grant no authority.
+Pure archive fixtures and command tests exercise local inspection only.
+
+The guidance documents trusted helper bootstrap, separate retained verified-byte
+acquisition, service/base-version observations and explicit production limits.
+`ts release verify` still has no public export option. The source-header split
+and historical #1213 development fallback remain documented. The checked guidance
+item above records the text implementation, not completion of its AC-9/D6 live
+validation dependency. An actual pinned Fastly CLI pack/inspect compatibility run,
+positive application-request runtime acceptance in this manual operation, and
+separately authorized disposable-service submission remain unobserved here.
+The pack/private-directory exit and live submission exit stay unchecked; AC-9
+and Task 21 are not complete. No production selector, workflow trigger, transfer
+adapter, signer, deployment code or provider resource was changed.
+
+Local verification passed 17 pure package tests with a nonzero-selection guard,
+both new public-command tests (spawning only the release binary), strict native
+all-target/all-feature Clippy, documentation generation, formatting and workflow
+lint. The acceptance command failed before dispatch existed and passed afterward;
+a non-UTF-8 report-path panic was separately reproduced and corrected. Independent
+spec and quality review found no remaining findings. No sandbox/container tests,
+Fastly CLI process or provider submission were run locally. The complete hosted
+CI matrix and actual pinned-pack compatibility remain separate validation.
+
+### Task 22: Full validation, qualification evidence and release handoff
+
+**Modify:** the implementation PR's evidence record and docs; no automatic production mutation.
+
+- [ ] Run the complete command block below and collect exit statuses/log summaries. On local certificate/localhost sandbox failures rerun the same tests with needed access; do not weaken TLS or alter assertions.
+- [ ] Rehearse hosted source authorization, shared JS, Fastly A/B, all three native A/SBOMs, optional B terminal failures, actual exact-action signatures, immutable draft/publication and full consumer verification together. Toy/synthetic component proofs cannot replace this complete composition.
+- [ ] Recheck permission/config separation, governance/rules/bypass authority, bootstrap docs, actual platform evidence and live manual submission. Missing evidence blocks tag enablement; native B equality, packaging or upstream integration do not add hidden blockers.
+- [ ] Review against AC-1–AC-7, AC-9–AC-10; keep AC-8 separate. Use @superpowers:requesting-code-review and @superpowers:verification-before-completion. Maintainer approval precedes any production tag.
+- [ ] Commit validated documentation/evidence with `Record initial release qualification`; update existing PR #1262 with implementation and validation evidence only when the required checks pass; never create a replacement implementation PR.
+
+## Threat-to-negative-proof trace
+
+| Threat | Existing test families | Plan negative proofs                                                                                               |
+| ------ | ---------------------- | ------------------------------------------------------------------------------------------------------------------ |
+| TH-1   | T-8, T-9               | Tasks 13, 17, 19: byte/subject/companion tampering and publication membership                                      |
+| TH-2   | T-8, T-9, T-10         | Tasks 17–20: independent source-policy acquisition, roots, historical identity and offline limits                  |
+| TH-3   | T-2, T-3, T-4, T-5     | Tasks 3, 7–11: source/common-Git/env audit, actual lifecycle/compile denial, native and JS coverage                |
+| TH-4   | T-7                    | Tasks 3, 14, 16: unlisted/self-approved RC, remote-ref substitution, governance bypass, skipped/wrong-SHA gates    |
+| TH-5   | T-4, T-7               | Tasks 8, 12, 15: authenticated tools/full closure, real boundary, current-run transfers and separated signer       |
+| TH-6   | T-9, T-11, T-12        | Tasks 18–21 and linked AC-8: exact gh bootstrap, retained substitution, bounded children, manual equality/recovery |
+| TH-7   | T-7, T-8, T-9          | Tasks 15–19: exact certificate/source/caller/run semantics and immutable membership; GitHub remains a trust root   |
+
+## Focused Rust test selection guard
+
+Before accepting any filtered private-module run, require an actual selected test. Register producer modules/tests before filters such as `documents::tests`, `preflight::tests`, `source::tests`, `materials::tests`, `process::tests`, `boundary::tests`, `preparation::tests`, `javascript::tests`, `qualification::tests`, `recipe::tests`, `inspect::tests`, `composition::tests`, `spdx::tests`, `collection::tests`, `distribution::tests`, `publication::tests` and `package::tests`. For Tasks 17–20 select `trusted-server-cli` and its registered `release::tests::{documents,gh,verification,offline}` filters instead. An intended compile failure for missing behavior can establish the first red state; successful zero selection never can.
+
+```sh
+set -eu
+HOST_TARGET=$(rustc -vV | sed -n 's/^host: //p')
+test -n "$HOST_TARGET"
+RELEASE_TEST_PACKAGE=trusted-server-release
+RELEASE_TEST_FILTER=documents::tests
+RELEASE_TEST_LIST=$(mktemp)
+trap 'rm -f "$RELEASE_TEST_LIST"' EXIT
+cargo test -p "$RELEASE_TEST_PACKAGE" --target "$HOST_TARGET" \
+  "$RELEASE_TEST_FILTER" -- --list > "$RELEASE_TEST_LIST"
+awk '/: test$/ { count++ } END { if (count == 0) { print "Focused release test filter selected zero tests"; exit 1 } print "Selected " count " release tests" }' "$RELEASE_TEST_LIST"
+cargo test -p "$RELEASE_TEST_PACKAGE" --target "$HOST_TARGET" "$RELEASE_TEST_FILTER"
+```
+
+Set `HOST_TARGET=$(rustc -vV | sed -n 's/^host: //p')` before each independent shell session/filter. `$APPROVED_SOURCE_COMMIT` MUST come from independent source approval, never the release index. These Cargo commands build a local developer tool only. Qualified production wrappers MUST select the independently approved source and OS-native toolchain described above. The ordinary `test-release-native` CI matrix on Ubuntu 24.04/macOS 15 directly runs all native helper tests, clippy/all-targets/all-features, documentation and actual nonzero native JS `release_prebuilt` tests/clippy. The prior WASI alias selecting zero native tests supplies no coverage. This source-built CI matrix is not production bootstrap or qualification proof. Future aliases require separate review; adapter/CLI aliases do not cover the helper. The explicit host commands below remain required until aliases are reviewed/wired. Never use default WASI output to bootstrap a native producer.
+
+## Full implementation verification commands
+
+Run from the repository root with pinned tools and installed npm dependencies. Linux CI uses its host triple; macOS can use the CLI helper. Record each command independently so a later command cannot mask an earlier failure.
+
+```sh
+cargo fmt --all -- --check
+cargo clippy-fastly
+cargo clippy-axum
+cargo clippy-cloudflare
+cargo clippy-cloudflare-wasm
+cargo clippy-spin-native
+cargo clippy-spin-wasm
+cargo clippy-cli
+cargo clippy-codegen
+cargo test-fastly
+cargo test-fastly-reuse
+cargo test-axum
+cargo test-cloudflare
+cargo test-spin
+cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test parity
+./scripts/test-cli.sh
+cargo test -p trusted-server-core --test template_build_digest
+cargo clippy -p trusted-server-core --test template_build_digest -- -D warnings
+scripts/lint-wasm-clock.sh
+HOST_TARGET=$(rustc -vV | sed -n 's/^host: //p')
+cargo test -p trusted-server-release --target "$HOST_TARGET" --all-features
+cargo doc -p trusted-server-release --target "$HOST_TARGET" --no-deps --all-features
+cargo test -p trusted-server-js --target "$HOST_TARGET" --test release_prebuilt
+cargo clippy -p trusted-server-js --target "$HOST_TARGET" --all-targets --all-features -- -D warnings
+cargo clippy -p trusted-server-release --target "$HOST_TARGET" --all-targets --all-features -- -D warnings
+```
+
+Run the remaining commands with the repository-pinned Node/npm selected explicitly (subdirectory shell startup can otherwise pick a different Node):
+
+```sh
+(cd crates/trusted-server-js/lib && node build-all.mjs && TRUSTED_SERVER__RELEASE_JS_TESTS=1 npx vitest run && npm run format)
+(cd docs && npm run lint && npm run format && npm run build)
+docs/node_modules/.bin/prettier --config docs/.prettierrc --check "*.md" ".claude/**/*.md" ".github/**/*.md" "crates/**/*.md" "scripts/**/*.md" "scripts/**/*.mjs" "tinybird/**/*.md"
+RELEASE_HOST_TARGET="$(rustc -vV | awk '/host:/ { print $2 }')"
+cargo run -p trusted-server-cli --target "$RELEASE_HOST_TARGET" -- dev lint domains --staged
+git diff --check
+git diff --cached --check
+```
+
+Stage the reviewed implementation files before the staged-domain check; each grouped command stops at its first failure. New producer/schema dependencies MUST be installed at their exact reviewed versions first. No bare workspace cargo test/build or global all-features clippy.
+
+## Traceability and milestone exits
+
+| Requirements                                                          | Tasks / principal negative proof                                                                   | Acceptance |
+| --------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- | ---------- |
+| R-COHORT, R-PLATFORM, R-VARIANT                                       | 1,3,8,9: exact cohort/profile, incompatible native runtime, unsupported reuse                      | AC-1, AC-2 |
+| R-CONFIG, R-INPUTS, R-ENV                                             | 3–5,7,9: operator inputs, unexpected source files, skips/overrides, source integrity               | AC-2       |
+| R-JS                                                                  | 5–7,10: locked A/B, inventory joins, input versus retained bytes                                   | AC-3       |
+| R-BUILD, R-REPEAT, R-NATIVE                                           | 8–12: actual confinement, complete wasm equality, valid transfers, honest native outcome           | AC-3       |
+| R-SBOM                                                                | 10,11,13,19: real Rust/native/JS coverage and SPDX root/predicate equality                         | AC-4       |
+| R-FACTS                                                               | 4: strict full source, owning target/variant, external tag and unchanged service identity          | AC-5       |
+| R-SOURCE, R-SIGN, R-PUBLISH                                           | 14–16: approved lightweight main/RC, exact-commit gates, isolated signer, immutable reconciliation | AC-6       |
+| R-INDEX, R-EVIDENCE, R-POLICY                                         | 2,13,17,19: schema/semantic joins, subjects and independent policy identity                        | AC-4, AC-7 |
+| R-BOOTSTRAP, R-BOUNDS, R-PUBLICATION                                  | 18–20: trustworthy first use, limits/pipe pressure, exact REST/signed membership                   | AC-7       |
+| R-OFFLINE                                                             | 19,20: approved build proof only; offline official deploy rejected                                 | AC-7       |
+| R-DEPLOY/R-PACK manual portion, R-MANUAL                              | 19,21: verified bytes before mutations, explicit manual limits and live submission                 | AC-9       |
+| R-DEPLOY/R-PACK integrated portion, R-CONTEXT, R-EDGEZERO, R-RECOVERY | Linked upstream plan, not first-release closure                                                    | AC-8       |
+| Operator/CLI/changelog guidance                                       | 20–22: source-header identity, bootstrap and manual-route instructions (D8)                        | AC-9       |
+| R-FOLLOWUP                                                            | 1,20–22: explicit unsupported adapters/reconstruction/offline; January supersession                | AC-10      |
+
+A completed task means its described tests pass and reviewed code exists, not merely that its checkbox was checked. Recipe pins/qualification are concrete outputs of Task 8, not assumed values. An unavailable required host blocks the selected contract; it does not authorize weakening it. For optional CLI B only, bounded unavailability is an honest nonblocking result.
+
+## Planning-only verification and handoff
+
+For these Markdown plans, validate formatting, links, shell syntax, requirement coverage, task dependencies and independent review. Do not claim that runtime tests verify implementation that has not been written. Continue in the existing main checkout on branch `spec/1235-release-attestation` and PR #1262. Automated review is not maintainer approval.
diff --git a/docs/superpowers/plans/2026-10-13-cli-packaging-attestation-integration.md b/docs/superpowers/plans/2026-10-13-cli-packaging-attestation-integration.md
new file mode 100644
index 0000000000..23ecf8caf5
--- /dev/null
+++ b/docs/superpowers/plans/2026-10-13-cli-packaging-attestation-integration.md
@@ -0,0 +1,112 @@
+# CLI package attestation integration Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Make installable CLI packages verifiably contain the canonical attested executables, without creating a second release authority or weakening #1235 evidence.
+
+**Architecture:** Consume final canonical Build A executables and their qualified evidence; packaging never recompiles or alters those bytes. A separately signed package inventory binds outer package digests to exact executable members. One publication job uploads canonical and selected package evidence before publishing a new immutable tag.
+
+**Tech Stack:** Existing #1292 shell helpers/nfpm packaging design, the host-only Rust release tool's strict metadata and bounded package/archive modules, SPDX canonical executable evidence, pinned GitHub attest/gh contracts from the primary plan.
+
+---
+
+The [Rust migration addendum](../specs/2026-10-14-release-tooling-rust-migration.md) applies to every new packaging producer helper. Extend private `crates/trusted-server-release/src/package.rs` and `distribution.rs` modules; retain thin POSIX/nfpm adapters, no introduced Python or generic packaging framework. Native independently approved-source bootstrap and all exact executable/acquisition checks remain required. Unit tests stay private alongside modules; fixture data uses the crate's `tests/fixtures/` and public process tests use `tests/commands.rs`.
+
+## Inputs and prerequisites
+
+Read the [primary release plan](2026-10-13-attested-release-implementation.md), [#1235 contract](../specs/2026-10-09-1235-release-attestation-design.md), PR #1292's packaging spec/plan and its final reviewed revision. At planning time #1292 is documentation only; do not assume its workflow/helper paths exist. Fetch or stack the owning changes before editing them. This plan supplements that plan rather than copying its independent publish job.
+
+The governing draft #1235 index v1 covers three raw CLI binaries plus Fastly, no package-inventory reference and no Linux ARM64. The package integration therefore requires a reviewed additive contract and new schema version. Task P1 MUST approve it before P2–P7 implementation. Neither package provenance alone nor SHA256SUMS satisfies the executable's SPDX/provenance graph.
+
+**Selected initial integration:** preserve the existing three qualified CLI targets. Produce three Linux x86_64 installer formats and two macOS archives (five packages). This deliberately does not complete #863's Linux ARM64 requirement. Task P8 independently extends canonical qualification/SBOM/policy to ARM64 before publishing its three packages. If maintainers require all eight installer assets in the first packaging release, P8 becomes a prerequisite before that release; no half-qualified ARM asset is slipped into the three-target cohort.
+
+Initial #1235 release can happen first; packaging appears on a later new tag once its approved contract is enabled. Never backfill packages into an immutable release. No implementation step may remove #1262's raw assets to make room for packages.
+
+### Task P1: Approve the cross-PR contract and schema migration
+
+**Modify after owning branch is available:** `docs/superpowers/specs/2026-10-12-863-cli-release-packaging-design.md`, `docs/superpowers/plans/2026-10-12-cli-release-packaging.md`, #1235 contract.
+**Create:** `docs/superpowers/specs/schemas/release-index-v2.schema.json`, `cli-packages-v1.schema.json`; keep index v1 immutable for historical verification.
+
+- [ ] Write a concrete spec delta: one release.yml owner; reusable release-build.yml signer; canonical three CLI profiles plus Fastly unchanged; five initial wrappers; ARM enablement separately selected; package code/member evidence is additive.
+- [ ] Agree on #1262's GNU/macOS baselines and real Intel startup. Do not treat Ubuntu 22.04/glibc 2.35 or Rosetta alone as satisfying GNU 2.34/Intel qualification. Keep package ecosystem smoke tests as additional evidence.
+- [ ] Resolve version policy explicitly: packaging milestone chooses #1292's tag equals owning CLI Cargo version, with documented maintainer bump/changelog procedure. This is a reviewed narrower packaging prerequisite, not an attempt to embed external tag into binaries. Initial un-packaged #1235 tags need not retroactively adopt it.
+- [ ] Approve index v2's optional `package_inventory` reference and its attestation references with exact name/length/digests. Enable it only in the reviewed `phase1-fastly-cli-packaged` cohort and updated consumer policy. Approve `ts release verify <tag> --package <package-asset> --expected-source-commit <commit>` as the distinct package-selection interface; `--package` and `--asset` are mutually exclusive. Older v1 consumers reject unsupported v2, with an independently trusted verifier upgrade path documented.
+- [ ] Define package inventory records: schema/source/cohort/recipe/policy identity, each package name/format/architecture/size/SHA-256, exact executable member path/mode/size/SHA-256 and canonical raw asset name. Refer to raw asset digests, not release-index digest: index → inventory → package/member MUST NOT form a self-hash cycle. Bundle references are in the index, not inside the inventory that the bundles authenticate.
+- [ ] Replace #1292's signed/annotated `git tag -s` release instruction with `git tag v<version> <approved-commit>` followed by the explicit tag push. Validate lightweight object type; a tag signature does not replace the approved source/signing policy.
+- [ ] Get the delta approved/merged and update plan baseline. Commit `Align CLI packaging with canonical attestation`.
+
+**Exit:** No implementer chooses their own signer, platform floor, ARM assurance, archive relationship or versioning rule.
+
+### Task P2: Consume canonical executables without transformations
+
+**Modify/create according to #1292 ownership:** `scripts/release/package-linux.sh`, `package-macos.sh`, `packaging/nfpm.yaml`, release tool private `package::tests` and `tests/commands.rs`.
+
+- [ ] Write tests rejecting wrong source/target/role, source recompilation, strip/sign hooks, unverified raw input, altered member and CLI B output substituted for A.
+- [ ] Derive `HOST_TARGET=$(rustc -vV | sed -n 's/^host: //p')`; run `cargo test -p trusted-server-release --target "$HOST_TARGET" package::tests` with the primary plan's nonzero-selection guard; expect missing integration behavior. These local source-built commands do not qualify native bootstrap.
+- [ ] Accept only Task 12/13 primary-plan validated A output and identity table. All final stripping/signature transformations occur in the canonical recipe before its digest/SBOM, never in packaging. Remove #1292's independent strip step and compiled-cache restoration from the canonical build path.
+- [ ] Add packaging configuration for the qualified x86_64 Linux executable and both Apple executables. Preserve member bytes; set documented installation modes. nfpm/tool acquisition has reviewed version/digest verification, not a floating installer.
+- [ ] Test canonical file unchanged before/after all package formats. Commit `Package the canonical CLI bytes without modification`.
+
+### Task P3: Inspect whole package structure and bind members
+
+**Extend:** release tool `src/package.rs`, `src/distribution.rs` and private registered tests; add adversarial data under `crates/trusted-server-release/tests/fixtures/packages/` and process cases to `tests/commands.rs`. Proposed fixed commands are `trusted-server-release inspect-cli-package` and `make-package-inventory`, only after P1 approval.
+
+- [ ] Write tests for nested traversal, links/hardlinks, duplicate members, oversized compressed/decompressed content, extra executable members, wrong architecture/mode, substituted maintainer script, unsupported compression and altered ts bytes.
+- [ ] Run `cargo test -p trusted-server-release --target "$HOST_TARGET" package::tests` and `distribution::tests` separately with the nonzero-selection guard; expect absent inspector.
+- [ ] Implement bounded format-specific inspection: Debian ar/control/data archives, RPM payload/header, Arch tar and macOS tar. Use maintained parsers/pinned utilities where possible. Each adapter validates allowed installation paths, executable ts, license/readme and explicitly approved metadata/scripts; reject unknown code-bearing entries. A raw tar scan is insufficient for .deb/.rpm.
+- [ ] Compare extracted executable bytes against canonical retained SHA-256/size, check 0755 installation mode, then hash the final outer package. Generate deterministic inventory only after every selected wrapper passes. Do not compare an archive digest directly to executable digest.
+- [ ] Validate closed package schema and source/target/profile joins with the canonical index data. Reject inventory attempts to approve an unknown raw target. Commit `Bind installer packages to canonical CLI members`.
+
+### Task P4: Smoke-test installation and provenance-aware extraction
+
+**Modify:** #1292 smoke helpers/workflow jobs; release tool private package-smoke tests and public process fixtures.
+
+- [ ] Test that failed install/startup/version or member mismatch blocks the selected package cohort; metadata-only architecture checks do not count as execution qualification.
+- [ ] Run `cargo test -p trusted-server-release --target "$HOST_TARGET" package_smoke` with the nonzero-selection guard after registering these cases; expect incomplete checks.
+- [ ] Install Linux wrappers in reviewed clean Ubuntu/Fedora/Arch environments, run version/help/config-init outside a checkout, and compare installed /usr/bin/ts to canonical digest. Preserve the GNU compatibility qualification independently of package-manager tests.
+- [ ] Extract/run macOS archives on actual qualified ARM/Intel hosts. Rosetta may be extra coverage, never the sole Intel gate. Restore executable permissions without altering bytes; verify loader requirements.
+- [ ] Record exact container/tool/OS identities and outcomes. Smoke images MUST be pinned and qualified, not `latest`. Commit `Qualify installed CLI package behavior and identity`.
+
+### Task P5: Sign package evidence inside the existing trusted boundary
+
+**Modify:** `.github/workflows/release-build.yml`, release tool `src/distribution.rs`, workflow contract tests.
+
+- [ ] Test package metadata cannot replace executable SPDX/provenance, wrong signer/action/run, modified outer bytes, inventory-member mismatch and unapproved package subject.
+- [ ] Run `cargo test -p trusted-server-release --target "$HOST_TARGET" distribution::tests` and `workflow_contract` separately with the nonzero-selection guard; expect package evidence unsupported.
+- [ ] Reuse exact same-revision signer and pinned attest 4.2.2; do not keep #1292's direct v2 provenance action in publish. Package provenance names each final package plus authenticated package inventory as exact subjects. Raw executable proofs still name only their approved executable/companions.
+- [ ] Add a signed package-inventory proof and index v2 references for inventory/bundles. Root index is assembled after package proofs exist and covers them; no signature/checksum cycle. For the CLI's component composition, consumers use the executable's SPDX proof. Do not advertise an enclosing installer SBOM unless a separate container-level scope is actually generated.
+- [ ] Verify actual pinned certificates/provenance and all wrapper/member edges before publication. Commit `Attest CLI installer and member evidence`.
+
+### Task P6: Extend consumer policy and bootstrap before v2 publication
+
+**Modify:** CLI `src/release/policy.rs`, `documents.rs`, `evidence.rs`, `release-policy.json`, release verification/CLI tests, `docs/guide/release-verification.md`, packaging install guide.
+
+- [ ] Add tests for v1 historical acceptance, v2 package selection, unknown package/version, altered inventory/member, verified outer package with unverified executable and the inverse.
+- [ ] Run CLI release unit/process tests; expect unsupported v2.
+- [ ] Implement the reviewed v2/member policy without letting a downloaded index select arbitrary package kinds or actions. Verify package signature/official membership, authenticate inventory, verify raw executable/SBOM graph and prove exact installed/extracted member equality before recommending installation/execution.
+- [ ] Implement the exact package-selection syntax approved in P1; do not overload `--asset` silently to turn arbitrary archives into canonical executable subjects. Use the same internal verification library, with a distinct verified-package result and retained-member identity.
+- [ ] Qualify independently trusted source/previous-verifier bootstrap for first v2 use. A CLI that only supports v1 cannot automatically authorize its own unverified upgrade. Commit `Verify packaged CLI members under reviewed v2 policy`.
+
+### Task P7: Integrate one complete immutable publication
+
+**Modify:** `.github/workflows/release.yml`, package release helpers, `CONTRIBUTING.md`, `CHANGELOG.md` and tests.
+
+- [ ] Test incomplete wrappers, mixed source versions, package-only draft, missing raw/SBOM assets, an existing immutable v1 tag and uncertain publish response.
+- [ ] Run `cargo test -p trusted-server-release --target "$HOST_TARGET" publication::tests` with the nonzero-selection guard; expect package cohort unsupported.
+- [ ] Publish exact canonical plus selected wrapper assets/evidence/checksums through the single owner. No independent #1292 publish job races or finalizes the tag first. Require all selected wrapper gates, complete downloads/joins and post-publication immutable checks.
+- [ ] Rehearse the whole v2 release and trusted package install in an authorized disposable repo, then run all AGENTS gates and producer/consumer tests. Only a separately authorized new production tag follows.
+- [ ] Commit `Publish canonical and packaged CLI evidence together`.
+
+### Task P8: Qualify Linux ARM64 before expanding packaging scope
+
+**Modify through a separate reviewed extension:** cohort, tools, versioned schema, consumer policy, native recipe/composition fixtures and package matrix.
+
+- [ ] Obtain approval for an aarch64-unknown-linux-gnu canonical executable, provenance-sbom profile and qualified compatibility floors. Until then it is unsupported, not a weaker undocumented extra asset.
+- [ ] Build actual ARM64 A with fresh JS/materials, validate native/external components, generate full SPDX and attest it under the same policy. Native B remains a bounded optional measurement unless explicitly promoted.
+- [ ] Run startup on actual ARM64 baseline hosts and each claimed package ecosystem. If an Arch ARM64 runtime cannot be qualified, either retain an explicit metadata-only distribution limitation approved in the packaging spec or defer that package; do not advertise fully smoke-tested execution.
+- [ ] Approve the `phase1-fastly-cli-arm64-packaged` cohort with five canonical executables and eight wrappers, and update the versioned schema/producer/consumer expected sets before runs; repeat P2–P7 for ARM packages. A failed selected ARM A/SBOM/runtime gate blocks the expanded cohort, with no after-failure fallback.
+- [ ] Commit `Qualify and attest the ARM64 CLI distribution`; close #863 only when its approved platform/package acceptance is satisfied.
+
+## Completion and review
+
+P1–P7 produce verifiable packages for the initially qualified targets on a new release. P8 completes the original all-four-platform packaging intent after qualification. Packaging does not weaken or retroactively expand existing #1235 releases. Run each new focused test first, then the primary plan's full AGENTS command list and package-manager/actual-host qualification. Review the complete evidence graph, source/tag/version consistency and first-use bootstrap before publication.
diff --git a/docs/superpowers/plans/2026-10-13-fastly-prebuilt-edgezero-integration.md b/docs/superpowers/plans/2026-10-13-fastly-prebuilt-edgezero-integration.md
new file mode 100644
index 0000000000..bbbc5d41f9
--- /dev/null
+++ b/docs/superpowers/plans/2026-10-13-fastly-prebuilt-edgezero-integration.md
@@ -0,0 +1,125 @@
+# Fastly prebuilt EdgeZero integration Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Add byte-preserving online production/staging deployment of verified Fastly wasm through a typed EdgeZero API with durable recoverable observations.
+
+**Architecture:** Trusted Server owns official verification, operator authorization and a private retained artifact. EdgeZero owns Fastly packaging/transport, observed context and concrete lifecycle operations. A durable operation sink records intent before every write and response afterward; uncertain provider state is reconciled read-only before any retry.
+
+**Tech Stack:** Existing Rust/error-stack consumer, reviewed upstream EdgeZero/Fastly CLI 15.1.0 or qualified API transport, restricted atomic local journal, provider-free runner fixtures and authorized disposable Fastly qualification.
+
+---
+
+## Authority and prerequisites
+
+Read the [primary plan](2026-10-13-attested-release-implementation.md) and [contract R-DEPLOY through R-RECOVERY](../specs/2026-10-09-1235-release-attestation-design.md#r-deploy). This is AC-8, a separate integration milestone, not an initial #1235 closure condition. It depends on the primary verifier/retained artifact, package inspector and public qualification; it may be prepared upstream in parallel but cannot ship an official release path without that verifier.
+
+Baseline EdgeZero revision is `683202c66948146ec360f490126f1d60f920288b`. Its generic adapter operation returns unit, source deploy can execute manifest shell commands, and Fastly staging builds/autoclones before staging. These are reference mechanisms, not an existing typed prebuilt seam.
+
+Use a separate upstream EdgeZero checkout/worktree; do not edit Cargo's shared cached checkout. Upstream relative paths below belong to that repo. After review, update Trusted Server's Cargo pin/lock rather than vendor-patching the cache.
+
+## Proposed API boundaries
+
+Keep small concrete APIs, with default unsupported behavior for other adapters. Do not add speculative Cloudflare/Spin/Axum payload variants.
+
+The owning upstream design MUST implement these concrete records (not empty adapter variants):
+
+| Record / interface                                 | Required fields / behavior                                                                                                                                                                                  |
+| -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `PreparedFastlyPackage`                            | Private retained archive handle/lifetime, checked archive length/SHA-256, canonical module length/SHA-256, deployment-only manifest SHA-256 and inspected package name                                      |
+| `PrebuiltFastlyRequest`                            | Strong service ID, exact base version, production/staging mode, prepared payload and resolved context/sharing policy                                                                                        |
+| `WriteIntent`                                      | Stable operation ID, monotonically increasing sequence, phase (`clone`, `upload`, `relink`, `selector-write`, `stage`, `activate`), exact resource/version where known, request identity digest             |
+| `WriteObservation`                                 | Matching operation/sequence/phase, actual response resource/version, known/unknown result and sanitized evidence references                                                                                 |
+| `OperationSink::before_write(&WriteIntent)`        | Synchronous concrete fallible result; caller MUST flush durable intent and failure forbids the following mutation                                                                                           |
+| `OperationSink::after_response(&WriteObservation)` | Synchronous concrete fallible result; failure stops subsequent writes while preserving already attempted effects                                                                                            |
+| `PrebuiltOutcome`                                  | Exact module/package/service identities, optional exact version, last confirmed phase, mutation-attempted flag and per-phase known/unknown results on success and error; no inferred active-version success |
+
+E1 follows the owning repository's AGENTS.md for concrete error conventions and visibility. A result-only deploy method is insufficient: it cannot let the caller flush a journal before hidden internal link/selector mutations. No publisher signing or universal attestation registry is introduced.
+
+### Task E1: Approve upstream API and operation-state contract
+
+**Upstream modify:** `crates/edgezero-adapter/src/registry.rs`, `crates/edgezero-cli/src/lib.rs`.
+**Upstream create:** `crates/edgezero-adapter/src/prebuilt.rs`, `crates/edgezero-adapter-fastly/src/prebuilt.rs`.
+
+- [ ] Write fake adapter tests for unsupported adapter/action, payload/context mismatch, mutation attempts before authorization, unit-success ambiguity and failed durability sink, truncated payload, pre-send failure versus sent/no-response uncertainty and missing exact version.
+- [ ] Run upstream targeted prebuilt tests; expect missing API.
+- [ ] Define private retained payload identity, exact service/base version, action/mode, logical/physical mappings, staging selector identity and sharing policy. Return structured observed IDs/phase states and error outcomes with known/unknown state, not an active-version lookup.
+- [ ] Define explicit phase enum and WriteIntent/WriteObservation with stable operation/sequence IDs; before_write MUST synchronously succeed before every provider/config mutation. Journal persistence errors halt further writes, even after earlier successful writes.
+- [ ] Approve exact-source Fastly unsupported defaults and review public API/docs/error types. Commit `Add a typed prebuilt Fastly operation interface`.
+
+### Task E2: Prepare byte-preserving packages from retained inputs
+
+**Upstream modify/create:** Fastly `src/prebuilt.rs`, `src/prebuilt/package.rs`, provider-free package fixtures.
+
+- [ ] Write tests for retained-file/path replacement, changed package/member/manifest, generic archive selection, local-server config leakage, extra executable, traversal and unsafe names.
+- [ ] Run package tests; expect no validated prepared-payload constructor.
+- [ ] Adopt the primary plan's exact deployment-only manifest and bounded four-member inspection semantics. Rehash retained wasm, manifest and selected archive before transport. Never run source build, compute publish, annotation/strip/sign hooks or arbitrary manifest shell overrides.
+- [ ] Keep module/archive digests distinct. Public callers cannot construct prepared identity from arbitrary asserted hashes; constructors validate owned bytes and context.
+- [ ] Run byte-retention/adversarial fixtures against pinned real pack output. Commit `Prepare verified Fastly packages without rebuilding`.
+
+### Task E3: Resolve and validate actual deployment context
+
+**Upstream create:** Fastly `src/prebuilt/context.rs`; modify existing selector/link helper seams only as required.
+
+- [ ] Test declared logical IDs vs observed links mismatch, wrong selector/config key, unknown secret-reference metadata, conflicting shared staging selector and disallowed resource-sharing policy.
+- [ ] Run context tests; expect absent observed-context validation.
+- [ ] Resolve service/base version and fetch read-only provider links/selector state. Validate repository logical IDs, selected physical links/key, runtime selector entries and required secret-reference metadata. Secret values are write-only; do not claim plaintext readback or log/store resolved secrets.
+- [ ] Declare which KV/secret/external-effect resources staging shares versus isolates. Config-selector isolation alone does not imply all resource isolation. Validate resulting exact draft again before stage/activation.
+- [ ] Commit `Validate observed Fastly deployment bindings` after fake-provider negatives pass.
+
+### Task E4: Implement exact clone/upload/context/stage or activation
+
+**Upstream create:** Fastly `src/prebuilt/lifecycle.rs` and fake provider/command tests.
+
+- [ ] Write sequence tests: verify/package/context before first write; explicit clone returning draft ID; upload to that ID without autoclone; exact draft readback; stage or activate only that ID. Test same-hash skip, partial response and unsupported staged request.
+- [ ] Run lifecycle tests; expect absent state machine.
+- [ ] Invoke OperationSink before each mutation, including clone, upload, resource relinks, selector writes, stage and activation. Use explicit version update rather than compute deploy's automatic activation or combined update/autoclone.
+- [ ] Capture returned IDs from operation responses. Require validated resulting context before activation; staged success reports staged, not activated. Never guess success from exit zero or whichever service revision is currently active.
+- [ ] Stop on sink/provider uncertainty and preserve last known observation. Commit `Deploy prepared Fastly packages through exact lifecycle phases`.
+
+### Task E5: Implement durable journal and scoped serialization
+
+**Trusted Server create:** CLI `src/release/deployment/mod.rs`, `journal.rs`, `context.rs`; internal tests and `tests/release_deploy.rs`.
+
+- [ ] Write crash-injection tests before send/after send/before response, failed journal flush, receipt path replacement, process restart, shared-selector races and loss of temporary files.
+- [ ] Run CLI deployment tests; expect absent journal integration.
+- [ ] Implement persistent restricted storage, stable operation ID, private retained evidence/package/context and atomic state writes. Flush file plus directory at each durable intent/response boundary. A TempDir that disappears on process exit is not recovery storage.
+- [ ] Lock by service and relevant shared-resource identity across processes/environments; define stale-lock inspection/recovery without blindly deleting locks. Preserve production previous-version observation before mutation.
+- [ ] Record exact known/unknown state, policy/source/module/package hashes and sanitized context identities; no active config, token or resolved secrets. Deployment-only health is not_performed. Commit `Persist deployment intent and recovery observations`.
+
+### Task E6: Reconcile uncertainty without guessing or replaying mutations
+
+**Upstream create:** Fastly `src/prebuilt/reconcile.rs`; Trusted Server internal journal reconciliation tests.
+
+- [ ] Test known draft inspection, lost first-clone response, multiple indistinguishable candidate versions, changed selector ownership, unknown upload/activation and receipt failure after success.
+- [ ] Run reconciliation tests; expect missing read-only recovery.
+- [ ] Query exact known resources/versions where IDs exist; attach observations to the saved operation. A lost clone ID without provider idempotency cannot always be recovered. Keep it unknown; do not adopt a candidate by timestamp/package resemblance or mutate a guess.
+- [ ] Require explicit operator-approved reconciliation before another write. Do not automatically rollback after uncertain state, bypass serialization, or replay create/clone on restart. Health and rollback remain separate operations consuming known exact identities.
+- [ ] Review any public recovery command separately before adding it; internal support and runbook are required here. Commit `Reconcile uncertain Fastly operations without replay`.
+
+### Task E7: Review upstream revision and integrate release arguments
+
+**Trusted Server modify:** root `Cargo.toml`, `Cargo.lock`, CLI `src/run.rs`, `src/commands/mod.rs`.
+**Create:** CLI `src/commands/deploy.rs`, `src/release/deployment/transport.rs`.
+
+- [ ] Land reviewed upstream tests/docs, pin its exact revision and rerun source deploy regression tests. Do not modify the shared Cargo cache or float a branch pin.
+- [ ] Write command tests for source deployment preserved, release/passthrough/package/source conflicts, unsupported offline/adapter/variant, failed verification before journal/provider writes and unavailable prebuilt capability.
+- [ ] Add wrapper flattening existing DeployArgs plus reviewed release/source/receipt inputs. Source mode delegates as before. Release mode selects a compatible retained VerifiedArtifact, validates local action/context and invokes only the typed prepared path. No fallback to a source build.
+- [ ] Keep producer artifact capability and consumer implemented transport intersection: initially production only. Enable fastly-staging only after E8 qualification and reviewed cohort/policy change; old releases do not gain it by downloaded metadata.
+- [ ] Run CLI source/release regressions and all AGENTS gates. Commit `Integrate verified release deployment with EdgeZero`.
+
+### Task E8: Qualify production/staging, recovery and operator guidance
+
+**Modify:** CLI/release guide, changelog and evidence records; upstream full validation.
+
+- [ ] Execute fake-provider coverage for all writes, crash boundaries, context mismatches, locks and unknown results; verify no provider writes occur on failed official evidence.
+- [ ] Before enabling integrated production transport, execute end-to-end `ts deploy --release` production qualification on a separately authorized disposable Fastly service using an independently verified production-capable release. Assert canonical module bytes, explicit clone/upload to the exact returned draft, context validation before activation, the exact activated version, durable per-write observations and receipt/restart behavior. The primary manual compute-deploy rehearsal is a different transport and cannot satisfy this gate.
+- [ ] First qualify direct upstream prepared-byte staging on a separately authorized disposable Fastly service, using source-built fixtures and no claim of an official staging-capable release. Compare actual module/context and shared/isolated bindings, plus separate health/rollback commands. The initial production-only CLI/release MUST continue to reject staging before writes.
+- [ ] After that transport proof, approve the cohort and embedded policy capability change, then publish a separately authorized new staging-enabled release through the primary pipeline. Use the independently trusted verifier to qualify end-to-end `ts deploy --release --staging` against that new release. Test that historical production-only releases still reject staging; no downloaded metadata or test policy override enables it in the production CLI.
+- [ ] Qualify durable recovery across process restart and uncertain responses without exposing secrets. An irreducibly unknown clone remains a documented manual resolution case, not a passed exactly-once guarantee.
+- [ ] Record the already reviewed/qualified staging capability and historical producer/consumer compatibility explicitly. Document receipt limits and the actual loaded snapshot boundary for #161; unsigned operator observations are not publisher authority or remote execution proof.
+- [ ] Run upstream tests and all Trusted Server AGENTS gates, independent staff review, then hand off for maintainer deployment approval. Commit `Qualify integrated Fastly artifact deployment and recovery`.
+
+## Exit criteria
+
+AC-8 is met only when reviewed upstream code is pinned, production/staging preserve canonical bytes, actual context is validated before finalization, durability precedes every write, exact/unknown outcomes survive failure and live disposable qualification is recorded. No other adapter, publisher claim signer, remote execution attestation or generic deploy framework is implied.
diff --git a/docs/superpowers/specs/2026-01-15-attestation-design.md b/docs/superpowers/specs/2026-01-15-attestation-design.md
index 87b135bdbc..bec21f80b0 100644
--- a/docs/superpowers/specs/2026-01-15-attestation-design.md
+++ b/docs/superpowers/specs/2026-01-15-attestation-design.md
@@ -1,6 +1,6 @@
 # Runtime Integration Attestation Architecture
 
-> **Status:** Proposal
+> **Status:** Historical proposal. Binary-attestation sections are superseded in direction by the [October release artifact specification](2026-10-09-1235-release-attestation-design.md), which becomes the implementation contract upon approval. Runtime/configuration proposals remain reference material for #161.
 > **Author:** Architecture Team
 > **Date:** January 2026
 
@@ -563,7 +563,7 @@ Sigstore uses DSSE envelopes carrying in-toto Statements. The runtime attestatio
       "attested_by": {
         "identity": "iab-tech-lab",
         "oidc_issuer": "https://token.actions.githubusercontent.com",
-        "certificate_subject": "https://github.com/IABTechLab/trusted-server/.github/workflows/release.yml@refs/tags/v1.5.0"
+        "certificate_subject": "https://github.com/IABTechLab/trusted-server/.github/workflows/release-build.yml@refs/tags/v1.5.0"
       }
     },
     "integrations": [
@@ -1164,6 +1164,12 @@ This section provides detailed code examples and implementation patterns for the
 
 ### GitHub Artifact Attestations (CI/CD)
 
+This binary workflow example is historical and superseded by the [October
+release contract](2026-10-09-1235-release-attestation-design.md#r-sign). Its
+current certificate SAN names `release-build.yml`; the caller `release.yml`
+does not satisfy that signer identity. Runtime/configuration and publisher
+proposals below remain historical #161 material.
+
 Use [GitHub Artifact Attestations](https://docs.github.com/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds) to create SLSA Build Level 2/3 provenance for the WASM binary.
 
 ```yaml
diff --git a/docs/superpowers/specs/2026-09-25-git-version-header-design.md b/docs/superpowers/specs/2026-09-25-git-version-header-design.md
index eca379c014..4213752593 100644
--- a/docs/superpowers/specs/2026-09-25-git-version-header-design.md
+++ b/docs/superpowers/specs/2026-09-25-git-version-header-design.md
@@ -23,6 +23,8 @@ monitors need to see from a response that production runs a release, and which
 one. Staging keeps deploying branches and commits, so it needs to be
 identifiable too.
 
+> **Release-scope update:** Merged #1213's tag/branch/override examples describe development source builds. The [October release contract](2026-10-09-1235-release-attestation-design.md#r-facts) adds strict `TRUSTED_SERVER__RELEASE_BUILD=1`: canonical attested builds require the approved full source commit, reject Git fallback, and return that commit in `x-ts-version`. The external release tag stays in the signed index; header values do not prove attested bytes. Development goals and acceptance examples below remain applicable outside release mode.
+
 ## Goals
 
 - Report the deployed git version in `x-ts-version`: the tag when the deployed
diff --git a/docs/superpowers/specs/2026-10-09-1235-release-attestation-design.md b/docs/superpowers/specs/2026-10-09-1235-release-attestation-design.md
new file mode 100644
index 0000000000..b6f02a6119
--- /dev/null
+++ b/docs/superpowers/specs/2026-10-09-1235-release-attestation-design.md
@@ -0,0 +1,583 @@
+# Release artifact attestation and verified consumption
+
+**Issue:** [#1235 — Publish attested release binaries with build provenance and SBOMs](https://github.com/IABTechLab/trusted-server/issues/1235)
+
+**Date:** 2026-10-09. **Review revision:** 2026-10-12.
+
+**Status:** Draft for maintainer review. As directed on 2026-10-13, this specification, its implementation plans and implementation share PR #1262 on `spec/1235-release-attestation`; no separate implementation PR is opened. Contract/code approval is required before merge and all selected qualification gates remain required before official release enablement. Requirements below describe proposed behavior, not an existing release pipeline. The [feasibility audit](2026-10-12-1235-release-attestation-feasibility.md) records measured prototypes, missing implementations and unresolved hosted/provider qualifications; document review alone is not feasibility proof.
+
+**Producer implementation constraint (2026-10-14):** Introduced release producer tooling MUST use the small domain-specific host-only `crates/trusted-server-release` Rust 2024/1.95.0 workspace member, excluded from default members and independent of core/CLI/JS crates. No introduced Python tooling is permitted. Existing Node JS collection and thin POSIX wrappers remain; native approved-source Rust bootstrap is independently authenticated and supplies no official binary proof for itself. `ts` remains the consumer, and the [migration addendum](2026-10-14-release-tooling-rust-migration.md) preserves every qualification, acquisition and evidence gate. The producer is not a fifth canonical asset or a generic attestation/publisher abstraction.
+
+**Implementation baseline:** `44c5b5620bfb1f82e5b959ab5ba8ec69c7091e52` includes #1213 and #1214, both merged on 2026-10-12. Release implementation extends their source-version and isolated JS/prebuilt mechanisms. The feasibility audit used the earlier `7f6056bf83eb96aa4167efca64d43280299fba73` snapshot with then-open PR overlays; those historical probes are not current release qualification.
+
+**Related work:** [#1213](https://github.com/IABTechLab/trusted-server/pull/1213), [#1214](https://github.com/IABTechLab/trusted-server/pull/1214), [#161](https://github.com/IABTechLab/trusted-server/issues/161), [#1179](https://github.com/IABTechLab/trusted-server/pull/1179), [#799](https://github.com/IABTechLab/trusted-server/pull/799), [#1045](https://github.com/IABTechLab/trusted-server/pull/1045), [#1084](https://github.com/IABTechLab/trusted-server/pull/1084), and [#167](https://github.com/IABTechLab/trusted-server/pull/167).
+
+## Problem
+
+Publishers and vendors need evidence that distributed binaries were built from reviewed source, and operators need a route that submits the verified bytes. Ordinary CI publishes no attested distribution. Source deployment delegates to build-capable EdgeZero/Fastly commands. Fastly build annotation can also change Cargo's wasm output.
+
+The previous draft coupled four-target reconstruction and all-adapter enablement to the first release. This contract instead selects assurance requirements per artifact before execution. Required evidence remains mandatory; an optional measurement cannot quietly become a claim that it passed. Build provenance, publication, local authorization and remote execution are separate claims.
+
+## Goals
+
+1. Publish Fastly wasm and three Linux/macOS operator CLI executables with build provenance, artifact-specific SPDX SBOMs, bundles and immutable release membership.
+2. Enforce configuration independence and fresh locked inputs, including one shared, twice-built JS module set.
+3. Require complete-byte Fastly A/B equality; report native CLI comparisons without making native reproducibility a first-release prerequisite.
+4. Document exact verification and a byte-preserving Fastly production route first, then integrate production/staging through a new EdgeZero API.
+5. Provide stable build facts and deployment observations for #161 without claiming publisher authorization or remote execution proof.
+
+## Non-goals
+
+Operator reconstruction, retained-input archives, automated offline deployment, Cloudflare/Spin/Axum distributions, standalone tsjs assets, external rebuild witnesses and SLSA Build Level 3 require follow-up specifications. Runtime/configuration attestation, publisher enrollment, variable permission-policy distribution, request signing and vendor endorsements remain with their owners. Windows, Linux ARM64, containers, Apple notarization and self-update are excluded from this distribution.
+
+Offline build-evidence verification is documented here, but cannot establish fresh official release membership and cannot authorize `ts deploy --release`. The external Prebid bundle remains outside the embedded artifact's SBOM. CLI commands that need source resources retain documented prerequisites.
+
+## Contract vocabulary and ownership
+
+MUST, MUST NOT, SHOULD and MAY have the meanings in BCP 14, only when capitalized. Each numbered requirement is normative. Rationale, rollout ordering, informational records and deferred investigations do not add implicit acceptance gates.
+
+Canonical **Build A** is the selected output proposed for publication. **Build B** is a fresh comparison build: complete-byte equality is mandatory for Fastly and the shared JS set, while native CLI B reports a bounded measurement.
+
+“Retained” specifies its object: an owned byte copy held by the verifier; JS module bytes observed in the final executable; archived reconstruction inputs (deferred); or durable deployment recovery state. These claims are distinct.
+
+The **declared insensitive envelope** lists recipe inputs qualified to vary without changing output bytes. A **terminal outcome** records `matched`, `mismatched`, `failed` or `unavailable` before the deadline. An **action-scoped verified value** holds verified bytes and approval for one supported operation and context; it grants no unrelated deployment authority. Requirement headings below provide stable R-ID links; T-1 through T-13 identify the test families in the traceability table.
+
+| Owner                   | Responsibility                                                                                                                                                                    |
+| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Release tooling         | Controlled builds, composition evidence, required comparison gates, signing and immutable publication                                                                             |
+| Trusted Server verifier | Fixed release policy; distinct checks of build evidence, official publication and consumer/action authorization; construction of an opaque `VerifiedArtifact` retaining the bytes |
+| EdgeZero                | Prepared payload integrity, resolved provider context, concrete lifecycle operations and durable known/unknown outcomes; no IAB release-policy decisions                          |
+| Consumer                | Trusted verifier bootstrap, approved source/tag/action/context and credentials                                                                                                    |
+| #161                    | Publisher authority, loaded configuration claims, signing/freshness and runtime transport                                                                                         |
+
+```mermaid
+flowchart TD
+    A[Controlled build and composition evidence] --> B[Signing and immutable publication]
+    B --> C[Trusted Server verifier]
+    P[Trusted local policy and source approval] --> C
+    C --> D[Opaque VerifiedArtifact with retained bytes]
+    D --> E[EdgeZero prepared payload and resolved context]
+    E --> F[Observed operation state and recovery record]
+```
+
+## 1. Threat model and claim limits
+
+| Threat                                   | Capability                                                     | Defending checks                                                                                                                                                           | Residual trust or limitation                                                                                      |
+| ---------------------------------------- | -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
+| TH-1 Asset/mirror tampering              | Replace executable, index or companions                        | R-INDEX, R-EVIDENCE, R-PUBLICATION: signed digests, exact subjects and release membership; negative proof families T-8, T-9                                                | Authentic malicious source is still malicious                                                                     |
+| TH-2 Malicious evidence transfer         | Substitute roots, policy, approved commit or offline pins      | R-POLICY, R-BOOTSTRAP, R-OFFLINE: obtain trust inputs independently of supplied evidence; negative proof families T-8, T-9, T-10                                           | A compromised trusted transfer channel defeats its pins                                                           |
+| TH-3 Compromised dependency/build script | Generate altered code or fetch undeclared inputs               | R-INPUTS, R-JS, R-SBOM, R-BUILD: locked materials, controlled environment, observed/declarative coverage, no build credentials; negative proof families T-2, T-3, T-4, T-5 | Locks authenticate origin, not safety; same malicious input can reproduce                                         |
+| TH-4 Rogue tag pusher                    | Tag unapproved source or bypass checks                         | R-SOURCE, R-PUBLISH: branch/source authorization, same-commit validation, restricted tag authority; negative proof families T-7                                            | Authorized maintainers and bypass actors remain trusted                                                           |
+| TH-5 Compromised runner image/compiler   | Produce altered bytes and consistent A/B results               | R-BUILD, R-SIGN: checked environment identities, hosted runners, separated signing permissions; negative proof families T-4, T-7                                           | A/B is project-controlled repeatability, not independent builder trust                                            |
+| TH-6 Compromised operator host           | Replace gh/ts, retained files or runtime; lie about deployment | R-BOOTSTRAP, R-DEPLOY, R-RECOVERY: trusted bootstrap, retained handles, pre-upload equality, recorded observations; negative proof families T-9, T-11, T-12                | Local checks cannot establish honest remote execution against this host                                           |
+| TH-7 GitHub compromise                   | Misstate workflow identity, source or immutable membership     | R-POLICY, R-EVIDENCE, R-PUBLICATION: constrained identities and Sigstore evidence; negative proof families T-7, T-8, T-9                                                   | GitHub/OIDC, applicable roots and release authority are trust roots; this design does not defeat their compromise |
+
+Build provenance establishes that the constrained workflow produced a digest. Immutable release evidence establishes publication membership. A/B records measured equality under declared conditions. None proves absence of vulnerabilities, truthful configuration claims, publisher/domain authority or that submitted bytes execute at every edge location. SLSA Build Level 2 is an implementation target; a local reusable workflow alone does not establish Level 3.
+
+## 2. Selected artifacts and assurance profiles
+
+### R-COHORT
+
+`scripts/release/release-cohort.json` MUST select the complete artifact set and required assurance profile before jobs execute. The first cohort is `phase1-fastly-cli`. Every selected artifact MUST have successful canonical Build A, build provenance, SBOM, composition validation, shared JS input equality, artifact-specific retained-JS coverage and immutable publication. A failure of any selected requirement MUST block publication; the workflow MUST NOT shrink the set or lower a profile after failure.
+
+| Asset                         | Package / target                                  | Required profile             | Compatibility qualification                                                                |
+| ----------------------------- | ------------------------------------------------- | ---------------------------- | ------------------------------------------------------------------------------------------ |
+| `trusted-server-fastly.wasm`  | `trusted-server-adapter-fastly` / `wasm32-wasip1` | `provenance-sbom-repeatable` | Fastly production defaults; variant `default`                                              |
+| `ts-x86_64-unknown-linux-gnu` | `trusted-server-cli` / `x86_64-unknown-linux-gnu` | `provenance-sbom`            | glibc floor 2.34; clean UBI 9 (RHEL 9 family), Ubuntu 22.04 and Debian 12 startup fixtures |
+| `ts-aarch64-apple-darwin`     | `trusted-server-cli` / `aarch64-apple-darwin`     | `provenance-sbom`            | macOS loader deployment target 13.0; initial release qualification on hosted macOS 15 only |
+| `ts-x86_64-apple-darwin`      | `trusted-server-cli` / `x86_64-apple-darwin`      | `provenance-sbom`            | Same loader floor and macOS 15 qualification; actual Intel startup fixture required        |
+
+### R-PLATFORM
+
+Recipes MUST use explicit packages/targets and recorded effective features/release profile. A pinned Linux builder with glibc no newer than 2.34 MUST establish the GNU compatibility floor; scheduling it on Ubuntu 24.04 does not establish a 2.39 floor. Native link inspection MUST validate the actual ELF GLIBC symbol ceiling and reject undeclared libraries and runner-only absolute paths.
+
+GNU recipe completion MUST derive its forbidden host and execution paths from the bound checkout, retained JS, materials, Rust tools, whole Cargo state and target roots, plus the host-only output root. The whole Cargo state includes `HOME`, `TMPDIR` and `CARGO_HOME`. Completion MUST inspect and scan the same bounded, nofollow-read bytes, verify their recorded size and SHA-256, reject those paths and `/boundary/`, and require a fixed remapped prefix before recording success. A standalone ELF inspection records structural facts; it does not establish this build-path property.
+
+The GNU build boundary MUST expose ordinary writable storage only through its checked roots: `/tmp` MUST be an empty read-only tmpfs, private IPC MUST omit `/dev/shm`, and selected images MUST declare no implicit writable volumes. Actual controls MUST demonstrate denied writes outside the roots and successful bound-`TMPDIR` write/read/removal, followed by full JS and Cargo compatibility runs. Generic `/tmp/` runtime lookup strings, such as the locked browser dependency's default search location, MUST NOT alone be classified as runner identity. This Linux refinement does not relax macOS inspection or qualify its filesystem boundary.
+
+macOS MUST use a recorded matching-host recipe initially; a reviewed ARM-to-Intel cross recipe MAY replace it only after full CLI build and Intel execution qualification. `MACOSX_DEPLOYMENT_TARGET=13.0` MUST be explicit. It is a loader/ABI floor, not a claim that macOS 13/14 execution is qualified.
+
+The initial required startup matrix is macOS 15 on ARM64 and Intel. macOS 13 hosted runners have retired and macOS 14 is retiring; neither is a first-release test gate. Broader runtime support requires separately available execution hosts and evidence. Schema `compatibility.minimum_version` records the loader/libc floor; `build-evidence.compatibility_tests` records the actually qualified OS, architecture and outcome. Intel execution remains mandatory on an Intel host. `macos-15-intel` availability MUST NOT be assumed indefinitely: qualify a replacement execution host or review removal of the target before that runner becomes unavailable. Failure to establish these baselines blocks this cohort before its first tag; it does not justify advertising untested compatibility. A static musl distribution is an alternative requiring a reviewed cohort/target change.
+
+### R-VARIANT
+
+The first Fastly artifact MUST retain the existing default, single-request production variant, with `reusable-sandbox` disabled. This is a deliberate conservative shipping choice pending deployed reuse qualification, not a claim that reuse is publisher configuration. There is no Fastly `test` feature. A second attested `reusable-sandbox` variant, or promotion to the default after the four runtime bounds and reuse lifecycle pass qualification, requires a reviewed cohort/policy change. Operators requesting reuse MUST receive an explicit unsupported-variant diagnostic rather than be told an unattested custom build is official.
+
+Native CLI A/B outcome is reported as `matched`, `mismatched`, `failed` or `unavailable`. Its measurement job MUST reach a bounded terminal outcome, but equality is not required by `provenance-sbom`. A later change can promote an individual target after qualification. No profile in this contract claims separately bootstrapped operator reconstruction.
+
+## 3. Configuration independence and complete build inputs
+
+### R-CONFIG
+
+Operator configuration MUST NOT be compiled into release binaries. Publisher domains, account/service IDs, physical bindings, active settings, secrets, selected integrations, configuration revisions and deployment-variable permission policy MUST enter at runtime. All artifacts MUST use the tracked repository `edgezero.toml` unchanged. Logical store identifiers, product defaults and the fictional CLI scaffold are source-defined product inputs shared by all operators. The scaffold MUST NOT be an active-config fallback. The permission work in #1045/#1084 MUST resolve any conflicting embedded variable-policy design before release enablement; this contract does not choose its distribution protocol.
+
+### R-INPUTS
+
+Build evidence MUST record every input class below, with selected identities/digests and roles. Introducing an input requires updating the inventory in the same implementation PR. Generic SLSA provenance is not assumed to enumerate these transitively.
+
+| Input                        | Scope and control                                                                                                                                                              |
+| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Git source snapshot          | Exact peeled tag commit and tracked bytes of workspace/crate manifests, Rust/TS/JS source, embedded assets, build scripts, and release scripts                                 |
+| Cargo resolution             | Root `Cargo.lock`, registry checksums, exact git revisions, resolved package/features, target and host dependency roles                                                        |
+| npm resolution               | JS `package.json` and `package-lock.json`, pinned Node and bundled npm version, installed package versions and integrity metadata                                              |
+| Toolchain configuration      | `rust-toolchain.toml`, `.tool-versions`, `.cargo/config.toml`, Rust compiler/LLVM/sysroot identity, Node/npm identity                                                          |
+| Build recipe                 | Package and binary target, target triple, explicit feature policy, release profile including current `debug = 1`, linker/native compiler settings and any byte transformations |
+| Repository EdgeZero manifest | Entire tracked `edgezero.toml`, default logical configuration ID derived by core, and the manifest digest                                                                      |
+| Core template build digest   | All non-editor regular files under `core/src`, core `build.rs`/`Cargo.toml`, and root `Cargo.toml`/`Cargo.lock`/`edgezero.toml`; normalized relative paths and original bytes  |
+| Embedded/generated JS        | Fresh core and discovered integration IIFEs, exact module IDs/digests, and the generated Rust module table copied into `OUT_DIR`                                               |
+| Other embedded assets        | Core GPT bootstrap, CLI browser collector/consent scripts, and the repository-root `trusted-server.example.toml` scaffold embedded by the CLI                                  |
+| OpenRTB bindings             | Checked-in generated bindings and their tracked sources; normal releases do not regenerate protobuf or invoke an ambient `protoc`                                              |
+| Dependency-generated code    | Build-script and proc-macro outputs, including EdgeZero CLI adapter registrations derived from its pinned manifest and enabled features                                        |
+| Release build facts          | Validated source commit supplied after environment sanitization; target/package version from Cargo; variant derived by the owning adapter/product; release tag stays external  |
+| Native build inputs          | Runner image version, SDK/Xcode where applicable, linker, compiler/assembler, build tools, vendored native library metadata, and linked external libraries                     |
+| Paths and environment        | Checkout/build paths, `CARGO_MANIFEST_DIR`, `OUT_DIR`, sanitized compiler/native-tool settings, explicit Vite mode, and permitted release environment values                   |
+
+`TEMPLATE_BUILD_DIGEST` includes complete raw manifest bytes and ordinary non-editor core source files, including untracked files. It is a template/cache compatibility input, not an executable digest or provenance. Fresh checkouts MUST contain only expected source/materials; generated outputs MUST remain outside source-only directories. Before/after checks MUST detect tracked-input changes and unexpected source-directory files.
+
+### R-ENV
+
+Release preflight MUST audit inherited variables before clearing them and reject `TSJS_SKIP_BUILD` with any value. It MUST NOT evade this audit by starting under an empty environment. Hosted/setup exports such as `RUSTFLAGS` or `VCPKG_INSTALLATION_ROOT` MUST be rejected unless their exact values and tool/path identities are explicitly reviewed and qualified.
+
+After auditing, the recipe MUST remove inherited operator `TRUSTED_SERVER__*` and `EDGEZERO__*`, sanitize the child environment, and reinject validated `TRUSTED_SERVER__RELEASE_BUILD=1` and the approved `TRUSTED_SERVER__GIT_VERSION`. Cargo supplies target/package facts and the owning product derives the typed variant (R-FACTS). Compiler/Cargo profile/linker flags, wrappers, Cargo home/configuration layers, native build selectors, `NODE_OPTIONS`, npm/Vite overrides and environment-file loading MUST be selected or rejected by the recipe. No ambient compiler wrapper is allowed. Release Vite mode MUST be explicit. Build jobs MUST have no provider/signing credentials. Wall-clock times, run IDs, publisher identity and final checksum MUST NOT be embedded. `SOURCE_DATE_EPOCH` MUST derive from the approved commit's committer timestamp.
+
+The CLI's compiled developer checkout fallback (`CARGO_MANIFEST_DIR`) MUST be disabled for official releases; explicit/current-checkout discovery can remain for documented source-dependent commands. Rust remapping does not rewrite arbitrary `env!` strings. CLI help, version and `config init` MUST run outside a checkout.
+
+## 4. Shared JS build and artifact repeatability
+
+### R-JS
+
+Release work MUST extend #1214's private output, expected-module validation, checked test failures and `TSJS_PREBUILT_DIR`; it MUST NOT add a parallel `TSJS_RELEASE_BUILD` fallback mode. One release-wide JS job MUST independently run two fresh locked installations/builds with pinned Node/npm. Both MUST reject any skip flag, missing npm, failed `npm ci`, test failure, missing/empty/extra modules or changed source. Both actual A/B Vitest processes MUST unconditionally receive `TRUSTED_SERVER__RELEASE_JS_TESTS=1` and run all registered tests and type checks; a developer opt-out MUST NOT suppress them. Ordinary development skips only the two slow Git collector fixtures by default; ordinary CI opts into the full suite. Each build owns its installation/output directory and includes required build dependencies.
+
+The two JS runs MUST compare final bytes for core plus every sorted tracked integration entry point. Only on equality MAY the job publish its Build A bundles and `tsjs-inventory.json`. That version-1 inventory MUST record sorted module IDs, filename, size, SHA-256, contributing source/package identities and tool/lifecycle identities. Each Rust build MUST consume these current-run bundles through absolute `TSJS_PREBUILT_DIR` and `TRUSTED_SERVER__TSJS_PREBUILT_INVENTORY` paths and a checked expected inventory, validate the exact set/digests of bytes copied into `OUT_DIR`, and run no npm.
+
+The first cohort MUST declare only `fastly-production` for Fastly until the integrated staging milestone is qualified. Adding `fastly-staging` requires a reviewed cohort and consumer-policy update. An artifact capability MUST intersect with an implemented local transport; downloaded metadata cannot enable an unavailable operation.
+
+The collector MUST verify identical prepared JS input inventories across all builds that compile the JS crate. Each artifact MUST separately record which module bytes remain in its final file. Claimed retained modules MUST match the shared inventory; a CLI executable MAY retain none after linking. Copies into `OUT_DIR` are build inputs and MUST NOT alone be called final embedded code, nor force unused JS into the CLI to satisfy an equality check.
+
+The shared JS set is a declared input to Rust builds. Sharing it means the Rust A/B pair does not independently test npm/Vite; the separate JS A/B gate supplies that evidence. Installed package inventory and permitted lifecycle outputs MUST be recorded separately from lockfile archive integrity. A platform esbuild binary removed from the prepared installation MUST cause the network-denied bundle phase to fail instead of downloading a replacement.
+
+### R-BUILD
+
+Container-backed builds and final-artifact startup MUST acknowledge a full immutable container ID before a separate attached start. Cleanup MUST stop, remove and confirm absence by that ID after execution failures as well as success. Failed or ambiguous creation MUST remain fatal and MUST NOT authorize a start; a name-based absence observation cannot resolve an in-flight creation request. The bounded timeout regression MUST exercise the same lifecycle as real execution.
+
+`scripts/release/build.sh` and `scripts/release/release-tools.json` at the approved source commit MUST define the executable recipes and checked tool/environment identities. A downloaded descriptor is informational and MUST NOT supply commands. Rust builds MUST use `--locked` (or `--frozen` after verified source preparation), a fresh target directory and checked dependency material. Compiled Cargo/JS outputs MUST NOT be restored from earlier runs. Verified download caches MAY be reused only after archive checksum/revision validation and fresh extraction. The compile/bundle phases MUST enforce network denial with a qualified OS/container boundary, including build-script/lifecycle downloads; a positive unconfined socket control and denied confined socket probe MUST run for each selected recipe. Cargo/npm offline flags, proxy settings or lockfiles alone do not enforce process network denial. Historical local macOS `sandbox-exec` prototypes demonstrated socket denial; replacement Rust boundaries and the full hosted native recipe still require qualification; preparation is a separate network-enabled phase. Required native/system SDK identities and code transformations MUST be checked before compilation.
+
+### R-REPEAT
+
+Fastly Build A and Build B MUST run in separate fresh hosted jobs with independent source/dependency materialization and Cargo outputs. Each MUST include every final byte transformation from the recipe. Build B MUST differ from A in each qualified insensitive input: checkout directory, Unix user where supported, umask, `TZ` and locale, start time and Cargo job count. `release-tools.json` MUST list the selected A and B values. The rebuild record MUST mark each dimension `varied`, `normalized` when the recipe pins it internally, or `not-varied` when the runner cannot change it. Only `varied` dimensions count as independence evidence.
+
+The collector MUST select outputs by the artifact ID and transfer digest returned by each expected job in the current run, verify artifact REST metadata's current workflow run/repository/source SHA, reject reused A/B IDs, validate source/recipe records, and byte-compare complete final wasm. Producing job/attempt association MUST come from the expected upload-step outputs and trusted workflow dependency topology; the artifact API does not expose an independent job/attempt-origin field. Transfer digest is the Actions archive digest, separately checked from final executable SHA-256; transfer mismatch warnings MUST be promoted to failure. It MUST NOT use artifact names as the sole binding. Missing output, inconsistent checked inputs or unequal bytes MUST block the entire selected release. No comparison-time stripping, normalization or excluded byte regions is allowed.
+
+Native CLI comparison MUST use the same fresh-job/result-binding discipline, but a recorded nonmatching or unavailable B result does not block its profile. Build A and its composition/smoke checks remain mandatory. A signed measurement stating failure MUST NOT be relabeled success.
+
+### R-NATIVE
+
+Native records MUST capture compiler, linker, archiver, SDK/sysroot, native source/libraries and relevant options. Linux SHOULD use a content-derived build ID. A future native repeatability-profile qualification MUST cover canonical rustup paths, OSO debug paths/mtimes, a tested content-derived UUID policy and any required ad-hoc signature. Random/disabled UUIDs or removing signatures only for comparison are not acceptable shortcuts. Developer ID signing, notarization and stapling remain outside scope. These controls support native measurements; they do not imply operator reconstruction is supported.
+
+## 5. Artifact-specific SPDX composition
+
+### R-SBOM
+
+The repository-owned Rust producer command `trusted-server-release generate-sbom`, implemented in `crates/trusted-server-release/src/spdx.rs`, MUST emit SPDX 2.3 JSON for each canonical executable from selected Cargo JSON build messages, an unfiltered Cargo metadata identity catalog and explicit-target Cargo tree evidence, the JS lockfile and Rollup contribution inventory, plus declared-and-validated native inputs. Target-filtered metadata can omit dependencies compiled for the host during a cross-build; catalog membership alone MUST NOT establish contribution. Syft and a `RUSTC_WRAPPER` are not required. This settles the generator; its fixture proof precedes release enablement.
+
+Coverage MUST distinguish observed Rust units, embedded JS contributors, validated native components, external runtime requirements and build materials/tools. With explicit `--target`, Cargo output layout, target kind, package ID and features MUST distinguish host build scripts/proc macros from target units, including a package built in both contexts. Metadata/tree edges MUST be reconciled with actual compiled membership; ambiguous source/unit joins MUST fail. Cargo metadata features are package-level unions, so effective per-unit features MUST come from compiler messages and explicit-target output context. This is a conservative component inventory, not a promise to recover an exact compiler unit dependency DAG from package metadata. Uncompiled dev-only packages MUST NOT be claimed as runtime contributors. Compiled code later eliminated by linking MAY remain in the conservative inventory; exact final function reachability is not claimed.
+
+The Rollup hook MUST record package/source contributions and virtual/plugin-generated origins. Final bundle hashes MUST be computed after Vite/esbuild transformations. Type-only imports and modules eliminated by Rollup MUST NOT create runtime components. Later minification can remove more code; contribution evidence MUST state this conservative limit. The embedded Prebid shim is covered; a type-only reference to externally distributed `prebid.js` MUST NOT claim that bundle is embedded. Build-only npm dependencies and native bundler tools remain build material even when called dev dependencies.
+
+Native records MUST bind origin, version/revision, source or linked-library digest, selection policy and validation evidence. The current CLI graph includes AWS-LC, ring and bundled SQLite. The release recipe MUST set `AWS_LC_SYS_USE_SYSTEM=0` and reject conflicting OpenSSL/pkg-config discovery overrides, or explicitly select and digest a reviewed system library. Target-suffixed AWS-LC selectors MUST also be rejected or explicitly selected; a target-specific value can override generic `AWS_LC_SYS_USE_SYSTEM=0`. The recipe MUST set `LIBSQLITE3_SYS_USE_PKG_CONFIG=0` and reject unreviewed SQLCipher/loadable-extension selection; a nonzero pkg-config selector can bypass SQLite's bundled feature. It MUST validate SQLite bundled selection and capture actual native outputs/link directives; a Rust invocation graph alone cannot discover these components. Dynamically linked platform libraries MUST be reported as external requirements, not embedded bytes. Rust sysroot identity MUST also be recorded.
+
+SPDX root checksum MUST equal the final executable SHA-256. Package IDs MUST include source/revision or installation location where name/version is ambiguous. SPDX relationships MUST distinguish artifact contributors from build tools/materials. Modules compiled as inputs but absent from the final executable MUST remain build material rather than be claimed as embedded JS. Raw substring presence and known source/link behavior supply a conservative retained-byte check for the current uncompressed strings; they do not establish function reachability. Cargo manifests/license files and npm metadata supply licenses; unknown licenses MUST be `NOASSERTION`. Schema, unique IDs, endpoints, coverage and the attestation predicate-size limit MUST be validated; an oversized or incomplete SBOM MUST block publication. Each published SBOM MUST equal the parsed document carried by its artifact's SBOM attestation.
+
+## 6. Build facts and #161 handoff
+
+### R-FACTS
+
+One immutable build-fact mechanism MUST extend merged #1213. Absence of `TRUSTED_SERVER__RELEASE_BUILD` selects development behavior; any present value other than exactly `1` MUST fail. The trusted recipe MUST set `TRUSTED_SERVER__RELEASE_BUILD=1` after inherited-environment audit and sanitation.
+
+Release Rust builds MUST receive absolute `TSJS_PREBUILT_DIR` and `TRUSTED_SERVER__TSJS_PREBUILT_INVENTORY` paths, validate the inventory and copied bytes, expose its raw digest as `TRUSTED_SERVER__TSJS_INVENTORY_SHA256`, and MUST NOT run npm. Rust Cargo builds MUST reject any presence of `TSJS_SKIP_BUILD`, including empty, `0` and `1`; Node development build/Vitest entry points preserve its development behavior when release control is absent.
+
+The recipe MUST supply `TRUSTED_SERVER__GIT_VERSION` as the approved full source commit after sanitation, and release builds MUST reject missing/malformed values and prohibit ambient `.git` tag/branch fallback. Development fallback from #1213 MAY remain outside release execution and MUST be recorded as a development input.
+
+A typed `BuildInfo` MUST derive target from Cargo `TARGET` through `TRUSTED_SERVER__BUILD_TARGET`, package version from `CARGO_PKG_VERSION` and variant/features in the owning adapter/product. Core cannot infer a Fastly feature that is not forwarded to it. Caller-supplied target/variant strings MUST NOT override these derived facts. `TEMPLATE_BUILD_DIGEST` remains separately named.
+
+The release tag/version MUST stay external in the release index, not be compiled into bytes. Two tags on one source commit can therefore refer to identical bytes. `ts --version` MUST label the fields as `ts package=<pkg> source=<identity> target=<triple> variant=default`; it MUST NOT imply the workspace's current `0.1.0` is the external release version. `X-TS-Version` is the approved full source commit in release mode. Development retains #1213's override/tag/branch/short-commit display behavior. A development checked inventory validates its own commit syntax and hashes but MUST NOT compare that source to the development display label. Fastly emits owning package/target/variant facts through its existing startup diagnostics; no additional response header or attestation authority is introduced. Fastly service version uses `X-TS-Fastly-Version`. Neither header is a binary checksum or remote execution proof.
+
+For the selected default Fastly artifact, settings load per request. Only a future qualified reusable variant retains settings for its sandbox lifetime. #161 MUST distinguish artifact identity, observed service/version and the configuration snapshot actually used; fetching the latest store after a request does not establish that snapshot. Build facts contain no secrets or active configuration. Deployment request-signing keys/JWKS remain unrelated to release signing.
+
+## 7. Source eligibility, workflow and immutable publication
+
+### R-SOURCE
+
+`.github/workflows/release.yml` MUST accept protected `v*` tag pushes and strict stable/prerelease SemVer, including schema-supported build metadata. Official tags MUST be lightweight, so the verified tag target is the source commit; annotated tags MUST be rejected, not confused with their peeled commits. The current reviewed `eligible_branches` is exactly `["main"]`. Eligibility MUST use the actual remote branch tip and commit ancestry, with governance validation of active branch/tag rulesets and bypass actors. Local remote-ref lookalikes MUST NOT supply that authority.
+
+A future exact `rc/YYYYMM` branch requires maintainer review of its tracked cohort entry and governance inclusion before use, plus actual remote-tip ancestry and ruleset/bypass validation. A regex match or a candidate checkout that lists its own branch MUST NOT approve itself. The tag ruleset and branch policy MUST constrain creation/update/deletion and bypass actors.
+
+Eligibility MUST run trusted release validation at the exact tag commit for every required AGENTS.md gate. `test.yml`/`format.yml` currently lack push coverage for RC branches, so successful push-to-main checks MUST NOT be the only path. Implementation MUST expose reviewed `workflow_call` validation jobs or equivalent explicit same-commit release jobs. It MUST enumerate required jobs and reject skipped/cancelled/PR-only/fork results. A tag immediately after merge MUST wait for these release validation jobs with a checked deadline (initially 90 minutes), then fail with a rerun diagnostic on timeout. It MUST NOT publish using an unrelated passing check name.
+
+### R-SIGN
+
+The local `.github/workflows/release-build.yml` at the caller's source revision MUST own build orchestration, collector validation and file attestations. Build/lifecycle execution MUST occur without OIDC/attestation writes. Signing MUST consume only validated current-run job outputs and MUST NOT compile untrusted source. The authenticated build boundary is the complete workflow invocation, not just the collector. No caller-supplied command, script, arbitrary path/repository or provenance predicate is accepted. All actions MUST be SHA-pinned; tools MUST have exact version/digest pins in `scripts/release/release-tools.json`.
+
+| Job                                       | Permissions                                                                                         |
+| ----------------------------------------- | --------------------------------------------------------------------------------------------------- |
+| Eligibility/validation/build/compare      | `contents: read`; `actions: read` / `checks: read` only for actual validation/artifact lookup needs |
+| Validated artifact and index signing      | `contents: read`, `id-token: write`, `attestations: write`; `actions: read` if collecting outputs   |
+| Draft upload/final publish/reconciliation | `contents: write`; no OIDC, provider credential or repository settings token                        |
+
+File attestations MUST NOT request `artifact-metadata: write`; no container storage record is being created. Each canonical artifact MUST get two pinned `actions/attest` invocations: build provenance with the executable and metadata subjects, then SPDX mode with the executable subject and published SBOM as predicate. `sbom-path` does not also create separate build provenance. The collector MUST verify all bundles before index signing.
+
+### R-PUBLISH
+
+Maintainers MUST enable immutable releases and active tag rules before first publication and record approval of release authority. No `RELEASE_SETTINGS_READ_TOKEN` is introduced. A tag-scoped concurrency group MUST serialize publication without cancelling a publishing run. The publication job MUST create/resume a matching draft, upload the complete asset set, re-download and verify it, publish, then read `immutable == true` using `GITHUB_TOKEN` and verify the GitHub release attestation. It MUST NOT report success before that final check.
+
+If a release is confirmed mutable, the job MUST mark publication failed, remove that still-mutable release if authorized by the workflow's release-write role, and raise a release incident with the result. An indeterminate response MUST trigger reconciliation, not blind deletion. This is detection/recovery, not a guarantee that a transient mutable publication was never visible; consumers require immutable signed membership and therefore reject it. Published immutable releases MUST NOT be overwritten or retagged. Defects require an advisory and new version.
+
+A rerun MUST refuse an already published tag. A partial draft MAY resume only when source/tag and all existing asset digests match the intended set. Conflicting bytes require explicit recovery. A failed optional CLI comparison is reportable; a failed required profile leaves no published release.
+
+## 8. Distribution schema and evidence graph
+
+### R-INDEX
+
+The normative [release-index v1 JSON Schema](schemas/release-index-v1.schema.json) MUST be evaluated with the JSON Schema Draft 2020-12 dialect and defines closed kinds, roles, targets, variants, profiles and capabilities. The governing schema raw bytes MUST remain unchanged absent an explicit reviewed schema amendment. Its retained `$comment` pins Draft 2020-12; Rust `KnownSchema` explicitly selects that dialect with offline evaluation, and committed positive/negative tests exercise the actual governing schema.
+
+Producer and consumer MUST additionally require `recipe_source_commit` and `cohort_source_commit` to equal the independently approved `source_commit`, and enforce exact cohort membership, unique safe asset names, expected package/target/variant/profile combinations and equality of each size/digest with actual bytes. These repeated v1 source/recipe/cohort equalities intentionally expose the joins; a different revision requires a future reviewed amendment. Structural v1 compatibility may accept `fastly-staging`, but current producer/consumer policy and cohort MUST semantically reject it until reviewed enablement. Tasks 3, 13 and 17 MUST test that rejection. SemVer metadata and schema fields MUST NOT be narrowed without review.
+
+Unknown schema versions, duplicate JSON keys, duplicate/conflicting identities, traversal names, unknown capabilities and mismatched JS inventories MUST fail. No executable asset is an archive in this cohort.
+
+Release-wide assets are `release-index.json`, `release-index.provenance.sigstore.json`, `tsjs-inventory.json` and `SHA256SUMS`. Each executable has `<asset>.spdx.json`, `<asset>.provenance.sigstore.json`, `<asset>.sbom.sigstore.json`, `<asset>.build-evidence.json`, `<asset>.build-recipe.json` and `<asset>.rebuild-check.json`. The index MUST name and digest companions and the JS inventory. It MUST NOT include its own digest/bundle; those identities are external. `SHA256SUMS` MUST cover every other published asset, never itself, and is only a convenience until authenticated by release membership. No `release-inputs.tar.zst` is promised here.
+
+| Document                      | Version-1 field contract / status                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `release-cohort.json`         | Producer policy: `schema_version` integer 1; `cohort` fixed string; `eligible_branches` unique exact branch strings; `artifacts` exact schema artifact combinations and required profiles. Source-controlled, never selected by downloaded metadata                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `release-tools.json`          | Producer policy: `schema_version` 1; `tools` sorted records of name/version/SHA-256/acquisition identity; `environments` checked image/SDK identities; `recipes` script paths/digests and effective configuration                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `tsjs-inventory.json`         | `schema_version` 1; `source_commit` 40 lowercase hex; `modules` sorted unique records with `id`, `filename`, `size` nonnegative integer, `sha256` 64 lowercase hex and contribution records; tool/material records                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| `<asset>.build-evidence.json` | `schema_version` 1; `source_commit`, `target`, `variant`, `artifact_sha256`; `js_inventory_sha256`; `prepared_modules` sorted input records and `compatibility_tests` records of actual OS/architecture/environment/outcome; `embedded_modules` sorted unique records of `id`, `filename`, nonnegative integer `size` and 64-character lowercase hex `sha256`, observed in the final executable and matched to the shared inventory; absence after linking is explicitly recorded, while `OUT_DIR` copies are prepared input evidence; `inputs`, `rust_units`, `js_contributors`, `native_components`, `external_requirements`, `tools` arrays containing identity/digest/role evidence from R-INPUTS/R-SBOM |
+| `<asset>.build-recipe.json`   | Informational: version 1; recipe source commit/script/tool identities and selected effective settings. MUST NOT be executed as a supplied program                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `<asset>.rebuild-check.json`  | Informational to consumers: version 1; profile, recipe/source/JS digest; A/B run/job/artifact IDs and transfer digests; environments, final size/SHA-256 or bounded failure status; outcome enum `matched`, `mismatched`, `failed`, `unavailable`                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| Operation record/receipt      | Private lifecycle observation under R-RECOVERY, not a public claim schema. #161 owns any future authenticated receipt use; no normative `verified-publication.json`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+
+These JSON files MUST use UTF-8, reject duplicate keys/nonfinite numbers and use safe relative asset names. Digests bind exact distributed file bytes; verifiers MUST NOT reserialize before hashing. Arrays with set semantics MUST have deterministic order. Producer tooling and the Trusted Server wrapper MUST implement strict parsed SBOM-document equality (object key order ignored, array order significant, duplicate keys rejected); it is not substituted for file-byte digest checks. gh verifies a predicate and returns it; it supplies no SBOM-file comparison operation. Duplicate keys MUST be rejected before signing as well as before consumer comparison. Informational descriptors/measurements remain authenticated companions, but consumers MUST NOT execute them or infer independent trust from their contents.
+
+### R-EVIDENCE
+
+Every successful verification MUST establish all equalities below:
+
+| Edge                                       | Required equality/check                                                                                                                                                                                                                                                                                         |
+| ------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Local policy → index                       | Repository, exact tag/source commit, cohort, package/kind/role/target/variant/profile/capability equal the approved local contract; recipe/cohort revisions equal approved source, and producer policy identity matches the locally computed current-policy identity or the trusted historical-policy allowlist |
+| Index provenance → index                   | Exact index subject SHA-256; approved certificate/source/builder/caller constraints                                                                                                                                                                                                                             |
+| Index → executable/companions/JS inventory | Exact names, lengths and SHA-256; no unlisted code or conflicting identity                                                                                                                                                                                                                                      |
+| Artifact provenance → executable/metadata  | Expected executable, SBOM, build evidence, recipe and rebuild-check all present as exact subjects; no extra unapproved subjects                                                                                                                                                                                 |
+| SBOM attestation → executable/document     | Executable subject SHA-256; SPDX predicate equals published parsed SPDX; SPDX root checksum equals executable                                                                                                                                                                                                   |
+| Build evidence → JS inventory              | Prepared input digest/table equals shared inventory; each claimed final retained module matches that inventory and per-artifact final-byte evidence                                                                                                                                                             |
+| GitHub release evidence → distribution     | Verified release statement binds repository/tag/target and consumed signed subject names/digests; signed index sizes equal actual bytes and REST asset sizes (release subjects have no size field)                                                                                                              |
+| Consumer → action                          | Approved source, local operation and service/environment/context before constructing the action-scoped verified value                                                                                                                                                                                           |
+
+The recipe and rebuild records are authenticated for audit, but consumers do not rerun a project-controlled comparison or treat its JSON outcome as an independent authorization authority. The reviewed producer workflow enforces the profile; consumers enforce its identity and selected profile.
+
+## 9. Fixed verifier policy, bootstrap and online commands
+
+### R-POLICY
+
+`crates/trusted-server-cli/release-policy.json` MUST be a tracked, embedded policy with `policy_version` integer and an external SHA-256 of its exact bytes. Only a reviewed CLI release MAY update it. Index `policy_version`/`policy_sha256` identify the producer policy tracked at `source_commit`, not a downloadable replacement for the consumer policy. The consumer MUST match that pair to independently trusted source-policy bytes, then accept either its own policy version and externally computed exact-byte digest, or a differing producer identity in a separately embedded reviewed historical allowlist. The current policy MUST NOT contain its own SHA-256 or be required to list itself; this avoids a self-hash cycle. Its own acceptance constraints always remain in force. New CLI policies MUST explicitly retain or retire historical identities; the index cannot pick its verifier policy by declaring a hash. Downloaded indexes, operator configuration, roots or arbitrary forwarded gh flags MUST NOT redefine it. The policy MUST fix GitHub host/repository numeric IDs, certificate identities/issuer, source/builder/caller semantics, supported artifact/profile/action combinations and resource bounds. Automation MUST also approve a source commit/tag; an index cannot approve its own source.
+
+Task 17 MUST obtain producer-policy bytes from an independently approved source snapshot or the fixed official GitHub Contents API endpoint `https://api.github.com/repos/IABTechLab/trusted-server/contents/crates/trusted-server-cli/release-policy.json?ref=<independently-approved-40-character-commit>`, using `Accept: application/vnd.github.raw+json`. The ref MUST come from independent full-commit approval, never the index. Fetching MUST use an explicit read-only credential, the 1 MiB policy bound, and the overall verification deadline. Arbitrary hosts/paths and redirects that change that origin/path or forward credentials MUST be rejected. The producer hash/version MUST be computed from those approved-source bytes before applying the consumer's own compiled constraints. Offline checks require an independently transferred approved source-policy snapshot and establish build proof only, never official deployment. [GitHub Contents API](https://docs.github.com/en/rest/repos/contents#get-repository-content) documents raw media and explicit commit refs. <!-- allow-domain: api.github.com -->
+
+The initial verified tool contract is GitHub CLI **2.97.0** and `actions/attest` **4.2.2** (SHA `1e69f48acb82d1966a394da916b4c1698aa569d6`). Implementation MUST record platform gh binary digests in `release-tools.json` and qualify this exact version. Other versions MUST fail with a compatibility diagnostic until a reviewed policy/tools update qualifies them. This is an exact supported version, not an unspecified minimum. Checking the version string is not proof that an executable is trustworthy.
+
+| Authenticated expectation               | Required value                                                                                                                                                                |
+| --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Repository / owner IDs                  | `950860906` / `82903538`, with `IABTechLab/trusted-server` on `github.com`                                                                                                    |
+| Certificate SAN / provenance builder ID | `https://github.com/IABTechLab/trusted-server/.github/workflows/release-build.yml@refs/tags/<tag>`                                                                            |
+| Certificate issuer                      | `https://token.actions.githubusercontent.com`                                                                                                                                 |
+| Source ref / source digest              | Exact `refs/tags/<tag>` / independently approved 40-character commit                                                                                                          |
+| Build signer digest                     | Same source commit for this same-revision local reusable workflow                                                                                                             |
+| Provenance predicate / build type       | `https://slsa.dev/provenance/v1` / `https://actions.github.io/buildtypes/workflow/v1`                                                                                         |
+| Caller / external parameters            | Exactly `workflow: {ref: "refs/tags/<tag>", repository: "https://github.com/IABTechLab/trusted-server", path: ".github/workflows/release.yml"}`; no arbitrary inputs/commands |
+| Source resolved dependency              | `git+https://github.com/IABTechLab/trusted-server@refs/tags/<tag>` with `gitCommit` equal to approved commit                                                                  |
+| Event / runner                          | `push` / `github-hosted`                                                                                                                                                      |
+| Invocation                              | Repository Actions run/attempt identity consistent across collected evidence; no cross-run substitution                                                                       |
+
+Certificate-backed fields MUST be checked using the pinned gh verifier. Build-type/caller/external-parameter/source-material/subject semantics MUST additionally be checked in successfully verified provenance, not merely inferred from certificate success. Unexpected required structures or missing constraints MUST fail. Policy fixtures MUST use actual output from the pinned action/toolkit; upgrading it requires explicit fixture review. A future separately protected Level 3 builder changes the signer identity: a reviewed policy update MUST define which CLI versions and releases accept it, document the migration and retain verification of supported historical identities. There is no distinct builder/source revision in today's local workflow layout.
+
+For both provenance and SPDX proofs, post-success gh JSON certificate checks MUST require `sourceRepositoryIdentifier`, `sourceRepositoryOwnerIdentifier`, `buildConfigURI`, `buildConfigDigest`, `buildTrigger` and `runInvocationURI` to match the numeric repository IDs, exact caller `release.yml@refs/tags/<tag>`, approved commit, `push` event and allowed shared run/attempt above. These fields are flattened under `verificationResult.signature.certificate` in the pinned verifier. Provenance `runDetails.metadata.invocationId` MUST equal the certificate run URI. SPDX has no SLSA workflow fields; it uses these certificate constraints plus subject/document checks, not an invented provenance predicate.
+
+### R-BOOTSTRAP
+
+Consumers MUST obtain gh through a trusted installation channel, use it plus their approved policy to verify the downloaded `ts` executable before first execution, then let verified `ts` drive gh. The exact qualified gh 2.97.0 executable MUST be privately selected through an authenticated installation path, resolved once and retained as the invocation target. Ambient `brew upgrade gh` is diagnostic only: an unsupported resulting version MUST fail, and version text alone MUST NOT authenticate it. A future reviewed list of qualified versions is a policy/tools amendment, not current broadening.
+
+A consumer compiled with policy v1 MUST reject an unsupported producer policy v2. A newer consumer MAY accept an explicitly reviewed historical v1 identity pair, but MUST enforce its own current bounds and constraints throughout verification. A source-built CLI can run checks but has no official binary/policy assurance until its bytes independently verify. A compromised operator PATH/host remains outside the guarantee.
+
+Online operations require GitHub authentication even for public artifacts. The integrated verifier MUST accept only an explicitly supplied `GH_TOKEN` or, as fallback, `GITHUB_TOKEN`, for a read-only public-repository request. It MUST pass the selected credential only as `GH_TOKEN` to the child, clear `GH_HOST`, enterprise tokens, inherited `GH_CONFIG_DIR` and other gh overrides, and set isolated private `GH_CONFIG_DIR` and `XDG_STATE_HOME` directories, a reviewed nonempty `HOME` and disabled prompts. Configuration isolation alone does not isolate gh telemetry/device state; an omitted home/state path can write relative to the current directory. Stored `gh auth login` credentials are not silently inherited; the diagnostic MUST explain the explicit-token requirement. Provider credentials MUST NOT reach gh. Normal direct gh commands can use their own trusted login configuration, but integrated behavior follows this narrower contract. The child environment MUST otherwise use reviewed OS/runtime variables and no dynamic-loader injection settings.
+
+### R-BOUNDS
+
+Each gh child MUST have a 120-second wall-clock deadline, at most 128 MiB of JSON stdout and 1 MiB of stderr; an integrated verification attempt MUST have a 15-minute overall deadline. Before parsing/invoking gh, index/policy/inventory files MUST be at most 1 MiB, each bundle/build companion at most 32 MiB, SPDX SBOM at most the pinned action's 16 MiB limit, and trusted-root snapshot at most 1 MiB, and each executable at most 512 MiB. The integrated verifier MUST verify one retained, membership-checked bundle per invocation and accept exactly one matching attestation result; JSON output includes both bundle and parsed predicate, so its bound is larger than the input bound. Metadata nesting MUST be limited to 64 levels and the cohort to four executables with their declared companions. Timeout, cancellation, oversize input/output, parser ambiguity, failed exit or incomplete JSON MUST fail, terminate/reap children and construct no `VerifiedArtifact`. Bounds can change only through reviewed policy. Diagnostic output MUST exclude credentials and secret context.
+
+### R-PUBLICATION
+
+Online verification MUST combine pinned gh signature verification with explicit REST and verified-statement policy checks; successful gh exit statuses alone are insufficient. `release verify-asset` matches the file digest even when its local name differs, does not check raw tag type or the API immutable flag, and does not authenticate an asset-size field. The wrapper MUST compare signed subject names/digests, independently approved source/type, REST immutable state and index/actual/API lengths. Online verification MUST verify the GitHub immutable release, confirm its lightweight tag object is a commit, match the signed release target to the approved commit, authenticate index provenance before using its fields, verify R-EVIDENCE, and verify immutable membership for every consumed asset. Successful verification of one predicate MUST NOT stand in for all predicates. Only then, after local action/context authorization, MAY the library construct private `VerifiedArtifact` with retained bytes. No provider write, secret/config creation or build hook is allowed during verification.
+
+The following fictional release example shows the primitive commands. They require the approved gh version and authentication. `<reviewed-40-character-commit>` comes from trusted consumer approval checked against the signed lightweight release target, not from the downloaded index. The literal #1235 D4 `--signer-workflow .../release.yml` fails because the certificate SAN names `release-build.yml`. Naming `release-build.yml` satisfies only the basic compatible prefix check; its prefix semantics do not meet this contract's exact-identity policy; `--cert-identity` is used instead. These flags are mutually exclusive.
+
+```sh
+RELEASE_TAG=v1.2.0
+REVIEWED_COMMIT='<reviewed-40-character-commit>'
+SIGNER="https://github.com/IABTechLab/trusted-server/.github/workflows/release-build.yml@refs/tags/$RELEASE_TAG"
+
+gh release download "$RELEASE_TAG" \
+  -R github.com/IABTechLab/trusted-server \
+  --pattern 'trusted-server-fastly.wasm*' \
+  --pattern 'release-index*' --pattern tsjs-inventory.json --pattern SHA256SUMS
+
+gh release verify "$RELEASE_TAG" -R github.com/IABTechLab/trusted-server
+
+verify_build() {
+  gh attestation verify "$1" \
+    -R IABTechLab/trusted-server --hostname github.com \
+    --cert-identity "$SIGNER" \
+    --cert-oidc-issuer https://token.actions.githubusercontent.com \
+    --source-ref "refs/tags/$RELEASE_TAG" --source-digest "$REVIEWED_COMMIT" \
+    --signer-digest "$REVIEWED_COMMIT" --deny-self-hosted-runners \
+    --predicate-type https://slsa.dev/provenance/v1 --format json
+}
+
+verify_build release-index.json
+verify_build trusted-server-fastly.wasm
+
+gh attestation verify trusted-server-fastly.wasm \
+  -R IABTechLab/trusted-server --hostname github.com \
+  --cert-identity "$SIGNER" \
+  --cert-oidc-issuer https://token.actions.githubusercontent.com \
+  --source-ref "refs/tags/$RELEASE_TAG" --source-digest "$REVIEWED_COMMIT" \
+  --signer-digest "$REVIEWED_COMMIT" --deny-self-hosted-runners \
+  --predicate-type https://spdx.dev/Document/v2.3 --format json
+
+gh release verify-asset "$RELEASE_TAG" release-index.json \
+  -R github.com/IABTechLab/trusted-server
+gh release verify-asset "$RELEASE_TAG" trusted-server-fastly.wasm \
+  -R github.com/IABTechLab/trusted-server
+gh release verify-asset "$RELEASE_TAG" trusted-server-fastly.wasm.spdx.json \
+  -R github.com/IABTechLab/trusted-server
+```
+
+The full R-EVIDENCE checks, JSON Schema validation and membership checks for remaining companions/JS inventory are still required; these commands alone do not construct a verified capability. The implementation MUST provide `ts release verify <tag> --asset <asset> --expected-source-commit <commit>` as a read-only complete online policy check, using the same verifier library as deployment. It MUST report policy version/digest, source, asset digest and required profile, and distinguish optional comparison outcomes. It does not export an offline publication-authorization record.
+
+## 10. Offline evidence limits
+
+### R-OFFLINE
+
+Offline build verification MUST use securely transported roots, an independently approved source commit and artifact SHA-256, and published provenance/SBOM bundles. Roots or digest pins supplied alongside arbitrary evidence MUST NOT become trust inputs. Preparation MAY obtain a root snapshot with `gh attestation trusted-root --hostname github.com`; artifacts/bundles are downloaded online. A file-mode bundle verification does not need GitHub authentication. Verification MUST work with network access denied and apply the same fixed certificate/source/predicate bounds.
+
+```sh
+RELEASE_TAG=v1.2.0
+REVIEWED_COMMIT='<reviewed-40-character-commit>'
+SIGNER="https://github.com/IABTechLab/trusted-server/.github/workflows/release-build.yml@refs/tags/$RELEASE_TAG"
+
+gh attestation verify trusted-server-fastly.wasm \
+  -R IABTechLab/trusted-server --hostname github.com \
+  --bundle trusted-server-fastly.wasm.provenance.sigstore.json \
+  --custom-trusted-root trusted_root.jsonl \
+  --cert-identity "$SIGNER" \
+  --cert-oidc-issuer https://token.actions.githubusercontent.com \
+  --source-ref "refs/tags/$RELEASE_TAG" --source-digest "$REVIEWED_COMMIT" \
+  --signer-digest "$REVIEWED_COMMIT" --deny-self-hosted-runners \
+  --predicate-type https://slsa.dev/provenance/v1 --format json
+```
+
+Apply equivalent checks to index and SBOM bundles, use SPDX predicate type for the latter, compare the independent executable pin and all authenticated companion digests, and compare the SPDX document. Offline success establishes build evidence and approved byte identity only. It does not re-establish GitHub release membership, current release state or fresh revocation. `gh release verify-asset` requires the API; `gh attestation verify` is not an offline verifier for GitHub's release-attestation certificate profile. Automated offline official deployment and a `verified-publication.json` protocol are deferred; `ts deploy --release --offline` MUST be rejected in this cohort.
+
+## 11. Fastly verified-byte consumption and recovery
+
+### R-DEPLOY
+
+Canonical identity is SHA-256 of final `trusted-server-fastly.wasm`, not a publisher-specific tarball. The new `ts deploy --adapter fastly --release <tag>` path MUST verify before side effects, retain the verified bytes in private owned storage and bypass source-build and manifest deploy overrides. Artifact flags without `--release`, unsupported variants/adapters, conflicting package/source arguments, arbitrary passthrough hooks and offline deployment MUST fail. A local `--artifact <path>` MAY be used only when its retained bytes equal the authenticated official asset and all online checks succeed. Matching source/version strings alone are insufficient.
+
+A delayed EdgeZero API MUST NOT block raw release publication or documented manual verified-byte production deployment. Integrated production/staging is separate completion item AC-8 below, not a prerequisite to build/sign/publish. Source deployment remains available for development/custom distributions, with an explicit diagnostic that canonical identity has not been established.
+
+### R-PACK
+
+Packing MUST use a validated deployment-only manifest derived from the selected publisher-owned manifest and retained verified wasm in a fresh private directory. The sanitized package name MUST be nonempty and MUST NOT equal `package`; that reserved name collides with the generic archive. With pinned Fastly CLI 15.1.0 and an accepted name, `compute pack --wasm-binary` writes `pkg/<sanitized-name>.tar.gz` and also an unrelated `pkg/package.tar.gz`; it can sweep pre-existing package contents.
+
+The chosen archive MUST have exactly `<name>/`, `<name>/bin/`, `<name>/bin/main.wasm` and `<name>/fastly.toml`. Inspection MUST reject links, traversal, duplicates, extra entries or mismatched manifest/wasm bytes, with bounded extraction. The archive MUST be selected by validated name and contents, not a guessed generic filename. Recheck retained archive/member digests immediately before submission.
+
+The deployment-only manifest MUST exclude `[local_server]`, inline fixture settings/secrets, active app-config payloads and build hooks; preserve only reviewed provider envelope/resource-reference fields. The original operator manifest is not silently edited. Fastly pack and `compute validate` can succeed on non-wasm bytes and neither strips local fixtures, so they MUST NOT be used as proof of wasm validity or privacy.
+
+Producer validation MUST parse the actual final core module with a pinned validator and execute an application request under pinned Viceroy; `/health` alone bypasses app settings. Live provider/runtime validation remains separate. Tar metadata is nondeterministic: package SHA-256 identifies this operation's envelope, not the canonical release.
+
+### R-CONTEXT
+
+Before any provider mutation, the integrated route MUST resolve an existing service, selected base version, approved logical config ID, physical resource mapping and runtime selectors, and compare declarations with observed links/selectors on that exact version. Existing-service `[setup]` declarations alone do not provision or update bindings. New-service provisioning MUST be a separate supported operation, otherwise fail read-only. Store/config/secrets push remains separately authorized and MUST NOT be hidden in verification.
+
+After clone/upload, the route MUST validate actual bindings and selectors on the exact returned draft version before staging or activation. Production MUST preserve intended config mappings; staging MUST use a verified isolated config mapping and selectors rather than silently retain inherited production links. Missing logical IDs, absent links, contradictory observed selectors or incomplete isolation MUST fail before activation/stage. Staging isolation here covers app-config mappings/selectors, not automatic isolation of KV/Secret Stores or external side effects. The approved context MUST explicitly declare shared versus isolated resources, and secret validation MUST use references/presence/metadata, not pretend write-only secret plaintext can be read back. Participating operations MUST serialize at service/shared-resource scope; an environment-only lock does not cover shared production/staging resources or other operators. Mutable context MUST be revalidated at the applicable phase; this is not a transaction or a guarantee against concurrent provider changes.
+
+### R-EDGEZERO
+
+The pinned EdgeZero adapter interface is `execute(AdapterAction, &[String]) -> Result<(), String>`; context is string tokens and outcomes are logs. Implementing `deploy_prebuilt` requires a new additive request/result API and reviewed upstream work. Its initial scope MUST be Fastly only. The request MUST contain retained package/path/size/SHA-256, existing service ID, selected base version, production/staging mode and resolved manifest/store context. The result MUST contain service ID, exact version if known, last confirmed phase, whether mutation was attempted and known/unknown outcomes.
+
+EdgeZero MUST own concrete clone/upload/context-validation/stage/activation operations and payload integrity without implementing official release policy. It MUST NOT run `compute build`, `compute publish`, `compute update --autoclone --version=active` as a combined guessed-version path, or infer the uploaded version from whichever version is now active/highest. It MUST inspect the exact selected version and capture the version returned by its own clone/upload operation. `compute deploy` activates internally and cannot expose the required draft-binding validation boundary, so the integrated API cannot be implemented by merely wrapping its exit status.
+
+### R-RECOVERY
+
+Before first mutation, the integrated route MUST durably persist a restricted operation journal plus retained package/evidence and original resolved context. The journal MUST bind a unique operation ID, policy/source/artifact/package identities, intended service/base version/mode/mappings, previous active version when observed, last confirmed phase and mutation/uncertainty state. It MUST exclude credentials, resolved secrets and active configuration payloads. Immediately before every clone, upload, selector/link write, stage or activation request, the journal MUST atomically persist and flush a pending/attempted marker and explicit uncertainty. A crash between request transmission and response MUST NOT leave a false no-mutation claim. Confirm responses in atomic durable updates through `Prepared → VersionAllocated → Uploaded → ContextBound → Staged/Activated`; allocated version and uploaded package are distinct observations. An abrupt interruption MUST leave enough durable intent/state for inspection.
+
+After any attempted write, retained recovery inputs MUST survive temporary-directory cleanup, a failed final receipt write and process termination until explicit reconciliation or abandonment. Before the first write, failed preparation MAY clean up. The consumer MUST serialize operations for the same service and any shared resources across environments; no distributed lock is promised. EdgeZero owns read-only reconciliation of exact observed/allocated versions and uncertain writes. The operator/orchestrator owns the retry, explicit rollback or abandonment decision. Recovery MUST NOT rebuild from today's edited manifest, blindly retry activation/upload or guess a rollback target. If the first clone commits but its response is lost before the allocated version is known, reconciliation MAY remain unresolved: the endpoint exposes no documented caller operation ID/idempotency key. Candidate versions, timestamps or matching packages are not unique ownership proof. Recovery MUST preserve unknown and MUST NOT adopt, activate, delete or roll back a guessed candidate. The local operation ID is not a provider transaction ID. Local receipt output MAY summarize observations but is non-normative for #161 and proves neither publisher authority nor live execution.
+
+The proposed integrated interface is new work:
+
+```sh
+ts deploy --adapter fastly --service-id '<service-id>' \
+  --release v1.2.0 --expected-source-commit '<reviewed-40-character-commit>' \
+  --receipt deployment-receipt.json
+
+ts deploy --adapter fastly --service-id '<service-id>' --staging \
+  --release v1.2.0 --expected-source-commit '<reviewed-40-character-commit>' \
+  --receipt staged-deployment-receipt.json
+```
+
+### Manual production route during integration
+
+### R-MANUAL
+
+Operator guidance MUST provide verification, private-directory packing, R-PACK inspection, observed existing-service binding checks and an explicit production submission command before the first release. A lower-level verified-byte transport can use:
+
+```sh
+fastly compute pack --wasm-binary ./trusted-server-fastly.wasm
+fastly compute deploy --package './pkg/<sanitized-name>.tar.gz' \
+  --service-id '<service-id>' --version '<selected-base-version>' --no-default-domain
+```
+
+Run in a private directory with exactly the validated deployment-only `fastly.toml`; inspect the package before deployment. At pinned 15.1.0, `compute deploy` clones an active/locked version and activates production, has no staging mode, and can successfully skip deployment when the selected version already has the same package hash. No upload/new version/activation can be inferred from exit zero. It reads a working-directory manifest before the packaged one and otherwise may create a random default domain; explicit service selection, the inspected integer `--version` and `--no-default-domain` are required here. The operator MUST serialize manual changes to that service and its shared resources across environments and recheck the selected version's bindings; omitting `--version` resolves active at execution time and falls back to latest if no active version exists, which can select a different version from the inspected one. `[setup]` stores are applied only for new services. Built-in availability checks do not establish application correctness.
+
+This manual route preserves inspected wasm bytes but does not supply the integrated preactivation binding check, staging isolation or durable structured outcome. Operators MUST document that limit, record the version actually reported, and independently inspect binding/context rather than claim the integrated contract passed. The proposed integrated route is the eventual default; this documented verified-byte production route satisfies #1235's initial artifact-deployment choice while upstream integration is pending.
+
+## 12. Follow-up ownership and stable adapter invariants
+
+### R-FOLLOWUP
+
+Additional adapter support MUST preserve configuration outside canonical bytes, external complete-byte SHA-256 identity, verification and action authorization before provider mutation/process start, and artifact-specific provenance/SBOM, reproducibility policy, runtime/binding, readiness and recovery proof. It MUST be selected in a reviewed cohort/policy before execution. One adapter's successful proof MUST NOT qualify another. These invariants do not make additional adapters part of #1235's acceptance or require a cumulative nine-artifact launch.
+
+The following are investigation inputs for separate specs, not approved transports/ABIs in this contract:
+
+| Follow-up                                                                                                                          | Questions and proof to resolve                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| ---------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Reproducible operator rebuild                                                                                                      | Retained authenticated source/dependency/tool inputs, legally obtainable SDKs, separately bootstrapped replay and offline official-release policy. Consider a supported library verification of GitHub-signed release attestations rather than a consumer-authored publication record. Promote native comparison gates individually                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| Cloudflare (existing [KV/Worker-variable mismatch #1140](https://github.com/IABTechLab/trusted-server/issues/1140), deferred here) | Define final executable modules and inventory subjects (prefer raw module assets plus `modules.json` unless an archive is justified). The Worker reads `TRUSTED_SERVER_CONFIG` and caches settings, while current EdgeZero config push writes KV; these channels MUST be reconciled in the adapter spec with explicit config-envelope/secret references and positive/negative publisher-request fixtures. Define prepared version upload and explicit activation identities                                                                                                                                                                                                                                                                                                                           |
+| Cloudflare build/transport                                                                                                         | Verify/preseed worker-build 0.8.5 tools: wasm-bindgen matching locked 0.2.126, Binaryen 130 and esbuild 0.28.1 (distinct from the JS lockfile). Account for `WASM_BINDGEN_BIN`, `WASM_OPT_BIN`, `ESBUILD_BIN`, cache/download fallbacks, `CUSTOM_SHIM`, `RUN_TO_COMPLETION`, coredump switches, minification, optimization, panic-unwind and producers metadata. Current `build.sh` installs without `--locked` and loads operator env. For inheritance, investigate `bindings_inherit=strict`. Ordinary script/Upload Version inheritance is latest-uploaded-only; an explicit non-latest `version_id` requires the beta Workers API Versions endpoints and a separately reviewed API contract. Do not prescribe that beta field for the ordinary endpoint; latest uploaded can differ from deployed |
+| Spin                                                                                                                               | `spin-sdk` 6.0.0 locks `wasip3` with WASI `0.3.0-rc-2026-03-15`. A `wasm32-wasip2` compiler target alone does not define a compatible ABI. Pin/test that exact world and runtime, migrate all owning targets/manifests/CI/commands together, and reassess RC support lifetime. Existing secret `default = ""` fields serialize into published locked-app data; define unresolved secret references. Default OCI composition and current-time annotations MUST not silently transform the canonical component; registry manifest identity is observed separately                                                                                                                                                                                                                                       |
+| Axum                                                                                                                               | Define direct verified local launch and a tested bridge from EdgeZero's local config envelope to runtime selectors/config variables and secret references. The binary uses `PORT` and loopback, not the source launcher's adapter port or `axum.toml`; a living error router is not readiness. Require an application request, child cleanup and signal handling. No generic remote deployment implied                                                                                                                                                                                                                                                                                                                                                                                                |
+| #161                                                                                                                               | Publisher authority, actual loaded snapshot, claims/freshness, remote execution limits and optional authenticated deployment observations. Fastly default is per-request; reusable Fastly/Axum/Cloudflare/Spin have distinct snapshot lifetimes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+
+The Cloudflare configuration mismatch and inaccurate configuration comments predate this spec. Runtime repair is separate work; no issue is automatically opened by this document.
+
+## Feasibility evidence and implementation dependencies
+
+The [feasibility audit](2026-10-12-1235-release-attestation-feasibility.md) covers every requirement and identifies concrete implementation boundaries. Local JS/wasm/native builds, application execution and pinned gh primitives were exercised. Hosted production recipes, full real-artifact SBOM coverage, GNU/Intel qualification, actual project signing/publication and live Fastly submission remain unproven release gates. Approval of prose does not waive them. The audit records the known unavailable old-macOS matrix, final-CLI JS distinction, primitive verifier limits, manifest fixture leakage and irreducible first-clone uncertainty corrected here.
+
+## Test plan and requirement traceability
+
+These are implementation acceptance tests, not tests claimed to pass in this specification and implementation PR. Every normative requirement maps below to a test family and acceptance item. D1–D8 refer to the eight “Done when” bullets of #1235 in their original order.
+
+| Requirements                                                          | Test family and essential positive/negative cases                                                                                                                                                                                                                                                                                                                                                                                                                                                  | Acceptance | #1235 Done when               |
+| --------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- | ----------------------------- |
+| R-COHORT, R-PLATFORM, R-VARIANT                                       | T-1 exact four assets/profiles; no downgrade on required failure; CLI B mismatch reported; Fastly failure blocks; ELF symbol/link/runtime checks; macOS 15 ARM/Intel startup; old-OS claims remain unqualified; reject unsupported reuse                                                                                                                                                                                                                                                           | AC-1, AC-2 | D1, D3                        |
+| R-CONFIG, R-INPUTS, R-ENV                                             | T-2 build with differing fictional publisher inputs gives identical permitted bytes; operator values absent; unchanged repository manifest; inventory covers embedded roots/generated assets/native inputs; prohibited flags/files/env fail                                                                                                                                                                                                                                                        | AC-2       | D2, D5                        |
+| R-JS                                                                  | T-3 #1214 private prebuilt path; skip absent/empty/0/1; missing npm, failed install/test, stale/empty/extra module; inventory tampering; two JS builds differ; cross-artifact digests differ; missing esbuild with network denied                                                                                                                                                                                                                                                                  | AC-3       | D5                            |
+| R-BUILD, R-REPEAT, R-NATIVE                                           | T-4 separate run/job/ID/digest binding; wrong-run/artifact substitution; fresh outputs; varied declared ambient inputs; final wasm equality/no normalized comparison; native A/B outcomes and signature/path observations; enforced socket-denial controls                                                                                                                                                                                                                                         | AC-3       | D3, D6                        |
+| R-SBOM                                                                | T-5 actual target and host proc-macro/build roles, dual-role package, dev exclusion, real JS contribution, Prebid type-only exclusion, plugin helper, AWS-LC/SQLite/ring native coverage and forbidden system selection, SPDX relationship/root/predicate equality and size limit                                                                                                                                                                                                                  | AC-4       | D3, D4                        |
+| R-FACTS                                                               | T-6 target/feature ownership; malformed/missing commit fails without git fallback; source header vs service version; two tags on same commit do not change bytes; no final checksum/config/run timestamp embedded                                                                                                                                                                                                                                                                                  | AC-5       | D2                            |
+| R-SOURCE, R-SIGN, R-PUBLISH                                           | T-7 approved main/RC tag; unauthorized RC and annotated tag rejected; pending/cancelled/skipped/path-filtered/wrong-commit checks; timeout; untrusted caller; permission separation; matching/conflicting draft reruns; immutable/mutable/unknown publish state                                                                                                                                                                                                                                    | AC-6       | D3, D7                        |
+| R-INDEX, R-EVIDENCE, R-POLICY                                         | T-8 schema positive fixture and unknown enums/version/extra field/duplicate keys/names/traversal; tampered subjects/companions; policy cannot self-select; wrong caller/build type/material/source/builder/prefix lookalike, trailing control characters, actual size limits; no extra unapproved subjects                                                                                                                                                                                         | AC-4, AC-7 | D3, D4                        |
+| R-BOOTSTRAP, R-BOUNDS, R-PUBLICATION                                  | T-9 verified CLI first-use fixture; absent token; isolated gh config/host; unsupported tool; hangs/cancel/oversize/nesting/partial JSON; unpublished or mutable artifact; source approval mismatch; all fail before provider mutation                                                                                                                                                                                                                                                              | AC-7       | D4, D6                        |
+| R-OFFLINE                                                             | T-10 pinned roots/source/digest with networking denied; artifact/predicate tampering; hostile transferred roots; offline build success cannot construct official-deploy capability; offline deployment rejected                                                                                                                                                                                                                                                                                    | AC-7       | D4 (specified offline limits) |
+| R-DEPLOY/R-PACK integrated portion, R-CONTEXT, R-EDGEZERO, R-RECOVERY | T-11 retained-file substitution/package/member mutation; all four Fastly pack members plus extra manifest-only archive; observed links disagree; exact draft mismatch prevents activation; staging isolation; no source hooks; exact/unknown outcomes; interrupted selector writes, first-clone/send-before-response crashes including indistinguishable candidate allocations, secret/reference privacy, shared-resource isolation boundaries and final receipt failure; read-only reconciliation | AC-8       | D6 (integrated enhancement)   |
+| R-DEPLOY/R-PACK manual portion, R-MANUAL                              | T-12 provider-free pack/member equality; documented native production limits including skipped upload and manifest precedence; authorized disposable-service production test with submitted wasm equality                                                                                                                                                                                                                                                                                          | AC-9       | D6                            |
+| R-FOLLOWUP                                                            | T-13 docs/policy reject unsupported adapters/actions; #1235 criteria contain no adapter migration, operator replay or offline deploy gate; January supersession link                                                                                                                                                                                                                                                                                                                               | AC-10      | D1                            |
+| Operator/CLI/changelog guidance                                       | T-12 manual-route instructions and T-13 unsupported-action diagnostics; document source-header identity and bootstrap prerequisites                                                                                                                                                                                                                                                                                                                                                                | AC-9       | D8                            |
+
+Implementation changes MUST run appropriate target-matched tests/lints after each behavioral change and the complete AGENTS.md CI gates before PR handoff. The deferred AC-8 milestone additionally requires upstream EdgeZero API/lifecycle tests; those are not a prerequisite for the AC-9 manual route. No real customer/domain/secret fixture data is permitted. PR #1262 contains implementation as well as documents/schema/plans. Document/schema formatting, committed positive/negative fixtures, reference/traceability checks and automated design review accompany implementation tests; these do not establish pending hosted qualification or maintainer approval.
+
+## Rollout
+
+1. Review this contract and its plans, then implement on the same `spec/1235-release-attestation` branch and PR #1262. Approve the contract/code together before merge; this explicitly replaces the separate-spec-PR delivery procedure for this work, without waiving qualification or release authorization. Extend merged #1214/#1213 and reconcile permission-config separation.
+2. Prototype Fastly A/B equality, shared JS output, SBOM native/host/JS fixtures and CLI compatibility baselines with throwaway recipes. Record feasibility and review any cohort change before production work; this step does not promise replay of nonexistent retained inputs.
+3. Implement reviewed release recipes/tools/cohort, JS inventory, composition generator, facts, validation, measurements, schema/policy, signing and immutable publication. Remove obsolete claims that configuration is baked into wasm from CI workflows, the integration-test setup action, adapter comments/tests and integration helpers, not just `test.yml`.
+4. Prepare governance/settings/tag rules, trusted gh/CLI bootstrap and documentation. Exercise publication and verification in a disposable public repository using policy fixtures for that repository; no production-policy override is added. Document/validate the manual verified-byte Fastly production route. Publish the first eligible four-artifact release after all its selected requirements pass.
+5. Implement the separate Fastly-only EdgeZero prebuilt request/result and recovery lifecycle, review/pin that upstream revision, then adopt integrated online production/staging in `ts`. Upstream delay does not block step 4, and MUST NOT cause the artifact path to rebuild.
+6. Update `docs/guide/getting-started.md`, `docs/guide/edgezero.md`, `docs/guide/error-reference.md` and `docs/guide/cli.md`, annotate #1213's historical header goals, add `docs/guide/release-verification.md` and navigation, and update `CHANGELOG.md`. Document platform/tool/token prerequisites, policy identities, manual/integrated distinctions, offline limits and optional comparison results. Historical source builds MUST NOT be relabeled attested.
+7. Follow-up specs independently qualify operator reconstruction, offline deployment, each other adapter and stronger builder isolation. #161 continues publisher/config/runtime work; none gates #1235 closure.
+
+## Acceptance criteria
+
+- [ ] **AC-1:** Spec, plans and implementation reviewed/approved together in PR #1262; implementation records the selected cohort/profiles before release execution.
+- [ ] **AC-2:** Configuration independence, complete input inventory, selected variant and qualified CLI compatibility hold for every selected Build A.
+- [ ] **AC-3:** The two fresh JS builds produce byte-identical bundles. Fastly Build A and Build B produce byte-identical `trusted-server-fastly.wasm`. Each native CLI Build B records `matched`, `mismatched`, `failed` or `unavailable` before its deadline; its result MUST NOT change whether that CLI's mandatory A, SBOM or provenance checks pass.
+- [ ] **AC-4:** Per-artifact provenance/SPDX/bundles/index/checksums and composition coverage pass their exact evidence and schema checks.
+- [ ] **AC-5:** Source facts reconcile #1213, derive target/variant correctly and keep release tags, service versions and final digests distinct.
+- [ ] **AC-6:** Approved main (or future explicitly reviewed exact RC) lightweight `v*` tags run same-commit gates and publish the exact immutable verified distribution with least-privilege authority.
+- [ ] **AC-7:** Trusted bootstrap, complete online verification, bounded subprocesses and offline build-evidence checks pass; unsupported offline official deployment fails before writes.
+- [ ] **AC-8 (integration milestone):** New reviewed/pinned EdgeZero Fastly API supports byte-preserving online production/staging, observed context validation and durable recovery. This item tracks the subsequent integrated enhancement and MUST NOT keep #1235 open when AC-9 satisfies its deployment choice.
+- [ ] **AC-9:** Operator verification/CLI/changelog guidance and the manual verified-byte production route are implemented and validated; ordinary source builds cannot be mistaken for canonical bytes.
+- [ ] **AC-10:** January binary-attestation guidance is superseded; #161 and deferred adapter/reconstruction scopes are explicit and unsupported actions fail.
+
+#1235 can close when AC-1 through AC-7, AC-9 and AC-10 satisfy its D1–D8 criteria. AC-8 remains a separately tracked integration milestone if upstream work is delayed. There is no requirement to implement Cloudflare, Spin, Axum, native CLI reproducibility, retained archives or operator replay to close #1235.
+
+## Appendix A. Review disposition and rationale
+
+This table accounts for all 32 inline comments in [review 5484754857](https://github.com/IABTechLab/trusted-server/pull/1262#pullrequestreview-5484754857). It records proposed spec resolution; GitHub conversations are not automatically marked resolved and maintainer acceptance is still required.
+
+| Review concern                                        | Resolution / requirement                                                                                                                                                                                                                |
+| ----------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Reusable sandbox (4243031371)                         | R-VARIANT retains current production default and plans qualified attested reuse; R-FACTS corrects snapshot lifetime; removes nonexistent test feature                                                                                   |
+| All-artifact reproducibility gate (4243031376)        | R-COHORT/R-REPEAT select Fastly equality, native observation; reconstruction/offline deploy deferred                                                                                                                                    |
+| Repository-root scaffold (4243031380)                 | R-INPUTS names the external-to-CLI-crate repository-root input                                                                                                                                                                          |
+| Ambient variation and job output binding (4243031389) | R-REPEAT varies declared-insensitive inputs and binds artifact IDs/digests to job outputs                                                                                                                                               |
+| Distinct assurance dimensions (4243031391)            | Profiles chosen before execution; claim/threat tables retain independent limits                                                                                                                                                         |
+| CLI host baselines (4243031395)                       | R-PLATFORM keeps glibc 2.34 as a qualification target not yet demonstrated; macOS loader floor 13 with initial hosted-15 qualification, matching-host recipes first; cross-build requires full qualification and actual Intel execution |
+| Index/schema and informational records (4243031397)   | R-INDEX links closed JSON Schema and field contracts; recipe/rebuild consumer semantics informational; receipts private observations                                                                                                    |
+| #1214 fit (4243031404)                                | R-JS adds release delta to private prebuilt interface, no competing strict mode                                                                                                                                                         |
+| One identical release-wide tsjs set (4243031409)      | R-JS twice-builds one shared set, checks prepared inputs and separately checks modules actually retained after linking                                                                                                                  |
+| Compiler wrapper/Syft cost (4243031418)               | R-SBOM uses Cargo/lock/Rollup evidence and a repository-owned SPDX generator                                                                                                                                                            |
+| Native and esbuild coverage (4243031423)              | R-SBOM declares/validates actual native selection; R-JS tests denied fallback download                                                                                                                                                  |
+| Release branches and in-progress CI (4243031426)      | R-SOURCE approves exact main/RC policy and runs bounded same-commit release validation                                                                                                                                                  |
+| Local signer/source revision (4243031429)             | R-POLICY pins equal signer/source revisions and defines future identity migration                                                                                                                                                       |
+| Attestation permission (4243031433)                   | R-SIGN removes `artifact-metadata: write` for file subjects                                                                                                                                                                             |
+| Settings token (4243031442)                           | R-PUBLISH uses governance plus actual immutable release check/recovery; no settings-read secret                                                                                                                                         |
+| gh prerequisites and bootstrap (4243031449)           | R-BOOTSTRAP specifies token/env/path/trust chain; exact qualified gh version                                                                                                                                                            |
+| Normative evidence graph (4243031456)                 | R-EVIDENCE/R-POLICY fix all digest/source/builder/caller/action constraints                                                                                                                                                             |
+| Annotated tag commit confusion (4243031459)           | R-SOURCE requires lightweight tags and explicit commit-object validation                                                                                                                                                                |
+| Prefix signer match (4243031464)                      | R-POLICY/commands use exact SAN `--cert-identity`                                                                                                                                                                                       |
+| Resource bounds (4243031467)                          | R-BOUNDS supplies concrete limits/deadlines, failure and child cleanup                                                                                                                                                                  |
+| Offline observation protocol cost (4243031470)        | R-OFFLINE retains bundle/pin checks; offline official deployment/record deferred                                                                                                                                                        |
+| Actual EdgeZero surface (4243031476)                  | R-EDGEZERO sizes new Fastly-only API and bypasses existing build/log/version fallbacks                                                                                                                                                  |
+| Observed binding validation (4243031479)              | R-CONTEXT checks existing base version and exact resulting draft before stage/activation                                                                                                                                                |
+| Pack archive facts (4243031481)                       | R-PACK specifies four prefixed entries, fresh directory and separate manifest-only archive                                                                                                                                              |
+| Durable recovery ownership (4243031485)               | R-RECOVERY persists before mutation, survives failures/crashes and assigns reconciliation/retry ownership                                                                                                                               |
+| Native deploy limits (4243031488)                     | R-MANUAL documents production activation, skip, domain creation and manifest precedence                                                                                                                                                 |
+| Derived facts / #1213 (4243031494)                    | R-FACTS uses established name, source-only override, Cargo/adapter derivation, external release tag                                                                                                                                     |
+| Cloudflare config mismatch (4243031498)               | §12 preserves concrete binding-channel investigation and fixture prerequisites for separate adapter spec                                                                                                                                |
+| Spin ABI and OCI facts (4243031502)                   | §12 records exact WASI 0.3 RC dependency, secret defaults and composition/annotation caveats; no premature migration gate                                                                                                               |
+| Rollout dependencies (4243031506)                     | Feasibility precedes recipes; publication/manual route precedes independent upstream integration                                                                                                                                        |
+| Stale config assertions beyond CI (4243031509)        | Rollout step 3 explicitly covers workflows/action/adapter comments/tests/helpers                                                                                                                                                        |
+| Phase 2 closure scope (4243031515)                    | R-FOLLOWUP/acceptance remove cumulative adapter gates from #1235                                                                                                                                                                        |
+
+Body-level findings are addressed by the threat model, BCP 14 requirements, requirement→test→acceptance→issue mapping, named producer-policy paths and the January supersession banner. Deferred Cloudflare notes are retained in §12 rather than lost during scope reduction.
+
+Verified-byte deployment is selected first because it directly preserves an attested subject without requiring an operator SDK/compiler. Fastly A/B adds affordable measured repeatability; native CLI reconstruction has separate linker/SDK/availability costs. Selected required profiles remain blocking, so this is a reviewed assurance split, not a fail-open release. A custom whole-lockfile SBOM or bare wasm scan misses target/host/JS/native selection; an extra compiler wrapper does not solve native library provenance. A complete-package attestation would vary with publisher metadata, so raw wasm identity and observed package identity stay separate. A future independent builder strengthens a different threat boundary than matching project-controlled builds.
+
+## Appendix B. Supersession and primary references
+
+This draft supersedes the binary-attestation direction in [the January proposal](2026-01-15-attestation-design.md); after approval it is the implementation contract for those sections. January runtime/configuration examples remain historical reference for #161, not approved claims, embedded active-config guidance or self-reported executable proof.
+
+- [Original issue](https://github.com/IABTechLab/trusted-server/issues/1235), [review](https://github.com/IABTechLab/trusted-server/pull/1262#pullrequestreview-5484754857), [JS PR #1214](https://github.com/IABTechLab/trusted-server/pull/1214), [version PR #1213](https://github.com/IABTechLab/trusted-server/pull/1213).
+- GitHub [artifact attestations](https://docs.github.com/en/actions/concepts/security/artifact-attestations), [immutable releases](https://docs.github.com/en/code-security/concepts/supply-chain-security/immutable-releases), [release verification](https://docs.github.com/en/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/verify-release-integrity), and [reusable workflow limits](https://docs.github.com/en/actions/how-tos/secure-your-work/use-artifact-attestations/increase-security-rating).
+- gh 2.97.0 [exact/prefix identity policy](https://github.com/cli/cli/blob/55dbb4dc6b7edb10b48e3d7fc5bccd32318d1b55/pkg/cmd/attestation/verify/policy.go) and [tag-target lookup](https://github.com/cli/cli/blob/55dbb4dc6b7edb10b48e3d7fc5bccd32318d1b55/pkg/cmd/release/shared/fetch.go); [verifier manual](https://cli.github.com/manual/gh_attestation_verify), [bundle download](https://cli.github.com/manual/gh_attestation_download), [trusted roots](https://cli.github.com/manual/gh_attestation_trusted-root). <!-- allow-domain: cli.github.com -->
+- Pinned [attest 4.2.2 dependency lock](https://github.com/actions/attest/blob/1e69f48acb82d1966a394da916b4c1698aa569d6/package-lock.json) and matching [toolkit provenance semantics](https://github.com/actions/toolkit/blob/7987771a2b727fe14b36351f6c877fa3a56b9c36/packages/attest/src/provenance.ts).
+- Pinned [Sigstore certificate summary fields](https://github.com/sigstore/sigstore-go/blob/v1.2.2/pkg/fulcio/certificate/summarize.go).
+- [SLSA build requirements](https://slsa.dev/spec/v1.2/build-requirements), [SPDX relationships](https://spdx.github.io/spdx-spec/v2.3.1/relationships-between-SPDX-elements/), [BCP 14 keyword clarification](https://www.rfc-editor.org/rfc/rfc8174.html). <!-- allow-domain: spdx.github.io, www.rfc-editor.org -->
+- Cargo [build messages](https://doc.rust-lang.org/cargo/reference/external-tools.html), [metadata](https://doc.rust-lang.org/cargo/commands/cargo-metadata.html), [source remapping](https://doc.rust-lang.org/rustc/remap-source-paths.html) and [Apple targets](https://doc.rust-lang.org/rustc/platform-support/apple-darwin.html); [Rollup output hooks](https://rollupjs.org/plugin-development/), [npm ci](https://docs.npmjs.com/cli/v11/commands/npm-ci/). <!-- allow-domain: rollupjs.org, docs.npmjs.com -->
+- Fastly 15.1.0 [packing](https://github.com/fastly/cli/blob/v15.1.0/pkg/commands/compute/pack.go), [deployment](https://github.com/fastly/cli/blob/v15.1.0/pkg/commands/compute/deploy.go), [build annotation](https://github.com/fastly/cli/blob/v15.1.0/pkg/commands/compute/build.go).
+- Pinned EdgeZero [adapter surface](https://github.com/stackpop/edgezero/blob/683202c66948146ec360f490126f1d60f920288b/crates/edgezero-adapter/src/registry.rs), [Fastly lifecycle](https://github.com/stackpop/edgezero/blob/683202c66948146ec360f490126f1d60f920288b/crates/edgezero-adapter-fastly/src/cli.rs), [CLI dispatch](https://github.com/stackpop/edgezero/blob/683202c66948146ec360f490126f1d60f920288b/crates/edgezero-cli/src/lib.rs).
+- [Cloudflare binding inheritance](https://developers.cloudflare.com/workers/configuration/multipart-upload-metadata/), [worker-build pipeline](https://github.com/cloudflare/workers-rs/blob/v0.8.5/worker-build/src/main.rs), [tool versions](https://github.com/cloudflare/workers-rs/blob/v0.8.5/worker-build/src/versions.rs); existing [Axum bridge guidance](../../guide/axum-dev.md).
+
+Tool availability and API semantics MUST be revalidated at implementation pin selection. Incompatible changes require reviewed policy/spec updates rather than silent fallback.
diff --git a/docs/superpowers/specs/2026-10-12-1235-release-attestation-feasibility.md b/docs/superpowers/specs/2026-10-12-1235-release-attestation-feasibility.md
new file mode 100644
index 0000000000..df928fa01a
--- /dev/null
+++ b/docs/superpowers/specs/2026-10-12-1235-release-attestation-feasibility.md
@@ -0,0 +1,121 @@
+# Release attestation feasibility and implementation dependencies
+
+**Date:** 2026-10-12.
+
+**Contract:** [Release artifact attestation and verified consumption](2026-10-09-1235-release-attestation-design.md), PR #1262, issue #1235.
+
+**Status:** Feasibility evidence for a proposed contract. The core build, verification and packaging mechanisms work in local prototypes. The complete four-target release is **not qualified**: hosted production recipes, full SBOM coverage, signing/publication rehearsal, Linux compatibility, Intel execution and live Fastly submission remain required evidence.
+
+Document/schema checks and independent design review establish consistency. They do not establish that a new workflow can publish, that every native target runs, or that provider operations preserve an intended runtime context.
+
+**2026-10-14 implementation correction:** Audit prototype scripts and their Python paths/counts are historical measurements, not active implementation instructions or Rust migration proof. Introduced Python release tooling has been superseded by the independent host-only Rust producer in the [migration addendum](2026-10-14-release-tooling-rust-migration.md). Existing Node composition remains. The original native acquisition/SDK, actual hosted-platform, full SPDX, same-run transfer, signing/publication and live-provider gaps remain mandatory; local macOS 26.6.2 does not establish macOS 15 execution.
+
+## Evidence scope
+
+The historical audit baseline was `7f6056bf83eb96aa4167efca64d43280299fba73`. Read-only PR checks identified #1214 head `e150780b4a922be0cd0dfbbe1167c72aa076d3e8` and #1213 head `959e503b9e35b0aecd42439edc85ad744bbb92f2`. Both were open during that audit; both merged on 2026-10-12 and are ancestors of the current implementation planning baseline `44c5b5620bfb1f82e5b959ab5ba8ec69c7091e52`. Open-PR overlays are historical probe conditions, not current prerequisites. Isolated JS/interface probes overlaid #1214 files onto the baseline; its old `build-all.mjs` diff requires reconciliation with the current refactor. These synthetic snapshots are not an approved release commit.
+
+Local tools were Rust 1.95.0, Node 24.12.0/npm 11.6.2, macOS 26.6.2 ARM64 with SDK 15.5, Fastly CLI 15.1.0, Viceroy 0.17.0 and downloaded GitHub CLI 2.97.0. The Fastly CLI separately reports a bundled Viceroy 0.21.1; that was not substituted for the pinned runtime probe. Compilation outputs were fresh; Rust source caches/compiler were shared. Prototype epoch input was fixed rather than produced by the final commit-derived recipe. Source-fact #1213 changes and CLI checkout-fallback removal were not applied to the full artifact builds.
+
+Build outputs and application fixtures stayed in temporary directories. A gh probe with omitted `HOME`/`XDG_STATE_HOME` briefly created anonymous device state relative to the repository; the behavior was reproduced, the exact generated file and empty directories were removed, and R-BOOTSTRAP now requires private home/state handling. Provider operations, repositories, workflows, releases and attestations were not created or modified. Online probes read existing public GitHub release evidence. Runtime requests used localhost fixtures with fictional configuration and secrets.
+
+## Historical local measurements
+
+| Probe                            | Measured result                                                                                                                                                                                            | What it proves                                                                                                                            | What it does not prove                                                                                                              |
+| -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
+| Fresh locked JS A/B              | All 13 final bundles byte-identical; each test run passed 50 files and 1,208 tests                                                                                                                         | The historical bundler could produce stable shared input under varied local paths/locale/timezone                                         | Separate hosted workers, all package-origin joins or independent toolchain trust                                                    |
+| #1214 prebuilt interface         | Exact copied module set/hashes; succeeded with npm absent; 7 bundle-set tests passed                                                                                                                       | Rust can consume one prepared JS set without rerunning npm                                                                                | Trusted expected-inventory input and a release presence-reject guard; historical upstream accepted skip alongside prebuilt          |
+| Missing esbuild binary           | Network-denied bundle step exited 1 without fetching replacement                                                                                                                                           | Selected Darwin bundler does not silently succeed without its prepared tool                                                               | Every installation-time/platform download fallback                                                                                  |
+| Network confinement              | Unconfined localhost socket succeeded; confined socket failed with `EPERM`; full Rust/JS builds ran inside that profile                                                                                    | Local macOS process-level network denial is available                                                                                     | Qualification of each actual hosted recipe or hostile-runner resistance                                                             |
+| Full Fastly release A/B          | Both complete files were 69,647,265 bytes and matched SHA-256 `2a740c43e93c47b31237861118e1bd75c5bd2940eb3daf1bb382d1104547c658`; no normalization                                                         | Fresh Cargo outputs can repeat across source/output paths, umask, locale/timezone and 4-versus-2 build jobs; all 13 JS strings remained   | Final Linux hosted recipe, fresh independent dependency materialization, final source facts, publication or operator reconstruction |
+| Actual Fastly runtime            | Viceroy 0.17.0 `/health` returned 200; publisher `/` separately returned 200, origin fixture body and injected script                                                                                      | This complete prototype wasm parses/links and executes meaningful app behavior with the test envelope                                     | Fastly upload/activation, PoP behavior, production credentials/config or remote execution proof                                     |
+| Full ARM64 CLI release           | Network-denied `--frozen` release build succeeded; final file 37,977,296 bytes; outside-checkout help/version/config init succeeded                                                                        | Current whole CLI graph builds/starts locally; scaffold bytes equal repository template                                                   | macOS 13/14/15, Intel or GNU startup; final release build-facts/version policy                                                      |
+| CLI native inputs                | Build messages/static archives identified `aws-lc-sys` 0.42.0 (vendored AWS-LC 5.1.0), ring 0.17.14 and `libsqlite3-sys` 0.30.1 (bundled SQLite 3.46.0); four native archives; loader floor 13.0, SDK 15.5 | Whole-CLI native evidence is observable and the explicit source-selection recipe works locally                                            | Complete source/SDK/sysroot/license provenance, final native reachability or cross-platform determinism                             |
+| Final JS byte membership         | All 13 complete bundles present in Fastly, none present in the final CLI, despite JS crate compilation                                                                                                     | OUT_DIR/compiled membership is not final embedded payload; per-artifact classification is necessary                                       | Exact final function reachability; absence of every possible transformed fragment                                                   |
+| CLI path literal                 | Compiled temporary checkout fallback survived Rust path remapping                                                                                                                                          | Literal fallback removal needs code; remapping is insufficient                                                                            | A qualified official CLI resource policy                                                                                            |
+| Cargo dual-context fixture       | Compiler JSON separated host/target units/features; metadata merged their feature sets                                                                                                                     | Effective unit features can be collected from messages; package metadata alone is insufficient                                            | Exact compiler dependency DAG from metadata/tree                                                                                    |
+| Rollup hook                      | Contributions collected for all 13 outputs without changing bundle bytes; current contributors were project modules, not full external Prebid.js                                                           | Hook-based contribution evidence is available                                                                                             | Full third-party/license joins, generated helper and elimination fixtures                                                           |
+| Limited native SPDX prototype    | Actual native-linked fixture ran; 30 packages/23 Rust units; 21,933-byte document passed official SPDX 2.3 schema                                                                                          | Selected-unit/native evidence can be serialized as valid SPDX                                                                             | Production generator coverage, full CLI/Rust/sysroot/JS semantics or signed SBOM equality                                           |
+| Exact gh offline verification    | gh 2.97.0 verified a signed reusable-workflow fixture under denied networking and absent token; wrong SAN/source/predicate rejected                                                                        | Exact certificate/source flags, offline roots/bundle primitive and flattened certificate JSON work                                        | Future action/workflow OIDC, official offline release membership or deployment                                                      |
+| gh state isolation               | An omitted home/state path created relative anonymous device state despite isolated gh config; reproduced and cleaned                                                                                      | `GH_CONFIG_DIR` alone does not isolate gh state                                                                                           | Production environment hygiene without explicit home/state paths                                                                    |
+| Live public release verification | gh 2.97.0 verified its immutable release and archive; independent REST checks reported immutable release and commit tag type                                                                               | Current online release primitives work                                                                                                    | This project's governance, RC permissions or new publication workflow                                                               |
+| Membership negative probe        | Renamed downloaded archive still passed `gh release verify-asset`                                                                                                                                          | Command checks digest, not expected local/published filename; wrapper needs signed-name checks                                            | Full release policy from exit zero                                                                                                  |
+| Pinned toolkit execution         | Integrity-checked toolkit 3.2.0 emitted expected current build type/caller/builder/source/run shape with mocked OIDC claims                                                                                | Current action's predicate construction matches the proposed semantics                                                                    | Actual certificate issuance for the future hosted local reusable workflow                                                           |
+| Fastly packaging negatives       | Named archive retained exact bytes; generic archive lacked wasm; extra package file was swept in; local settings/secrets were copied; ASCII non-wasm passed both pack and validate                         | Fresh directory, nonreserved package name, strict inspection, deployment-only manifest and separate wasm/runtime validation are necessary | Deployability or confidentiality from pack/validate exit zero                                                                       |
+
+These are measurements from this audit, not claims about a published release. The CLI result is a conservative byte check plus source-use analysis; unused JS must not be added to the CLI merely to make a cross-artifact inventory assertion true.
+
+## Corrections made to the contract
+
+1. **Remove unavailable macOS qualification gates.** macOS 13 hosted runners retired on December 4, 2025; macOS 14 retires November 2, 2026. A hosted-only 13/14/15 startup requirement cannot be treated as a routine supported matrix. The initial required matrix is macOS 15 on ARM64 and Intel. Deployment target 13.0 is a loader floor; older runtime support remains unqualified. Intel cross-build is an optional replacement after whole-project qualification, not an assumed first implementation. [macOS 13 retirement](https://github.blog/changelog/2025-09-19-github-actions-macos-13-runner-image-is-closing-down/), [macOS 14 retirement](https://github.blog/changelog/2026-10-01-github-actions-macos-14-runner-image-retirement/). <!-- allow-domain: github.blog -->
+2. **Distinguish prepared JS from retained code.** One shared input set is feasible, but the current optimized CLI discards its complete bundles. Only final retained modules get an embedded-payload claim. Compiler inputs remain build material.
+3. **Make native selection enforceable.** Target-suffixed AWS-LC variables can override a generic selector; SQLite pkg-config can override the bundled feature. The recipe must control both channels and validate actual archives/link directives. Effective Rust features come from compiler messages, not metadata unions.
+4. **Implement release policy beyond gh exit statuses.** Additional REST/verified-statement checks are needed for raw tag type, immutability, subject names and source authority. Signed release subjects have names/digests but no size; lengths bind through the signed index, actual bytes and REST metadata. The successful renamed-file negative probe prevents treating `verify-asset` as a name check.
+5. **Attribute SBOM comparison correctly.** gh returns the verified predicate; it does not compare a downloaded SPDX file. The strict duplicate-rejecting document comparison belongs to the new Trusted Server wrapper and producer validation.
+6. **Match actual artifact-transfer identity.** Actions artifact metadata contains run/source identity but no independent producer-job/attempt field. Job binding comes from the expected upload outputs and workflow topology. Archive transfer hash is distinct from executable SHA-256; mismatch warnings must fail the collector.
+7. **Close schema gaps.** Newline-suffixed tag/names matched regex end anchors. Explicit newline rejection now accompanies patterns. Inventory and companion declarations have role-specific size limits, including 16 MiB SBOM. Parser/download limits and cross-document checks still belong to the implementation, not JSON Schema alone.
+8. **Prevent deployment-envelope fixture leakage.** Packing carries the entire manifest, including local test values. The production envelope must use an allowlisted deployment-only manifest, without local-server sections, active settings or secrets; such a minimal manifest packed successfully. Sanitized empty/`package` names are rejected to avoid archive selection collisions. Pack/validate do not establish valid wasm; actual core-module parsing and app execution are separate gates.
+9. **Bound recovery and isolation claims.** The clone API has no documented caller idempotency key. A lost first-clone response can leave multiple indistinguishable candidate versions; reconciliation can remain unknown and must not mutate a guess. Config staging isolation is not automatic KV/secret/external-effect isolation. Secret values are write-only, so readback validates references/metadata rather than plaintext. [Fastly version API](https://www.fastly.com/documentation/reference/api/services/version/), [resource links](https://www.fastly.com/documentation/reference/api/services/resource/), [secret-store semantics](https://www.fastly.com/documentation/reference/api/services/resources/secret-store-secret/).
+10. **Qualify Cloudflare inheritance by endpoint.** Ordinary upload inherits latest and rejects a different version ID. Explicit non-latest version inheritance belongs to beta Workers API Versions endpoints and its own reviewed adapter contract. [Cloudflare error 10057](https://developers.cloudflare.com/workers/observability/errors/).
+
+## Requirement feasibility register
+
+“Demonstrated” means only the stated local probe. “Supported” means pinned source/docs expose the needed primitive. “New code” is an implementable contract absent from the existing application. “Unqualified” means a mandatory shipping proof is missing. A composite row can have more than one status because a working primitive does not supply the full policy.
+
+| Requirement   | Status and evidence                                                               | Implementation or qualification still needed                                                                                                                           |
+| ------------- | --------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| R-COHORT      | New code; fixed profiles are structurally expressible                             | Source-controlled cohort/collector; all four canonical Build A qualification gates                                                                                     |
+| R-PLATFORM    | ARM build/run and loader floor demonstrated; GNU/Intel/hosted 15 unqualified      | Actual glibc 2.34 builder and ELF symbols/UBI/Ubuntu/Debian tests; hosted ARM/Intel execution; review any baseline change before enablement                            |
+| R-VARIANT     | Supported by current Cargo/runtime source; default artifact ran locally           | Release variant allowlist/diagnostic; reuse remains separate qualification                                                                                             |
+| R-CONFIG      | Source-supported separation; runtime fixture loaded independently of wasm         | Whole-release differing-publisher-input negative fixture; permission-spec compatibility                                                                                |
+| R-INPUTS      | Important inputs and native/script env evidence observed                          | Complete tracked source/dependency/sysroot/tool/native identities; new generated input coverage                                                                        |
+| R-ENV         | Denied socket and selected fresh environments demonstrated                        | Checked release env whitelist, private gh home/state, all skip values, Cargo/config layers, Vite env suppression and source mutation guards                            |
+| R-JS          | Fresh A/B, tests, prebuilt handoff, Rollup/missing-tool probes demonstrated       | Current Rust recipe proof, trusted inventory binding, final retained classification, hosted transfer                                                                   |
+| R-BUILD       | Full frozen network-denied local builds demonstrated                              | Digest-pinned hosted recipes; verified fresh material extraction; every selected confinement profile and native bootstrap                                              |
+| R-REPEAT      | Complete Fastly equality demonstrated locally                                     | Separate hosted Linux jobs, final facts/source, explicit upload outputs/transfer failure gate; optional-native terminal outcomes                                       |
+| R-NATIVE      | Whole ARM CLI and static native evidence demonstrated                             | Effective tool/SDK pins, platform linker/signature policy; GNU/Intel measurements; no native equality shipping claim                                                   |
+| R-SBOM        | Limited selected-unit/native serialization prototype demonstrated                 | Full real artifact SPDX coverage, source/license/roles/sysroot/native/JS joins and negative fixtures; real selected-artifact validation beyond prototype serialization |
+| R-FACTS       | Cargo inputs and exact #1213 helper semantics supported/probed                    | Strict full-commit release validation, no git fallback, owning adapter variant, typed facts, CLI source version and literal fallback removal                           |
+| R-SOURCE      | Existing branch/CI shape inspected; APIs supported                                | Protected main/approved-RC policy, trusted same-commit workflow-call validation and pending-check deadline; annotated-tag rejection                                    |
+| R-SIGN        | Action inputs/toolkit predicate source-supported and shape executed               | Real hosted exact-version provenance+SPDX certificates, caller permission propagation, least-privilege jobs and collector                                              |
+| R-PUBLISH     | Existing public immutable release consumer path demonstrated                      | Authorized disposable publication rehearsal, repository settings/rules/bypass audit and RC workflow-difference/minimal-token test                                      |
+| R-INDEX       | Schema and negative structural checks demonstrated                                | Producer and strict consumer parser; all semantic source/name/policy/digest/size joins                                                                                 |
+| R-EVIDENCE    | Existing signed bundle/release graphs observed                                    | Full new index/executable/companion/SPDX relationship checker and actual project fixtures                                                                              |
+| R-POLICY      | Exact tool flags/certificate JSON demonstrated                                    | Embedded current/historical policy identity, action/caller/run checks, closed profile/action permissions                                                               |
+| R-BOOTSTRAP   | Auth requirement and isolated no-auth offline primitive demonstrated              | Trusted gh installation, external first-use CLI verification procedure, explicit token/env/path handling                                                               |
+| R-BOUNDS      | Actual fixture outputs measured; limits expressible                               | Concurrent bounded-pipe reader, timeouts/cancel/kill/reap, strict JSON/depth/duplicate checks and negative tests                                                       |
+| R-PUBLICATION | Primitive signatures work; missing name/type/immutable checks confirmed           | REST plus verified-statement wrapper and source approval; cannot use command success alone                                                                             |
+| R-OFFLINE     | Exact build proof with denied network and rejection cases demonstrated            | Document transport trust/pins; official offline deployment remains intentionally unsupported                                                                           |
+| R-DEPLOY      | Canonical byte check/source-supported transport                                   | Shared verifier/retained handles/action validation; integrated upstream API is separate milestone                                                                      |
+| R-PACK        | Byte-preserving pack and adversarial local envelope cases demonstrated            | Allowlisted deployment-only manifest, strict bounded archive inspector and final real-module/runtime validation                                                        |
+| R-CONTEXT     | Exact links/selectors endpoints source-supported                                  | Preflight/resulting-draft readbacks and explicit sharing policy; live propagation/readiness proof; secret plaintext cannot be read                                     |
+| R-EDGEZERO    | Clone → exact draft update → context → stage/activate APIs supported              | New typed upstream API and structured outcomes, no source/manifest hooks; current adapter does not implement it                                                        |
+| R-RECOVERY    | Filesystem journal design implementable; provider uncertainty boundary identified | Flush/atomic records before each write, exact-version inspection where known, unresolved clone handling/crash fixtures; no exactly-once guarantee                      |
+| R-MANUAL      | Pack/flags verified; actual wasm ran only locally                                 | Complete verified policy/inspection instructions and separately authorized disposable Fastly production submission                                                     |
+| R-FOLLOWUP    | Existing adapter facts inspected with endpoint correction                         | Independent Cloudflare/Spin/Axum/reconstruction specs; no additional issue-closure gate here                                                                           |
+
+## Executable implementation order
+
+The remaining implementation MUST produce these concrete interfaces and evidence; this is a dependency analysis, not a claim that the named scripts already exist.
+
+1. **Reconcile inputs and facts.** Extend merged #1214 and #1213; add exact expected JS inventory validation, strict release fact/skip/env handling and disable the compiled CLI checkout fallback. Preserve ordinary development behavior separately. Exercise these guards before adding signing.
+2. **Qualify actual platform recipes.** The approved-source native Rust producer, reached through thin `scripts/release/build.sh`/`bootstrap.sh` adapters, owns source/material preparation, effective settings, confinement and final artifacts; CLI/core/JS dependencies cannot enter the producer bootstrap. Linux can use a digest-pinned OCI environment with no compile network. macOS needs a tested confinement/SDK/native profile on the selected hosted machines. Material preparation and network-denied compilation are separate. Establish GNU 2.34 and macOS 15 ARM/Intel startup before approving the fixed first cohort; a failed baseline requires a reviewed change, not an after-failure downgrade.
+3. **Generate actual evidence and SPDX.** Collector inputs are Cargo JSON, selected metadata/tree, checked material identities, Rollup inventory, native output/link declarations, sysroot/tools and final files. Produce prepared and retained-module lists separately. Validate real Fastly and each CLI SBOM, not only a toy fixture. Then qualify the Rust schema evaluator with explicit offline Draft 2020-12 and Draft 7 semantics, retain the authoritative schema raw-byte identity, and prove negative/actual coverage tests.
+4. **Implement same-commit validation and transfers.** Refactor current CI into reviewed callable validation or equivalent explicit release jobs. Run required validations at the tag SHA, shared JS A/B, Fastly A/B and required native Build A with bounded optional comparisons. Upload selected raw outputs; pass artifact ID/archive hash through explicit job outputs. Fetch exact current-run ZIP bytes, fail transfer mismatch and inspect/extract only declared bounded members. Do not restore compiled state across the supposedly independent builds.
+5. **Sign and publish through a tested boundary.** A separate signing/collector job authenticates source/input/output/evidence relationships before invoking the pinned action twice per artifact and signing the index. An existing lightweight tag avoids relying on automatic tag creation. Caller job permissions must allow the called signing jobs while build jobs explicitly remain read-only. The publication job handles draft/resume/upload/redownload/publish/reconcile with contents-write. Rehearse main and RC workflow divergence, partial drafts, reruns, optional failures and mutable/unknown publication before production enablement. [Release API permission behavior](https://docs.github.com/en/rest/releases/releases#create-a-release).
+6. **Implement the online consumer.** A shared library performs strict schema/policy joins, invokes bounded pinned gh on retained bundles, checks all certificate/provenance/SPDX fields and verifies release API/statement semantics. Its private verified result retains selected bytes. `ts release verify` is read-only; manual packing uses that result plus a deployment-only envelope and archive inspector. Exact identity flags alone do not implement the evidence graph.
+7. **Deliver the manual verified-byte production route.** Authorize a disposable provider test separately and retain the submitted-member/version observations. This route does not certify integrated staging, preactivation validation or remote execution. It can precede the upstream API.
+8. **Implement the separate Fastly upstream milestone.** EdgeZero `deploy_prebuilt` takes retained payload identity, exact base/service/mode and resolved context. Use explicit clone, non-autoclone update of the returned draft, exact draft link/selector validation, stage/activate. Durable journal/pending markers and read-only reconciliation belong here. Lost first-clone identity remains unknown if the provider cannot uniquely establish it; do not invent an exactly-once contract.
+
+Future stronger builder isolation, independently reconstructed executables, offline official membership and additional adapters use separate proof boundaries. They are not shortcuts to close missing evidence in this initial pipeline.
+
+## Remaining qualification boundaries
+
+The local machine had no usable Docker daemon, old-macOS or Intel execution host. GNU compatibility was not inferred from Cargo metadata or an ARM native fixture. Actual hosted action/OIDC, artifact transfer, repository governance and RC release-token behavior require an authorized disposable GitHub rehearsal. Live package/bindings/stage/activation require an authorized disposable Fastly service. No such resources were mutated during this audit.
+
+These gaps do not establish impossibility of the narrowed architecture; their APIs and locally measured primitives support implementation. They do prevent claiming that all required release behavior is already feasible as a tested composition. Release enablement remains blocked until those selected qualifications and the new code pass. The known unavailable-host gate and overstated existing-tool/final-JS/recovery claims have been removed or corrected rather than passed to an implementation plan as assumptions.
+
+## Primary implementation references
+
+Historical temporary probe scripts/logs are not retained or reviewer-reproducible current proof. The measurements above preserve their historical scope. Current committed Rust document/schema tests supply local utility evidence; actual selected native boundaries, complete recipes and hosted release/provider proofs remain pending.
+
+Pinned implementation references: [gh 2.97.0](https://github.com/cli/cli/tree/55dbb4dc6b7edb10b48e3d7fc5bccd32318d1b55), [attest 4.2.2](https://github.com/actions/attest/tree/1e69f48acb82d1966a394da916b4c1698aa569d6), [toolkit provenance](https://github.com/actions/toolkit/blob/7987771a2b727fe14b36351f6c877fa3a56b9c36/packages/attest/src/provenance.ts), [Fastly 15.1.0 pack](https://github.com/fastly/cli/blob/v15.1.0/pkg/commands/compute/pack.go), [validate](https://github.com/fastly/cli/blob/v15.1.0/pkg/commands/compute/validate.go), [clone](https://github.com/fastly/cli/blob/v15.1.0/pkg/commands/service/version/clone.go), [EdgeZero adapter](https://github.com/stackpop/edgezero/blob/683202c66948146ec360f490126f1d60f920288b/crates/edgezero-adapter/src/registry.rs). Cargo [metadata](https://doc.rust-lang.org/cargo/commands/cargo-metadata.html) and [build messages](https://doc.rust-lang.org/cargo/reference/external-tools.html), [SPDX 2.3 schema](https://github.com/spdx/spdx-spec/blob/v2.3/schemas/spdx-schema.json).
diff --git a/docs/superpowers/specs/2026-10-14-release-tooling-rust-migration.md b/docs/superpowers/specs/2026-10-14-release-tooling-rust-migration.md
new file mode 100644
index 0000000000..d291333901
--- /dev/null
+++ b/docs/superpowers/specs/2026-10-14-release-tooling-rust-migration.md
@@ -0,0 +1,55 @@
+# Release tooling Rust migration addendum
+
+**Status:** Draft implementation revision for PR #1262 on `spec/1235-release-attestation`. The user authorized implementation on this branch and directed removal of introduced Python tooling on 2026-10-14. This addendum implements that language constraint; maintainer contract/code approval, independently approved source and every selected release qualification remain outstanding. No new branch, worktree or PR is required.
+
+**Authority:** The [governing contract](2026-10-09-1235-release-attestation-design.md), [feasibility register](2026-10-12-1235-release-attestation-feasibility.md) and [22-task implementation plan](../plans/2026-10-13-attested-release-implementation.md) retain their security requirements. This migration does not amend the index schema, cohort, capabilities or vendor-source acquisition rules.
+
+## Decision and alternatives
+
+Use a small domain-specific host-only `crates/trusted-server-release` binary. It follows the existing host-only codegen workspace-member precedent, uses Rust 2024 and pinned Rust 1.95.0, and is a workspace member outside `default-members`. It has no dependency on core, CLI or JS crates and is not a fifth canonical release asset. Existing `collect-js.mjs` and the Node composition observer remain responsible for actual bundling/contribution capture; POSIX wrappers remain thin fixed adapters.
+
+Moving the producer into `ts` would reuse command dispatch but introduces CLI → core → JS build dependencies before JS preparation. That bootstrap cycle prevents the CLI from producing its own prerequisite JS evidence. Tasks 17–20 therefore keep `ts` as the read-only consumer. Expanding Node to own all native release security would reuse an installed runtime but duplicate native process/archive/platform enforcement and still require separately authenticated Node acquisition. A generic attestation crate adds an unsupported abstraction and unnecessary public APIs. The independent Rust tool is the smallest safe boundary for the existing producer requirements.
+
+## Modules and data flow
+
+Create only modules needed by the current migration stage. `documents`, `policy`, `preflight` and `source` establish bounded parsing and independently approved fixed inputs. `materials`, `process`, `boundary` and `preparation` authenticate original acquisitions and execute fresh work under the selected native denial boundary. `javascript` invokes retained Node tooling, records actual lifecycle observations, completes two independent offline installations/tests/builds and compares all final bundles. `qualification` checks reviewed platform evidence. `recipe`, `inspect` and `composition` drive actual Cargo compilation, final-byte/runtime acceptance and observed Rust/native/sysroot/JS evidence. `spdx`, `collection`, `distribution`, `publication` and `package` supply the remaining existing producer tasks without changing signing/publication ownership.
+
+The flow is independently approved source → authenticated acquisitions → current native installed-tool rehash → actual confined execution → private typed completion → checked artifact/composition/transfer records → isolated signer → sole immutable publisher. Constructors for source/acquisition approval and JS completion remain private to their successful verification/execution paths. Serialized booleans, source labels, an arbitrary inventory or a pathname plus checksum cannot construct authority. Retained bytes are rehashed at handoff/use. All-cohort remotely reviewed qualification receipts are separate from evidence about tools actually installed in the current process environment; neither substitutes for the other.
+
+Unit tests remain private alongside their modules or in registered child `tests.rs` files. Public command-process tests live in `tests/commands.rs`; data fixtures live in `tests/fixtures/`. Register tests before filtered runs and require a nonzero selection with the plan's POSIX `awk` guard. Do not expose internal APIs for integration tests.
+
+Reuse existing workspace serde/serde_json, error-stack, derive_more, clap, SHA, log, tempfile, toml, gix, libc and flate2 only where needed, with minimal dependency features. Existing bounded TAR/ZIP, Draft 2020-12/Draft 7 schema and ELF/Mach-O/core-Wasm requirements justify maintained format parsers. Exact replacement versions require primary-source research, lockfile review, acquisition identity and qualification; no library selection itself is a qualified tool pin. The researched [jsonschema 0.58.6 options](https://docs.rs/jsonschema/0.58.6/jsonschema/struct.ValidationOptions.html) are a candidate for explicit-dialect, offline-only validation with default network/file features disabled. No optional language binding, arbitrary public schema path or automatic reference retrieval is selected.
+
+Strict JSON parsing rejects duplicate keys through a recursive Serde visitor before insertion, limits container depth to 64, preserves original bytes for SHA-256 and enforces every role size bound before allocation/download. Before `deserialize_any`, a string-aware lexical scanner validates every numeric token across the whole document, including opaque fields and top-level values: negative integers fit `i64`, nonnegative integers fit `u64`, and decimal/exponent tokens parse as finite `f64`. Quoted number-like text and escaped string contents remain text. The visitor's finite-float check alone cannot reject integer overflow that Serde converts to a finite float; the plan's example is an ambiguity parser requiring this strict prevalidation. The existing JS build inventory scanner supplies a behavioral reference without a JS-crate dependency. Tests cover opaque/top-level integer overflow, decimal/exponent overflow and quoted-text controls; closed role checks additionally enforce safe-integer limits and negative/noninteger-length rejection. Schema checks accompany semantic joins and actual coverage. Governing schemas use Draft 2020-12; the official SPDX 2.3 schema uses Draft 7. The retained [official schema source](https://github.com/spdx/spdx-spec/blob/aadf3b0b8dbbabdb4d880b0fc714255fea436ff7/schemas/spdx-schema.json) is 45,312 bytes, SHA-256 `239208b7ac287b3cf5d9a9af23f9d69863971102a5e1587a27a398b43490b89b`. This measured candidate identity is not schema-engine or real-SBOM qualification.
+
+## Bootstrap and unchanged release gates
+
+POSIX bootstrap first establishes independently approved source and an authenticated OS-native Rust source-build chain, then builds/selects the host tool and records its complete executable source/dependency/tool closure. A colocated self-authored SHA manifest does not authenticate that chain. Developer `cargo run/test` commands establish local behavior only; the source-built tool has no official release-binary proof. The producer executable is not distributed as a canonical asset. Pending approval, acquisition roots or measured pins fail closed; downloaded evidence cannot open a candidate/production selector.
+
+The producer helper MUST itself be built and executable inside the selected GNU builder at glibc <=2.34, using an independently approved image/toolchain/material channel. An ambient Ubuntu 24 build cannot be assumed to load in UBI 9. Bind helper target, loader/runtime, source/dependency closure and actual native executable identity before execution. macOS helpers require the approved native CPU/SDK/floor-compatible chain. Initial shell/hash/Rust/Cargo authority is independent of the tool; record and authenticate rustup only if it is actually used (direct signed-component installation does not require it); the tool cannot authenticate itself. Native Rust helper/staged POSIX drivers implement socket and lifecycle probes, without language substitutions.
+
+The four canonical assets remain default Fastly Wasm plus three `ts` executables. Complete final Fastly A/B equality, both final-byte application checks and all canonical A/SPDX proofs are mandatory. Native B remains a bounded optional measurement. GNU remains glibc ceiling 2.34 with three clean compatibility runtimes; macOS requires actual native 15 ARM/Intel execution with loader floor 13.0. macOS 26.6.2 local diagnostics cannot satisfy those gates.
+
+Real positive/denied native socket controls and actual Cargo/npm missing-tool/download attempts use the same boundary as production execution. Source/object stores and acquired shared inputs are read-only; private profile/install/output writes remain bounded. Children and descendants are killed/reaped on timeout, cancellation or pipe limits, and temporary profiles/resources plus Docker containers are cleaned up with bounded stop/remove behavior. Rust does not waive acquisition/SDK/native archive identity, Cargo effective unit features, final retained JS classification or conservative reachability limits. Original Fastly vendor archive authentication remains a separate unsatisfied gate until independently reviewed vendor-source evidence is available.
+
+One `release.yml` owns publication and same-source `release-build.yml` owns signing. Exact action 4.2.2/full SHA and gh 2.97.0 contracts, SLSA Build Level 2 target, exact current-run artifact/attempt/topology bindings, strict SPDX/graph joins and immutable publication remain unchanged. `ts release verify` remains read-only. Manual Fastly consumption inspects the approved four-member archive with verified exact Wasm bytes; integrated EdgeZero deployment/recovery and future packaging retain their separate approval/proof boundaries.
+
+## Migration order and evidence
+
+The active plan keeps Task IDs 1–22 and prepends migration checkpoints: M0 verify removal/fail-closed wrappers; M1 Rust documents/preflight/source; M2 original materials/process/OS boundaries; M3 real two-installation JS completion; M4 actual canonical recipes/inspection/composition; then finish Tasks 10–22. Full AGENTS CI and independent review remain required before handoff. No resource creation/dispatch, signing, publication or provider operation follows from this language correction.
+
+Introduced Python producer tooling and requirements are removed. The host-only crate implements strict documents/policy, local source/preflight checks, a helper-closure fingerprint, bounded process supervision and final-artifact inspection. Rust build-fact and checked-inventory guards and Node composition are implemented. The experimental macOS profile kills and rejects descendants that escape their process group, even with a scrubbed environment, by identifying its per-run sandbox instance; it remains unqualified for M2 lifecycle containment. Original npm/Cargo Git material verification and M3 real two-installation JS orchestration are implemented; the full Linux A/B execution test passed in ordinary PR CI ([evidence](../../../scripts/release/qualification/2026-10-15-js-two-builds.md)). That CI candidate is not release qualification. Qualification of M2 and M4 (candidate recipes for all four assets pass ordinary CI, unqualified), qualified macOS lifecycle containment, independently approved acquisition/bootstrap roots and every selected hosted qualification remain pending. Production execution remains closed.
+
+## Mandatory replacement regressions
+
+Tasks 3 and M2/Tasks 7–9 MUST carry the original failure cases into real Rust tests before qualification:
+
+- Audit the true Git common directory for linked-worktree alternates/grafts/shallow/replacements/config/environment channels; reject unsupported linked indirections instead of partially checking them. Preserve bounded detailed Git errors. Reject untracked extensionless `rust-toolchain` before toolchain selection. Join approved source and original inventory commits.
+- Audit inherited hosted/setup variables before clearing them. Exact reviewed/qualified values and path identities are required for accepted `RUSTFLAGS`, `VCPKG_INSTALLATION_ROOT` and other selectors; unreviewed values fail. Production selection MUST reject all pending/null pins by default. Named audit diagnostics cannot construct authorization state.
+- Docker MUST use its default private PID namespace, not invalid `--pid=private`. Both host-owned seccomp profiles and empty Docker configuration MUST be outside container-writable roots; scan before creation and rehash both before every host command. Select authenticated client/config/Unix daemon, no TTY/plugins/context/environment overrides, read-only anchors, and reject escaping/dangling aliases in the container namespace. Actual positive/denial/whole-recipe execution is required, not argv checks alone.
+- Every immutable macOS source/object regular file MUST have `nlink == 1` before execution. Actual hard-link write-through/restoration negatives are required. Signals MUST be restricted to `same-sandbox`, with own-child success and outside same-user sibling/orchestrator denial.
+- Observations MUST join the approved-source catalog, selection/version/authentication identities, SDK/raw receipts and the complete compiled helper closure, including all path-dependency manifests such as `crates/trusted-server-openrtb/Cargo.toml`, tool-version files and selected executable digests. Source changes invalidate the closure. Labels, boolean claims and checksums cannot self-qualify.
+- Container CPU/memory limits MUST fit actual host capacity; Cargo A jobs 4/B jobs 2 does not require four container CPUs on a two-vCPU host. Record actual errno instead of inventing `ETIMEDOUT`, hash the actual shell instead of assuming `/bin/sh --version`, and use host-independent environment/tool-path fixtures without ambient shim or interpreter trust.
+- Both actual JS A/B test processes MUST unconditionally inject `TRUSTED_SERVER__RELEASE_JS_TESTS=1` and execute the full registered suite/type checks. Lifecycle/Cargo/compiler/proc-macro/native children MUST inherit OS-enforced denial. Timeout/cancellation/pipe limits MUST kill and reap descendants; token/provider/injection environment is cleared.
+
+The [primary plan](../plans/2026-10-13-attested-release-implementation.md#threat-to-negative-proof-trace) maps these pending proofs to TH IDs and existing T-1–T-13 families. Ordinary native CI checks utility behavior and nonzero test selection; it does not qualify native bootstrap or recipes. Manual verified-byte consumption/documentation is AC-9/D6/D8; integrated context, staging, preactivation and recovery remain AC-8 and do not block the manual route.
diff --git a/docs/superpowers/specs/schemas/release-index-v1.schema.json b/docs/superpowers/specs/schemas/release-index-v1.schema.json
new file mode 100644
index 0000000000..1adaa0d20f
--- /dev/null
+++ b/docs/superpowers/specs/schemas/release-index-v1.schema.json
@@ -0,0 +1,581 @@
+{
+  "$comment": "Evaluate explicitly with JSON Schema Draft 2020-12 as required by R-INDEX. This dialect declaration is part of the normative specification.",
+  "title": "Trusted Server release-index version 1",
+  "description": "Normative structural contract. The specification adds exact cohort membership, unique asset/companion names, companion naming, byte digest checks, source approval and evidence-policy checks.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version",
+    "repository",
+    "tag",
+    "source_commit",
+    "recipe_source_commit",
+    "cohort_source_commit",
+    "cohort",
+    "policy_version",
+    "policy_sha256",
+    "tsjs_inventory",
+    "artifacts"
+  ],
+  "properties": {
+    "schema_version": {
+      "const": 1
+    },
+    "repository": {
+      "const": "IABTechLab/trusted-server"
+    },
+    "tag": {
+      "type": "string",
+      "maxLength": 128,
+      "pattern": "^v(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)(?:-(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(?:\\.(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$",
+      "not": {
+        "pattern": "[\\r\\n]"
+      }
+    },
+    "source_commit": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{40}$",
+      "not": {
+        "pattern": "[\\r\\n]"
+      }
+    },
+    "recipe_source_commit": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{40}$",
+      "not": {
+        "pattern": "[\\r\\n]"
+      }
+    },
+    "cohort_source_commit": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{40}$",
+      "not": {
+        "pattern": "[\\r\\n]"
+      }
+    },
+    "cohort": {
+      "const": "phase1-fastly-cli"
+    },
+    "policy_version": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "Producer policy at source_commit. Must match an independently trusted accepted historical producer policy; does not select consumer policy."
+    },
+    "policy_sha256": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{64}$",
+      "description": "SHA-256 of producer policy bytes at source_commit; consumer acceptance is defined by the specification.",
+      "not": {
+        "pattern": "[\\r\\n]"
+      }
+    },
+    "tsjs_inventory": {
+      "allOf": [
+        {
+          "$ref": "#/$defs/file"
+        },
+        {
+          "properties": {
+            "name": {
+              "const": "tsjs-inventory.json"
+            },
+            "size": {
+              "maximum": 1048576
+            }
+          }
+        }
+      ]
+    },
+    "artifacts": {
+      "type": "array",
+      "minItems": 4,
+      "maxItems": 4,
+      "uniqueItems": true,
+      "items": {
+        "$ref": "#/$defs/artifact"
+      },
+      "allOf": [
+        {
+          "contains": {
+            "properties": {
+              "name": {
+                "const": "trusted-server-fastly.wasm"
+              }
+            },
+            "required": ["name"]
+          },
+          "minContains": 1,
+          "maxContains": 1
+        },
+        {
+          "contains": {
+            "properties": {
+              "name": {
+                "const": "ts-x86_64-unknown-linux-gnu"
+              }
+            },
+            "required": ["name"]
+          },
+          "minContains": 1,
+          "maxContains": 1
+        },
+        {
+          "contains": {
+            "properties": {
+              "name": {
+                "const": "ts-aarch64-apple-darwin"
+              }
+            },
+            "required": ["name"]
+          },
+          "minContains": 1,
+          "maxContains": 1
+        },
+        {
+          "contains": {
+            "properties": {
+              "name": {
+                "const": "ts-x86_64-apple-darwin"
+              }
+            },
+            "required": ["name"]
+          },
+          "minContains": 1,
+          "maxContains": 1
+        }
+      ]
+    }
+  },
+  "$defs": {
+    "file": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "size", "sha256"],
+      "properties": {
+        "name": {
+          "type": "string",
+          "maxLength": 160,
+          "pattern": "^[A-Za-z0-9][A-Za-z0-9_-]*(?:\\.[A-Za-z0-9_-]+)*$",
+          "not": {
+            "pattern": "[\\r\\n]"
+          }
+        },
+        "size": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 536870912
+        },
+        "sha256": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{64}$",
+          "not": {
+            "pattern": "[\\r\\n]"
+          }
+        }
+      }
+    },
+    "artifact": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "name",
+        "size",
+        "sha256",
+        "role",
+        "kind",
+        "package",
+        "target",
+        "variant",
+        "assurance_profile",
+        "capabilities",
+        "compatibility",
+        "js_inventory_sha256",
+        "companions"
+      ],
+      "properties": {
+        "name": {
+          "enum": [
+            "trusted-server-fastly.wasm",
+            "ts-x86_64-unknown-linux-gnu",
+            "ts-aarch64-apple-darwin",
+            "ts-x86_64-apple-darwin"
+          ]
+        },
+        "size": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 536870912
+        },
+        "sha256": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{64}$",
+          "not": {
+            "pattern": "[\\r\\n]"
+          }
+        },
+        "role": {
+          "enum": ["server", "operator-cli"]
+        },
+        "kind": {
+          "enum": ["wasm-core", "native-executable"]
+        },
+        "package": {
+          "enum": ["trusted-server-adapter-fastly", "trusted-server-cli"]
+        },
+        "target": {
+          "enum": [
+            "wasm32-wasip1",
+            "x86_64-unknown-linux-gnu",
+            "aarch64-apple-darwin",
+            "x86_64-apple-darwin"
+          ]
+        },
+        "variant": {
+          "const": "default"
+        },
+        "assurance_profile": {
+          "enum": ["provenance-sbom-repeatable", "provenance-sbom"]
+        },
+        "capabilities": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 2,
+          "uniqueItems": true,
+          "items": {
+            "enum": ["fastly-production", "fastly-staging", "cli-execute"]
+          }
+        },
+        "compatibility": {
+          "$ref": "#/$defs/compatibility"
+        },
+        "js_inventory_sha256": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{64}$",
+          "not": {
+            "pattern": "[\\r\\n]"
+          }
+        },
+        "companions": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "sbom",
+            "provenance",
+            "sbom_attestation",
+            "build_evidence",
+            "build_recipe",
+            "rebuild_check"
+          ],
+          "properties": {
+            "sbom": {
+              "allOf": [
+                {
+                  "$ref": "#/$defs/file"
+                },
+                {
+                  "properties": {
+                    "size": {
+                      "maximum": 16777216
+                    }
+                  }
+                }
+              ]
+            },
+            "provenance": {
+              "allOf": [
+                {
+                  "$ref": "#/$defs/file"
+                },
+                {
+                  "properties": {
+                    "size": {
+                      "maximum": 33554432
+                    }
+                  }
+                }
+              ]
+            },
+            "sbom_attestation": {
+              "allOf": [
+                {
+                  "$ref": "#/$defs/file"
+                },
+                {
+                  "properties": {
+                    "size": {
+                      "maximum": 33554432
+                    }
+                  }
+                }
+              ]
+            },
+            "build_evidence": {
+              "allOf": [
+                {
+                  "$ref": "#/$defs/file"
+                },
+                {
+                  "properties": {
+                    "size": {
+                      "maximum": 33554432
+                    }
+                  }
+                }
+              ]
+            },
+            "build_recipe": {
+              "allOf": [
+                {
+                  "$ref": "#/$defs/file"
+                },
+                {
+                  "properties": {
+                    "size": {
+                      "maximum": 33554432
+                    }
+                  }
+                }
+              ]
+            },
+            "rebuild_check": {
+              "allOf": [
+                {
+                  "$ref": "#/$defs/file"
+                },
+                {
+                  "properties": {
+                    "size": {
+                      "maximum": 33554432
+                    }
+                  }
+                }
+              ]
+            }
+          }
+        }
+      },
+      "oneOf": [
+        {
+          "properties": {
+            "name": {
+              "const": "trusted-server-fastly.wasm"
+            },
+            "role": {
+              "const": "server"
+            },
+            "kind": {
+              "const": "wasm-core"
+            },
+            "package": {
+              "const": "trusted-server-adapter-fastly"
+            },
+            "target": {
+              "const": "wasm32-wasip1"
+            },
+            "variant": {
+              "const": "default"
+            },
+            "assurance_profile": {
+              "const": "provenance-sbom-repeatable"
+            },
+            "capabilities": {
+              "type": "array",
+              "minItems": 1,
+              "maxItems": 2,
+              "uniqueItems": true,
+              "items": {
+                "enum": ["fastly-production", "fastly-staging"]
+              },
+              "contains": {
+                "const": "fastly-production"
+              }
+            },
+            "compatibility": {
+              "properties": {
+                "runtime": {
+                  "const": "fastly-compute"
+                },
+                "architecture": {
+                  "const": "wasm32"
+                }
+              }
+            }
+          }
+        },
+        {
+          "properties": {
+            "name": {
+              "const": "ts-x86_64-unknown-linux-gnu"
+            },
+            "role": {
+              "const": "operator-cli"
+            },
+            "kind": {
+              "const": "native-executable"
+            },
+            "package": {
+              "const": "trusted-server-cli"
+            },
+            "target": {
+              "const": "x86_64-unknown-linux-gnu"
+            },
+            "variant": {
+              "const": "default"
+            },
+            "assurance_profile": {
+              "const": "provenance-sbom"
+            },
+            "capabilities": {
+              "const": ["cli-execute"]
+            },
+            "compatibility": {
+              "properties": {
+                "runtime": {
+                  "const": "linux-gnu"
+                },
+                "architecture": {
+                  "const": "x86_64"
+                }
+              }
+            }
+          }
+        },
+        {
+          "properties": {
+            "name": {
+              "const": "ts-aarch64-apple-darwin"
+            },
+            "role": {
+              "const": "operator-cli"
+            },
+            "kind": {
+              "const": "native-executable"
+            },
+            "package": {
+              "const": "trusted-server-cli"
+            },
+            "target": {
+              "const": "aarch64-apple-darwin"
+            },
+            "variant": {
+              "const": "default"
+            },
+            "assurance_profile": {
+              "const": "provenance-sbom"
+            },
+            "capabilities": {
+              "const": ["cli-execute"]
+            },
+            "compatibility": {
+              "properties": {
+                "runtime": {
+                  "const": "macos"
+                },
+                "architecture": {
+                  "const": "aarch64"
+                }
+              }
+            }
+          }
+        },
+        {
+          "properties": {
+            "name": {
+              "const": "ts-x86_64-apple-darwin"
+            },
+            "role": {
+              "const": "operator-cli"
+            },
+            "kind": {
+              "const": "native-executable"
+            },
+            "package": {
+              "const": "trusted-server-cli"
+            },
+            "target": {
+              "const": "x86_64-apple-darwin"
+            },
+            "variant": {
+              "const": "default"
+            },
+            "assurance_profile": {
+              "const": "provenance-sbom"
+            },
+            "capabilities": {
+              "const": ["cli-execute"]
+            },
+            "compatibility": {
+              "properties": {
+                "runtime": {
+                  "const": "macos"
+                },
+                "architecture": {
+                  "const": "x86_64"
+                }
+              }
+            }
+          }
+        }
+      ]
+    },
+    "compatibility": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["runtime", "minimum_version", "architecture"],
+      "properties": {
+        "runtime": {
+          "enum": ["fastly-compute", "linux-gnu", "macos"]
+        },
+        "minimum_version": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 64
+        },
+        "architecture": {
+          "enum": ["wasm32", "x86_64", "aarch64"]
+        }
+      },
+      "oneOf": [
+        {
+          "properties": {
+            "runtime": {
+              "const": "fastly-compute"
+            },
+            "minimum_version": {
+              "const": "wasip1"
+            },
+            "architecture": {
+              "const": "wasm32"
+            }
+          }
+        },
+        {
+          "properties": {
+            "runtime": {
+              "const": "linux-gnu"
+            },
+            "minimum_version": {
+              "const": "glibc-2.34"
+            },
+            "architecture": {
+              "const": "x86_64"
+            }
+          }
+        },
+        {
+          "properties": {
+            "runtime": {
+              "const": "macos"
+            },
+            "minimum_version": {
+              "const": "13.0"
+            },
+            "architecture": {
+              "enum": ["x86_64", "aarch64"]
+            }
+          }
+        }
+      ]
+    }
+  }
+}
diff --git a/scripts/docs-proposal/hunks.mjs b/scripts/docs-proposal/hunks.mjs
index edd934162b..a6dbced089 100644
--- a/scripts/docs-proposal/hunks.mjs
+++ b/scripts/docs-proposal/hunks.mjs
@@ -1,93 +1,93 @@
 // Parses a unified documentation diff into hunks and builds the per-hunk
 // review that cites Copilot evidence and offers a suggestion reverting each
 // hunk. Dependency-free so it runs on any runner with Node.
-import { createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
+import { createHash } from 'node:crypto'
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
 
-const FILE_HEADER = /^diff --git a\/(.+) b\/(.+)$/;
-const HUNK_HEADER = /^@@ -(\d+)(?:,\d+)? \+(\d+)(?:,\d+)? @@/;
+const FILE_HEADER = /^diff --git a\/(.+) b\/(.+)$/
+const HUNK_HEADER = /^@@ -(\d+)(?:,\d+)? \+(\d+)(?:,\d+)? @@/
 
 export function parseDiff(text) {
-  const files = [];
-  let file = null;
-  let hunk = null;
-  let oldNo = 0;
-  let newNo = 0;
-  for (const raw of text.split("\n")) {
-    const fileHeader = FILE_HEADER.exec(raw);
+  const files = []
+  let file = null
+  let hunk = null
+  let oldNo = 0
+  let newNo = 0
+  for (const raw of text.split('\n')) {
+    const fileHeader = FILE_HEADER.exec(raw)
     if (fileHeader) {
       file = {
         path: fileHeader[2],
-        status: "modified",
+        status: 'modified',
         binary: false,
         hunks: [],
-      };
-      files.push(file);
-      hunk = null;
-      continue;
+      }
+      files.push(file)
+      hunk = null
+      continue
     }
     if (!file) {
-      continue;
+      continue
     }
-    const hunkHeader = HUNK_HEADER.exec(raw);
+    const hunkHeader = HUNK_HEADER.exec(raw)
     if (hunkHeader) {
-      oldNo = Number(hunkHeader[1]);
-      newNo = Number(hunkHeader[2]);
-      hunk = { lines: [] };
-      file.hunks.push(hunk);
-      continue;
+      oldNo = Number(hunkHeader[1])
+      newNo = Number(hunkHeader[2])
+      hunk = { lines: [] }
+      file.hunks.push(hunk)
+      continue
     }
     if (!hunk) {
-      if (raw.startsWith("new file mode")) {
-        file.status = "added";
-      } else if (raw.startsWith("deleted file mode")) {
-        file.status = "deleted";
-      } else if (raw.startsWith("Binary files ")) {
-        file.binary = true;
+      if (raw.startsWith('new file mode')) {
+        file.status = 'added'
+      } else if (raw.startsWith('deleted file mode')) {
+        file.status = 'deleted'
+      } else if (raw.startsWith('Binary files ')) {
+        file.binary = true
       }
-      continue;
+      continue
     }
-    const type = raw[0];
-    const lineText = raw.slice(1);
-    if (type === " ") {
-      hunk.lines.push({ type, text: lineText, oldNo: oldNo++, newNo: newNo++ });
-    } else if (type === "-") {
-      hunk.lines.push({ type, text: lineText, oldNo: oldNo++, newNo: null });
-    } else if (type === "+") {
-      hunk.lines.push({ type, text: lineText, oldNo: null, newNo: newNo++ });
+    const type = raw[0]
+    const lineText = raw.slice(1)
+    if (type === ' ') {
+      hunk.lines.push({ type, text: lineText, oldNo: oldNo++, newNo: newNo++ })
+    } else if (type === '-') {
+      hunk.lines.push({ type, text: lineText, oldNo: oldNo++, newNo: null })
+    } else if (type === '+') {
+      hunk.lines.push({ type, text: lineText, oldNo: null, newNo: newNo++ })
     }
   }
-  return files;
+  return files
 }
 
 function hashHunk(path, hunk) {
-  const hash = createHash("sha256");
-  hash.update(path);
+  const hash = createHash('sha256')
+  hash.update(path)
   for (const line of hunk.lines) {
-    if (line.type !== " ") {
-      hash.update(`\n${line.type}${line.text}`);
+    if (line.type !== ' ') {
+      hash.update(`\n${line.type}${line.text}`)
     }
   }
-  return `${path}#${hash.digest("hex").slice(0, 8)}`;
+  return `${path}#${hash.digest('hex').slice(0, 8)}`
 }
 
 export function collectHunks(files) {
-  const seen = new Map();
-  const entries = [];
+  const seen = new Map()
+  const entries = []
   for (const file of files) {
     if (file.binary) {
-      continue;
+      continue
     }
     for (const hunk of file.hunks) {
-      const base = hashHunk(file.path, hunk);
-      const count = (seen.get(base) ?? 0) + 1;
-      seen.set(base, count);
-      const id = count === 1 ? base : `${base}-${count}`;
-      entries.push({ id, path: file.path, status: file.status, hunk });
+      const base = hashHunk(file.path, hunk)
+      const count = (seen.get(base) ?? 0) + 1
+      seen.set(base, count)
+      const id = count === 1 ? base : `${base}-${count}`
+      entries.push({ id, path: file.path, status: file.status, hunk })
     }
   }
-  return entries;
+  return entries
 }
 
 export function listHunks(files) {
@@ -96,107 +96,107 @@ export function listHunks(files) {
     path,
     status,
     removed: hunk.lines
-      .filter((line) => line.type === "-")
+      .filter((line) => line.type === '-')
       .map((line) => line.text),
     added: hunk.lines
-      .filter((line) => line.type === "+")
+      .filter((line) => line.type === '+')
       .map((line) => line.text),
-  }));
+  }))
 }
 
 // Returns the comment anchor and the original text that undoes a hunk, or
 // null when the hunk has no new-side line to anchor a suggestion on.
 export function revertSuggestion(hunk) {
-  const { lines } = hunk;
-  const first = lines.findIndex((line) => line.type !== " ");
-  const last = lines.findLastIndex((line) => line.type !== " ");
+  const { lines } = hunk
+  const first = lines.findIndex((line) => line.type !== ' ')
+  const last = lines.findLastIndex((line) => line.type !== ' ')
   if (first === -1) {
-    return null;
+    return null
   }
-  const span = lines.slice(first, last + 1);
-  const newSide = span.filter((line) => line.type !== "-");
+  const span = lines.slice(first, last + 1)
+  const newSide = span.filter((line) => line.type !== '-')
   const oldText = span
-    .filter((line) => line.type !== "+")
-    .map((line) => line.text);
+    .filter((line) => line.type !== '+')
+    .map((line) => line.text)
   if (newSide.length > 0) {
     return {
       startLine: newSide[0].newNo,
       line: newSide.at(-1).newNo,
       body: oldText,
-    };
+    }
   }
-  const before = lines[first - 1];
-  if (before?.type === " ") {
+  const before = lines[first - 1]
+  if (before?.type === ' ') {
     return {
       startLine: before.newNo,
       line: before.newNo,
       body: [before.text, ...oldText],
-    };
+    }
   }
-  const after = lines[last + 1];
-  if (after?.type === " ") {
+  const after = lines[last + 1]
+  if (after?.type === ' ') {
     return {
       startLine: after.newNo,
       line: after.newNo,
       body: [...oldText, after.text],
-    };
+    }
   }
-  return null;
+  return null
 }
 
-const MAX_EVIDENCE_LENGTH = 300;
+const MAX_EVIDENCE_LENGTH = 300
 
 // Model output lands in pull request bodies and review comments, so a zero
 // width space after every `@` keeps it from pinging a user or team.
 export function neutralizeMentions(text) {
-  return text.replace(/@/g, "@​");
+  return text.replace(/@/g, '@​')
 }
 
 // Evidence also lands in an inline code span, so strip anything that could
 // break out of it.
 function sanitize(value) {
-  if (typeof value !== "string") {
-    return "";
+  if (typeof value !== 'string') {
+    return ''
   }
-  return neutralizeMentions(value.replace(/[`\r\n]+/g, " "))
-    .replace(/\s+/g, " ")
+  return neutralizeMentions(value.replace(/[`\r\n]+/g, ' '))
+    .replace(/\s+/g, ' ')
     .trim()
-    .slice(0, MAX_EVIDENCE_LENGTH);
+    .slice(0, MAX_EVIDENCE_LENGTH)
 }
 
 export function indexEvidence(raw) {
-  const evidence = new Map();
-  const items = Array.isArray(raw?.hunks) ? raw.hunks : [];
+  const evidence = new Map()
+  const items = Array.isArray(raw?.hunks) ? raw.hunks : []
   for (const item of items) {
-    if (typeof item?.id !== "string") {
-      continue;
+    if (typeof item?.id !== 'string') {
+      continue
     }
-    const source = sanitize(item.source);
-    const reason = sanitize(item.reason);
+    const source = sanitize(item.source)
+    const reason = sanitize(item.reason)
     if (source || reason) {
-      evidence.set(item.id, { source, reason });
+      evidence.set(item.id, { source, reason })
     }
   }
-  return evidence;
+  return evidence
 }
 
 // A fence must be longer than any backtick run in its body.
 function fenceFor(body) {
-  let longestRun = 0;
+  let longestRun = 0
   for (const text of body) {
     for (const run of text.match(/`+/g) ?? []) {
-      longestRun = Math.max(longestRun, run.length);
+      longestRun = Math.max(longestRun, run.length)
     }
   }
-  return "`".repeat(Math.max(3, longestRun + 1));
+  return '`'.repeat(Math.max(3, longestRun + 1))
 }
 
 // The rationale is model output, so render it as a plain text block: links,
 // images, HTML, issue references, and closing keywords in it stay inert.
 export function inertBlock(text) {
-  const body = neutralizeMentions(text).replace(/\n+$/, "");
-  const fence = fenceFor(body.split("\n"));
-  return `${fence}text\n${body}\n${fence}\n`;
+  const body = neutralizeMentions(text).replace(/\n+$/, '')
+  const fence = fenceFor(body.split('\n'))
+  return `${fence}text\n${body}\n${fence}\n`
 }
 
 // A null body marks a hunk that creates its file: an empty suggestion would
@@ -204,105 +204,105 @@ export function inertBlock(text) {
 function commentBody(cited, body) {
   const source = cited?.source
     ? `\`${cited.source}\``
-    : "none cited — verify this hunk against the merged code.";
+    : 'none cited — verify this hunk against the merged code.'
   // The reason is model output; inline code keeps its links, images, HTML,
   // and issue references inert (sanitize already removed backticks).
-  const reason = cited?.reason ? ` — \`${cited.reason}\`` : "";
-  const heading = `**Source:** ${source}${reason}`;
+  const reason = cited?.reason ? ` — \`${cited.reason}\`` : ''
+  const heading = `**Source:** ${source}${reason}`
   if (body === null) {
     return [
       heading,
-      "",
-      "This hunk creates the file. Delete the file to revert it.",
-    ].join("\n");
+      '',
+      'This hunk creates the file. Delete the file to revert it.',
+    ].join('\n')
   }
-  const fence = fenceFor(body);
-  const content = body.length > 0 ? `${body.join("\n")}\n` : "";
+  const fence = fenceFor(body)
+  const content = body.length > 0 ? `${body.join('\n')}\n` : ''
   return [
     heading,
-    "",
-    "Apply this suggestion to revert the hunk.",
-    "",
+    '',
+    'Apply this suggestion to revert the hunk.',
+    '',
     `${fence}suggestion\n${content}${fence}`,
-  ].join("\n");
+  ].join('\n')
 }
 
 const REVIEW_INTRO =
-  "Copilot evidence for each proposed hunk. Leave a hunk to accept it, or apply its suggestion to revert it. Verify every cited source before merging.";
+  'Copilot evidence for each proposed hunk. Leave a hunk to accept it, or apply its suggestion to revert it. Verify every cited source before merging.'
 
 export function buildReview(files, evidence, commitId) {
-  const comments = [];
-  const notes = [];
+  const comments = []
+  const notes = []
   for (const file of files) {
     if (file.binary) {
       notes.push(
-        `- \`${file.path}\`: binary change — review the file directly.`,
-      );
+        `- \`${file.path}\`: binary change — review the file directly.`
+      )
     }
   }
   for (const { id, path, status, hunk } of collectHunks(files)) {
-    const suggestion = revertSuggestion(hunk);
+    const suggestion = revertSuggestion(hunk)
     if (!suggestion) {
       const reason =
-        status === "deleted" ? "file deleted" : "no line to anchor a revert";
-      notes.push(`- \`${path}\`: ${reason} — revert it manually if needed.`);
-      continue;
+        status === 'deleted' ? 'file deleted' : 'no line to anchor a revert'
+      notes.push(`- \`${path}\`: ${reason} — revert it manually if needed.`)
+      continue
     }
     const comment = {
       path,
       line: suggestion.line,
-      side: "RIGHT",
+      side: 'RIGHT',
       body: commentBody(
         evidence.get(id),
-        status === "added" ? null : suggestion.body,
+        status === 'added' ? null : suggestion.body
       ),
-    };
+    }
     if (suggestion.startLine !== suggestion.line) {
-      comment.start_line = suggestion.startLine;
-      comment.start_side = "RIGHT";
+      comment.start_line = suggestion.startLine
+      comment.start_side = 'RIGHT'
     }
-    comments.push(comment);
+    comments.push(comment)
   }
   const body =
     notes.length > 0
-      ? `${REVIEW_INTRO}\n\nChanges without a suggestion:\n\n${notes.join("\n")}`
-      : REVIEW_INTRO;
-  return { commit_id: commitId, event: "COMMENT", body, comments };
+      ? `${REVIEW_INTRO}\n\nChanges without a suggestion:\n\n${notes.join('\n')}`
+      : REVIEW_INTRO
+  return { commit_id: commitId, event: 'COMMENT', body, comments }
 }
 
 function readEvidence(path) {
   try {
-    return indexEvidence(JSON.parse(readFileSync(path, "utf8")));
+    return indexEvidence(JSON.parse(readFileSync(path, 'utf8')))
   } catch (error) {
     process.stderr.write(
-      `Ignoring unreadable evidence at ${path}: ${error.message}\n`,
-    );
-    return new Map();
+      `Ignoring unreadable evidence at ${path}: ${error.message}\n`
+    )
+    return new Map()
   }
 }
 
 function main([command, evidencePath, commitId]) {
-  const input = readFileSync(0, "utf8");
-  if (command === "rationale") {
-    process.stdout.write(inertBlock(input));
-    return;
+  const input = readFileSync(0, 'utf8')
+  if (command === 'rationale') {
+    process.stdout.write(inertBlock(input))
+    return
   }
-  const files = parseDiff(input);
-  if (command === "list") {
-    process.stdout.write(`${JSON.stringify(listHunks(files), null, 2)}\n`);
-    return;
+  const files = parseDiff(input)
+  if (command === 'list') {
+    process.stdout.write(`${JSON.stringify(listHunks(files), null, 2)}\n`)
+    return
   }
-  if (command === "review" && evidencePath && commitId) {
-    const review = buildReview(files, readEvidence(evidencePath), commitId);
-    process.stdout.write(`${JSON.stringify(review, null, 2)}\n`);
-    return;
+  if (command === 'review' && evidencePath && commitId) {
+    const review = buildReview(files, readEvidence(evidencePath), commitId)
+    process.stdout.write(`${JSON.stringify(review, null, 2)}\n`)
+    return
   }
   process.stderr.write(
-    "usage: hunks.mjs list | review <evidence.json> <commit-sha> | rationale\n",
-  );
-  process.exitCode = 2;
+    'usage: hunks.mjs list | review <evidence.json> <commit-sha> | rationale\n'
+  )
+  process.exitCode = 2
 }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) {
-  main(process.argv.slice(2));
+  main(process.argv.slice(2))
 }
diff --git a/scripts/docs-proposal/hunks.test.mjs b/scripts/docs-proposal/hunks.test.mjs
index b42decc078..18e1af5cf3 100644
--- a/scripts/docs-proposal/hunks.test.mjs
+++ b/scripts/docs-proposal/hunks.test.mjs
@@ -1,5 +1,5 @@
-import assert from "node:assert/strict";
-import { test } from "node:test";
+import assert from 'node:assert/strict'
+import { test } from 'node:test'
 
 import {
   buildReview,
@@ -10,389 +10,385 @@ import {
   neutralizeMentions,
   parseDiff,
   revertSuggestion,
-} from "./hunks.mjs";
+} from './hunks.mjs'
 
 const MODIFIED = [
-  "diff --git a/docs/guide/cli.md b/docs/guide/cli.md",
-  "index 1111111..2222222 100644",
-  "--- a/docs/guide/cli.md",
-  "+++ b/docs/guide/cli.md",
-  "@@ -10,4 +10,4 @@ heading",
-  " keep one",
-  "-old flag",
-  "+new flag",
-  " keep two",
-  "",
-].join("\n");
+  'diff --git a/docs/guide/cli.md b/docs/guide/cli.md',
+  'index 1111111..2222222 100644',
+  '--- a/docs/guide/cli.md',
+  '+++ b/docs/guide/cli.md',
+  '@@ -10,4 +10,4 @@ heading',
+  ' keep one',
+  '-old flag',
+  '+new flag',
+  ' keep two',
+  '',
+].join('\n')
 
-test("parseDiff numbers context, removed, and added lines", () => {
-  const [file] = parseDiff(MODIFIED);
-  assert.equal(file.path, "docs/guide/cli.md", "should take the b/ path");
-  assert.equal(file.status, "modified", "should default to modified");
+test('parseDiff numbers context, removed, and added lines', () => {
+  const [file] = parseDiff(MODIFIED)
+  assert.equal(file.path, 'docs/guide/cli.md', 'should take the b/ path')
+  assert.equal(file.status, 'modified', 'should default to modified')
   assert.deepEqual(
     file.hunks[0].lines,
     [
-      { type: " ", text: "keep one", oldNo: 10, newNo: 10 },
-      { type: "-", text: "old flag", oldNo: 11, newNo: null },
-      { type: "+", text: "new flag", oldNo: null, newNo: 11 },
-      { type: " ", text: "keep two", oldNo: 12, newNo: 12 },
+      { type: ' ', text: 'keep one', oldNo: 10, newNo: 10 },
+      { type: '-', text: 'old flag', oldNo: 11, newNo: null },
+      { type: '+', text: 'new flag', oldNo: null, newNo: 11 },
+      { type: ' ', text: 'keep two', oldNo: 12, newNo: 12 },
     ],
-    "should track old and new line numbers",
-  );
-});
+    'should track old and new line numbers'
+  )
+})
 
-test("parseDiff records added, deleted, and binary files", () => {
+test('parseDiff records added, deleted, and binary files', () => {
   const diff = [
-    "diff --git a/docs/guide/new.md b/docs/guide/new.md",
-    "new file mode 100644",
-    "--- /dev/null",
-    "+++ b/docs/guide/new.md",
-    "@@ -0,0 +1 @@",
-    "+hello",
-    "diff --git a/docs/guide/gone.md b/docs/guide/gone.md",
-    "deleted file mode 100644",
-    "--- a/docs/guide/gone.md",
-    "+++ /dev/null",
-    "@@ -1 +0,0 @@",
-    "-bye",
-    "diff --git a/docs/guide/logo.png b/docs/guide/logo.png",
-    "Binary files a/docs/guide/logo.png and b/docs/guide/logo.png differ",
-    "",
-  ].join("\n");
-  const files = parseDiff(diff);
+    'diff --git a/docs/guide/new.md b/docs/guide/new.md',
+    'new file mode 100644',
+    '--- /dev/null',
+    '+++ b/docs/guide/new.md',
+    '@@ -0,0 +1 @@',
+    '+hello',
+    'diff --git a/docs/guide/gone.md b/docs/guide/gone.md',
+    'deleted file mode 100644',
+    '--- a/docs/guide/gone.md',
+    '+++ /dev/null',
+    '@@ -1 +0,0 @@',
+    '-bye',
+    'diff --git a/docs/guide/logo.png b/docs/guide/logo.png',
+    'Binary files a/docs/guide/logo.png and b/docs/guide/logo.png differ',
+    '',
+  ].join('\n')
+  const files = parseDiff(diff)
   assert.deepEqual(
     files.map(({ path, status, binary }) => ({ path, status, binary })),
     [
-      { path: "docs/guide/new.md", status: "added", binary: false },
-      { path: "docs/guide/gone.md", status: "deleted", binary: false },
-      { path: "docs/guide/logo.png", status: "modified", binary: true },
+      { path: 'docs/guide/new.md', status: 'added', binary: false },
+      { path: 'docs/guide/gone.md', status: 'deleted', binary: false },
+      { path: 'docs/guide/logo.png', status: 'modified', binary: true },
     ],
-    "should classify each file",
-  );
+    'should classify each file'
+  )
   assert.deepEqual(
     files[0].hunks[0].lines,
-    [{ type: "+", text: "hello", oldNo: null, newNo: 1 }],
-    "should start a new file at line 1",
-  );
-});
+    [{ type: '+', text: 'hello', oldNo: null, newNo: 1 }],
+    'should start a new file at line 1'
+  )
+})
 
-test("parseDiff skips no-newline markers", () => {
+test('parseDiff skips no-newline markers', () => {
   const diff = MODIFIED.replace(
-    " keep two\n",
-    " keep two\n\\ No newline at end of file\n",
-  );
-  const [file] = parseDiff(diff);
-  assert.equal(file.hunks[0].lines.length, 4, "should ignore the marker line");
-});
+    ' keep two\n',
+    ' keep two\n\\ No newline at end of file\n'
+  )
+  const [file] = parseDiff(diff)
+  assert.equal(file.hunks[0].lines.length, 4, 'should ignore the marker line')
+})
 
-test("collectHunks gives stable ids and skips binary files", () => {
-  const first = collectHunks(parseDiff(MODIFIED));
+test('collectHunks gives stable ids and skips binary files', () => {
+  const first = collectHunks(parseDiff(MODIFIED))
   const second = collectHunks(
-    parseDiff(MODIFIED.replace("@@ -10,4 +10,4", "@@ -20,4 +20,4")),
-  );
-  assert.equal(first.length, 1, "should collect the single hunk");
+    parseDiff(MODIFIED.replace('@@ -10,4 +10,4', '@@ -20,4 +20,4'))
+  )
+  assert.equal(first.length, 1, 'should collect the single hunk')
   assert.match(
     first[0].id,
     /^docs\/guide\/cli\.md#[0-9a-f]{8}$/,
-    "should use path#hash",
-  );
-  assert.equal(first[0].id, second[0].id, "should not depend on line numbers");
-});
+    'should use path#hash'
+  )
+  assert.equal(first[0].id, second[0].id, 'should not depend on line numbers')
+})
 
-test("collectHunks suffixes duplicate ids", () => {
-  const twice = MODIFIED + MODIFIED.split("\n").slice(4).join("\n");
-  const ids = collectHunks(parseDiff(twice)).map((entry) => entry.id);
-  assert.equal(ids.length, 2, "should collect both hunks");
-  assert.equal(ids[1], `${ids[0]}-2`, "should suffix the repeated id");
-});
+test('collectHunks suffixes duplicate ids', () => {
+  const twice = MODIFIED + MODIFIED.split('\n').slice(4).join('\n')
+  const ids = collectHunks(parseDiff(twice)).map((entry) => entry.id)
+  assert.equal(ids.length, 2, 'should collect both hunks')
+  assert.equal(ids[1], `${ids[0]}-2`, 'should suffix the repeated id')
+})
 
-test("listHunks exposes removed and added text", () => {
-  const [entry] = listHunks(parseDiff(MODIFIED));
-  assert.deepEqual(entry.removed, ["old flag"], "should list removed lines");
-  assert.deepEqual(entry.added, ["new flag"], "should list added lines");
-  assert.equal(entry.status, "modified", "should carry the file status");
-});
+test('listHunks exposes removed and added text', () => {
+  const [entry] = listHunks(parseDiff(MODIFIED))
+  assert.deepEqual(entry.removed, ['old flag'], 'should list removed lines')
+  assert.deepEqual(entry.added, ['new flag'], 'should list added lines')
+  assert.equal(entry.status, 'modified', 'should carry the file status')
+})
 
 function hunkOf(lines, oldStart = 1, newStart = 1) {
   const diff = [
-    "diff --git a/docs/guide/a.md b/docs/guide/a.md",
-    "--- a/docs/guide/a.md",
-    "+++ b/docs/guide/a.md",
+    'diff --git a/docs/guide/a.md b/docs/guide/a.md',
+    '--- a/docs/guide/a.md',
+    '+++ b/docs/guide/a.md',
     `@@ -${oldStart} +${newStart} @@`,
     ...lines,
-    "",
-  ].join("\n");
-  return parseDiff(diff)[0].hunks[0];
+    '',
+  ].join('\n')
+  return parseDiff(diff)[0].hunks[0]
 }
 
-test("revertSuggestion restores replaced lines", () => {
-  const suggestion = revertSuggestion(hunkOf([" a", "-b", "+B", "+B2", " c"]));
+test('revertSuggestion restores replaced lines', () => {
+  const suggestion = revertSuggestion(hunkOf([' a', '-b', '+B', '+B2', ' c']))
   assert.deepEqual(
     suggestion,
-    { startLine: 2, line: 3, body: ["b"] },
-    "should span the new lines and restore the old one",
-  );
-});
+    { startLine: 2, line: 3, body: ['b'] },
+    'should span the new lines and restore the old one'
+  )
+})
 
-test("revertSuggestion deletes pure insertions", () => {
-  const suggestion = revertSuggestion(hunkOf([" a", "+new", " c"]));
+test('revertSuggestion deletes pure insertions', () => {
+  const suggestion = revertSuggestion(hunkOf([' a', '+new', ' c']))
   assert.deepEqual(
     suggestion,
     { startLine: 2, line: 2, body: [] },
-    "should suggest an empty body",
-  );
-});
+    'should suggest an empty body'
+  )
+})
 
-test("revertSuggestion spans several change groups with their context", () => {
-  const suggestion = revertSuggestion(hunkOf(["-a", "+A", " mid", "-c", "+C"]));
+test('revertSuggestion spans several change groups with their context', () => {
+  const suggestion = revertSuggestion(hunkOf(['-a', '+A', ' mid', '-c', '+C']))
   assert.deepEqual(
     suggestion,
-    { startLine: 1, line: 3, body: ["a", "mid", "c"] },
-    "should keep the middle context line",
-  );
-});
+    { startLine: 1, line: 3, body: ['a', 'mid', 'c'] },
+    'should keep the middle context line'
+  )
+})
 
-test("revertSuggestion anchors pure deletions on the previous context line", () => {
-  const suggestion = revertSuggestion(hunkOf([" a", "-gone", " c"], 4, 4));
+test('revertSuggestion anchors pure deletions on the previous context line', () => {
+  const suggestion = revertSuggestion(hunkOf([' a', '-gone', ' c'], 4, 4))
   assert.deepEqual(
     suggestion,
-    { startLine: 4, line: 4, body: ["a", "gone"] },
-    "should restore the deleted line after its anchor",
-  );
-});
+    { startLine: 4, line: 4, body: ['a', 'gone'] },
+    'should restore the deleted line after its anchor'
+  )
+})
 
-test("revertSuggestion anchors leading deletions on the next context line", () => {
-  const suggestion = revertSuggestion(hunkOf(["-gone", " a"]));
+test('revertSuggestion anchors leading deletions on the next context line', () => {
+  const suggestion = revertSuggestion(hunkOf(['-gone', ' a']))
   assert.deepEqual(
     suggestion,
-    { startLine: 1, line: 1, body: ["gone", "a"] },
-    "should restore the deleted line before its anchor",
-  );
-});
+    { startLine: 1, line: 1, body: ['gone', 'a'] },
+    'should restore the deleted line before its anchor'
+  )
+})
 
-test("revertSuggestion returns null without an anchor", () => {
+test('revertSuggestion returns null without an anchor', () => {
   assert.equal(
-    revertSuggestion(hunkOf(["-only"])),
+    revertSuggestion(hunkOf(['-only'])),
     null,
-    "should not invent an anchor",
-  );
-});
+    'should not invent an anchor'
+  )
+})
 
-test("indexEvidence keeps valid entries and sanitizes text", () => {
+test('indexEvidence keeps valid entries and sanitizes text', () => {
   const evidence = indexEvidence({
     hunks: [
       {
-        id: "x#1",
-        source: "crates/a.rs:4",
-        reason: "Adds `--flag`\nfor @team",
+        id: 'x#1',
+        source: 'crates/a.rs:4',
+        reason: 'Adds `--flag`\nfor @team',
       },
-      { id: 7, source: "ignored" },
-      { id: "x#2" },
-      "junk",
+      { id: 7, source: 'ignored' },
+      { id: 'x#2' },
+      'junk',
     ],
-  });
+  })
   assert.deepEqual(
     [...evidence],
-    [["x#1", { source: "crates/a.rs:4", reason: "Adds --flag for @​team" }]],
-    "should drop invalid entries and strip backticks, newlines, and mentions",
-  );
-  assert.equal(indexEvidence(null).size, 0, "should accept missing evidence");
-});
+    [['x#1', { source: 'crates/a.rs:4', reason: 'Adds --flag for @​team' }]],
+    'should drop invalid entries and strip backticks, newlines, and mentions'
+  )
+  assert.equal(indexEvidence(null).size, 0, 'should accept missing evidence')
+})
 
-test("neutralizeMentions keeps text but breaks every mention", () => {
+test('neutralizeMentions keeps text but breaks every mention', () => {
   assert.equal(
     neutralizeMentions(
-      "- docs/guide/cli.md: ask @example-org/team\nor @user.\n",
+      '- docs/guide/cli.md: ask @example-org/team\nor @user.\n'
     ),
-    "- docs/guide/cli.md: ask @\u200bexample-org/team\nor @\u200buser.\n",
-    "should insert a zero width space after each @ and keep newlines",
-  );
-});
+    '- docs/guide/cli.md: ask @\u200bexample-org/team\nor @\u200buser.\n',
+    'should insert a zero width space after each @ and keep newlines'
+  )
+})
 
-test("inertBlock fences the rationale beyond any backtick run", () => {
+test('inertBlock fences the rationale beyond any backtick run', () => {
   assert.equal(
-    inertBlock("Closes #12, see [x](https://example.com) and `a` ```b```\n\n"),
+    inertBlock('Closes #12, see [x](https://example.com) and `a` ```b```\n\n'),
     [
-      "````text",
-      "Closes #12, see [x](https://example.com) and `a` ```b```",
-      "````",
-      "",
-    ].join("\n"),
-    "should wrap the text in a longer fence and drop trailing newlines",
-  );
+      '````text',
+      'Closes #12, see [x](https://example.com) and `a` ```b```',
+      '````',
+      '',
+    ].join('\n'),
+    'should wrap the text in a longer fence and drop trailing newlines'
+  )
   assert.equal(
-    inertBlock("ask @team\n"),
-    "```text\nask @\u200bteam\n```\n",
-    "should still neutralize mentions",
-  );
-});
+    inertBlock('ask @team\n'),
+    '```text\nask @\u200bteam\n```\n',
+    'should still neutralize mentions'
+  )
+})
 
-test("buildReview cites evidence and suggests reverts", () => {
+test('buildReview cites evidence and suggests reverts', () => {
   const files = parseDiff(
     [
-      "diff --git a/docs/guide/a.md b/docs/guide/a.md",
-      "--- a/docs/guide/a.md",
-      "+++ b/docs/guide/a.md",
-      "@@ -1,3 +1,3 @@",
-      " a",
-      "-uses ```fence```",
-      "+B",
-      " c",
-      "@@ -10 +10,2 @@",
-      " j",
-      "+k",
-      "",
-    ].join("\n"),
-  );
-  const [first] = collectHunks(files);
+      'diff --git a/docs/guide/a.md b/docs/guide/a.md',
+      '--- a/docs/guide/a.md',
+      '+++ b/docs/guide/a.md',
+      '@@ -1,3 +1,3 @@',
+      ' a',
+      '-uses ```fence```',
+      '+B',
+      ' c',
+      '@@ -10 +10,2 @@',
+      ' j',
+      '+k',
+      '',
+    ].join('\n')
+  )
+  const [first] = collectHunks(files)
   const evidence = indexEvidence({
     hunks: [
-      { id: first.id, source: "crates/a.rs:9", reason: "Renames the flag." },
+      { id: first.id, source: 'crates/a.rs:9', reason: 'Renames the flag.' },
     ],
-  });
-  const review = buildReview(files, evidence, "abc123");
+  })
+  const review = buildReview(files, evidence, 'abc123')
 
-  assert.equal(review.commit_id, "abc123", "should pin the reviewed commit");
-  assert.equal(
-    review.event,
-    "COMMENT",
-    "should not approve or request changes",
-  );
-  assert.equal(review.comments.length, 2, "should comment on every hunk");
+  assert.equal(review.commit_id, 'abc123', 'should pin the reviewed commit')
+  assert.equal(review.event, 'COMMENT', 'should not approve or request changes')
+  assert.equal(review.comments.length, 2, 'should comment on every hunk')
   assert.deepEqual(
     review.comments[0],
     {
-      path: "docs/guide/a.md",
+      path: 'docs/guide/a.md',
       line: 2,
-      side: "RIGHT",
+      side: 'RIGHT',
       body: [
-        "**Source:** `crates/a.rs:9` — `Renames the flag.`",
-        "",
-        "Apply this suggestion to revert the hunk.",
-        "",
-        "````suggestion",
-        "uses ```fence```",
-        "````",
-      ].join("\n"),
+        '**Source:** `crates/a.rs:9` — `Renames the flag.`',
+        '',
+        'Apply this suggestion to revert the hunk.',
+        '',
+        '````suggestion',
+        'uses ```fence```',
+        '````',
+      ].join('\n'),
     },
-    "should escalate the fence and omit start_line for one line",
-  );
+    'should escalate the fence and omit start_line for one line'
+  )
   assert.match(
     review.comments[1].body,
     /none cited/,
-    "should flag hunks without evidence",
-  );
+    'should flag hunks without evidence'
+  )
   assert.match(
     review.comments[1].body,
     /```suggestion\n```$/,
-    "should suggest deleting an insertion",
-  );
-});
+    'should suggest deleting an insertion'
+  )
+})
 
-test("buildReview lists binary and unanchored changes in the body", () => {
+test('buildReview lists binary and unanchored changes in the body', () => {
   const files = parseDiff(
     [
-      "diff --git a/docs/guide/gone.md b/docs/guide/gone.md",
-      "deleted file mode 100644",
-      "@@ -1 +0,0 @@",
-      "-bye",
-      "diff --git a/docs/guide/logo.png b/docs/guide/logo.png",
-      "Binary files a/docs/guide/logo.png and b/docs/guide/logo.png differ",
-      "",
-    ].join("\n"),
-  );
-  const review = buildReview(files, new Map(), "abc123");
-  assert.equal(review.comments.length, 0, "should not post line comments");
+      'diff --git a/docs/guide/gone.md b/docs/guide/gone.md',
+      'deleted file mode 100644',
+      '@@ -1 +0,0 @@',
+      '-bye',
+      'diff --git a/docs/guide/logo.png b/docs/guide/logo.png',
+      'Binary files a/docs/guide/logo.png and b/docs/guide/logo.png differ',
+      '',
+    ].join('\n')
+  )
+  const review = buildReview(files, new Map(), 'abc123')
+  assert.equal(review.comments.length, 0, 'should not post line comments')
   assert.match(
     review.body,
     /`docs\/guide\/gone\.md`: file deleted/,
-    "should note the deletion",
-  );
+    'should note the deletion'
+  )
   assert.match(
     review.body,
     /`docs\/guide\/logo\.png`: binary change/,
-    "should note the binary file",
-  );
-});
+    'should note the binary file'
+  )
+})
 
-test("buildReview asks to delete a new file instead of emptying it", () => {
+test('buildReview asks to delete a new file instead of emptying it', () => {
   const files = parseDiff(
     [
-      "diff --git a/docs/guide/new.md b/docs/guide/new.md",
-      "new file mode 100644",
-      "--- /dev/null",
-      "+++ b/docs/guide/new.md",
-      "@@ -0,0 +1,2 @@",
-      "+# New",
-      "+page",
-      "",
-    ].join("\n"),
-  );
-  const [entry] = collectHunks(files);
+      'diff --git a/docs/guide/new.md b/docs/guide/new.md',
+      'new file mode 100644',
+      '--- /dev/null',
+      '+++ b/docs/guide/new.md',
+      '@@ -0,0 +1,2 @@',
+      '+# New',
+      '+page',
+      '',
+    ].join('\n')
+  )
+  const [entry] = collectHunks(files)
   const evidence = indexEvidence({
-    hunks: [{ id: entry.id, source: "crates/a.rs:1", reason: "New page." }],
-  });
-  const [comment] = buildReview(files, evidence, "abc123").comments;
+    hunks: [{ id: entry.id, source: 'crates/a.rs:1', reason: 'New page.' }],
+  })
+  const [comment] = buildReview(files, evidence, 'abc123').comments
   assert.equal(
     comment.path,
-    "docs/guide/new.md",
-    "should anchor on the new file",
-  );
-  assert.equal(comment.line, 2, "should end at the last new line");
+    'docs/guide/new.md',
+    'should anchor on the new file'
+  )
+  assert.equal(comment.line, 2, 'should end at the last new line')
   assert.equal(
     comment.body,
     [
-      "**Source:** `crates/a.rs:1` — `New page.`",
-      "",
-      "This hunk creates the file. Delete the file to revert it.",
-    ].join("\n"),
-    "should keep the evidence and offer no empty suggestion",
-  );
-});
+      '**Source:** `crates/a.rs:1` — `New page.`',
+      '',
+      'This hunk creates the file. Delete the file to revert it.',
+    ].join('\n'),
+    'should keep the evidence and offer no empty suggestion'
+  )
+})
 
-test("buildReview adds start_line for multi-line spans", () => {
+test('buildReview adds start_line for multi-line spans', () => {
   const files = parseDiff(
     [
-      "diff --git a/docs/index.md b/docs/index.md",
-      "@@ -1 +1,2 @@",
-      "-a",
-      "+b",
-      "+c",
-      "",
-    ].join("\n"),
-  );
-  const [comment] = buildReview(files, new Map(), "abc123").comments;
-  assert.equal(comment.start_line, 1, "should start at the first new line");
+      'diff --git a/docs/index.md b/docs/index.md',
+      '@@ -1 +1,2 @@',
+      '-a',
+      '+b',
+      '+c',
+      '',
+    ].join('\n')
+  )
+  const [comment] = buildReview(files, new Map(), 'abc123').comments
+  assert.equal(comment.start_line, 1, 'should start at the first new line')
   assert.equal(
     comment.start_side,
-    "RIGHT",
-    "should anchor the start on the new side",
-  );
-  assert.equal(comment.line, 2, "should end at the last new line");
-});
+    'RIGHT',
+    'should anchor the start on the new side'
+  )
+  assert.equal(comment.line, 2, 'should end at the last new line')
+})
 
-test("buildReview renders the evidence reason as inline code", () => {
+test('buildReview renders the evidence reason as inline code', () => {
   const files = parseDiff(
     [
-      "diff --git a/docs/guide/a.md b/docs/guide/a.md",
-      "--- a/docs/guide/a.md",
-      "+++ b/docs/guide/a.md",
-      "@@ -1 +1 @@",
-      "-a",
-      "+b",
-      "",
-    ].join("\n"),
-  );
-  const [hunk] = collectHunks(files);
+      'diff --git a/docs/guide/a.md b/docs/guide/a.md',
+      '--- a/docs/guide/a.md',
+      '+++ b/docs/guide/a.md',
+      '@@ -1 +1 @@',
+      '-a',
+      '+b',
+      '',
+    ].join('\n')
+  )
+  const [hunk] = collectHunks(files)
   const reason =
-    "See #1 and [click](https://example.com) ![](https://example.com/p.png) <img src=x>";
+    'See #1 and [click](https://example.com) ![](https://example.com/p.png) <img src=x>'
   const evidence = indexEvidence({
-    hunks: [{ id: hunk.id, source: "x.rs:1", reason }],
-  });
-  const [comment] = buildReview(files, evidence, "abc123").comments;
+    hunks: [{ id: hunk.id, source: 'x.rs:1', reason }],
+  })
+  const [comment] = buildReview(files, evidence, 'abc123').comments
 
   assert.ok(
     comment.body.startsWith(`**Source:** \`x.rs:1\` — \`${reason}\`\n`),
-    "should wrap the reason in inline code so Markdown and HTML stay inert",
-  );
-});
+    'should wrap the reason in inline code so Markdown and HTML stay inert'
+  )
+})
diff --git a/scripts/release/bootstrap.sh b/scripts/release/bootstrap.sh
new file mode 100644
index 0000000000..e02fd3f659
--- /dev/null
+++ b/scripts/release/bootstrap.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+# Rust release tooling must be source-approved before this launcher can execute it.
+# Keep release execution closed while the replacement is implemented and reviewed.
+set -eu
+# An extensionless pin overrides rust-toolchain.toml during rustup selection,
+# so reject it in the invocation directory and in the repository root that
+# owns this script before any future toolchain selection can happen.
+script_directory=$(dirname -- "$0")
+repository_root=$(CDPATH='' cd -P -- "$script_directory/../.." && pwd -P)
+for candidate in rust-toolchain "$repository_root/rust-toolchain"; do
+    if [ -e "$candidate" ] || [ -L "$candidate" ]; then
+        printf '%s\n' 'Extensionless rust-toolchain is rejected before toolchain selection' >&2
+        exit 1
+    fi
+done
+printf '%s\n' 'Release bootstrap is pending the reviewed Rust tooling replacement' >&2
+exit 1
diff --git a/scripts/release/build-js.sh b/scripts/release/build-js.sh
new file mode 100755
index 0000000000..46f37e7981
--- /dev/null
+++ b/scripts/release/build-js.sh
@@ -0,0 +1,4 @@
+#!/bin/sh
+# Use the same independently approved bootstrap boundary as the Rust recipe.
+set -eu
+exec /bin/sh "$(dirname "$0")/bootstrap.sh" js "$@"
diff --git a/scripts/release/build.sh b/scripts/release/build.sh
new file mode 100755
index 0000000000..e5e5dfd118
--- /dev/null
+++ b/scripts/release/build.sh
@@ -0,0 +1,4 @@
+#!/bin/sh
+# Independent native/bootstrap approval precedes release-tool execution.
+set -eu
+exec /bin/sh "$(dirname "$0")/bootstrap.sh" rust "$@"
diff --git a/scripts/release/collect-js.mjs b/scripts/release/collect-js.mjs
new file mode 100644
index 0000000000..5a1ac57694
--- /dev/null
+++ b/scripts/release/collect-js.mjs
@@ -0,0 +1,252 @@
+/**
+ * Produce conservative post-Rollup contributions and final post-esbuild hashes.
+ * Later minification can eliminate recorded code; rendered_length is not final
+ * byte attribution. This producer does not prove authenticated acquisition,
+ * lifecycle execution, host qualification or A/B equality. Preparation
+ * observations and execution boundary qualification remain separate requirements.
+ */
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { execFileSync } from 'node:child_process'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+import { buildAll } from '../../crates/trusted-server-js/lib/build-all.mjs'
+import {
+  actualToolFiles,
+  installedOrigins,
+  installedMaterials,
+  validatePreparation,
+  releaseBuild,
+  readBounded,
+  strictJson,
+  sha256,
+} from '../../crates/trusted-server-js/lib/release-composition.mjs'
+
+const here = path.dirname(fileURLToPath(import.meta.url))
+const defaultRoot = path.resolve(here, '../..')
+const MAX_BUNDLE = 32 * 1024 * 1024
+
+/** Discover modules from the selected source identity. */
+export function expectedModuleIds(repoRoot, sourceCommit, sourceContextPath) {
+  if (!/^[a-f0-9]{40}$/.test(sourceCommit ?? ''))
+    throw new Error('Expected full source commit')
+  if (sourceContextPath) {
+    const file = fs.realpathSync(sourceContextPath)
+    if (file === repoRoot || file.startsWith(`${repoRoot}${path.sep}`))
+      throw new Error('Source context must be outside the writable checkout')
+    const context = strictJson(readBounded(file))
+    if (
+      !context ||
+      typeof context !== 'object' ||
+      Array.isArray(context) ||
+      Object.keys(context).sort().join(',') !==
+        'module_ids,schema_version,source_commit' ||
+      context.schema_version !== 1 ||
+      context.source_commit !== sourceCommit ||
+      !Array.isArray(context.module_ids) ||
+      !context.module_ids.includes('core') ||
+      context.module_ids.some(
+        (id) => typeof id !== 'string' || !/^[a-z][a-z0-9_-]*$/.test(id)
+      ) ||
+      context.module_ids.some(
+        (id, index) => index > 0 && context.module_ids[index - 1] >= id
+      )
+    )
+      throw new Error('Invalid parent-derived source context')
+    // The parent derives this list from authenticated objects and mounts it
+    // read-only. Parsing it alone does not establish source/build completion.
+    return context.module_ids
+  }
+  const gitEnvironment = {
+    PATH: process.env.PATH,
+    TMPDIR: os.tmpdir(),
+    LANG: 'C',
+    LC_ALL: 'C',
+    GIT_CONFIG_NOSYSTEM: '1',
+    GIT_CONFIG_GLOBAL: '/dev/null',
+    GIT_NO_REPLACE_OBJECTS: '1',
+    GIT_OPTIONAL_LOCKS: '0',
+  }
+  const raw = execFileSync(
+    'git',
+    ['ls-tree', '-rz', '--name-only', sourceCommit],
+    {
+      cwd: repoRoot,
+      env: gitEnvironment,
+      maxBuffer: 1024 * 1024,
+    }
+  )
+  const tracked = new TextDecoder('utf-8', { fatal: true })
+    .decode(raw)
+    .split('\0')
+    .filter(
+      (file) =>
+        file === 'crates/trusted-server-js/lib/src/core/index.ts' ||
+        /^crates\/trusted-server-js\/lib\/src\/integrations\/[^/]+\/index\.ts$/.test(
+          file
+        )
+    )
+  const expected = tracked
+    .map((file) =>
+      file.endsWith('/core/index.ts') ? 'core' : file.split('/').at(-2)
+    )
+    .sort()
+  if (
+    !expected.includes('core') ||
+    expected.some((id) => !/^[a-z][a-z0-9_-]*$/.test(id)) ||
+    new Set(expected).size !== expected.length
+  )
+    throw new Error('Invalid tracked module identities')
+  return expected
+}
+
+/** Build release bundles using checked observations from independent preparation. */
+export async function collectJs({
+  repoRoot = defaultRoot,
+  outDir,
+  inventoryPath,
+  preparationPath,
+  sourceContextPath,
+}) {
+  if (!preparationPath)
+    throw new Error('Checked preparation records are required')
+  if (!releaseBuild())
+    throw new Error('Collector requires the existing release build control')
+  repoRoot = fs.realpathSync(repoRoot)
+  if (repoRoot !== fs.realpathSync(defaultRoot))
+    throw new Error('Collector must execute from its own checkout')
+  const sourceCommit = process.env.TRUSTED_SERVER__GIT_VERSION
+  const libDir = path.join(repoRoot, 'crates/trusted-server-js/lib')
+  const lockFile = path.join(libDir, 'package-lock.json')
+  const owners = installedOrigins({ repoRoot, lockFile })
+  const packages = installedMaterials(owners)
+  const strictPreparation = strictJson(readBounded(preparationPath))
+  const prepared = validatePreparation(strictPreparation, {
+    installRoot: libDir,
+    packages,
+  })
+  for (const actual of actualToolFiles({ installRoot: libDir })) {
+    const tool = prepared.tools.find(
+      (record) => record.name === actual.name && record.role === actual.role
+    )
+    const material = prepared.materials.find(
+      (record) => record.id === tool?.material_id
+    )
+    const distribution = strictPreparation.distributions.find(
+      (record) => record.material.id === tool?.material_id
+    )
+    if (
+      !tool ||
+      tool.version !== actual.version ||
+      material.sha256 !== actual.sha256 ||
+      fs.realpathSync(distribution.path) !== fs.realpathSync(actual.path)
+    )
+      throw new Error(
+        `Actual build tool digest or identity mismatch: ${actual.name}`
+      )
+  }
+  fs.mkdirSync(path.resolve(outDir), { recursive: true })
+  outDir = fs.realpathSync(path.resolve(outDir))
+  inventoryPath = path.join(
+    fs.realpathSync(path.dirname(path.resolve(inventoryPath))),
+    path.basename(inventoryPath)
+  )
+  if (
+    inventoryPath === outDir ||
+    inventoryPath.startsWith(`${outDir}${path.sep}`)
+  )
+    throw new Error('Inventory must be outside the bundle directory')
+  const expected = expectedModuleIds(repoRoot, sourceCommit, sourceContextPath)
+  const records = await buildAll({
+    outDir,
+    sourceDir: path.join(libDir, 'src'),
+    composition: { repoRoot, lockFile, owners },
+  })
+  if (
+    JSON.stringify(records.map((record) => record.id)) !==
+    JSON.stringify(expected)
+  )
+    throw new Error('Discovered module set differs from tracked source')
+  const actualFiles = fs.readdirSync(outDir).sort()
+  if (
+    JSON.stringify(actualFiles) !==
+    JSON.stringify(expected.map((id) => `tsjs-${id}.js`).sort())
+  )
+    throw new Error('Unexpected bundle files')
+  const modules = records.map((record) => {
+    const bytes = readBounded(path.join(outDir, record.filename), MAX_BUNDLE)
+    if (!bytes.length) throw new Error('Empty release bundle')
+    new TextDecoder('utf-8', { fatal: true }).decode(bytes)
+    return {
+      id: record.id,
+      filename: record.filename,
+      size: bytes.length,
+      sha256: sha256(bytes),
+      contributions: record.contributions,
+    }
+  })
+  const sources = [
+    'package.json',
+    'package-lock.json',
+    'build-all.mjs',
+    'build-module-options.mjs',
+    'release-composition.mjs',
+    'vitest.config.ts',
+    'tsconfig.json',
+  ].map((file) => `crates/trusted-server-js/lib/${file}`)
+  sources.push('scripts/release/collect-js.mjs')
+  sources.push('scripts/release/observe-npm.mjs')
+  sources.push(
+    'scripts/release/build-js.sh',
+    'scripts/release/bootstrap.sh',
+    'crates/trusted-server-release/Cargo.toml',
+    'crates/trusted-server-release/src/main.rs'
+  )
+  const materials = [
+    ...prepared.materials,
+    ...sources.map((file) => ({
+      kind: 'source',
+      id: `source:${file}`,
+      path: file,
+      sha256: sha256(readBounded(path.join(repoRoot, file))),
+    })),
+  ].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0))
+  if (
+    new Set(materials.map((material) => material.id)).size !== materials.length
+  )
+    throw new Error('Duplicate combined material identity')
+  const inventory = {
+    schema_version: 1,
+    source_commit: sourceCommit,
+    modules,
+    tools: prepared.tools,
+    materials,
+  }
+  const bytes = Buffer.from(`${JSON.stringify(inventory)}\n`)
+  if (bytes.length > 1024 * 1024) throw new Error('Inventory exceeds 1 MiB')
+  fs.writeFileSync(inventoryPath, bytes, { flag: 'wx', mode: 0o600 })
+  return inventory
+}
+
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(fs.realpathSync(process.argv[1])).href
+) {
+  const args = process.argv.slice(2)
+  if (
+    ![6, 8].includes(args.length) ||
+    args[0] !== '--out-dir' ||
+    args[2] !== '--inventory' ||
+    args[4] !== '--preparation' ||
+    (args.length === 8 && args[6] !== '--source-context')
+  )
+    throw new Error(
+      'Usage: collect-js.mjs --out-dir <dir> --inventory <file> --preparation <file> [--source-context <file>]'
+    )
+  await collectJs({
+    outDir: args[1],
+    inventoryPath: args[3],
+    preparationPath: args[5],
+    sourceContextPath: args[7],
+  })
+}
diff --git a/scripts/release/js-composition.md b/scripts/release/js-composition.md
new file mode 100644
index 0000000000..aeb877b790
--- /dev/null
+++ b/scripts/release/js-composition.md
@@ -0,0 +1,269 @@
+# JS composition producer interface
+
+`collect-js.mjs` reuses the ordinary build pipeline with a read-only Rollup
+observer. Its version-1 output follows the closed Task 5 root/module schema.
+It requires the existing `TRUSTED_SERVER__RELEASE_BUILD=1` control and a full
+`TRUSTED_SERVER__GIT_VERSION`. Any skip presence or invalid release control fails.
+Expected entry points come from the selected full commit’s Git tree, independently
+of the current index. The collector builds only its own checkout, so imported
+build/tool code cannot be measured as a different checkout’s installation. Source-byte immutability remains preparation’s check.
+The release options disable Vite configuration and `.env` loading and select
+production mode; Vitest uses the same release controls. These options do not
+remove inherited Node/npm/Vite environment variables: release preflight owns
+that rejection.
+
+## Contribution semantics
+
+Contributions with positive Rollup `renderedLength` carry
+`stage: "rollup-rendered"` and `rendered_length`. Type-only and wholly eliminated
+modules are excluded. Later esbuild minification can remove additional code.
+These records describe conservative post-Rollup reachability, not final function
+reachability or attribution of final bundle bytes. Final module sizes and SHA-256
+are measured from files after Vite/esbuild finishes.
+
+Source contributions contain repository-relative `path`, original-file `sha256`
+and `transform` (`identity`, `raw` or `inline`). npm contributions additionally
+contain exact `lock_path`, `package_name`, `package_version` and archive
+`integrity`; their paths are relative to the owning installed package. Only the selected registry’s canonical HTTPS tarball sources are supported;
+links, missing sources and file/git sources fail. Parent/root aliases are
+normalized before nearest-owner lookup; package-root aliases and escapes fail. Unsupported
+queries, unmapped owners, symlink escapes and ambiguous identities fail.
+
+Generated contributions contain `id`, `plugin`, `owner_lock_path` and
+`generated_sha256` of the actual transformed virtual code. The reviewed mappings
+are Vite's bundled CommonJS helper, CommonJS ES-import wrappers and Vite's preload
+helper. Wrappers additionally record the underlying file's `input` origin.
+Unknown virtual producers fail. Wrapper IDs use normalized input paths;
+transformed-code hashes still measure actual code, which can include checkout
+paths. Contribution inventories are not a claim that different checkout paths
+produce identical virtual-code hashes. The bundle-byte comparison is separate.
+
+## Checked preparation input
+
+The producer accepts a bounded strict UTF-8 JSON document with exactly:
+
+- `schema_version: 1`;
+- `packages`: the full measured installed `npm-package` material set;
+- `distributions`: records with exactly `material` and `path`;
+- `tools`: records with `name`, `version`, `role`, `material_id`;
+- `lifecycle_events`: observed executions, including executions with no output;
+- `lifecycle_outputs`: observed output files.
+
+A package material contains `kind: "npm-package"`, `id: "npm:<lock_path>"`,
+`lock_path`, `name`, `version`, `integrity` and `installed_tree_sha256`.
+Only installed locked locations are recorded; optional absent platform packages
+are not claimed installed. The selected native esbuild and Rollup packages are
+mandatory through the actual-tool checks.
+
+Each distribution material contains `kind: "tool-distribution"`, `id`, `name`,
+`version`, `sha256`. `path` selects the actual measured tool entry file or native
+executable, never a command to run. Required tools are Node, npm, Vite, Rollup,
+esbuild, Vitest and the selected esbuild/Rollup native executables. Paths, versions,
+roles and file digests MUST match the producer's actual tool selection. Whole
+locked npm package trees are recorded separately. Tool entry/native file hashes
+are measured identities; they are not authenticated distribution acquisition or
+qualified host evidence. Task 8 supplies that boundary.
+
+Lifecycle events contain `kind: "lifecycle-event"`, unique `id`,
+`package_material_id`, `event` and `script_sha256`. The script digest is SHA-256
+of the UTF-8 command string in the owning installed package's
+`package.json.scripts[event]`. Outputs contain `kind: "lifecycle-output"`, unique
+`id`, the same event/script/package join, installation-relative `path`, `size`
+and `sha256`. Each output MUST remain inside its owning package and match an
+explicit observed event. Registry-install coverage requires exactly the installed packages’ declared
+preinstall, install and postinstall hooks, including hooks producing no files.
+Registry dependency prepare scripts do not run in the selected npm ci recipe.
+Implicit binding.gyp installs without explicit reviewed hooks are rejected. Neither array is inferred from lockfile flags. Task 7 MUST produce
+these records from actual preparation execution; semantic checks here cannot
+prove that an execution occurred or that the observations are exhaustive.
+Synthetic fixture observations exercise joins but do not claim genuine execution
+history. Missing required events cannot produce an inventory.
+
+## Installed tree hash
+
+`installed_tree_sha256` hashes the UTF-8 domain separator
+`trusted-server-installed-tree-v1\n`, then entries in recursive sorted pathname
+order. A directory contributes compact JSON `[relative_path,"directory"]` plus
+newline. A regular file contributes compact JSON
+`[relative_path,"file",byte_length,is_executable]`, newline, actual bytes and
+newline; `is_executable` means any executable bit is set. A symlink contributes
+compact JSON `[relative_path,"symlink",relative_target]` plus newline and MUST
+resolve inside its package. Separately locked nested package roots and their
+contents are excluded from the parent's hash. Timestamps, owners and
+non-executable permission bits are excluded. Files are read through held
+regular-file descriptors with mutation checks and bounded buffers.
+
+JSON and final inventory are limited to 1 MiB; source and final bundle reads are
+limited to 32 MiB. Duplicate keys, invalid UTF-8, BOM, unpaired surrogates,
+unsafe integers, non-finite numbers and more than 64 nested containers fail.
+The inventory writer sorts module/material/tool records and appends one newline.
+The inventory MUST live outside the bundle directory. This task does not perform
+fresh installation, network confinement, A/B comparison, signing or publication.
+
+## Independent Rust preparation recipe
+
+The private Rust preparation and comparison recipe uses the retained Node collector.
+`build-js.sh` remains a thin POSIX adapter to the independently approved-source
+OS-native `trusted-server-release build-js` command. Until its authenticated Rust
+bootstrap and qualified source-owned selections are implemented, the wrapper
+refuses before creating work directories. No public fixture bypass, unchecked
+interpreter or colocated self-authored SHA file establishes bootstrap authority.
+The host-only tool has no core/CLI/JS crate dependency; it retains this Node
+collector and composition pipeline. See the [migration addendum](../../docs/superpowers/specs/2026-10-14-release-tooling-rust-migration.md).
+
+The recipe lives in private `materials`, `process`, `boundary`,
+`preparation` and `javascript` modules. Each installation owns a fresh copy of
+approved tracked source bytes, cache, node_modules, HOME, TMP, lifecycle observations
+and bundles. The parent authenticates the approved Git objects and derives the
+complete module set; it supplies that set and the source commit through a protected
+read-only source-context document. JS working copies contain no inherited `.git`,
+configuration or history. Git material snapshots for Cargo remain separate.
+Original sources/object stores and shared authenticated archives/tools are read-only;
+sibling data/metadata, shared writes and network sockets are denied. The shared JS
+execution path selects Linux containers with owned descendant cleanup; macOS native
+recipes require their own lifecycle containment and qualification. Current installed-tool
+rehashing is separate from independently reviewed all-cohort hosted evidence.
+Local macOS 26.6.2 diagnostics cannot qualify macOS 15 ARM/Intel or GNU.
+
+Archive filenames remain locked SHA-512 hex digests followed by `.tgz`. Authenticate
+original bytes before bounded decompression/TAR inspection. Preserve the source-owned
+exception for three exact locked npm archives containing identical
+`package/./dist/index.js` and `package/dist/index.js` entries: agent-base 7.1.4,
+http-proxy-agent 7.0.2 and https-proxy-agent 7.0.6. Resolve their original locked
+SHA-512 identities and require matching regular type, size, mode and bytes;
+materialize the canonical file once. Other duplicates, dot aliases, traversal,
+links, devices and privileged modes fail. Eight exact locked type-package
+versions use reviewed legacy roots: `@types/chai` 5.2.3 (`chai`),
+`@types/deep-eql` 4.0.2 (`deep-eql`), `@types/estree` 1.0.8 (`estree`),
+`@types/jsdom` 27.0.0 (`jsdom`), `@types/json-schema` 7.0.15 (`json-schema`),
+`@types/json5` 0.0.29 (`json5`), `@types/node` 24.10.13 (`node v24.10`),
+and `@types/tough-cookie` 4.0.5 (`tough-cookie`). Seven of these originals
+(all except json5) may use the observed node-tar timestamp layout: empty
+130-byte prefix, a zero separator, two eleven-digit octal timestamps with
+NUL terminators, and zero remaining reserved bytes. No timestamp propagates
+to extracted files. Other hidden name/prefix bytes fail.
+
+Only locked `gulp-wrap` 0.15.0 may carry local PAX metadata. Each bounded
+record uses the reviewed metadata-key allowlist; duplicate, unknown and
+malformed fields fail. Its path and size must exactly match the immediately
+following raw regular-file header, and its own name must be
+`PaxHeader/<that-path>`. Global, consecutive and dangling records and any
+path/size override fail. These exceptions apply only after original-byte
+authentication and exact name/version selection; they are not general
+extension support.
+
+Registry archive SHA-256/exact-root and
+Git revision/whole-tree validation remain available to Cargo preparation. Query
+selected Git object identity/type/size before body acquisition: reject objects
+over 32 MiB or cumulative bodies over 512 MiB, then rejoin exact body headers.
+This reader assumes the sanitized trusted Git implementation and an immutable
+object store, rather than claiming adversarial race-proof streaming.
+
+The Rust dependency archive inspector limits each authenticated compressed
+original to 64 MiB, decoded TAR bytes to 512 MiB, each member to 128 MiB,
+entries to 100,000, path depth to 64 and path text to 4,096 bytes. It accepts
+ASCII regular-file and directory names under the exact locked root, rejects
+case aliases and unsupported extension records (including unreviewed PAX,
+GNU long-name and sparse records), and requires a single complete gzip member with complete
+TAR zero terminators and no hidden trailing data. These are dependency archive
+limits, separate from toolchain distributions and Git object limits. The
+128 MiB member limit accommodates the current locked optional OpenBSD Rollup
+binary expands to 110,275,248 bytes. Hashing and extraction remain streamed;
+this does not increase the compressed-original or total decoded-byte limits. Extraction
+owns a fresh private directory and preserves original compressed bytes. File
+permissions become owner read/write plus the archive's executable bits; archive
+ownership, timestamps and other permission bits do not propagate. This stage
+does not establish an installed dependency, executed hook or completed JS build.
+
+Seed each private cache through selected npm's public `cache add` API with only
+verified archives, offline and scripts disabled. Run fresh pinned npm 11.19.0
+`ci --offline --include=dev --no-audit --no-fund` with hooks in the foreground
+under the qualified lifecycle denial boundary. Reject root install/prepare hooks
+and implicit binding.gyp installs. Preserve the two exact reviewed dependency
+hooks and actual starts/completions/failures/script hashes/changed-owned-files,
+including no-output hooks and swallowed optional failures. Bind bare `node` to
+selected Node 24.20.0 despite package-bin shadowing. Missing prepared native
+Vite/esbuild tools MUST fail without fetching substitutes. Observed lifecycle
+records cannot be inferred from lockfile flags or successful npm exit alone.
+
+The source-owned declaration policy in the Rust material reviewer permits only
+these exact dependency install-hook tuples. It checks the name/version against
+the approved lock, the manifest bytes against the authenticated extraction, and
+the command bytes against this policy:
+
+| Package   | Version  | Event         | Exact command                                       |
+| --------- | -------- | ------------- | --------------------------------------------------- |
+| `core-js` | `3.48.0` | `postinstall` | `node -e "try{require('./postinstall')}catch(e){}"` |
+| `esbuild` | `0.27.3` | `postinstall` | `node install.js`                                   |
+
+Any added hook or command/version change requires a source policy review.
+Root review rejects all ten `npm ci` lifecycle hooks: `preinstall`, `install`,
+`postinstall`, `prepublish`, `preprepare`, `prepare`, `postprepare`,
+`predependencies`, `dependencies` and `postdependencies`. The last three also run
+through pinned npm's Arborist when installation changes the dependency tree. These
+results describe declarations only. They grant no execution authority and supply
+no starts, completions, failures or changed-file observations. Full installation
+tree mutation checks and actual lifecycle observations remain separate gates.
+
+`observe-npm.mjs` adapts the selected npm 11.19.0 lifecycle entry before npm loads
+its dependency graph. It records real starts, fulfilled/rejected execution,
+exit status and changed owned-file facts in memory. This includes hooks with no
+output and optional hook failures that npm would otherwise swallow. Root calls
+for absent scripts remain no-ops; root commands and unreviewed dependency hooks
+fail. Selected Node replaces the reviewed command's bare `node` and leads the
+child PATH after npm prepends package bins. Lifecycle children receive no parent
+stdin or additional inherited descriptors.
+
+The Linux supervisor loads the authenticated native non-dumpable-process guard
+before giving the observer its private request key. The guard and the process
+memory syscall denials prevent lifecycle children from reading or modifying the
+trusted npm process. Observations and the checked preparation document are sealed
+together with HMAC-SHA-256 over their exact original JSON bytes. The supervisor
+joins the nonce, source, workspace, cache, guard and native esbuild expectation,
+requires successful npm exit and complete successful events, and independently
+checks the retained outputs. A child's printed prefix or writable JSON file does
+not establish an observation. This adapter provides no macOS completion path and
+does not itself authenticate Node/npm distributions or qualify a hosted runner.
+
+The reviewed esbuild 0.27.3 postinstall can hard-link its selected native package
+binary to `node_modules/esbuild/bin/esbuild`. To retain the boundary's global
+single-link policy, the observer detaches only this exact pair after execution.
+Both paths must identify the same regular inode with exactly two links and match
+the parent-derived authenticated native archive's digest, size and expected mode.
+The observer copies the owned esbuild path into a fresh file and atomically
+replaces it, then verifies both files have one link and unchanged executable
+bytes. It records `esbuild-hardlink-copy-v1` separately in the sealed observations;
+the changed owned executable remains a lifecycle output. Other hard links,
+additional aliases, mismatched bytes/modes or unsafe paths fail. This
+normalization changes inode ownership of the bytes, not executable content.
+
+Run collector and unconditional full Vitest/type checks under that same native
+boundary, checking tracked source and unexpected files before/after each stage.
+Preserve release Vitest's literal host and narrowly scoped native `node:` import
+resolver; npm imports remain unmodified. `configFile: false` collector builds
+remain separate from that test plugin. Existing ordinary development behavior
+remains supported. Both actual A/B Vitest processes MUST unconditionally receive
+`TRUSTED_SERVER__RELEASE_JS_TESTS=1` and run the full registered suite/type checks,
+with no developer opt-out. Require all tracked core/integration final files
+compared byte-for-byte. Ordinary development skips only the two slow Git
+collector fixtures by default; CI enables the full suite. B inventory virtual-code hashes may differ because paths differ.
+
+After all actual preparation/lifecycle/test/build/control/comparison stages pass,
+construct a private typed completion bound to approved source, authenticated tools,
+settings, raw inventory digest and retained A module bytes. A parsed JSON boolean,
+source label, arbitrary checked inventory or asserted path/hash cannot construct
+that state. Atomically retain A's `bundles/` plus sibling `tsjs-inventory.json`,
+with only JS files in `bundles/`; preserve A's original inventory encoding and
+closed root/module shape, exact integer sizes and final digests. Rehash at handoff.
+Use bounded child pipes/deadlines and kill/reap descendants on cancellation,
+timeout or oversize output. Clean private profiles/resources and Docker containers
+on success and failure with bounded stop/remove operations.
+
+Once Rust modules/tests exist, derive `HOST_TARGET=$(rustc -vV | sed -n 's/^host: //p')`
+and run `cargo test -p trusted-server-release --target "$HOST_TARGET" javascript::tests`
+using the [primary plan's nonzero-selection guard](../../docs/superpowers/plans/2026-10-13-attested-release-implementation.md#focused-rust-test-selection-guard).
+Private fixtures belong alongside their registered modules; public process tests
+use `tests/commands.rs`. Full local two-installation/native-probe execution MUST be
+selected explicitly through reviewed test paths and cannot waive hosted gates.
+
+The committed Node collector/composition fixtures are current local interface checks; utility fixtures do not construct producer completion. Task 7's real two-installation orchestration passed its full Linux execution test in ordinary PR CI; see the [two-build evidence report](qualification/2026-10-15-js-two-builds.md). That candidate run is not release qualification: Task 8's selected hosted/native qualification, authenticated bootstrap and tool pins remain pending.
diff --git a/scripts/release/observe-npm.mjs b/scripts/release/observe-npm.mjs
new file mode 100644
index 0000000000..f69e87e970
--- /dev/null
+++ b/scripts/release/observe-npm.mjs
@@ -0,0 +1,690 @@
+/** Observe pinned npm execution; the Rust supervisor authenticates the sealed result. */
+import crypto from 'node:crypto'
+import fs from 'node:fs'
+import path from 'node:path'
+import { createRequire } from 'node:module'
+import { fileURLToPath } from 'node:url'
+import {
+  actualToolFiles,
+  expectedLifecycleEvents,
+  fileDigest,
+  installedMaterials,
+  installedOrigins,
+  readBounded,
+  sha256,
+  strictJson,
+  validatePreparation,
+} from '../../crates/trusted-server-js/lib/release-composition.mjs'
+
+const require = createRequire(import.meta.url)
+const MAX_JSON = 1024 * 1024
+const MAX_FILE = 32 * 1024 * 1024
+const MAX_TREE = 2 * 1024 * 1024 * 1024
+const HOOKS = new Map([
+  [
+    'core-js@3.48.0:postinstall',
+    'node -e "try{require(\'./postinstall\')}catch(e){}"',
+  ],
+  ['esbuild@0.27.3:postinstall', 'node install.js'],
+])
+const ROOT_HOOKS = [
+  'preinstall',
+  'install',
+  'postinstall',
+  'prepublish',
+  'preprepare',
+  'prepare',
+  'postprepare',
+  'predependencies',
+  'dependencies',
+  'postdependencies',
+]
+const inside = (root, file) =>
+  file === root || file.startsWith(`${root}${path.sep}`)
+const ordered = (left, right) => (left < right ? -1 : left > right ? 1 : 0)
+const fail = () => {
+  throw new Error('Release npm observation rejected')
+}
+
+/** Parse a bounded parent request without accepting commands or hook-policy overrides. */
+export function parseRequest(bytes) {
+  const request = strictJson(bytes)
+  const keys = [
+    'schema_version',
+    'key',
+    'nonce',
+    'source_commit',
+    'repo_root',
+    'cache',
+    'guard_path',
+    'native_esbuild',
+  ]
+  if (
+    !request ||
+    typeof request !== 'object' ||
+    Array.isArray(request) ||
+    Object.keys(request).sort().join(',') !== keys.sort().join(',') ||
+    request.schema_version !== 1 ||
+    !/^[a-f0-9]{64}$/.test(request.key ?? '') ||
+    !/^[a-f0-9]{64}$/.test(request.nonce ?? '') ||
+    !/^[a-f0-9]{40}$/.test(request.source_commit ?? '')
+  )
+    fail()
+  validateNativeExpectation(request.native_esbuild)
+  for (const key of ['repo_root', 'cache', 'guard_path']) {
+    const value = request[key]
+    if (
+      typeof value !== 'string' ||
+      !path.isAbsolute(value) ||
+      /[\\\x00-\x1f\x7f]/.test(value) ||
+      value.split('/').some((part) => part === '.' || part === '..') ||
+      fs.realpathSync(value) !== value
+    )
+      fail()
+  }
+  if (
+    inside(request.repo_root, request.cache) ||
+    inside(request.cache, request.repo_root) ||
+    inside(request.repo_root, request.guard_path) ||
+    inside(request.cache, request.guard_path) ||
+    !fs.lstatSync(request.repo_root).isDirectory() ||
+    !fs.lstatSync(request.cache).isDirectory() ||
+    !fs.lstatSync(request.guard_path).isFile() ||
+    fs.lstatSync(request.guard_path).nlink !== 1
+  )
+    fail()
+  return request
+}
+
+function validateNativeExpectation(native) {
+  if (
+    !native ||
+    typeof native !== 'object' ||
+    Array.isArray(native) ||
+    Object.keys(native).sort().join(',') !== 'lock_path,mode,sha256,size' ||
+    !/^node_modules\/@esbuild\/linux-(?:x64|arm64)$/.test(
+      native.lock_path ?? ''
+    ) ||
+    !/^[a-f0-9]{64}$/.test(native.sha256 ?? '') ||
+    !Number.isSafeInteger(native.size) ||
+    native.size < 1 ||
+    native.size > MAX_FILE ||
+    !Number.isSafeInteger(native.mode) ||
+    native.mode < 0 ||
+    native.mode > 0o777 ||
+    !(native.mode & 0o111)
+  )
+    fail()
+}
+
+/** Detach only esbuild's reviewed native hard-link optimization without changing executable bytes. */
+export function normalizeEsbuildHardlink({ installRoot, native }) {
+  validateNativeExpectation(native)
+  const nativePath = `${native.lock_path}/bin/esbuild`
+  const ownedPath = 'node_modules/esbuild/bin/esbuild'
+  const original = path.join(installRoot, nativePath)
+  const owned = path.join(installRoot, ownedPath)
+  if (
+    fs.realpathSync(original) !== original ||
+    fs.realpathSync(owned) !== owned
+  )
+    fail()
+  const first = fs.lstatSync(original)
+  const second = fs.lstatSync(owned)
+  if (
+    !first.isFile() ||
+    !second.isFile() ||
+    first.size !== native.size ||
+    (first.mode & 0o777) !== native.mode ||
+    fileDigest(original) !== native.sha256
+  )
+    fail()
+  if (first.nlink === 1 && second.nlink === 1) return null
+  if (
+    first.nlink !== 2 ||
+    second.nlink !== 2 ||
+    first.dev !== second.dev ||
+    first.ino !== second.ino ||
+    second.size !== native.size ||
+    (second.mode & 0o777) !== native.mode ||
+    fileDigest(owned) !== native.sha256
+  )
+    fail()
+  const temporary = path.join(
+    path.dirname(owned),
+    `.release-esbuild-${crypto.randomBytes(16).toString('hex')}`
+  )
+  let descriptor
+  try {
+    descriptor = fs.openSync(
+      temporary,
+      fs.constants.O_WRONLY |
+        fs.constants.O_CREAT |
+        fs.constants.O_EXCL |
+        fs.constants.O_NOFOLLOW,
+      0o600
+    )
+    const bytes = readBounded(original, MAX_FILE)
+    const held = fs.lstatSync(original)
+    if (
+      bytes.length !== native.size ||
+      sha256(bytes) !== native.sha256 ||
+      held.dev !== first.dev ||
+      held.ino !== first.ino ||
+      held.nlink !== 2 ||
+      held.size !== first.size ||
+      held.mode !== first.mode ||
+      held.mtimeMs !== first.mtimeMs ||
+      held.ctimeMs !== first.ctimeMs
+    )
+      fail()
+    let offset = 0
+    while (offset < bytes.length) {
+      const written = fs.writeSync(
+        descriptor,
+        bytes,
+        offset,
+        bytes.length - offset
+      )
+      if (!written) fail()
+      offset += written
+    }
+    fs.fchmodSync(descriptor, native.mode)
+    fs.closeSync(descriptor)
+    descriptor = undefined
+    if (
+      fs.lstatSync(owned).ino !== second.ino ||
+      fs.lstatSync(owned).dev !== second.dev
+    )
+      fail()
+    fs.renameSync(temporary, owned)
+    const afterOriginal = fs.lstatSync(original)
+    const afterOwned = fs.lstatSync(owned)
+    if (
+      afterOriginal.nlink !== 1 ||
+      afterOwned.nlink !== 1 ||
+      afterOwned.ino === afterOriginal.ino ||
+      afterOwned.size !== native.size ||
+      (afterOwned.mode & 0o777) !== native.mode ||
+      fileDigest(original) !== native.sha256 ||
+      fileDigest(owned) !== native.sha256
+    )
+      fail()
+    return {
+      kind: 'esbuild-hardlink-copy-v1',
+      path: ownedPath,
+      native_path: nativePath,
+      sha256: native.sha256,
+      size: native.size,
+      mode: native.mode,
+    }
+  } finally {
+    if (descriptor !== undefined) fs.closeSync(descriptor)
+    fs.rmSync(temporary, { force: true })
+  }
+}
+
+/** Measure bounded file facts, rejecting special files, hard links and concurrent mutation. */
+export function snapshotTree(root) {
+  const facts = new Map()
+  let total = 0
+  function visit(directory, depth) {
+    if (depth > 64) fail()
+    for (const name of fs.readdirSync(directory).sort(ordered)) {
+      if (!name || /[\\\x00-\x1f\x7f]/.test(name)) fail()
+      const file = path.join(directory, name)
+      const relative = path.relative(root, file).split(path.sep).join('/')
+      const stat = fs.lstatSync(file)
+      if (facts.size >= 100000) fail()
+      if (stat.isDirectory()) {
+        facts.set(relative, { kind: 'directory' })
+        visit(file, depth + 1)
+      } else if (stat.isFile()) {
+        if (
+          stat.nlink !== 1 ||
+          stat.size > MAX_FILE ||
+          (total += stat.size) > MAX_TREE
+        )
+          fail()
+        const digest = fileDigest(file)
+        const after = fs.lstatSync(file)
+        if (
+          after.dev !== stat.dev ||
+          after.ino !== stat.ino ||
+          after.nlink !== 1 ||
+          after.size !== stat.size ||
+          after.mtimeMs !== stat.mtimeMs ||
+          after.ctimeMs !== stat.ctimeMs ||
+          after.mode !== stat.mode
+        )
+          fail()
+        facts.set(relative, {
+          kind: 'file',
+          size: stat.size,
+          executable: Boolean(stat.mode & 0o111),
+          sha256: digest,
+        })
+      } else if (stat.isSymbolicLink()) {
+        const target = fs.readlinkSync(file)
+        if (
+          path.isAbsolute(target) ||
+          /[\\\x00-\x1f\x7f]/.test(target) ||
+          !inside(root, fs.realpathSync(file))
+        )
+          fail()
+        facts.set(relative, { kind: 'symlink', target })
+      } else fail()
+    }
+  }
+  visit(root, 0)
+  return facts
+}
+
+function changesAfter(before, after, owner) {
+  const paths = [...new Set([...before.keys(), ...after.keys()])].sort(ordered)
+  const changes = []
+  for (const filename of paths) {
+    const first = before.get(filename) ?? null
+    const last = after.get(filename) ?? null
+    if (JSON.stringify(first) === JSON.stringify(last)) continue
+    if (!filename.startsWith(`${owner}/`)) fail()
+    changes.push({ path: filename, before: first, after: last })
+  }
+  return changes
+}
+
+/** Adapt exact pinned npm lifecycle calls before npm loads its dependency graph. */
+export function installLifecycleObserver({
+  npmRoot,
+  installRoot,
+  nodePath,
+  nativeEsbuild,
+}) {
+  if (
+    strictJson(readBounded(path.join(npmRoot, 'package.json'))).version !==
+      '11.19.0' ||
+    process.versions.node !== '24.20.0' ||
+    fs.realpathSync(nodePath) !== fs.realpathSync(process.execPath)
+  )
+    fail()
+  const lock = strictJson(
+    readBounded(path.join(installRoot, 'package-lock.json'))
+  )
+  const manifest = strictJson(
+    readBounded(path.join(installRoot, 'package.json'))
+  )
+  if (
+    lock.lockfileVersion !== 3 ||
+    !lock.packages ||
+    ROOT_HOOKS.some((event) => Object.hasOwn(manifest.scripts ?? {}, event)) ||
+    fs.existsSync(path.join(installRoot, 'binding.gyp'))
+  )
+    fail()
+  const root = path.join(npmRoot, 'node_modules/@npmcli/run-script')
+  const entry = path.join(root, 'lib/run-script.js')
+  const spawnEntry = path.join(root, 'lib/make-spawn-args.js')
+  // Already captured imports would retain an unobserved lifecycle function.
+  if (
+    require.cache[entry] ||
+    require.cache[path.join(root, 'lib/run-script-pkg.js')]
+  )
+    fail()
+  const makeSpawnArgs = require(spawnEntry)
+  const events = []
+  const normalizations = []
+  let active = null
+  let rejected = false
+  require.cache[spawnEntry].exports = (options) => {
+    if (
+      !active ||
+      options.event !== active.event ||
+      options.path !== active.path ||
+      options.cmd !== active.command ||
+      options.args?.length
+    ) {
+      rejected = true
+      fail()
+    }
+    const result = makeSpawnArgs(options)
+    const spawn = result[2]
+    // npm prepends package bins; bind node after that transformation too.
+    for (const key of Object.keys(spawn.env)) {
+      if (/^path$/i.test(key))
+        spawn.env[key] =
+          `${path.dirname(nodePath)}${path.delimiter}${spawn.env[key]}`
+      if (
+        /^(?:NODE_OPTIONS|NODE_PATH|TS_RELEASE_OBSERVER|TS_RELEASE_KEY)/.test(
+          key
+        )
+      )
+        delete spawn.env[key]
+    }
+    // Both reviewed commands start with bare node; resolve that word independently of PATH.
+    result[0] = `'${nodePath.replaceAll("'", "'\\''")}'${active.command.slice(4)}`
+    spawn.stdio = ['ignore', 'inherit', 'inherit']
+    active.spawned = true
+    return result
+  }
+  const original = require(entry)
+  const observed = async (options) => {
+    let row
+    let before
+    try {
+      if (active || !options || typeof options.path !== 'string') fail()
+      const owner = fs.realpathSync(options.path)
+      // npm invokes absent root hooks too. Preserve those real no-op calls, never a root command.
+      if (owner === installRoot) {
+        const current = strictJson(
+          readBounded(path.join(installRoot, 'package.json'))
+        )
+        if (
+          !ROOT_HOOKS.includes(options.event) ||
+          options.cmd !== undefined ||
+          options.args?.length ||
+          ROOT_HOOKS.some((event) =>
+            Object.hasOwn(current.scripts ?? {}, event)
+          ) ||
+          fs.existsSync(path.join(installRoot, 'binding.gyp'))
+        )
+          fail()
+        return await original(options)
+      }
+      const location = path
+        .relative(installRoot, owner)
+        .split(path.sep)
+        .join('/')
+      const locked = lock.packages[location]
+      const pkg = strictJson(readBounded(path.join(owner, 'package.json')))
+      const command = pkg.scripts?.[options.event]
+      const expected = HOOKS.get(`${pkg.name}@${pkg.version}:${options.event}`)
+      const lockName = location
+        .split('/node_modules/')
+        .at(-1)
+        .replace(/^node_modules\//, '')
+      if (
+        !inside(installRoot, owner) ||
+        owner === installRoot ||
+        !locked ||
+        pkg.name !== lockName ||
+        pkg.version !== locked.version ||
+        !expected ||
+        command !== expected ||
+        options.cmd !== undefined ||
+        options.args?.length ||
+        options.pkg?.name !== pkg.name ||
+        options.pkg?.version !== pkg.version ||
+        options.pkg?.scripts?.[options.event] !== command ||
+        events.some(
+          (event) =>
+            event.stage === 'start' &&
+            event.lock_path === location &&
+            event.event === options.event
+        )
+      )
+        fail()
+      before = snapshotTree(installRoot)
+      if (nativeEsbuild && location === 'node_modules/esbuild') {
+        validateNativeExpectation(nativeEsbuild)
+        const native = before.get(`${nativeEsbuild.lock_path}/bin/esbuild`)
+        if (
+          native?.kind !== 'file' ||
+          native.sha256 !== nativeEsbuild.sha256 ||
+          native.size !== nativeEsbuild.size ||
+          native.executable !== true ||
+          lock.packages[nativeEsbuild.lock_path]?.version !== '0.27.3'
+        )
+          fail()
+      }
+      row = {
+        lock_path: location,
+        event: options.event,
+        script_sha256: sha256(command),
+      }
+      events.push({ ...row, stage: 'start', changes: [] })
+      active = { ...row, path: options.path, command, spawned: false }
+      const result = await original(options)
+      if (!active.spawned || result.code !== 0 || result.signal) fail()
+      if (nativeEsbuild && location === 'node_modules/esbuild') {
+        const normalization = normalizeEsbuildHardlink({
+          installRoot,
+          native: nativeEsbuild,
+        })
+        if (normalization) normalizations.push(normalization)
+      }
+      const changes = changesAfter(before, snapshotTree(installRoot), location)
+      events.push({
+        ...row,
+        stage: 'success',
+        exit_code: result.code,
+        signal: null,
+        changes,
+      })
+      return result
+    } catch (error) {
+      rejected = true
+      if (row) {
+        let changes = []
+        try {
+          changes = changesAfter(
+            before,
+            snapshotTree(installRoot),
+            row.lock_path
+          )
+        } catch {
+          /* Failed observations authorize nothing. */
+        }
+        events.push({
+          ...row,
+          stage: 'failure',
+          exit_code: Number.isInteger(error?.code) ? error.code : null,
+          signal: typeof error?.signal === 'string' ? error.signal : null,
+          changes,
+        })
+      }
+      throw error
+    } finally {
+      active = null
+    }
+  }
+  Object.assign(observed, original)
+  require.cache[entry].exports = observed
+  return { events, normalizations, failed: () => rejected || active !== null }
+}
+
+/** Measure preparation using existing collector semantics after actual successful hooks. */
+export function buildPreparation({ repoRoot, observation }) {
+  if (observation.failed()) fail()
+  const installRoot = path.join(repoRoot, 'crates/trusted-server-js/lib')
+  const owners = installedOrigins({
+    repoRoot,
+    lockFile: path.join(installRoot, 'package-lock.json'),
+  })
+  const packages = installedMaterials(owners)
+  const lifecycle = observation.events.filter(
+    (event) => event.stage === 'success'
+  )
+  const expected = expectedLifecycleEvents({ installRoot, packages })
+  if (lifecycle.length !== expected.length) fail()
+  const lifecycle_events = expected.map((event) => {
+    if (
+      !lifecycle.some(
+        (row) =>
+          `npm:${row.lock_path}` === event.package_material_id &&
+          row.event === event.event &&
+          row.script_sha256 === event.script_sha256
+      )
+    )
+      fail()
+    return event
+  })
+  const lifecycle_outputs = lifecycle.flatMap((event) =>
+    event.changes
+      .filter((change) => change.after?.kind === 'file')
+      .map((change) => ({
+        kind: 'lifecycle-output',
+        id: `lifecycle-output:${event.lock_path}:${event.event}:${change.path}`,
+        package_material_id: `npm:${event.lock_path}`,
+        event: event.event,
+        script_sha256: event.script_sha256,
+        path: change.path,
+        size: change.after.size,
+        sha256: change.after.sha256,
+      }))
+  )
+  const measured = actualToolFiles({ installRoot })
+  const distributions = measured.map((tool) => ({
+    material: {
+      kind: 'tool-distribution',
+      id: `tool:${tool.name}`,
+      name: tool.name,
+      version: tool.version,
+      sha256: tool.sha256,
+    },
+    path: tool.path,
+  }))
+  const tools = measured.map((tool) => ({
+    name: tool.name,
+    version: tool.version,
+    role: tool.role,
+    material_id: `tool:${tool.name}`,
+  }))
+  const preparation = {
+    schema_version: 1,
+    packages,
+    distributions,
+    tools,
+    lifecycle_events,
+    lifecycle_outputs,
+  }
+  validatePreparation(preparation, { installRoot, packages })
+  return preparation
+}
+
+/** Seal exact JSON bytes; child output cannot forge a valid result without the parent key. */
+export function sealObservation(value, key) {
+  const bytes = Buffer.from(JSON.stringify(value))
+  if (bytes.length > MAX_JSON || !/^[a-f0-9]{64}$/.test(key)) fail()
+  const signature = crypto
+    .createHmac('sha256', Buffer.from(key, 'hex'))
+    .update(bytes)
+    .digest('hex')
+  return `TS_RELEASE_NPM_OBSERVATION_V1 ${bytes.toString('base64')} ${signature}\n`
+}
+
+function readRequest() {
+  const bytes = Buffer.alloc(MAX_JSON + 1)
+  let count = 0
+  while (count < bytes.length) {
+    const read = fs.readSync(0, bytes, count, bytes.length - count, null)
+    if (!read) break
+    count += read
+  }
+  if (count > MAX_JSON) fail()
+  return parseRequest(bytes.subarray(0, count))
+}
+
+function main() {
+  // Protect the trusted npm process before reading the parent's private key.
+  // The Rust supervisor authenticates and mounts this selected native guard read-only.
+  if (
+    process.platform !== 'linux' ||
+    process.argv.length !== 4 ||
+    process.argv[2] !== '--guard'
+  )
+    fail()
+  const guard = process.argv[3]
+  if (
+    !path.isAbsolute(guard) ||
+    !guard.endsWith('.node') ||
+    fs.realpathSync(guard) !== guard ||
+    /[\\\x00-\x1f\x7f]/.test(guard) ||
+    guard.split('/').some((part) => part === '.' || part === '..') ||
+    require(guard).protected !== true
+  )
+    fail()
+  const request = readRequest()
+  const key = request.key
+  delete request.key
+  if (
+    process.platform !== 'linux' ||
+    request.guard_path !== guard ||
+    process.cwd() !==
+      path.join(request.repo_root, 'crates/trusted-server-js/lib') ||
+    process.env.NODE_OPTIONS !== undefined ||
+    process.env.NODE_PATH !== undefined ||
+    Object.keys(process.env).some((name) => /^npm_config_/i.test(name)) ||
+    fs.existsSync(path.join(process.cwd(), '.npmrc')) ||
+    fs.existsSync(path.join(request.cache, 'release-disabled-global.npmrc')) ||
+    process.env.TRUSTED_SERVER__RELEASE_BUILD !== '1' ||
+    process.env.TRUSTED_SERVER__GIT_VERSION !== request.source_commit
+  )
+    fail()
+  const npmRoot = path.resolve(
+    path.dirname(process.execPath),
+    '../lib/node_modules/npm'
+  )
+  const observation = installLifecycleObserver({
+    npmRoot,
+    installRoot: process.cwd(),
+    nodePath: process.execPath,
+    nativeEsbuild: request.native_esbuild,
+  })
+  process.once('exit', (code) => {
+    let preparation = null
+    let success = code === 0 && !observation.failed()
+    if (success) {
+      try {
+        preparation = buildPreparation({
+          repoRoot: request.repo_root,
+          observation,
+        })
+      } catch {
+        success = false
+      }
+    }
+    const summary = {
+      ...request,
+      success,
+      npm_exit_code: code,
+      events: observation.events,
+      normalizations: observation.normalizations,
+      preparation,
+    }
+    try {
+      fs.writeSync(1, `\n${sealObservation(summary, key)}`)
+    } catch {
+      success = false
+    }
+    if (!success) process.exitCode = 1
+  })
+  process.argv = [
+    process.execPath,
+    path.join(npmRoot, 'bin/npm-cli.js'),
+    'ci',
+    '--offline',
+    '--include=dev',
+    '--no-audit',
+    '--no-fund',
+    '--foreground-scripts',
+    '--ignore-scripts=false',
+    '--userconfig=/dev/null',
+    `--globalconfig=${path.join(request.cache, 'release-disabled-global.npmrc')}`,
+    '--script-shell=/bin/sh',
+    '--progress=false',
+    '--cache',
+    request.cache,
+  ]
+  require(path.join(npmRoot, 'bin/npm-cli.js'))
+}
+
+if (
+  process.argv[1] &&
+  path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)
+) {
+  try {
+    main()
+  } catch {
+    process.stderr.write('Release npm observation rejected\n')
+    process.exitCode = 1
+  }
+}
diff --git a/scripts/release/qualification/2026-10-15-consumer-real-fixtures.md b/scripts/release/qualification/2026-10-15-consumer-real-fixtures.md
new file mode 100644
index 0000000000..31d7d0a09a
--- /dev/null
+++ b/scripts/release/qualification/2026-10-15-consumer-real-fixtures.md
@@ -0,0 +1,150 @@
+# Consumer verifier: measured public-fixture qualification
+
+Measured on 2026-10-15 on native Apple Silicon macOS. This report records
+actual public upstream evidence, rather than fictional examples. No release,
+workflow, repository or deployment was created. Downloaded subject archives
+were never executed. The retained evidence is outside the repository at
+`/private/tmp/ts-real-fixture-qualification` and is temporary local evidence;
+the digests below detect changes but do not authenticate a future download.
+
+## Trust and bootstrap
+
+The independently installed `/opt/homebrew/bin/gh` reported version 2.87.2.
+That existing verifier, rather than the downloaded executable, successfully
+verified the public attestation on `cli/cli`'s
+`gh_2.97.0_macOS_arm64.zip` before its executable was run. The verified
+certificate bound the archive to source/signer commit
+`55dbb4dc6b7edb10b48e3d7fc5bccd32318d1b55`, workflow
+`.github/workflows/deployment.yml`, `refs/heads/trunk`, and run
+`30597407850/attempts/1`. The archive SHA-256 was
+`a58b8fd77b417a38f47a0b54d1370c59b0fcdb324ccc9ca002b0998f7c4c999e`.
+The extracted executable reported exactly 2.97.0. Version output alone was not
+used as authentication. This relies on the pre-existing verifier installation
+as a local trust prerequisite; this work did not independently rebuild or
+qualify that installation's own historical bootstrap.
+
+Primary inputs:
+
+- [Pinned verifier release](https://github.com/cli/cli/releases/tag/v2.97.0).
+- [Bootstrap signing workflow at its verified commit](https://github.com/cli/cli/blob/55dbb4dc6b7edb10b48e3d7fc5bccd32318d1b55/.github/workflows/deployment.yml).
+- [Measured fixture release](https://github.com/d2lang/d2/releases/tag/v0.9.0).
+- [Fixture signing workflow at its verified commit](https://github.com/d2lang/d2/blob/d5a51743b6d5c00f1ec6f8340003f5d5a6ba4eda/.github/workflows/release-archives.yml).
+- [Exact attest 4.2.2 action](https://github.com/actions/attest/tree/1e69f48acb82d1966a394da916b4c1698aa569d6).
+
+The bootstrap release used attest 4.2.0. It was used to authenticate the
+verifier, not to stand in for the required 4.2.2 signing fixture. The D2
+workflow at the verified commit explicitly pins attest 4.2.2 for both
+provenance and SPDX signing.
+
+## Successful measurements
+
+The authenticated gh 2.97.0 verified both provenance and SPDX signatures for
+`d2-v0.9.0-linux-arm64.tar.gz`. Its real certificates reported:
+
+| Field                    | Observed value                                                                         |
+| ------------------------ | -------------------------------------------------------------------------------------- |
+| Issuer                   | `https://token.actions.githubusercontent.com`                                          |
+| SAN and build signer     | `https://github.com/d2lang/d2/.github/workflows/release-archives.yml@refs/tags/v0.9.0` |
+| Source and signer digest | `d5a51743b6d5c00f1ec6f8340003f5d5a6ba4eda`                                             |
+| Source repository ID     | `533087958`                                                                            |
+| Source owner ID          | `242104691`                                                                            |
+| Trigger / runner         | `push` / `github-hosted`                                                               |
+| Invocation               | `https://github.com/d2lang/d2/actions/runs/34165396038/attempts/1`                     |
+
+The actual output was an array of one processing result for each
+`attestation verify` invocation. The real verification media type,
+flattened certificate field names, SLSA v1 provenance fields, and SPDX
+`https://spdx.dev/Document/v2.3` predicate matched the implemented consumer
+contract. The separately downloaded `d2.spdx.json` compared equal as parsed
+JSON to the signed SPDX predicate.
+
+Both bundles were replayed with the production-equivalent explicit issuer,
+SAN, source ref, source digest, signer digest and hosted-runner restriction.
+The process environment was cleared, with only private HOME/config and
+noninteractive settings supplied; no token was present. SPDX verification
+also succeeded under a macOS `sandbox-exec` profile denying `network*`,
+using a local bundle and independently transferred trusted roots. The same
+profile caused a separate curl DNS/network attempt to fail. This is an
+actual consumer offline primitive check, not qualification of producer
+process cleanup or the broader macOS build boundary.
+
+Pinned `gh release verify --format json` also successfully verified the D2
+and CLI public release manifests. Actual output was one processing-result
+object rather than the attestation command's array; the release predicate
+was `https://in-toto.io/attestation/release/v0.2`.
+
+## Retained evidence digests
+
+All digests are SHA-256 of exact retained bytes.
+
+| File                                | Digest                                                             |
+| ----------------------------------- | ------------------------------------------------------------------ |
+| `bootstrap-proof.json`              | `b53f05f983872a6f5f2d9e95d54bf371f86b012a36fc324b80be5eebbf57fc66` |
+| `d2-v0.9.0-linux-arm64.tar.gz`      | `ac2c028697199479acb321db1e3d68caee9f2ba492ed73caa3cd13f3829bf913` |
+| `d2.spdx.json`                      | `efaf407d3142ee52de4f3e90864f3023110dd9f430f8220143d6f3d9de86e689` |
+| `d2.provenance.sigstore.json`       | `d42456c264743abc09194a548e18019e4073eef4040abd182fd1c974616a9259` |
+| `d2.spdx.sigstore.json`             | `26cab9234beaa45c49510924ae7c8aa4cb058a3419aff673eb6c51c33bce3ad3` |
+| `d2-isolated-provenance-proof.json` | `59045bc27b9d7bbf1f6747ca7939aa8ef2c77330e86d2229d7cee9daf3c7e2ca` |
+| `d2-isolated-spdx-proof.json`       | `bf43a603bb1a4f83cdcfeee68ae0b69b3d23e8fb1f46a20d083dafafc4220c8a` |
+| `d2-offline-spdx-proof.json`        | `bf43a603bb1a4f83cdcfeee68ae0b69b3d23e8fb1f46a20d083dafafc4220c8a` |
+| `d2-release-proof.json`             | `a1269c4c7da96bd0e5129b1d95030cf084d91fed2b8a085ad8fdcb633b979deb` |
+| `gh-release-proof.json`             | `dd934980d284943275aa2d9c574fdbcc5e3713e38a616ce49ca0ac682040f07c` |
+| `trusted-root.jsonl`                | `65ca537f6ed8a47fd0e560c421baa1f6c1efb8b25fc200d8c5c02c0e92eb2b9c` |
+
+## Replay commands
+
+First authenticate the pinned archive with the independently installed
+verifier, then extract it. Fetch the D2 archive and standalone SPDX document
+from the release linked above. Use the retained signed bundles, or obtain
+and verify fresh ones from the fixed public repository; a hash here cannot
+replace cryptographic verification.
+
+```sh
+set -eu
+EVIDENCE=/private/tmp/ts-real-fixture-qualification
+PINNED_GH="$EVIDENCE/extracted/gh_2.97.0_macOS_arm64/bin/gh"
+/opt/homebrew/bin/gh attestation verify \
+  "$EVIDENCE/gh_2.97.0_macOS_arm64.zip" -R cli/cli --format json
+/opt/homebrew/bin/gh attestation trusted-root --hostname github.com \
+  > "$EVIDENCE/trusted-root.jsonl"
+
+# Run once per predicate, choosing the corresponding retained bundle.
+PREDICATE=https://spdx.dev/Document/v2.3
+BUNDLE="$EVIDENCE/d2.spdx.sigstore.json"
+env -i HOME="$EVIDENCE/isolated-home" \
+  GH_CONFIG_DIR="$EVIDENCE/isolated-home" GH_PROMPT_DISABLED=1 \
+  /usr/bin/sandbox-exec -p '(version 1)(allow default)(deny network*)' \
+  "$PINNED_GH" attestation verify \
+  "$EVIDENCE/d2-v0.9.0-linux-arm64.tar.gz" --bundle "$BUNDLE" \
+  --custom-trusted-root "$EVIDENCE/trusted-root.jsonl" \
+  -R d2lang/d2 --hostname github.com \
+  --cert-identity https://github.com/d2lang/d2/.github/workflows/release-archives.yml@refs/tags/v0.9.0 \
+  --cert-oidc-issuer https://token.actions.githubusercontent.com \
+  --source-ref refs/tags/v0.9.0 \
+  --source-digest d5a51743b6d5c00f1ec6f8340003f5d5a6ba4eda \
+  --signer-digest d5a51743b6d5c00f1ec6f8340003f5d5a6ba4eda \
+  --deny-self-hosted-runners --predicate-type "$PREDICATE" --format json
+```
+
+For provenance, use `https://slsa.dev/provenance/v1` and
+`d2.provenance.sigstore.json`. Preserve the exact expected source identities;
+never derive acceptance policy from an unverified proof's fields. Runtime
+proofs and bundles remain outside the repository; checked-in compatibility
+fixtures use fictional identities and contain no signatures or trusted proof
+constructors.
+
+## Scope and remaining first-use work
+
+Task 18's real pinned-verifier/signed-public-fixture primitive requirement is
+now measured. Its adversarial bounded-process tests remain the separate
+source-built CLI verification evidence.
+
+Task 19's upstream format uncertainty is resolved for both predicate kinds
+and release-manifest output. The public fixture has a different repository,
+workflow and product graph and cannot satisfy Trusted Server policy. No
+third-party result constructs official project authorization. Full official
+first-use verification remains pending until the producer emits the canonical
+signed index and all required companion assets, from independently approved
+source, and an independently trusted/source-built verifier checks that actual
+release. This report does not enable releases or qualify authenticated
+producer bootstrap, hosted build recipes, or signing workflow execution.
diff --git a/scripts/release/qualification/2026-10-15-js-two-builds.md b/scripts/release/qualification/2026-10-15-js-two-builds.md
new file mode 100644
index 0000000000..6ef9467e9e
--- /dev/null
+++ b/scripts/release/qualification/2026-10-15-js-two-builds.md
@@ -0,0 +1,170 @@
+# Task 7: real original materials and two fresh JS builds
+
+Status: the explicit original-material and Cargo Git tests passed locally on
+native macOS, and the full Linux A/B execution test passed in
+[ordinary PR CI](https://github.com/IABTechLab/trusted-server/actions/runs/38747798078)
+on 2026-10-15. This is candidate execution evidence from an ordinary CI
+runner. It does not qualify release tools, an OCI image, bootstrap, hosted
+release environments or independently approved release source. Production
+selectors remain closed.
+
+## Original-material validation
+
+The explicit native test
+`materials::npm_bundle::tests::actual_current_lock_npm_originals` passed
+locally on native macOS on 2026-10-15 in 283.74 seconds. It is ignored in
+ordinary CI; there, original authentication runs only inside the A/B fixture's
+npm original preparation. It authenticated all 651 locked installation
+locations and 626 distinct compressed originals against the current npm
+lock's SHA-512 identities, freshly extracted every original, reviewed every
+manifest, retained the compressed originals, and rechecked all retained
+archives and extracted trees. Its fictional source binding is a diagnostic
+test input, not independent source approval or acquisition qualification.
+
+The exact npm lock SHA-256 is
+`d5a1b74310b0455531c3133cacf86fa528682cbed91c40412fb3791ccd48c527`.
+An independent local raw-header diagnostic, not retained in the repository,
+inspected 30,723 entries. The largest
+member is the locked optional OpenBSD Rollup binary, 110,275,248 bytes. The
+reviewed member limit is 128 MiB; the compressed-original limit remains
+64 MiB and total decoded limit remains 512 MiB per archive. Extraction and
+rehashing stream bytes and honor cancellation/deadlines.
+
+Actual originals exposed the eight exact-version legacy type-package roots,
+seven node-tar timestamp layouts, and local PAX metadata in `gulp-wrap`
+0.15.0 documented in [JS composition](../js-composition.md). Only redundant
+PAX path/size values matching the next raw regular member are accepted.
+Unknown fields, duplicate keys, malformed framing, overrides, unsupported
+record sequences, links, privileged modes, and hidden name bytes fail.
+The only empty script entries were non-install separator labels in `ignore`;
+empty lifecycle declarations remain rejected. The only actual dependency
+install hooks were the reviewed `core-js` and `esbuild` tuples.
+
+The separate actual-current-Cargo-Git fixture also passed locally; it is
+ignored in ordinary CI. The selected
+closure contained 557 objects and 6,334,558 decoded object-content bytes,
+excluding canonical object headers, with root tree
+`411e16f40511f3f4867349d09784ec68beac022d`. This checks actual Git material
+format and closure validation; it does not qualify Git acquisition, a native
+toolchain, or a Cargo recipe.
+
+## Linux execution acceptance
+
+Orchestration commit: `2edd46ce6`
+(`Build and compare two fresh offline JavaScript installations`); reviewed
+archive layouts: `e2260d457b29b1202a39f8732e78d5d4bd9c323b`; CI runner configuration:
+`cbd96047400099271534f110b5decdcf73b1a5c8`; collector fixture context and
+failure diagnostics: `1a2c46075e18791b623f26ea73af8f833dc5f70b`.
+The [Linux producer job](https://github.com/IABTechLab/trusted-server/actions/runs/38747798078/job/116465922121)
+(`cargo test (release tooling and JS prebuilt, native) (ubuntu-24.04)`)
+selects exactly one ignored full-execution test:
+`preparation::tests::full::real_two_fresh_js_builds`.
+It passed in 687.37 seconds (14:09:47Z to 14:21:15Z) after a two-minute
+optimized test build: `1 passed; 0 failed; 0 ignored; 354 filtered out`.
+Every job in that Run Tests workflow passed, as did the Run Format, CodeQL
+and Integration Tests workflows for the same head.
+
+CI checked out the pull request merge commit
+`15fcd34c64b0f726f42f4f4da5de5af7e3577aa2`, whose parents are `main` at
+`a0b00c72705baf6b0f63c206d7721b68ee03e995` and branch head
+`1a2c46075e18791b623f26ea73af8f833dc5f70b`. The fixture cloned that exact
+checkout. The commit is a CI candidate, not independently approved release
+source. The printed measurement was:
+
+```json
+{
+  "inventory_sha256": "2cdcb1da9c6318ce812cf7fd0b9cc0b1bdc9465c93d68953054db3e361b45042",
+  "kind": "ordinary-ci-two-fresh-js-builds",
+  "module_count": 13,
+  "private_roots_removed": 6,
+  "release_qualification": false,
+  "schema_version": 1,
+  "settings_sha256": "6bce0b31534321c4e36209caf09cad19a0ede1dbe7f6e39254b3f68657a8ea27",
+  "source_commit": "15fcd34c64b0f726f42f4f4da5de5af7e3577aa2",
+  "test_counts": [1275, 1275],
+  "tools_sha256": "4a461321d25eec779752960570ba574bae397102cb3b652b9b70cc24bb6431c6"
+}
+```
+
+Both confined full suites passed all 1,275 registered tests including type
+checks. All 13 final core/integration modules were byte-identical, six private
+roots were removed and retained A bytes were rehashed at handoff. The test
+writes this file only after every stage succeeds, so its presence records the
+actual completed path; the file itself remains a diagnostic printout.
+
+After this run, the fixture gained explicit assertions that each side exposes
+only its own private source, installation and metadata roots, shares only the
+read-only originals and tool roots, and cannot reuse the other side's boundary.
+Isolation was already enforced: exact `matches_roots` checks run before
+execution and each installation, and every command path is translated only
+through its own boundary; the next CI run on
+this branch exercises the new assertions. A unit test also now rejects failed,
+pending and unregistered Vitest report results.
+
+The fixture uses Node 24.12.0, npm 11.6.2, a source-built producer and native
+observer guard, original compressed archives, and an ordinary local Linux
+container image. It creates two independent tracked-source copies with no
+`.git`, installed dependencies, generated bundles or shared writable cache.
+Each side establishes an actual socket-denial proof in its own network/PID
+boundary, seeds its private cache from authenticated originals, performs a
+fresh offline installation with lifecycle observation, captures the original
+collector inventory, exercises missing native tools and the actual esbuild
+download fallback, and runs the full registered suite with release guards
+and type checks. It compares every final core/integration bundle byte for
+byte, closes all six private source/state/metadata roots, then rehashes
+retained A bytes at handoff. No serialized measurement can construct private
+completion authority.
+
+After success the test writes `js-execution-measurement.json` into its
+external fixture root and CI prints it. This records actual source identity,
+A/B test counts, module count, selected tool/settings hashes, original A
+inventory hash and removed-root count. Its `release_qualification` field is
+explicitly false; the file is diagnostic evidence, not an authorization
+input or a canonical release companion.
+
+The full fixture uses test-profile optimization level 2 with debug assertions
+and overflow checks explicitly enabled. Ordinary native tests retain their
+existing debug profile. Cache seeding alone triggers at least 80 complete
+original/tree/tool rechecks across A/B; optimization retains every check.
+Local all-originals runtime fell from 283.74 seconds to 18.18 seconds after
+a 48.44-second optimized compilation. A further run with both safety settings
+explicitly enabled reused the same executable and passed in 17.93 seconds.
+These are local performance measurements, not hosted execution proof.
+
+## Supporting checks and scope
+
+With the new unit test, the local producer suite passed 364 unit tests, four
+boundary integration tests and 13 command tests on macOS. Two explicit
+actual-material tests are ignored by that ordinary run and are exercised
+separately.
+All-target/all-feature producer Clippy, documentation, formatting and staged
+domain lint passed. Independent spec and quality reviews found no remaining
+Task 7 code blocker before the Linux run; that run has since passed.
+
+A separate local, unretained release-mode Vitest JSON run passed all 1,275 tests. Its
+52 report entries cover exactly 51 distinct registered test/type-check files;
+the type-check file appears twice. This confirms the Rust report parser's
+real format/coverage join; it does not substitute for either confined A/B run.
+
+Two earlier full Linux attempts failed for concrete, since-fixed causes. The
+[first](https://github.com/IABTechLab/trusted-server/actions/runs/38736177179/job/116425928695)
+rejected the authentic 110,275,248-byte optional OpenBSD Rollup member under
+the former 64 MiB member limit. The
+[second](https://github.com/IABTechLab/trusted-server/actions/runs/38741529217/job/116444179601),
+unoptimized, reached Vitest and failed one collector negative fixture after
+2,027.48 seconds. That fixture passed parent
+source context to its main call but omitted it from later rejection cases;
+the duplicate-material case consequently failed at Git discovery in a fresh
+source copy without `.git`. A separate local full no-`.git` reproduction confirmed
+exactly that single failure. Copying only the corrected test file into the
+same disposable tree made all 1,275 tests and type checks pass with zero
+failed/pending tests. Every negative call now supplies the same source context,
+preserving its intended semantic assertion. Failed Vitest runs also retain a
+bounded sanitized list of registered failed test names in the process error
+before checked cleanup; raw assertion messages and stacks are excluded.
+
+R-JS allows one shared Linux JS build for later Rust artifact jobs. Task 7
+does not qualify native Rust recipes or macOS lifecycle containment. The
+macOS regression ports passed afterwards on [macOS 15 CI](https://github.com/IABTechLab/trusted-server/actions/runs/38765937295/job/116529009924), including the formerly residual scrubbed process-group escape, which is now killed and rejected. That boundary remains unqualified. Authenticated
+bootstrap, selected hosted environments, actual Cargo recipes and official
+release publication remain separate incomplete gates.
diff --git a/scripts/release/qualification/2026-10-16-confined-cargo-candidate.md b/scripts/release/qualification/2026-10-16-confined-cargo-candidate.md
new file mode 100644
index 0000000000..59c73bb74f
--- /dev/null
+++ b/scripts/release/qualification/2026-10-16-confined-cargo-candidate.md
@@ -0,0 +1,102 @@
+# Task 9: first confined candidate Cargo build
+
+Status: on 2026-10-16 ordinary PR CI built `trusted-server-fastly.wasm` (role A)
+through `PreparedRecipe::execute` inside the Linux Docker denial boundary. It
+also proved that Cargo build scripts, a build-script grandchild and a
+procedural macro inherit network denial. This is candidate execution evidence
+from an ordinary CI runner and records `release_qualification: false`. It does
+not qualify the toolchain, the image, the acquired crates, the vendored Git
+manifests, bootstrap or any hosted release environment. Production tool
+selections remain uninhabited, so production `execute` still returns
+`Unqualified`.
+
+## Run
+
+The job
+[`cargo test (confined release Cargo candidate, Linux)`](https://github.com/IABTechLab/trusted-server/actions/runs/38849941580/job/116808709738)
+checked out the pull request merge commit
+`309b9553657bd74c3e7dea03927284b68756c7e6` (branch head
+`2d933b0e9debed3960f97f2cc3ebb5948da17471` merged into `main` at
+`fa9837f2b95f817f58eadb16c929c38fcb581c9a`). Each step ran exactly one
+selected ignored test, after a guard that the selection matched exactly one
+test.
+
+The fixture acquired 706 registry originals (each checked against its locked
+SHA-256), one Git object store for the locked `edgezero` revision, and eight
+normalized Git manifests from `cargo vendor --offline`. Cargo 1.95.0 wrote no
+`Cargo.toml.orig` for Git packages, so each original manifest was read from
+the Git object database and paired with its normalized form. The acquisition
+was unauthenticated ordinary CI. The tool root was a private single-link copy
+of the host Rust 1.95.0 sysroot with `wasm32-wasip1`; the image was Ubuntu
+24.04 with `gcc` and `libc6-dev`, identified only by its image ID.
+
+## Denial inheritance
+
+`recipe::tests::full::cargo_children_inherit_denial` passed in 25.17 seconds.
+A build script, a build-script grandchild and a procedural macro each
+attempted a loopback connection inside the boundary. All three reported errno
+1 (`EPERM`), matching the boundary's own denial proof, not `ECONNREFUSED`.
+The control crate built a real `denial-control.wasm` (2,013,985 bytes, SHA-256
+`60bd5bc1f0388a50a75dd3a0e87400282fb5c97499fc414a1e8dadd2343d8534`) through
+the same `execute` path.
+
+## JS handoff into the Fastly build
+
+`recipe::tests::full::real_js_handoff_to_fastly_cargo_build` passed in 871.02
+seconds. It first repeated the full two-fresh-installation JS acceptance: both
+sides passed 1,275 tests including type checks, all 13 final modules were
+byte-identical and six private roots were removed. It then bound that
+in-memory JS completion to a third fresh source copy, prepared the vendor
+directory, ran `cargo build --release --frozen
+--message-format=json-render-diagnostics` with umask 022 and four jobs, and
+completed only after the JS handoff, tools and materials rehashed unchanged.
+No Cargo registry or Git cache appeared in the private `CARGO_HOME`. The
+confined build took 130 seconds.
+
+```json
+{
+  "artifact": {
+    "name": "trusted-server-fastly.wasm",
+    "sha256": "6a19dece46c11b40f352a0ac23a124a4f8d6af5742df56845d37a99dc2b713c5",
+    "size": 66885152
+  },
+  "asset": "trusted-server-fastly.wasm",
+  "boundary_fingerprint": "99af57442bb03eeaaa50c320d83dbe5bf8938de97d5eca1c9f62668c17170582",
+  "cargo_lock_sha256": "9d1ce5338f2511e9ae289ceb4e1679a2330cda8c43f205d80b6d01672589e4dc",
+  "derived_manifest_digests": 8,
+  "elapsed_seconds": 130,
+  "js_inventory_sha256": "f3645c7699165920ccc64bfc0f91c43479b01b771cfacf9b9bd4721bcaedf33e",
+  "js_settings_sha256": "5d341e8a8b58a638ddc71b663daa0dbada5d1970175f21391b7750d36ffdef02",
+  "js_tools_sha256": "ba26c9198ef338cf0afc94762d91cfaa3cdbd51987e65dfe0f8905980963da2d",
+  "kind": "ordinary-ci-confined-cargo-build",
+  "materials_digest": "da91ba65a309b9290460a2e3fb5fdf2dd6fee59f39225777264444932bf5ab17",
+  "plan_digest": "a743a63a68cd1ace19f434bae98cf4fc1fafcfe5913e141c5196e7302255afa8",
+  "release_qualification": false,
+  "role": "A",
+  "rust_tools_digest": "0a741d4f4c3b4f9087da3891120b3557925573867341cdf826cb0ce56f883879",
+  "schema_version": 1,
+  "source_commit": "309b9553657bd74c3e7dea03927284b68756c7e6",
+  "stderr_sha256": "ba7154da1ed3e07bfa14e0e6ab0c894684fbe7b4eeccc903262f7e1db0cfca1c",
+  "stdout_sha256": "9fb08fe022a5fccef541d756acc85df5a6480c9987b29275a7cdc86166953efc"
+}
+```
+
+Eight derived manifest digests mark this build unqualified: the normalized
+`edgezero` manifests came from `cargo vendor`, not from a reviewed producer
+normalization.
+
+## Archive policy change
+
+Real registry crates required two narrowly reviewed compatibility encodings,
+for registry originals only: a GNU `././@LongLink` record (regular mode,
+exact join with the next header's 100-byte name, bounded, never consecutive,
+dangling or mixed with PAX) and tar modes that carry the regular or directory
+type bits. npm originals keep the stricter policy. Git packages are vendored
+under their bare name so that intra-workspace relative paths resolve.
+
+## Not covered
+
+Role B and the A/B comparison, the three `ts` executables, path remapping,
+final-byte Viceroy acceptance, producer-owned manifest normalization,
+authenticated acquisition, qualified tool and image pins, and hosted
+qualification remain open under Tasks 8 and 9.
diff --git a/scripts/release/qualification/2026-10-16-fastly-canonical-reproduction-equality.md b/scripts/release/qualification/2026-10-16-fastly-canonical-reproduction-equality.md
new file mode 100644
index 0000000000..afa9c00791
--- /dev/null
+++ b/scripts/release/qualification/2026-10-16-fastly-canonical-reproduction-equality.md
@@ -0,0 +1,60 @@
+# Task 9: Fastly canonical and reproduction builds are byte-identical
+
+Status: on 2026-10-16 ordinary PR CI built `trusted-server-fastly.wasm` twice
+through `PreparedRecipe::execute`, as the canonical build (`Role::Canonical`,
+the spec's Build A) and as the reproduction build (`Role::Reproduction`, Build
+B), from one JS handoff and in separate fresh roots and denial boundaries. The
+final bytes were identical, and a scan of those bytes proved that the path
+remapping took effect. This is candidate evidence from an ordinary CI runner
+and records `release_qualification: false`. The reproduction profile comes from
+a test-only alternate; the production reproduction profile, the toolchain, the
+image, the acquired crates and the `cargo vendor` Git manifests remain
+unqualified.
+
+## Runs
+
+| Run                                                                                                                      | Source (PR merge commit)                   | Final SHA-256                                                      | Size (bytes) | Test duration |
+| ------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------ | ------------------------------------------------------------------ | ------------ | ------------- |
+| [Primary, after the role rename](https://github.com/IABTechLab/trusted-server/actions/runs/38856856376/job/116830159922) | `4243e3a1c16bf1212ab585eecce8592bd5137950` | `a17a77cc5119384d2fb5f74d83cb76cbf264c768e508b8545cf8537db481f178` | 66,833,859   | 1,119.36 s    |
+| [Earlier, before the rename](https://github.com/IABTechLab/trusted-server/actions/runs/38855948935/job/116827324356)     | `373463048c22237ba6e045e7fd0706bb4a104568` | `e5390f47e025f34b70190c944134d6e2b7209e792e8a4ec2d64c65ead594ca4b` | 66,833,943   | 1,064.12 s    |
+
+Each run built both roles from the same commit and matched. The two runs
+differ from each other because the source commit is embedded in the binary.
+The earlier run's measurement still labels the roles `A` and `B`. Test
+durations include the full two-fresh-installation JS acceptance (1,275 tests
+per side, 13 byte-identical modules) that produces the shared JS handoff. Both
+runs also repeated the build-script, grandchild and procedural-macro denial
+test.
+
+## What varied
+
+| Dimension        | Canonical                       | Reproduction                    |
+| ---------------- | ------------------------------- | ------------------------------- |
+| umask            | 022                             | 027                             |
+| Cargo jobs       | 4                               | 2                               |
+| Host checkout    | separate fresh temporary copy   | separate fresh temporary copy   |
+| Start time       | recorded per run                | recorded per run                |
+| Locale, timezone | normalized to `C`, `UTC`        | normalized to `C`, `UTC`        |
+| Execution user   | same CI user (unsupported here) | same CI user (unsupported here) |
+
+In the primary run the confined builds took 137 and 171 seconds. Inside the
+Linux container both roles see every root at the same `/boundary/<kind>/<index>`
+path, so the checkout-root difference is a host-only variation there.
+
+## Remapping proof
+
+The build remaps the checkout, vendor tree, Cargo home, Rust tool root and
+target directory to fixed prefixes through one quoted
+`--config target."<triple>".rustflags` entry, which Cargo appends to tracked
+target rustflags. Because container paths match across roles on Linux, byte
+equality alone would not prove the remapping. The test therefore scanned the
+compared final bytes: they contained none of `/boundary/`, the host build
+roots, the fixture root or `RUNNER_TEMP`, and they did contain the remapped
+`/trusted-server` and `/cargo-vendor` prefixes.
+
+## Not covered
+
+The three `ts` executables, Viceroy final-byte acceptance, producer-owned Git
+manifest normalization, the production reproduction profile, authenticated
+acquisition, qualified tool and image pins, and hosted qualification remain
+open under Tasks 8 and 9.
diff --git a/scripts/release/qualification/2026-10-16-fastly-runtime-gate.md b/scripts/release/qualification/2026-10-16-fastly-runtime-gate.md
new file mode 100644
index 0000000000..a9fe68a6aa
--- /dev/null
+++ b/scripts/release/qualification/2026-10-16-fastly-runtime-gate.md
@@ -0,0 +1,60 @@
+# Task 9: Fastly final-byte runtime gate
+
+Status: on 2026-10-16 ordinary PR CI ran the Fastly final-byte gate on both
+the canonical and the reproduction `trusted-server-fastly.wasm` outputs, and
+both were accepted. The same run rejected a closed-origin control as a
+health-only success. This is candidate evidence from an ordinary CI runner and
+records `release_qualification: false`. Viceroy is pinned by version text and
+recorded by digest, not by an independently reviewed digest; that pin, the
+toolchain, the image and the acquired inputs remain unqualified.
+
+## Run
+
+The job
+[`cargo test (confined release Cargo candidate, Linux)`](https://github.com/IABTechLab/trusted-server/actions/runs/38875569290/job/116889681434)
+checked out the pull request merge commit
+`ab6cba207192969c55547876f9adf7d625a64ea1` (branch head
+`4cc5700e834c3238f99a81b3a567edb634fecfe1`). The ignored test
+`recipe::tests::full::fastly_canonical_and_reproduction_builds_are_byte_identical`
+passed in 1,113.82 seconds. It built both roles from one JS handoff (confined
+builds of 132 and 166 seconds), found them byte-identical (66,833,956 bytes,
+SHA-256 `0c21ec136d2ffabf2d3440142d741e96b2aef18d5a52c82d4cfc8022dc0866c9`),
+then ran the gate on each output without rebuilding. The denial-inheritance
+test passed again in the same job.
+
+## What the gate checks
+
+1. The exact final bytes are re-read against the recorded size and digest and
+   fully validated as a core Wasm command with the pinned wasmparser: no
+   component, only Fastly import modules, a no-argument `_start`, an exported
+   memory, the HTTP request and response modules, and debug sections.
+2. The verified bytes are copied read-only into a private directory and served
+   by the explicitly selected Viceroy, whose `--version` output must be exactly
+   `viceroy 0.17.0` and whose binary is rehashed around every use. Unknown
+   imports fail to link. The configuration comes from the integration
+   harness's fixtures, which must match the built source.
+3. `/health` only gates readiness. Acceptance requires a 200 HTML publisher
+   page that carries this run's unique origin marker once and exactly one
+   injected tsjs script, an origin request observed by the gate's loopback
+   origin, no guest failure in Viceroy's output, and a stop initiated by the
+   gate. The artifact rehashes unchanged afterwards. Responses are parsed
+   strictly over loopback only.
+
+## Results
+
+| Output       | Health | Publisher | Injected script                                                                                       | Origin request   | Viceroy stderr | Startup |
+| ------------ | ------ | --------- | ----------------------------------------------------------------------------------------------------- | ---------------- | -------------- | ------- |
+| Canonical    | 200    | 200       | `/static/tsjs=tsjs-unified.min.js?v=662e376b054ac1fccc82a9c8f0d2a086bfa11541343cb0af8c046ef09ac5aa75` | `GET / HTTP/1.1` | empty          | 4.26 s  |
+| Reproduction | 200    | 200       | same                                                                                                  | `GET / HTTP/1.1` | empty          | 4.26 s  |
+
+Viceroy 0.17.0 binary SHA-256:
+`05da4843fd8ae870409211e9fbc168aafbb1609445fbd0eefa3902e5a151cce1`. The
+closed-origin control was rejected with "publisher page status is not 200" and
+tagged as a health-only success.
+
+## Not covered
+
+The three `ts` executables, producer-owned Git manifest normalization, the
+production reproduction profile, an independently reviewed Viceroy digest,
+authenticated acquisition, qualified pins and hosted qualification remain open
+under Tasks 8 and 9. Live deployment is separate.
diff --git a/scripts/release/qualification/2026-10-16-linux-cli-candidate.md b/scripts/release/qualification/2026-10-16-linux-cli-candidate.md
new file mode 100644
index 0000000000..ae9b265d3c
--- /dev/null
+++ b/scripts/release/qualification/2026-10-16-linux-cli-candidate.md
@@ -0,0 +1,153 @@
+# Task 9: Linux CLI candidate builds, inspects and starts cleanly
+
+Status: ordinary PR CI passed the Linux `ts` candidate recipe on 2026-10-16.
+The canonical and reproduction builds produced byte-identical executables.
+The exact accepted canonical bytes passed final-path and ELF inspection and
+started outside the checkout in all three reviewed Linux images. This is
+candidate evidence with `release_qualification: false`; it does not qualify
+production tools, image pins, acquisition or release enablement.
+
+## Subsequent reproduction scheduling
+
+This report retains its original equality observation. `3e3e30996` later
+defers optional native reproduction on ordinary push/PR runs, measuring it on
+scheduled/dispatched or appropriately labelled PR runs instead. Canonical
+build/inspection/startup remain required. The [dated schedule report](2026-10-21-native-reproduction-schedule.md)
+records the triggers, cache limits and subsequent 45-minute ordinary-CI per-build
+wall. Future equality results must cite the measured run/job and built source;
+a deferred run does not repeat this report's equality proof.
+
+## Run and artifact
+
+- [Successful candidate job](https://github.com/IABTechLab/trusted-server/actions/runs/38921701566/job/117042987142).
+- Branch head: `0299c3a17812ce78def6b8df479f091a27120ce8`.
+- Built source (PR merge commit): `4a6404b072a3bc4bd36a12b33e4201c5f5797522`.
+- Asset: `ts-x86_64-unknown-linux-gnu`, variant `default`, package `0.1.0`.
+- SHA-256, both builds: `a3a64d15ee1663ff747a21e0edc089703183a0a8685740ec65592d9fdd3a34b1`.
+- Size, both builds: 285,604,680 bytes.
+- Complete candidate test: 1,352.55 seconds; canonical Cargo execution: 293 seconds.
+- Lock SHA-256: `c37beb7694512de99ac99c8ac214fa01f56f32226810e814e7cc26a717c8eedd`.
+- Shared JS inventory SHA-256: `b0632a21ad06c0bec46be365aba30b62f89e8153a33e5517ce4109eca30793eb`.
+
+The job logs retain `linux-cli-candidate-measurement.json` and
+`builder-filesystem-controls.json`, including tool/material/plan digests,
+image IDs, debug-section sizes, startup output and reproduction comparison.
+The source commit above, rather than the later documentation commit, is the
+identity embedded in and measured for this executable.
+
+## Actual build and boundary
+
+The producer/probe itself was rebuilt inside the GNU baseline from the
+tracked source and copied pinned Rust toolchain using cached offline Cargo
+inputs. Both CLI roles then used `PreparedRecipe::execute` in the selected
+UBI builder with glibc 2.34. The candidate acquired inputs through ordinary
+unauthenticated CI preparation, including eight producer-normalized Git
+package manifests and zero caller-derived manifests.
+
+Builder base: `registry.access.redhat.com/ubi9/ubi:9.6`.
+Observed builder ID:
+`sha256:c92872ae3dc77cff493a6d50ba5835961c03ba7f50aac94b5c3e643ddc8e7e71`.
+The immutable image configuration was checked for absent/empty declared
+volumes. Cargo, compiler and build children ran under the established
+socket-denial boundary with no network and a read-only container root.
+
+Actual filesystem controls exited zero after observing:
+
+| Location                                          | Observed control                                         |
+| ------------------------------------------------- | -------------------------------------------------------- |
+| `/tmp`                                            | Write denied: read-only filesystem                       |
+| `/dev/shm`                                        | Write denied: directory absent with IPC disabled         |
+| `/dev`                                            | Write denied: permission denied                          |
+| `/etc/hosts`, `/etc/hostname`, `/etc/resolv.conf` | Append-open denied: permission denied                    |
+| Bound `TMPDIR`                                    | Write, read and removal succeeded; no test file remained |
+
+These checks precede the real fresh JS and native builds. Global `/tmp` is
+not writable scratch storage. The JS containment test uses a real symlink
+between owned sibling directories relative to its configured source root;
+it no longer clears the supplied `TMPDIR` to reach global temporary storage.
+
+The separate real timeout regression passed in 5.05 seconds. It starts only
+after Docker acknowledges a full container ID, times out an attached child,
+and verifies removal of that owned container. Build and startup cleanup use
+the same acknowledged-create lifecycle; a failed/unresolved creation remains
+fatal rather than being cleared by an early absence check.
+
+## Final bytes and startup
+
+Inspection of the copied final executable found:
+
+| Check                          | Measured result                                                                 |
+| ------------------------------ | ------------------------------------------------------------------------------- |
+| Architecture                   | x86-64 ELF                                                                      |
+| Interpreter                    | `/lib64/ld-linux-x86-64.so.2`                                                   |
+| Highest required GLIBC version | `2.34` across 27 version requirements                                           |
+| Needed libraries               | `libgcc_s.so.1`, `libm.so.6`, `libc.so.6`, `ld-linux-x86-64.so.2`               |
+| `.debug_info`                  | 87,973,465 file-backed bytes                                                    |
+| `.debug_line`                  | 33,681,096 file-backed bytes                                                    |
+| Remapped prefixes retained     | `/trusted-server`, `/cargo-vendor`, `/cargo-target`                             |
+| Build paths                    | No bound host/execution roots, `/boundary/`, fixture roots or `RUNNER_TEMP`     |
+| Operator values                | Three planted fictional variables removed by preflight; zero final-byte matches |
+
+Bound-root rejection and remap evidence are mandatory inside recipe
+completion, before an accepted artifact can be returned. The candidate also
+scans fixture/runner roots. The GNU-only generic `/tmp/` policy permits the
+measured Chromiumoxide runtime Chrome lookup constant `/tmp/aws/lib`; it does
+not permit the actual build roots. The closed scratch-storage controls above
+support that distinction. macOS retains its separate temporary-path policy.
+
+The accepted executable was copied read-only, hashed before and after each
+startup, and executed as `ts --version` without a checkout or operator config.
+All starts exited zero with empty stderr and identical expected output:
+
+```text
+ts package=0.1.0 source=4a6404b072a3bc4bd36a12b33e4201c5f5797522 target=x86_64-unknown-linux-gnu variant=default
+```
+
+| Startup image                                     | Observed local image ID                                                   |
+| ------------------------------------------------- | ------------------------------------------------------------------------- |
+| `registry.access.redhat.com/ubi9/ubi-minimal:9.6` | `sha256:a2c5a85865a585c3bc8b10f6c269358fdf89fe32be4232885166889d85c76421` |
+| `docker.io/library/ubuntu:22.04`                  | `sha256:e8df6c74f650ad385efe2e20103eca9b0ad50690fb3c63d49fa00762412bbf55` |
+| `docker.io/library/debian:12`                     | `sha256:94926f0fd968cd68ac486502185a5dd78687874a9ec7727f64fe2af696e28311` |
+
+These are observed IDs from ordinary CI tag acquisition, not authenticated
+production digest selections. Startup uses a non-root user, no network,
+read-only mounts/root, dropped capabilities and bounded execution/cleanup.
+This exercises executable loading and version reporting, not every CLI
+command or a browser installation.
+
+## Reproduction and regression coverage
+
+The reproduction used separate fresh checkout, vendor, Cargo-state, target
+and output roots from the shared JS handoff. The checked pairing required
+identical source, lock, tools, material closure and JS inputs, with the
+supported ambient differences recorded honestly: canonical umask 022/jobs 4
+versus reproduction umask 027/jobs 2, distinct host roots and start times.
+Container paths remain fixed; locale/timezone are normalized and execution
+user variation is unsupported here. Final-byte path inspection supplies
+evidence beyond equality under those fixed container paths.
+
+The measured native result was `identical`, with no differing offset/section.
+Native reproduction remains a measurement, rather than a release equality
+gate; this successful pair does not qualify a general reproducibility claim.
+
+The [Linux release-tooling job](https://github.com/IABTechLab/trusted-server/actions/runs/38921701566/job/117042986647)
+also passed its actual two-fresh-installation JS proof in 702.81 seconds:
+1,275 tests per side, 13 matching bundles and six private roots removed. Its
+registered native producer tests passed; prebuilt-JS tests recorded 37 passed
+and one ignored. The [companion Fastly job](https://github.com/IABTechLab/trusted-server/actions/runs/38921701566/job/117042986628)
+passed Cargo build-script, grandchild and procedural-macro
+network-denial attempts, including a successfully compiled control retaining
+an actual compiler-remapped source filename. It also passed complete Fastly
+canonical/reproduction equality and both final-byte Viceroy acceptance gates.
+Tests, formatting, integration tests and CodeQL all passed on branch head
+`0299c3a17812ce78def6b8df479f091a27120ce8`; this report is a later
+documentation-only update.
+
+## Remaining scope
+
+Task 9 and milestone M4 remain open. The two Apple CLI recipes and native
+startup acceptance, qualified production ambient profiles, independently
+authenticated acquisition/tool/image selections, Task 8 hosted qualification
+and subsequent executable composition/evidence work are still required.
+Production wrappers and qualified selection remain closed. This candidate
+does not sign, publish, deploy or enable an official release.
diff --git a/scripts/release/qualification/2026-10-16-producer-normalized-manifests.md b/scripts/release/qualification/2026-10-16-producer-normalized-manifests.md
new file mode 100644
index 0000000000..36644f90d6
--- /dev/null
+++ b/scripts/release/qualification/2026-10-16-producer-normalized-manifests.md
@@ -0,0 +1,49 @@
+# Task 9: producer-normalized Git manifests
+
+Status: on 2026-10-16 ordinary PR CI built the Fastly canonical and
+reproduction outputs using Git package manifests that the producer normalized
+itself from the verified Git tree, instead of manifests supplied by
+`cargo vendor`. Both builds report zero caller-derived manifests. This is
+candidate evidence from an ordinary CI runner and records
+`release_qualification: false`; the toolchain, image, acquisition and the
+production reproduction profile remain unqualified.
+
+## Run
+
+The job
+[`cargo test (confined release Cargo candidate, Linux)`](https://github.com/IABTechLab/trusted-server/actions/runs/38884296635/job/116918199285)
+checked out the pull request merge commit
+`5e2c68a5e30c6b4da7fa8ae83faf30c96c9511f3` for branch head
+`bf3057d60f99a92693c0836305129ba68962afd5`. The
+ignored test
+`recipe::tests::full::fastly_canonical_and_reproduction_builds_are_byte_identical`
+passed in 1,103.54 seconds and the denial-inheritance test passed again.
+
+## Results
+
+- The producer resolved workspace inheritance for all eight locked `edgezero`
+  packages: package fields, workspace dependencies with merged features and
+  relocated paths, and workspace lints. The originals are kept as
+  `Cargo.toml.orig`.
+- Before each build, an evidence-only differential compared every producer
+  manifest with the one `cargo vendor` writes, on package identity, `links`,
+  features, every dependency's source, version, rename, optionality, default
+  features and features, and the build-script and procedural-macro settings:
+  8 compared, 0 differing, for both roles.
+- Each build recorded 8 producer-normalized manifest digests and 0
+  caller-derived manifest digests, so no build is marked unqualified for its
+  manifests.
+- The canonical (133 s) and reproduction (166 s) builds were byte-identical:
+  66,833,914 bytes, SHA-256
+  `8df10dfc2373dbec38fe5a21bdf6153dbb49bec51368034c475350c223368d88`.
+- The Viceroy final-byte gate accepted both outputs and rejected the
+  closed-origin control as a health-only success.
+
+`cargo vendor` now supplies only comparison fixtures; nothing it writes is
+trusted by the build.
+
+## Not covered
+
+The three `ts` executables, the production reproduction profile, an
+independently reviewed Viceroy digest, authenticated acquisition, qualified
+pins and hosted qualification remain open under Tasks 8 and 9.
diff --git a/scripts/release/qualification/2026-10-19-apple-sdk-inputs.md b/scripts/release/qualification/2026-10-19-apple-sdk-inputs.md
new file mode 100644
index 0000000000..dc389cf374
--- /dev/null
+++ b/scripts/release/qualification/2026-10-19-apple-sdk-inputs.md
@@ -0,0 +1,98 @@
+# Apple SDK input audit
+
+Status: local candidate-input investigation, not hosted qualification or
+authenticated vendor acquisition.
+
+The selected local Xcode 16.4 installation exposes macOS SDK 15.5. An
+independent read-only traversal confirmed the following layout on 2026-10-19:
+
+| Observation                          | Count       |
+| ------------------------------------ | ----------- |
+| Entries below the selected SDK root  | 46,233      |
+| Directories                          | 8,781       |
+| Regular files                        | 30,727      |
+| Regular-file bytes across all paths  | 656,877,420 |
+| Largest regular file, bytes          | 8,899,657   |
+| Relative internal symlinks           | 6,725       |
+| Regular files with multiple links    | 8,605       |
+| Special files                        | 0           |
+| Absolute, dangling or escaping links | 0           |
+
+These observations describe this installation only. They do not establish
+either hosted runner's SDK layout, original distribution integrity or
+release qualification.
+
+## Selection consequence
+
+The existing owned tool-tree policy rejects multiply linked regular files.
+The installed SDK therefore cannot pass that policy directly. Hardlinked
+headers are part of the input set; excluding documentation cannot solve the
+problem. Hashing the original SDK before and after execution would also
+leave an alias outside the selected tree able to modify its content.
+
+The selected implementation preserves the existing owned-tree policy:
+
+1. Copy the selected SDK into a fresh owned directory, reading vendor files
+   through held descriptors and creating independent destination files.
+2. Preserve permission bits and relative internal symlinks. Reject special
+   files, unsafe aliases and exceeded bounds; do not preserve hardlinks or
+   silently omit inputs.
+3. Validate the detached tree with the existing 512 MiB per-file, 2 GiB
+   total-byte and 100,000-entry limits.
+4. Bind its content digest and lifetime to the selected Apple tools, select
+   that exact SDK in the recipe, grant it a read-only boundary root and
+   remap its temporary path to a fixed prefix.
+5. Recheck it through the existing tool-verification hooks, using the
+   caller's deadline and cancellation. Record the tree digest as structured
+   installed-content evidence, not a raw archive checksum.
+
+This closes selected SDK-content coverage only when the implementation and
+its actual native ARM/Intel recipe executions pass. Compiler resources,
+helper executables, toolchain libraries such as libLTO, operating-system
+inputs, authenticated acquisition and full native/tool closure remain
+separate requirements. Overall composition coverage must remain incomplete.
+
+## Local detached-copy smoke
+
+The real installed-SDK smoke passed in 168.94 seconds. It copied and
+measured all 46,233 entries and 656,877,420 regular-file bytes, reverified the
+selected copy while retaining a cloned tool selection, and confirmed that
+the copy disappeared after the last owner was dropped. The observed
+structured-tree SHA-256 is
+`72007de53280923111d03a4b0277e2d3cc986ec9594cfcc3c9807f2e97d02fc8`.
+This is installed-tree evidence, not a distribution checksum or approved
+production pin.
+
+The local machine lacks the selection symlink used by the CI constructor,
+so this ignored smoke test used an explicit canonical developer directory
+and the same private measurement/staging implementation. CI still requires
+its selection symlink; no fallback or qualified constructor was added.
+
+Pure regressions cover modified headers/stubs/frameworks, unsafe aliases,
+hardlinks in the destination, exhausted bounds, cancellation, stable
+path-independent identities, final-byte path leaks and cleanup of restrictive
+directory modes on error and final-clone drop. A review finding caught the
+read-only-directory cleanup leak before the full smoke; its regression was
+observed failing before the cleanup guard was added.
+
+## Hosted native recipe follow-up — 2026-10-20
+
+[Run 39290139247](https://github.com/IABTechLab/trusted-server/actions/runs/39290139247)
+finalized success for head `df4a6e5c30fe8c93df68748ead77a3bc559d16b2`.
+Its actual merge source was `506d8ead69757556e1bd8ed29b578d0257d05169`.
+Both Apple candidate recipes compiled, inspected and started their canonical
+CLI artifacts using detached `/apple-sdk`, Xcode 16.4 and SDK 15.5.0.
+Both emitted the same installed SDK tree identity:
+`1482e88484d3ab4b430306607ed07113068eadd7581b232dedb20ea80842bce0`,
+46,233 entries and 656,877,420 regular-file bytes. Their SDK-settings file
+SHA-256 was `58a133735f0a55a624a1703067059f6e78925e51725ec6e1f966072e142c9c42`.
+This hosted tree digest differs from the local smoke's installed tree;
+neither is an authenticated distribution identity or production pin.
+
+ARM's second build was byte-identical. Intel's canonical artifact and
+retained receipt exports passed; its optional second build failed on its
+time bound. No Intel reproducibility result is inferred from the green job.
+The successful fixtures additionally joined verified Rust packages through
+the typed SPDX projection and checked retained export integrity after
+dropping the original build storage. Complete native/tool coverage and
+release qualification remain false.
diff --git a/scripts/release/qualification/2026-10-20-apple-cli-candidates.md b/scripts/release/qualification/2026-10-20-apple-cli-candidates.md
new file mode 100644
index 0000000000..b528625959
--- /dev/null
+++ b/scripts/release/qualification/2026-10-20-apple-cli-candidates.md
@@ -0,0 +1,157 @@
+# Task 9: Apple CLI candidates build, inspect and start on native macOS runners
+
+Status: ordinary PR CI built both Apple `ts` candidate recipes on native macOS
+15 runners and started each canonical executable. Two earlier runs
+(2026-10-19) and two later runs (2026-10-20) are recorded below. Every record
+carries `release_qualification: false`. This is candidate evidence only: it
+does not qualify production tools, the Xcode/SDK selection, acquisition or
+release enablement, and macOS 15 qualification (Task 8) remains open.
+
+## Runs and jobs
+
+All four runs were `Run Tests` workflows on branch `spec/1235-release-attestation`
+and concluded `success`. The Intel optional reproduction is a bounded
+measurement; its failure does not fail the job (see below).
+
+| Run                                                                                  | Branch head                                | Built source (PR merge commit)             | ARM job                                                                                                | Intel job                                                                                              |
+| ------------------------------------------------------------------------------------ | ------------------------------------------ | ------------------------------------------ | ------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------ |
+| [39273777887](https://github.com/IABTechLab/trusted-server/actions/runs/39273777887) | `d8fdb265748181f3d419b7902b3b0590a67c2ad9` | `cace4c508159bc7502d359e0cce49fef47d61f8b` | [118142122193](https://github.com/IABTechLab/trusted-server/actions/runs/39273777887/job/118142122193) | [118142122336](https://github.com/IABTechLab/trusted-server/actions/runs/39273777887/job/118142122336) |
+| [39290139247](https://github.com/IABTechLab/trusted-server/actions/runs/39290139247) | `df4a6e5c30fe8c93df68748ead77a3bc559d16b2` | `506d8ead69757556e1bd8ed29b578d0257d05169` | [118196413038](https://github.com/IABTechLab/trusted-server/actions/runs/39290139247/job/118196413038) | [118196413106](https://github.com/IABTechLab/trusted-server/actions/runs/39290139247/job/118196413106) |
+| [39417433680](https://github.com/IABTechLab/trusted-server/actions/runs/39417433680) | `bfab8ef2009fa6f28b1258135e2445ee22775dc8` | `b05bd8a18f137b43f7542c797f0a5d7856363d23` | [118617017385](https://github.com/IABTechLab/trusted-server/actions/runs/39417433680/job/118617017385) | [118617017568](https://github.com/IABTechLab/trusted-server/actions/runs/39417433680/job/118617017568) |
+| [39420011152](https://github.com/IABTechLab/trusted-server/actions/runs/39420011152) | `1719cf15fd58fcf029f6b4ae5003215802bef405` | `b2273db76b8a2070f3c0d20d22788eed434d0029` | [118625917697](https://github.com/IABTechLab/trusted-server/actions/runs/39420011152/job/118625917697) | [118625917703](https://github.com/IABTechLab/trusted-server/actions/runs/39420011152/job/118625917703) |
+
+The job logs retain `macos-cli-candidate-measurement.json` (printed by the
+workflow step) and the Cargo denial measurement for each host. The source
+commit embedded in and measured for each executable is the merge commit above,
+which is why digests differ between runs even though the build is
+deterministic for a given source.
+
+## Hosts and tools
+
+Both hosts reported macOS product version 15.7.9 (ARM: `aarch64`,
+`hw_optional_arm64: 1`, `proc_translated: 0`; Intel: `x86_64`). The selected
+developer tools were Xcode 16.4 with SDK 15.5.0 and the boundary was
+`macos-sandbox-exec`.
+
+| Measurement                           | Value                                                                                                                                            |
+| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `clang` SHA-256 (ARM and Intel)       | `4c458256bcdf913774de1bb4a37768244d3b41f32ad55afb2dfec3432f46f4fe`                                                                               |
+| ARM `ar` SHA-256                      | `f362372395c1dd8ef349b6ceaad3b7958f1207a32e95d285721eba4c84ca55ae`                                                                               |
+| ARM `ld` SHA-256                      | `648a8aac7f6f829a42305d24dddd7a3cfa48ee0bd9d4e7ec1ded5c51edea372b`                                                                               |
+| SDK settings SHA-256                  | `58a133735f0a55a624a1703067059f6e78925e51725ec6e1f966072e142c9c42`                                                                               |
+| SDK tree, runs 39290139247 and later  | 46,233 entries, 656,877,420 regular bytes, tree SHA-256 `1482e88484d3ab4b430306607ed07113068eadd7581b232dedb20ea80842bce0` on both ARM and Intel |
+| SDK tree, run 39273777887             | ARM `e26d617a1870b3ecaf9bb0245da20662b0b8b6b66042ae15b2023a5fda37403f`, Intel `147b1549c1c3e34ca34a36ece451d474edb67e4a5343e8bf9f814b465bead527` |
+| Native Cargo denial, control size/ARM | `denial-control-aarch64-apple-darwin`, 465,928 bytes, SHA-256 `c80e84f01196e51d420a0dffa0a4472db19ac956d51c67e0f66b104280abb8a8`                 |
+| Native Cargo denial, control size/x86 | 451,072 bytes, SHA-256 `dadab281f3a2ec0542933a5b32ed4b0bb11a3d9add2d3499be477a1e47dff61d`                                                        |
+
+Run 39273777887 predates `df4a6e5c3` (detached SDK contents), so its SDK tree
+digests differ between the two hosts. Runs from `df4a6e5c3` onward recorded
+the same detached-tree digest on both. The Intel `clang` digest equals the ARM one in runs 39290139247 and
+39417433680; other Intel tool digests are retained in the logs.
+
+Each host also passed the real native Cargo denial test
+(`full_macos::cargo_children_inherit_denial_macos`): build-direct,
+build-grandchild and procedural-macro attempts each failed with `errno` 1
+(`proof_errno` 1) under the boundary. The measurement reports
+`descendant_cleanup: "post-run-reaped"`: after each run the sandbox instance's
+processes are found, killed and the run is rejected if any survived. That is
+weaker than a container owning its descendants, and only the `cfg(test)`
+ordinary-CI tool selection accepts it (approved 2026-10-19). A qualified or
+production selection still rejects the macOS boundary at the execute gate.
+
+## Executables and Mach-O facts
+
+Canonical builds used the same observed package, unit and build-script
+counts in every run for a given host: ARM 486 packages, 649 units and 62
+build-script executions; Intel 487, 650 and 62. `material_native_coverage_complete`
+stayed `false`.
+
+| Run         | Host  | Asset                     | SHA-256                                                            | Size (bytes) | Canonical build (s) |
+| ----------- | ----- | ------------------------- | ------------------------------------------------------------------ | ------------ | ------------------- |
+| 39273777887 | ARM   | `ts-aarch64-apple-darwin` | `65c68e611e3803cc9b80a0a48c218f629f3fa5752d787276a2b385a2f01874b9` | 43,260,288   | 663                 |
+| 39273777887 | Intel | `ts-x86_64-apple-darwin`  | `c9da6682c713ecf597e5c85a2c01992af26294493b6249c6a9bb4a6fa5c6f54f` | 46,114,496   | 1,101               |
+| 39290139247 | ARM   | `ts-aarch64-apple-darwin` | `071ba0375ade6195552efaf363a384c8dd8684a9cfd8033c8c207a2b34def59d` | 43,260,288   | 560                 |
+| 39290139247 | Intel | `ts-x86_64-apple-darwin`  | `3bfa14727f66915b76e95ce5445d5e19b68d11be78ba8caf69be6c1e3011ac42` | 46,114,496   | 1,140               |
+| 39417433680 | ARM   | `ts-aarch64-apple-darwin` | `923e5f7bddbfdb67596e45cdfe3adfcd5aaab353af94fb4f697d05ab4a32cd45` | 43,260,288   | 612                 |
+| 39417433680 | Intel | `ts-x86_64-apple-darwin`  | `b892eb2a08c66c6ccbf945224a5e42ca1e59388ed0ae8b48d203c0a3c40ec367` | 46,114,496   | 879                 |
+| 39420011152 | ARM   | `ts-aarch64-apple-darwin` | `1c28da620cb7654c5b376a7e09eff889fabc62cdc6e100a12b2c4d913c17e187` | 43,260,288   | 602                 |
+| 39420011152 | Intel | `ts-x86_64-apple-darwin`  | `1fdceeae363ed7afe97f28056170240194eebcf1f3b216f7880add0d0fdf744d` | 46,114,496   | 914                 |
+
+Mach-O inspection of the accepted canonical executable (identical across runs
+except where noted):
+
+| Check                  | ARM                                                                             | Intel      |
+| ---------------------- | ------------------------------------------------------------------------------- | ---------- |
+| CPU                    | `arm64`                                                                         | `x86_64`   |
+| Minimum OS (`minos`)   | `13.0.0`                                                                        | `13.0.0`   |
+| SDK                    | `15.5.0`                                                                        | `15.5.0`   |
+| Signature              | `linker-signed-ad-hoc`                                                          | `unsigned` |
+| Dynamic libraries      | Security, CoreFoundation, `libiconv.2`, `libSystem.B`                           | same four  |
+| Symbol count           | 305,558                                                                         | 306,211    |
+| Debug-map object files | 1,426                                                                           | 1,422      |
+| Operator values        | Three planted fictional variables removed by preflight; zero final-byte matches | same       |
+
+Mach-O UUIDs differ per run because the embedded source commit differs (for
+example ARM `ea89f38109c83fbea6bed4ac7de8f98b` and Intel
+`47678b08fa0a38bcba792ffc65173f1f` in run 39290139247). The final-byte scan
+rejected host build roots, the fixture root and `RUNNER_TEMP`, and found only
+the remapped prefixes `/trusted-server` and `/cargo-vendor`.
+
+## Startup
+
+The accepted canonical executable was run as `ts --version` outside the
+checkout with a scrubbed environment (`HOME`, `LC_ALL`, `PATH`, `TMPDIR`
+only). Every start, in every run on both hosts, reported `status: accepted`
+with exit code 0 and `ts package=0.1.0 source=<merge commit> target=<triple> variant=default`, for example (run 39290139247, ARM):
+
+```text
+ts package=0.1.0 source=506d8ead69757556e1bd8ed29b578d0257d05169 target=aarch64-apple-darwin variant=default
+```
+
+The Intel output names `target=x86_64-apple-darwin`. The measurements record the host CPU and, on ARM, translation state
+(`hw_optional_arm64: 1`, `proc_translated: 0`). This exercises loading and
+version reporting on macOS 15.7.9 only. It does not exercise the macOS 13
+loader floor on a real macOS 13 host or every CLI command.
+
+## Reproduction measurement
+
+The reproduction (role B) uses separate fresh roots and the checked ambient
+profile (umask 027, two jobs, different roots and start time). It is a
+bounded measurement, never a release equality gate.
+
+| Run         | ARM reproduction                                 | Intel reproduction                                                                                                                          |
+| ----------- | ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------- |
+| 39273777887 | `identical` (same SHA-256 and size as canonical) | `build-failed`: the confined Cargo build exceeded its wall-clock deadline (`sandbox-exec exceeded its wall-clock deadline`) while compiling |
+| 39290139247 | `identical`                                      | `build-failed`: `Release source is not authenticated` caused by `source preparation cancelled or timed out`                                 |
+| 39417433680 | `identical`                                      | `identical`                                                                                                                                 |
+| 39420011152 | `identical`                                      | `identical`                                                                                                                                 |
+
+No Intel equality result exists for the two earlier runs and none is inferred.
+The two later Intel results were identical, but the whole Intel candidate test
+took 3,552 seconds (run 39417433680) and 3,305 seconds (run 39420011152)
+against a 60-minute test deadline, after 3,844 seconds in run 39290139247
+where it was exceeded. No code change was made to widen that margin, so this
+is a timing observation: it does not establish that Intel reproduction is now
+reliable. Intel remains a bounded optional measurement.
+
+## Subsequent reproduction scheduling
+
+`3e3e30996` defers optional native reproduction on ordinary push/PR runs;
+scheduled/dispatched runs and PRs carrying the reproduction label before a
+triggering event measure it. Canonical Apple build/inspection/startup remain
+mandatory. Run 39540057202 subsequently passed both canonical candidates, with
+ARM reproduction identical and Intel reproduction failing at its 25-minute
+confined-build wall. `b4c8e0c0f` raises that ordinary-CI wall to 45 minutes;
+it does not establish Intel equality. See the [dated schedule report](2026-10-21-native-reproduction-schedule.md)
+for exact jobs, built source and trigger limitations. Future equality statements
+must cite the measured run/job and built source; a deferred pass supplies none.
+
+## Limits
+
+This evidence does not establish authenticated acquisition of Xcode, the SDK
+or the Rust tree; original vendor identity; compiler resource, `libLTO` and
+helper-tool coverage; production reproduction profiles; macOS 13 loader
+behavior; or Task 8 qualification. The JS handoff came from a Linux ordinary-CI
+artifact marked `authenticated: false`. Production wrappers and qualified
+selection remain closed, and nothing here signs, publishes or enables an
+official release.
diff --git a/scripts/release/qualification/2026-10-20-linux-cli-gnu-follow-up.md b/scripts/release/qualification/2026-10-20-linux-cli-gnu-follow-up.md
new file mode 100644
index 0000000000..b046213e07
--- /dev/null
+++ b/scripts/release/qualification/2026-10-20-linux-cli-gnu-follow-up.md
@@ -0,0 +1,153 @@
+# Task 9: Linux CLI candidate after the GNU snapshot and measurement fixes
+
+Status: ordinary PR CI passed the Linux `ts` candidate recipe again on
+2026-10-20 after two hosted failures were fixed. The canonical and
+reproduction builds were byte-identical and the exact accepted bytes started
+in all three reviewed Linux images. This is candidate evidence with
+`release_qualification: false`. It extends the
+[2026-10-16 Linux CLI candidate report](2026-10-16-linux-cli-candidate.md) and
+does not qualify production tools, image pins, acquisition or release
+enablement.
+
+## Why the earlier candidate stopped passing
+
+After the 2026-10-16 pass, the candidate recipe gained source-owned GNU tool
+selectors and a staged helper that records a bounded installed-image
+inventory before and after Cargo. Two hosted runs then failed in the Linux CLI
+candidate job; each failure was fixed by one commit.
+
+| Run                                                                                  | Head        | Failed job                                                                                             | Recorded failure                                                                                                                                        | Fix                                                                         |
+| ------------------------------------------------------------------------------------ | ----------- | ------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------- |
+| [39371724671](https://github.com/IABTechLab/trusted-server/actions/runs/39371724671) | `7be86d935` | [118460869596](https://github.com/IABTechLab/trusted-server/actions/runs/39371724671/job/118460869596) | `cannot open image file: Permission denied (os error 13)` after 557.93 seconds                                                                          | `e5a780d5c`: record three reviewed root-only helpers by metadata only       |
+| [39382624785](https://github.com/IABTechLab/trusted-server/actions/runs/39382624785) | `e5a780d5c` | [118494982595](https://github.com/IABTechLab/trusted-server/actions/runs/39382624785/job/118494982595) | `file .../release/build/prettyplease-.../build-script-build has 2 hard links; a link outside the root would bypass write denial` after 1,273.09 seconds | `bfab8ef20`: measure the image in a sibling sandbox without the target root |
+
+Both failures were in the real candidate test
+`recipe::tests::cli::linux_cli_candidate_builds_inspects_and_starts_cleanly`;
+other jobs in those runs are not summarised here. Run 39371724671 also had a
+cancelled Intel macOS job, which is outside this report.
+
+### Reviewed root-only helpers (`e5a780d5c`)
+
+The confined GNU helper runs unprivileged and hashes every regular file under
+the measured image roots. The UBI 9 builder ships three privileged helpers it
+cannot open: `/usr/libexec/utempter/utempter` (setgid, mode 2711),
+`/usr/sbin/userhelper` (setuid, 4711) and `/usr/sbin/unix_update` (0700),
+observed identically on amd64 and arm64 by a local Podman build of the same
+builder Dockerfile, listing files unreadable to a non-root user under the
+measured roots (local diagnostic, not CI output). The snapshot now accepts
+a permission-denied file only at those exact paths, owned by root, with no
+group or other write bit, no other-read permission and unchanged since first
+inspection. Each is recorded by mode, owner and size instead of content
+(inode is excluded because it varies with host storage) and listed as
+`content_unmeasured_files`, which the orchestrator requires to be a sorted
+subset of the reviewed paths. Every other unreadable file, including an
+execute-only compiler helper, still fails closed, and selected build tools
+must remain readable and hashed. These three files' content is therefore
+unmeasured; the SPDX candidate states the count as a coverage gap.
+
+### Sibling measurement sandbox (`bfab8ef20`)
+
+The second GNU image measurement ran in the build boundary, whose unchanged
+pre-run writable scan rejects Cargo's in-root hard links in the target
+directory. Both GNU measurements now run in a sibling Linux container
+boundary derived from the build boundary: same image, settings, read-only and
+tool roots, and every writable root except the last (the target directory).
+The sibling has a fresh fingerprint, records the boundary it derived from and
+proves denial with the staged probe. Cargo queries and the build keep the
+build boundary and proof, receipts record both fingerprints, and completion
+still binds the build boundary and plan.
+
+## Passing runs and jobs
+
+| Run                                                                                  | Head                                       | Built source (PR merge commit)             | Linux CLI job                                                                                          | Test duration |
+| ------------------------------------------------------------------------------------ | ------------------------------------------ | ------------------------------------------ | ------------------------------------------------------------------------------------------------------ | ------------- |
+| [39417433680](https://github.com/IABTechLab/trusted-server/actions/runs/39417433680) | `bfab8ef2009fa6f28b1258135e2445ee22775dc8` | `b05bd8a18f137b43f7542c797f0a5d7856363d23` | [118609761876](https://github.com/IABTechLab/trusted-server/actions/runs/39417433680/job/118609761876) | 2,124.97 s    |
+| [39420011152](https://github.com/IABTechLab/trusted-server/actions/runs/39420011152) | `1719cf15fd58fcf029f6b4ae5003215802bef405` | `b2273db76b8a2070f3c0d20d22788eed434d0029` | [118618316864](https://github.com/IABTechLab/trusted-server/actions/runs/39420011152/job/118618316864) | 2,089.82 s    |
+
+Both runs concluded `success` for every job, including the Fastly confined
+Cargo job, the native producer jobs on Ubuntu 24.04 and macOS 15, and the
+Apple candidate jobs (see the [Apple CLI candidates report](2026-10-20-apple-cli-candidates.md)).
+The run for the later documentation-and-SPDX head `073704cc7` (Run Tests 39452090186) was still in progress when this report was written and is not
+recorded.
+
+## Measured results
+
+| Measurement                           | Run 39417433680 (`bfab8ef20`)                                             | Run 39420011152 (`1719cf15f`)                                             |
+| ------------------------------------- | ------------------------------------------------------------------------- | ------------------------------------------------------------------------- |
+| Asset                                 | `ts-x86_64-unknown-linux-gnu`, variant `default`, package `0.1.0`         | same                                                                      |
+| SHA-256, canonical and reproduction   | `066000e58902ad9e8b2077498383c27f466fd45337320082eab20da83a28df7d`        | `99991c0ae4a34b0db1630925df5e0ca1ef4aa0c3ca17f30d9a162ed746923245`        |
+| Size, both builds                     | 282,956,784 bytes                                                         | 282,956,920 bytes                                                         |
+| Reproduction status                   | `identical`, no differing offset                                          | `identical`, no differing offset                                          |
+| Canonical Cargo execution             | 473 seconds                                                               | 454 seconds                                                               |
+| Observed packages/units/build scripts | 486 / 649 / 62                                                            | 486 / 649 / 62                                                            |
+| Lock SHA-256                          | `82ef943339970e6399fe56f434beee484a05e7a0fe0db40383a794651ab19214`        | `82ef943339970e6399fe56f434beee484a05e7a0fe0db40383a794651ab19214`        |
+| Descendant cleanup                    | `owned-by-container`                                                      | not tabulated; same boundary                                              |
+| Builder image                         | `registry.access.redhat.com/ubi9/ubi:9.6`, glibc 2.34                     | same reference, glibc 2.34                                                |
+| Observed builder image ID             | `sha256:417c122225da0b6990c9f50c32a7b3908022e30df6d5480b572b45be9dd4d03c` | `sha256:b4eae457404e63633888ffaff3cd5020c6ffb4cc4fb495657a8945698ebdd5a0` |
+
+The builder image ID differs between the two runs for the same mutable tag
+and both differ from the 2026-10-16 report, which is further reason these are
+observations from ordinary tag acquisition and not authenticated production
+digests. The executable bytes differ between runs because the embedded source
+commit differs, and the size and digest of this binary also differ from the
+2026-10-16 report because the source and lock changed.
+
+Final-byte ELF inspection of the canonical executable (run 39417433680; run
+39420011152 reported the same ELF facts): x86-64, interpreter
+`/lib64/ld-linux-x86-64.so.2`, highest required GLIBC version `2.34` across 27
+version requirements, needed libraries `libgcc_s.so.1`, `libm.so.6`,
+`libc.so.6` and `ld-linux-x86-64.so.2`, `.debug_info` 87,947,690 bytes and
+`.debug_line` 33,663,154 bytes. The path scan found only the remapped
+prefixes `/trusted-server`, `/cargo-vendor` and `/cargo-target` and none of
+`/boundary/`, host build roots, fixture roots or `RUNNER_TEMP`; the three
+planted fictional operator variables were removed by preflight with zero
+final-byte matches. `material_native_coverage_complete` stayed `false`.
+
+The builder filesystem controls again exited zero: `/tmp`, `/dev/shm`, `/dev`,
+`/etc/hosts`, `/etc/hostname` and `/etc/resolv.conf` writes denied, and the
+bound `TMPDIR` accepted write, read and cleanup.
+
+## Startup
+
+The copied read-only executable ran as `ts --version` without a checkout or
+operator configuration in each reviewed image. All starts exited zero with an
+empty stderr (SHA-256 of empty input) and, in run 39420011152:
+
+```text
+ts package=0.1.0 source=b2273db76b8a2070f3c0d20d22788eed434d0029 target=x86_64-unknown-linux-gnu variant=default
+```
+
+| Startup image                                     | Observed local image ID (both runs)                                       |
+| ------------------------------------------------- | ------------------------------------------------------------------------- |
+| `registry.access.redhat.com/ubi9/ubi-minimal:9.6` | `sha256:a2c5a85865a585c3bc8b10f6c269358fdf89fe32be4232885166889d85c76421` |
+| `docker.io/library/ubuntu:22.04`                  | `sha256:cee13550f97b8a595506e8e4ca74263ba44924248779a4ba4f942e197652acff` |
+| `docker.io/library/debian:12`                     | `sha256:94926f0fd968cd68ac486502185a5dd78687874a9ec7727f64fe2af696e28311` |
+
+The `ubuntu:22.04` image ID differs from the 2026-10-16 report
+(`sha256:e8df6c74...`), showing the tag moved between runs. Run
+39417433680 recorded the same three IDs. The real startup timeout regression
+(`startup_timeout_removes_only_its_owned_container`) also passed in run 39417433680.
+
+## Subsequent reproduction scheduling
+
+The equality observations above remain tied to their original runs. Since
+`3e3e30996`, ordinary push/PR runs defer the optional native reproduction;
+scheduled/dispatched or appropriately labelled PR runs measure it. Linux
+canonical build, inspection and all three startup checks remain mandatory.
+See the [dated schedule report](2026-10-21-native-reproduction-schedule.md)
+for the selector, exact baseline jobs and the subsequent 45-minute ordinary-CI
+per-build wall. Later equality claims need a measured run/job and built source,
+not a successful deferred job. GNU helper coverage and qualification gaps remain.
+
+## Limits
+
+The GNU installed-file snapshot and the sibling measurement record which files
+were present and, except for three root-only helpers recorded by metadata, their
+content hashes. They do not establish which helpers executed, authenticated
+acquisition of the UBI image or tools, or a complete native closure. The
+candidate SPDX for this build must list the privileged-helper gap. Native
+reproduction remains a measurement rather than a release gate. Task 9 and
+milestone M4 remain open: qualified production ambient profiles, the closed
+`build.sh` interface, independently authenticated acquisition/tool/image
+selections and Task 8 hosted qualification are still required. This candidate
+does not sign, publish, deploy or enable an official release.
diff --git a/scripts/release/qualification/2026-10-21-candidate-release-index.md b/scripts/release/qualification/2026-10-21-candidate-release-index.md
new file mode 100644
index 0000000000..85398500a5
--- /dev/null
+++ b/scripts/release/qualification/2026-10-21-candidate-release-index.md
@@ -0,0 +1,90 @@
+# Task 13 candidate release index evidence
+
+Status: partial candidate implementation, without signing, publication or
+release authority. The production Task 13 exit remains open.
+
+## Implemented boundary
+
+`crates/trusted-server-release/src/distribution.rs` and its `entry`, `joins`
+and test-only `summary` modules retain candidate entries and exact-cohort index
+assembly. `candidate_entry_from_completed` takes a canonical completed owner
+with its matching actual runtime/startup acceptance; Fastly additionally requires
+owning canonical/reproduction equality. It renders candidate SPDX, build-evidence,
+build-recipe and rebuild-check companions. The candidate entries bind final-byte
+digests and the retained original JS inventory.
+
+The index assembler requires exactly the four fixed canonical assets with one
+source commit, policy identity and JS inventory, and checks the retained v1
+schema and mirrored consumer joins. It uses tag `v0.0.0-unqualified-candidate`
+and name `candidate-release-index.json`. Signature slots contain size zero and
+the actual empty-file SHA-256 sentinel; `BundleSlot::Signed` requires the
+uninhabited `SignedCompanions` type. No signature file is fabricated. Companions
+retain `release_qualification: false`, explicit gaps and null workflow/transfer
+identities. The CLI rejects zero-size signature bundles, so these fixtures cannot
+pass full release verification. Consumer rejection of sentinel/unqualified
+documents after future signing remains a separate tracked requirement.
+
+Golden fixtures in `tests/fixtures/index/candidate/` and CLI
+`release/evidence/candidate_fixture_tests.rs` exercise unsigned structural joins
+and rejection boundaries. `recipe/tests/candidate_index.rs` covers pure owner
+wiring rejections. `candidate_entry.rs` checks each real canonical entry
+independently, with reporting in `distribution/summary.rs`. Collecting and
+assembling the four real entries across CI jobs is now implemented. Each
+candidate job uploads its rechecked entry and final executable. The
+`test-release-candidate-index` job rebuilds the four entries from the exact
+uploads (`distribution::transfer` and `distribution::ordinary`, test-only) and
+assembles them. It then runs the CLI consumer's unsigned joins over the
+result. The first hosted all-four assembly passed in run 39577910126; see the
+[four-asset candidate join report](2026-10-21-four-asset-candidate-join.md).
+
+## Real canonical-entry observations
+
+The initial real-entry wiring in `4483e8256dc52c89e615f1388daa873324a871f5`
+has [run 39529922087](https://github.com/IABTechLab/trusted-server/actions/runs/39529922087).
+REST job conclusions show Fastly
+[118993209872](https://github.com/IABTechLab/trusted-server/actions/runs/39529922087/job/118993209872),
+Linux CLI [118993210395](https://github.com/IABTechLab/trusted-server/actions/runs/39529922087/job/118993210395)
+and Apple ARM [118998766555](https://github.com/IABTechLab/trusted-server/actions/runs/39529922087/job/118998766555)
+succeeded; Intel [118998766733](https://github.com/IABTechLab/trusted-server/actions/runs/39529922087/job/118998766733)
+and the overall run were cancelled. These conclusions establish three completed
+jobs, not an all-four result. Their measurements are not transcribed here;
+the completed baseline below supplies the audited entry identities and outcomes.
+
+[Run 39540057202](https://github.com/IABTechLab/trusted-server/actions/runs/39540057202)
+concluded success for head `a9994b4c2b50265de4bbe5b8bb42cd8cab4e43ae`, building
+source `d0cd53343fcbe1fb6f06eafc009e306e24b1245d`. Its logs retain:
+
+| Asset           | Job                                                                                                    | Candidate entry SHA-256                                            | Entry bytes | Entry rebuild outcome |
+| --------------- | ------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------ | ----------- | --------------------- |
+| Fastly Wasm     | [119025502524](https://github.com/IABTechLab/trusted-server/actions/runs/39540057202/job/119025502524) | `45ba885e8a210d6c1b6db92ff67fff9f4d3574370a118b7aa41be359831d5631` | 1,488       | `matched`             |
+| Linux GNU CLI   | [119025502758](https://github.com/IABTechLab/trusted-server/actions/runs/39540057202/job/119025502758) | `668c22fd33c959c269289192671630275939a6f0c324de36e13547b1db701c47` | 1,492       | `unavailable`         |
+| Apple ARM CLI   | [119029080050](https://github.com/IABTechLab/trusted-server/actions/runs/39540057202/job/119029080050) | `23d1b2beaeaeeae048b573afaaecd10be8c20d4b9f068cad6fb8f54d07d7a49e` | 1,450       | `unavailable`         |
+| Apple Intel CLI | [119029080038](https://github.com/IABTechLab/trusted-server/actions/runs/39540057202/job/119029080038) | `336b4b3876205dde71cfd99f1726455953e950636544a67d6193fa4f9633fa63` | 1,441       | `unavailable`         |
+
+These are entry-document digests, not executable or SBOM digests. The native
+entry outcome is deliberately conservative: separate fixture measurements show
+Linux and ARM reproduction `identical`, while Intel reproduction exhausted its
+wall budget. Those measurements do not become owning rebuild proofs in the
+candidate native entry. A passing Intel canonical entry does not imply equality.
+
+All four jobs recorded JS inventory SHA-256
+`24efd45b403e955eb4cb98c0b5e9f31e7f878d0be2637d2f89447660383511f6`
+for that same built source. This supports inventory compatibility for a future
+join of these observations; it does not establish that a real four-job join ran.
+An inventory digest includes source-specific metadata, so values from different
+built commits are not interchangeable. Other runs need their own verified values.
+
+## Remaining exits
+
+Task 12's trusted workflow dependency and transfer binding is the next
+prerequisite to a trusted cross-job candidate join. It is not the only remaining
+release-attestation work. The logs explicitly retain missing authenticated
+bootstrap, incomplete native material coverage, unresolved Fastly host tools,
+three GNU privileged helpers with unmeasured content, incomplete Apple tool
+closure, absent signatures and absent trusted workflow/run identities.
+
+Complete qualified SPDX generation, authentic provenance subjects, actual
+signature bundles, SHA256SUMS, immutable publication and final qualification
+remain required. Builder/startup images still acquired by mutable tags do not
+become authenticated because their installed IDs were recorded. This report
+does not implement the transfer adapter or change any production gate.
diff --git a/scripts/release/qualification/2026-10-21-four-asset-candidate-join.md b/scripts/release/qualification/2026-10-21-four-asset-candidate-join.md
new file mode 100644
index 0000000000..a65ab5fe6b
--- /dev/null
+++ b/scripts/release/qualification/2026-10-21-four-asset-candidate-join.md
@@ -0,0 +1,122 @@
+# Tasks 12 and 13: first cross-job four-asset candidate index
+
+Status: ordinary PR CI assembled one unqualified candidate release index from
+the four real candidate jobs on 2026-10-21. This is candidate integration
+evidence with `release_qualification: false`. It is not a signed release,
+trusted-workflow binding, authenticated acquisition or qualification, and it
+extends the [candidate release index report](2026-10-21-candidate-release-index.md).
+
+## Run
+
+| Field                    | Value                                                                                |
+| ------------------------ | ------------------------------------------------------------------------------------ |
+| Run                      | [39577910126](https://github.com/IABTechLab/trusted-server/actions/runs/39577910126) |
+| Event                    | `pull_request`                                                                       |
+| PR head (REST head)      | `d774ee47c274257fa0a088280f7df37ed530020c`                                           |
+| Built source (PR merge)  | `fb42d8268af93c011959d032c81bfa581306c7c2`                                           |
+| Native reproduction mode | `defer` (recorded as `deferred-to-scheduled-run`)                                    |
+| Index evidence artifact  | `unqualified-candidate-release-index-evidence-39577910126-1`, ID 12340882671, 7 days |
+
+The previous run, 39567710071 at `6ffebbd08`, completed all four producer jobs
+and both macOS matrix outputs, but its collector rejected the first download:
+it passed one 20-minute deadline while the bounded transport caps an attempt at
+15 minutes. `d774ee47c` gives each download its own 10-minute attempt and
+leaves the transport bound unchanged.
+
+## Jobs
+
+| Job                                                                                                    | Name                                                | Duration |
+| ------------------------------------------------------------------------------------------------------ | --------------------------------------------------- | -------- |
+| [119147931992](https://github.com/IABTechLab/trusted-server/actions/runs/39577910126/job/119147931992) | Confined release Cargo candidate (Fastly), Linux    | 33 min   |
+| [119147931961](https://github.com/IABTechLab/trusted-server/actions/runs/39577910126/job/119147931961) | Linux `ts` CLI release candidate                    | 31 min   |
+| [119148070099](https://github.com/IABTechLab/trusted-server/actions/runs/39577910126/job/119148070099) | Linux JS handoff for macOS candidates               | 14 min   |
+| [119154065068](https://github.com/IABTechLab/trusted-server/actions/runs/39577910126/job/119154065068) | macOS `ts` CLI release candidate, `macos-15`        | 38 min   |
+| [119154065062](https://github.com/IABTechLab/trusted-server/actions/runs/39577910126/job/119154065062) | macOS `ts` CLI release candidate, `macos-15-intel`  | 54 min   |
+| [119176658773](https://github.com/IABTechLab/trusted-server/actions/runs/39577910126/job/119176658773) | Assemble the unqualified four-asset candidate index | 15 min   |
+
+## What the collector checked
+
+Each candidate job exported its rechecked entry companions, the shared JS
+inventory and its final executable, uploaded them with the pinned upload
+action and passed the exact artifact ID, name and digest through job outputs.
+The collector, which runs only when all three candidate jobs succeed on a
+same-repository event, then:
+
+- parsed four descriptors strictly and required distinct upload IDs, each
+  name recomputed from the fixed asset slot, run ID and producer attempt;
+- downloaded each upload by exact ID through the bounded release-tool backend
+  and corroborated run, head, repository, name, digest and expiry in raw REST
+  metadata, then read the exact six flat ZIP members;
+- authenticated a clean clone at the built source and read the consumer
+  policy from it, not from any producer;
+- rebuilt each entry through the test-only `from_ordinary_ci_transfer`, which
+  reruns the inventory, build-evidence, SPDX, recipe and rebuild joins and
+  rehashes the executable against the recorded size and digest;
+- required each rebuilt entry digest to equal the digest its producer
+  reported, and assembled the index with the unchanged assembler;
+- reread the written index and its 17 sibling files and checked their
+  digests, the sentinel tag and the empty signature-bundle sentinels.
+
+The CLI consumer test then accepted the assembled bytes under its unsigned
+joins and policy and rejected the size-zero signature bundles.
+
+## Entries
+
+| Asset                         | Producer entry SHA-256                                             | Executable SHA-256                                                 | Executable bytes |
+| ----------------------------- | ------------------------------------------------------------------ | ------------------------------------------------------------------ | ---------------- |
+| `trusted-server-fastly.wasm`  | `93468d7d8aa4dcd066fe3b42c38943f09a732d3bc858d4ae9ed3c584c2482dc3` | `d43c4412c9b01daf6c74add4cbde01a6a6699b7b1959f9c15f0426c84e08ba63` | 66,992,633       |
+| `ts-x86_64-unknown-linux-gnu` | `46676743d02c252b8a373a9242a4baf4dec3344003af44c6c314240533319db2` | `21c55e583569a84f353181022efdfd43d8310caf5fdf3fc58eba18317f8acc61` | 283,190,976      |
+| `ts-aarch64-apple-darwin`     | `d6984e55e659999c9c5c0575ac1f95c89bf70b25c85157d98638edd49ed1d4d2` | `f715aa69b467db23b846efbede73d5acc3313fa605a431115ba75c854a88f088` | 43,244,624       |
+| `ts-x86_64-apple-darwin`      | `b9cf2e517615876d8417a8c01fa1891504bb4ea9154dda97c1fb1405f282e03a` | `6826bed7761f62c84587f45a08f4493bab67a587b9346570cdd73ecf48220959` | 46,159,016       |
+
+## Assembled index
+
+| Field                          | Value                                                                             |
+| ------------------------------ | --------------------------------------------------------------------------------- |
+| `candidate-release-index.json` | `4872ef96086e93f720187f363e7262ae2921e663fbc9a531f2a42cc5d803b14d`                |
+| Tag                            | `v0.0.0-unqualified-candidate`                                                    |
+| Cohort                         | `phase1-fastly-cli`                                                               |
+| Source, recipe and cohort      | `fb42d8268af93c011959d032c81bfa581306c7c2`                                        |
+| Policy                         | version 1, `f08ce10cd16ff2d1acc482db2b85eb53b667ec2b4753792f277d12f41d1f636c`     |
+| `tsjs-inventory.json`          | `90c79b953ca112310707d52100ebaefe6c97718466242c34ade46b188a54b729`, 246,440 bytes |
+
+All four candidate jobs built the same JS inventory bytes for this source. The
+inventory digest differs from the one in the earlier candidate index report
+because the source differs.
+
+The collector printed these unqualified candidate gaps, carried unchanged in
+the companions:
+
+```text
+apple-coverage-excluded:toolchain_libraries
+apple-tool-closure-unmeasured
+authenticated-bootstrap-not-established
+candidate-tag-sentinel
+gnu-original-acquisition-unverified
+gnu-privileged-helper-content-unmeasured
+gnu-tool-closure-unmeasured
+native-material-coverage-incomplete
+native-reproduction-unavailable
+native-tool-host-path-unresolved:archiver
+native-tool-host-path-unresolved:assembler
+native-tool-host-path-unresolved:build_tools
+native-tool-host-path-unresolved:compiler
+native-tool-host-path-unresolved:linker
+signature-bundles-awaiting-signature
+trusted-workflow-transfer-not-bound
+workflow-run-identity-unavailable
+```
+
+## Limits
+
+The exact-ID transfer and REST corroboration prove which uploads of this run
+were read, not which job or attempt produced them: the artifact API does not
+identify the producing job, so trusted workflow dependency binding (Task 15)
+remains open and companions keep null workflow and transfer IDs. The
+collector's `GH_TOKEN` is read-only and visible to the same-repository test
+binary. The index is unsigned, uses the sentinel tag and cannot pass full
+release verification. Native reproduction was deferred for this run, so the
+three native entries record rebuild outcome `unavailable`; Fastly records
+`matched`. Tasks 12 and 13 remain partial; signing, publication, authenticated
+acquisition, complete native coverage and qualification are separate open
+exits.
diff --git a/scripts/release/qualification/2026-10-21-native-reproduction-schedule.md b/scripts/release/qualification/2026-10-21-native-reproduction-schedule.md
new file mode 100644
index 0000000000..c4f5efc214
--- /dev/null
+++ b/scripts/release/qualification/2026-10-21-native-reproduction-schedule.md
@@ -0,0 +1,77 @@
+# Ordinary CI native reproduction scheduling and build cache
+
+Status: candidate CI optimization, not release qualification. Commit
+`3e3e30996` changes when native reproduction is measured; `b4c8e0c0f`
+increases the ordinary-CI confined Cargo build wall from 25 to 45 minutes.
+Neither change establishes Intel equality or authenticates tools or images.
+
+## Selection and triggers
+
+The Linux and Apple CLI fixtures require `TS_RELEASE_NATIVE_REPRODUCTION`
+to be `measure` or `defer`. The workflow selects `measure` for `schedule`,
+`workflow_dispatch`, or a pull request carrying `release-native-reproduction`;
+other push and pull-request runs select `defer`. Deferred runs record
+`status: deferred-to-scheduled-run` and `gate: measurement-only`. The fixtures
+reject missing/unknown modes and reject `defer` on scheduled/dispatched runs.
+Canonical native build, inspection, startup and evidence checks remain required.
+Fastly canonical/reproduction equality and final-byte runtime checks are unchanged.
+
+The cron is `23 4 * * *` (04:23 UTC daily). GitHub runs scheduled workflows
+from the default branch; dispatch also requires the workflow file to exist on
+that branch, although a dispatch can select another ref. These triggers do not
+by themselves validate this unmerged branch. The PR label must be present
+before the next push or another configured PR event: this workflow does not
+subscribe to the `labeled` event. See GitHub's
+[schedule](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#schedule)
+and [dispatch](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#workflow_dispatch)
+contracts. This report does not dispatch a run or change labels.
+
+## Cache scope and limits
+
+The pinned `actions/cache` v5.1.0 restore/save steps cache `target`, keyed by
+runner OS, host target, pinned Rust version, lock/tool/manifest hashes and test
+profile. The Linux Fastly producer job and Apple candidate jobs save only on
+`refs/heads/main` and an exact-key miss, before ignored execution fixtures;
+Linux CLI and JS handoff jobs restore without saving. Incremental directories
+are removed before saving. This cache does not include `~/.cargo/registry`
+and does not replace fresh confined application build roots.
+
+Measurements retain `ci_build_provenance`: producer/probe and test-binary
+SHA-256 values plus `build_cache` (matched key, `miss`, or `unreported`). These
+are observed identities, not independently authenticated provenance. Main-only
+writes in this workflow and GitHub's branch-scoped cache access reduce sharing;
+they do not qualify cached code or make a digest proof of trusted compilation.
+See GitHub's [cache access restrictions](https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching#restrictions-for-accessing-a-cache).
+All measurements remain `release_qualification: false`.
+
+## Observed baseline and pending validation
+
+[Run 39540057202](https://github.com/IABTechLab/trusted-server/actions/runs/39540057202)
+concluded success for head `a9994b4c2b50265de4bbe5b8bb42cd8cab4e43ae`, building
+PR merge source `d0cd53343fcbe1fb6f06eafc009e306e24b1245d`. It predates both
+optimizations and supplies the timing baseline, not evidence that they work.
+
+| Candidate       | Job                                                                                                    | Observed result                                                                                                                       |
+| --------------- | ------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------- |
+| Fastly          | [119025502524](https://github.com/IABTechLab/trusted-server/actions/runs/39540057202/job/119025502524) | Candidate entry rebuild outcome `matched`                                                                                             |
+| Linux CLI       | [119025502758](https://github.com/IABTechLab/trusted-server/actions/runs/39540057202/job/119025502758) | Native reproduction `identical`                                                                                                       |
+| Apple ARM CLI   | [119029080050](https://github.com/IABTechLab/trusted-server/actions/runs/39540057202/job/119029080050) | Native reproduction `identical`; complete fixture 3,144.22 seconds                                                                    |
+| Apple Intel CLI | [119029080038](https://github.com/IABTechLab/trusted-server/actions/runs/39540057202/job/119029080038) | Canonical Cargo execution 1,193 seconds; optional reproduction `build-failed` at its wall deadline; complete fixture 4,093.14 seconds |
+| JS handoff      | [119025605842](https://github.com/IABTechLab/trusted-server/actions/runs/39540057202/job/119025605842) | Fresh offline JS fixture passed in 474.23 seconds; this is fixture time, not total job time                                           |
+
+The Intel reproduction timeout previously occurred in run 39273777887 and
+recurred here, despite `identical` measurements in intervening historical runs
+39417433680 and 39420011152 (see the [Apple report](2026-10-20-apple-cli-candidates.md)).
+`ToolSelection::build_wall` now supplies 45 minutes for ordinary
+CI instead of the fixed 25-minute wall. This is a per-confined-build budget,
+not the complete fixture or job budget, and production selection remains closed.
+
+At this report's evidence check on 2026-10-21, the first run for
+`b4c8e0c0fded27f02930edc6de990f17a63f5820`,
+[39551207134](https://github.com/IABTechLab/trusted-server/actions/runs/39551207134),
+was still in progress. Deferred reproduction, cache behavior, recorded producer
+identities and unchanged mandatory Fastly equality require that run's completed
+logs. A PR cache miss is expected when no eligible entry exists, not guaranteed;
+main-only save steps must remain skipped on the PR. Intel equality under the
+45-minute wall requires a later measured run; a deferred pass cannot establish it.
+Every later equality claim must identify the measured run, job and built source.
diff --git a/scripts/release/qualification/README.md b/scripts/release/qualification/README.md
new file mode 100644
index 0000000000..10e63f41cf
--- /dev/null
+++ b/scripts/release/qualification/README.md
@@ -0,0 +1,314 @@
+# Disposable release qualification framework
+
+Status: **Rust migration in progress; candidate recipes for all four assets pass ordinary CI, but Tasks 8–9 qualification remains incomplete**. No tool,
+SDK, OCI image or recipe has become qualified. `release-tools.json` retains null
+measurement slots. A source checksum and a successful unit test cannot supply
+hosted execution or acquisition authenticity.
+
+The retained observation schema, experimental source-owned boundaries and inert
+hosted proposal guide Rust semantic checks and native execution. This framework creates no repository, dispatches no job, registers no workflow,
+publishes no tag, signs no release and deploys no publisher service.
+
+## Rust migration and Task 9 status
+
+Introduced Python qualification/recipe tooling and validator requirements are removed. Historical local socket/Cargo/tiny Mach-O probes are not selected macOS 15/GNU qualification. The [Rust migration addendum](../../../docs/superpowers/specs/2026-10-14-release-tooling-rust-migration.md) and [primary plan](../../../docs/superpowers/plans/2026-10-13-attested-release-implementation.md#rust-migration-and-current-execution-boundary) define the host-only `crates/trusted-server-release` tool. Strict document/policy checks, local source authentication, helper-closure fingerprinting, bounded Git/process execution and final-artifact inspection are implemented. Authenticated bootstrap/acquisition and actual qualification remain pending.
+
+The experimental macOS sandbox denies network access but does not own
+descendant cleanup the way a container does. Commit `60fafa717` supersedes the
+earlier finding that a `posix_spawn` escape, or a child that scrubs its
+tracking environment, could survive the run: the boundary now identifies the
+run's sandbox instance, finds, kills and rejects every process of that
+instance after the run, and reports `descendant_cleanup: "post-run-reaped"`
+(Linux containers report `owned-by-container`). Survivors exist until that
+reap, so this is weaker than ownership and remains unqualified. Only the
+`cfg(test)` ordinary-CI candidate selection accepts post-run-reaped cleanup
+(approved 2026-10-19). Socket denial and successful utility tests do not
+qualify the lifecycle boundary. The production macOS and Linux selectors remain
+unconstructible until their required controls and independently authenticated
+inputs are established.
+
+Current wrappers fail closed until the independently approved native Rust
+bootstrap and source-owned authenticated selections are implemented. Neither
+inventory labels/hashes nor a self-authored checksum authenticates its producer.
+Private typed source/acquisition approval and actual JS completion are constructed
+only by the corresponding successful verification/execution path; no serialized
+authorization boolean is accepted. The tool has no core/CLI/JS crate dependency.
+
+Task 9 is candidate-implemented, with qualification pending. Candidate recipes for
+all four canonical assets (Fastly Wasm, Linux x86-64 `ts`, Apple ARM `ts`, Apple
+Intel `ts`) build, inspect and start in ordinary PR CI with
+`release_qualification: false`; see the dated reports in this directory. The
+closed `build.sh` interface, the production reproduction profile, authenticated
+acquisition/tool selections and hosted qualification remain open. Rust MUST compose original-material preparation, actual
+whole-product Cargo compilation, final-byte acceptance and output copying. Task 10
+MUST collect explicit-target metadata/tree, effective unit features, native archive
+and sysroot evidence through the same boundary before hosted measurement. Native
+selected runtimes and complete Fastly A/B acceptance remain mandatory. Independently
+reviewed all-cohort remote evidence is distinct from current installed-tool rehash
+and SDK/environment checks; neither is a substitute for the other.
+
+Native reproduction scheduling changed in `3e3e30996`: ordinary push/PR runs
+defer the optional CLI reproduction, while scheduled/dispatched runs and PRs
+labelled before a triggering event measure it. Fastly equality and native
+canonical acceptance remain mandatory. `b4c8e0c0f` increases the ordinary-CI
+per-build wall to 45 minutes after Intel's optional reproduction again exhausted
+25 minutes in run 39540057202. The [schedule/cache report](2026-10-21-native-reproduction-schedule.md)
+records baseline timings and pending validation; no Intel equality under the new
+wall is established. The [candidate index report](2026-10-21-candidate-release-index.md)
+records four successful per-asset entry checks, not a real cross-job assembly
+or completion of Task 13. None of these changes qualifies a production selection.
+
+## Local Rust checks
+
+Current registered utility checks use the source-built developer target. The
+qualification module/filter below is a future instruction: it MUST fail its
+nonzero guard until the real qualification tests are registered.
+
+```sh
+set -eu
+HOST_TARGET=$(rustc -vV | sed -n 's/^host: //p')
+test -n "$HOST_TARGET"
+RELEASE_TEST_LIST=$(mktemp)
+trap 'rm -f "$RELEASE_TEST_LIST"' EXIT
+cargo test -p trusted-server-release --target "$HOST_TARGET" qualification::tests -- --list > "$RELEASE_TEST_LIST"
+awk '/: test$/ { count++ } END { if (count == 0) { print "Qualification filter selected zero tests"; exit 1 } print "Selected " count " qualification tests" }' "$RELEASE_TEST_LIST"
+cargo test -p trusted-server-release --target "$HOST_TARGET" qualification::tests
+cargo clippy -p trusted-server-release --target "$HOST_TARGET" --all-targets --all-features -- -D warnings
+```
+
+These commands provide local behavior evidence, not authenticated native bootstrap
+or official release proof. Private tests live alongside `src/qualification.rs` or
+in its registered child `tests.rs`; public process tests use `tests/commands.rs`.
+Fixtures MUST stay fictional. Do not make internal APIs public for tests.
+
+The real unconfined probe requires local socket permission. Selected actual native
+boundary probes MUST run outside an enclosing application sandbox. Child and
+grandchild execute the same compiled Rust probe under inherited confinement with
+private HOME/TMP and closed inherited descriptors. No ambient interpreter/tool
+selection is trusted. A successful local test does not qualify macOS 15, GNU,
+Intel execution, the whole SDK or original distribution acquisition.
+
+The proposed command `trusted-server-release qualify validate-observation <file>`
+MUST check bounded closed schema and semantic joins once implemented; coherent JSON still has pending
+qualification until independent evidence is verified. The production qualified
+selector remains closed. Fields asserting `passed`, caller commands and unknown
+keys are rejected. Actual logs, acquisition signatures, independent trust roots
+and run identities MUST be verified; no JSON field authenticates itself. Native
+bootstrap/schema pins MUST be reviewed before this command can serve production.
+
+## Closed identities and fingerprints
+
+The GNU builder selection is a distinct `gnu-builder-x86_64` slot, with no image
+chosen or digest invented. UBI 9 is an initial candidate to investigate; its
+availability, glibc, compiler and SDK MUST be measured before selecting it. UBI 9,
+Ubuntu 22.04 and Debian 12 are three separate compatibility runtime slots. They
+do not pretend to supply a build SDK.
+
+macOS records GitHub's actual runner image version and the Apple SDK identity.
+No VM byte hash is available through this contract, so a hash of a version string
+is never labeled an image digest. The source-owned labels are `macos-15` for ARM64
+and `macos-15-intel` for native Intel. Native `uname`, `sw_vers`, translation
+`sysctl`, Xcode build version and SDK version/tree identity MUST be recorded.
+The actual startup OS is 15; the Mach-O loader floor is explicitly 13.0. Neither
+Rosetta nor startup on a newer developer Mac establishes this matrix.
+
+The recipe closure is SHA-256 of
+`trusted-server-recipe-closure-v1\n` followed by deterministic JSON containing
+sorted reviewed file path/executable-bit/SHA-256 records and effective settings.
+The execution selection digest uses
+`trusted-server-execution-selection-v1\n` followed by deterministic JSON of the
+tool, environment and recipe selections. It includes acquisition trust roots,
+archive identities and selected SDK/image identities. Only derived qualification
+status and recipe-result digests are excluded. Complete raw `release-tools.json`
+bytes remain an independently recorded build/preflight input.
+
+This avoids a self-hash cycle: a result cannot hash a future tools file containing
+that result's digest. The observation records its own source commit; the later
+reviewed measured-pin commit has different raw tools bytes. Recipe/profile/helper
+changes or changed executable/acquisition selections invalidate qualification.
+The Rust candidate fingerprint validator MUST refuse missing shared Task 9 helpers or changed executable source. The closure includes the release-tool manifest/lockfile and full compiled path-dependency closure, all loaded Rust modules, POSIX adapters, retained Node collector, reviewed profiles and schema bytes; a candidate cannot choose that path list. The existing
+Git reader assumes a trusted immutable object store; the actual staging boundary
+MUST make Git objects and tracked source files read-only while permitting the
+private installation's required node_modules/output writes. This framework does
+not claim race-proof reads against mutable Git storage.
+
+The reviewed closure explicitly includes the Rust build scripts and their
+shared git-version/JS prebuilt/inventory/bundle-set helpers, Cargo configuration
+and ALL path-dependency manifests, explicitly `crates/trusted-server-openrtb/Cargo.toml`, tool-version files, authenticated executable digests, SDK identities and raw receipts, and the executable JS build-all/module-options/composition/Vitest
+pipeline. Ordinary application source and dependencies have separate commit and
+dependency identities. Future imported build helpers MUST enter this reviewed
+closure before execution; the candidate selector cannot supply its own path list.
+
+The host release helper itself MUST load/run inside the GNU <=2.34 builder; build
+it through an independently approved baseline image/toolchain/material channel,
+not ambient Ubuntu 24 followed by an assumed UBI 9 invocation. Bind helper target,
+loader/runtime and its own source/dependency closure. Native macOS helper CPU/SDK
+and floor compatibility need the same independent approval. Initial shell/hash/
+Rust/Cargo trust is external to the tool; authenticate rustup only if actually used; compiled native socket/lifecycle probes
+cannot bootstrap their own authority.
+
+## Candidate boundaries
+
+The Linux seccomp baseline is retained from `moby/profiles`: annotated tag
+`seccomp/v0.2.1` has tag-object identity
+`e295db0a4d7b67853387fef0b2ef0a29e796b1c1` and peels to commit
+`5ad5f40ecde90d78e4a7c861c003fe92747d5518`, file
+`seccomp/default.json`, SHA-256
+`536529b665dd0972c37bfb569f5d4ac8a53592e7b00752bc39ff063ca9864c74`.
+Its Apache license is retained in `SECCOMP-LICENSE`. The future Rust profile MUST preserve the baseline's default deny,
+architecture mapping and other reviewed syscall conditions. It MUST remove every socket/socketpair/socketcall
+allowance and add only socket/socketpair with argument zero equal to AF_UNIX. This avoids inventing a syscall allowlist.
+The original file hash MUST be checked before generating the effective profile.
+Both original and effective profile hashes MUST be checked before EVERY host command.
+The AF_UNIX layer is required because this contract denies INET sockets including
+loopback; `--network none` alone permits loopback. Preserve reviewed syscalls
+rather than introducing an unchecked custom allowlist.
+
+The Rust container adapter (`boundary/docker.rs`, implemented; unqualified) MUST combine `--network none` with that
+seccomp profile, drop all capabilities, set no-new-privileges, use private IPC
+and Docker's default private PID namespace (no invalid `--pid=private`), a
+read-only root and UID 65532 with prepared writable ownership. Memory, CPU and
+process limits MUST fit the actual host; Cargo A jobs 4/B jobs 2 does not
+authorize four container CPUs on a two-vCPU host. No host daemon socket is mounted.
+
+Both profiles and an empty Docker client configuration MUST live in a host-owned
+root disjoint from every container-writable workspace. Scan BEFORE creating
+these inputs and rehash BOTH profiles before EVERY host command. Select the
+authenticated fixed Docker client, explicit empty config and Unix daemon; reject
+TTY, plugins, alternate contexts and inherited Docker overrides. Read-only
+anchors MUST remain outside the writable root. Test escaping/dangling aliases
+in the CONTAINER namespace, not only their host interpretation.
+
+The earlier local-only finding (a Docker client without a usable daemon, so no
+actual Linux execution proof) is superseded: ordinary Ubuntu 24.04 CI runs the
+real container boundary and the Linux candidate recipes, recorded in the
+[confined Cargo candidate](2026-10-16-confined-cargo-candidate.md) and
+[Linux CLI candidate](2026-10-16-linux-cli-candidate.md) reports and the
+[GNU follow-up](2026-10-20-linux-cli-gnu-follow-up.md). That is candidate
+evidence, not qualification. Rust MUST execute positive, denied and full-recipe
+controls with the same selected native probe and OCI image, not merely compare
+command arguments. Controls map approved workspace inputs to `/work`, with
+shared tools/source read-only. Scan sockets and aliases before use; this does
+not claim protection against an adversarial mutable host mount.
+
+The macOS Rust adapter (`boundary/macos.rs`, implemented; unqualified) MUST enforce private-path/AF_UNIX rules, denying
+INET, arbitrary Mach lookup and AppleEvent delegation. The same generated
+profile wraps positive/denied probes and the full Cargo/compiler/proc-macro/
+build-script/native-tool invocation; Task 7's lifecycle/JS boundary needs the
+same actual qualification.
+
+Tracked source and Git-object stores MUST be immutable while private installation/
+output writes remain available. Deny ancestor unlink/rename. Every immutable
+regular file MUST have `nlink == 1` before execution; reject pre-existing
+hard-link aliases and execute write-through/restoration negatives. Limit signals
+to `same-sandbox`: own-child success and outside same-user sibling/orchestrator
+denial are required. Deleted local prototypes do not establish these Rust proofs.
+
+Both boundaries require actual positive then confined TCP and UDP bind/connect/
+send probes for IPv4/IPv6, loopback/documentation-address destinations, across
+parent/child/grandchild, plus private Unix exchange. External routing failures and
+unsupported unconfined IPv6 are recorded as unavailable, never successful
+controls. Positive IPv4 loopback operations MUST succeed, every confined INET
+operation MUST return EPERM/EACCES, and private Unix exchange MUST succeed. A
+socket helper is only boundary evidence; full recipe success is a separate gate.
+
+The Task 13 candidate release index (`src/distribution.rs`) is candidate
+evidence only. Its tag is the sentinel `v0.0.0-unqualified-candidate`, its bytes
+are named only `candidate-release-index.json`, and both signature bundle records
+of every artifact are empty-file records. Every unsigned companion declares
+`"release_qualification": false` and lists its gaps. The CLI verifier rejects
+size-0 bundle records, so a candidate index can never verify. It does not
+qualify an environment, and no command writes, signs or publishes it.
+
+## Reviewable hosted resource proposal
+
+The adjacent `hosted-workflow.proposal.yml` is inert outside `.github/workflows`.
+Its only trigger is manual workflow_dispatch with no inputs. It uses three fresh
+GitHub-hosted jobs: `ubuntu-24.04`, `macos-15`, `macos-15-intel`; 120 minutes each,
+no matrix fail-fast, no concurrent cancellation, contents-read only, no OIDC,
+attestation/provider/release permissions, credentials, cache restore or publish
+steps. Logs are retained for seven days. Action versions and full revisions were
+verified from primary action metadata for checkout 5.0.0 and upload-artifact
+6.0.0 (Node 24); full fetch history avoids the pending shallow-source rejection.
+Pins require manual review/maintenance: Dependabot does not scan this inert
+path outside `.github/workflows`. Logs use `tee` with `pipefail` so failure
+output is visible and retained. Native Rust bootstrap steps remain pending; they are source-reviewed code selections, not independently
+authenticated tool archives. Runner labels were checked against primary GitHub
+runner documentation on 2026-10-14; availability MUST be rechecked at dispatch.
+
+This proposal intentionally stops at `check-ready`. It cannot falsely report a
+complete qualification with version-only probes. The reviewed executable staging
+steps may replace that stop only when all prerequisites below are complete. Production selection MUST
+require all qualified inputs by default; named audit diagnostics cannot
+construct approval state or turn pending/null pins into success:
+
+1. Task 9 implements the shared full production recipes, native inspection and
+   exact-final-Wasm core-ABI/publisher-response validation. The staging selector
+   MUST invoke those same source-owned functions with independently authenticated
+   candidate selections. It cannot require its own future production-qualified
+   result, accept downloaded commands or introduce a public local-fixture bypass.
+2. Review independently approved-source native Rust bootstrap and actually acquire
+   Git/shell, signed Rust 1.98.1 components/sysroot, compiler/linker/archiver,
+   Node 24.20.0,
+   npm 11.19.0 and the selected runtime tools through source-owned authenticators.
+   Node uses signed checksums and independently reviewed keys; Rust uses signed
+   manifests/components; gh uses its verified archive and independent bootstrap.
+   A colocated checksum alone does not authenticate Fastly or an SDK. Retain raw
+   signature/checksum evidence, reviewed trust roots, archive and extracted-tree
+   digests and actual selected file identities. SDK/platform trust needs an
+   explicit vendor/platform evidence chain. Ambient PATH cannot select unreviewed native tools before isolation. A
+   source-built tool and colocated checksum supply no qualifying bootstrap proof.
+   Authenticate original Fastly vendor archive bytes through independently reviewed
+   vendor-source evidence; no missing-root fallback is permitted.
+3. Acquire the candidate GNU image by authenticated content identity, record both
+   OCI index and selected AMD64 manifest digests, and measure glibc <=2.34 inside
+   that builder. Select the three runtime-only images by their actual digests.
+   Record native archive/link/sysroot identities: aws-lc-sys 0.42 target-suffix
+   overrides and generic/target system-use=0, AWS-LC 5.1 source, ring 0.17.14
+   pregenerated source membership, and libsqlite3-sys 0.38.2 bundled SQLite
+   source/pkg-config=0. Wrapper versions do not establish the native
+   implementation version in emitted evidence.
+4. Network-enabled authenticated archive/tool acquisition precedes fresh offline
+   installation and compilation. Execute actual lifecycle hooks under the selected
+   native denial boundary; recording an install flag alone is insufficient.
+   Close source/object-store writes and run positive/negative probes,
+   full working compilation, actual Cargo/npm download-attempt negatives and
+   actual missing-tool negatives through the same selected boundary. Retain
+   outcomes and attempted fetch evidence even when a script catches denial.
+   Audit inherited hosted/setup exports before clearing them; only explicitly
+   reviewed qualified values/path identities may survive. Bound subprocess
+   pipes/deadlines, clear token/provider/injection environment, terminate/reap
+   descendant groups on timeout/cancellation/failure and
+   clean up private profiles/resources and Docker containers with bounded removal.
+5. Outside the compile-denial boundary, run the exact CLI bytes outside checkout
+   on clean UBI 9/Ubuntu 22.04/Debian 12 and actual native macOS 15 ARM/Intel.
+   Verify GNU symbol ceiling/libraries and Mach-O LC_BUILD_VERSION 13.0. Validate
+   the exact final Fastly Wasm with pinned Wasmtime and complete publisher-origin
+   response/injection through pinned Viceroy, retaining pre/post byte hashes.
+   No health-only success, cross-Intel inference or changed cohort is accepted.
+6. Join every observation to the reviewed approved-source catalog, selection
+   digest, exact tool versions/authentication methods and full helper closure
+   before accepting it. Record actual errno; do not invent `ETIMEDOUT`. Hash the
+   selected shell rather than assuming `/bin/sh --version` works. Use
+   host-independent tool/environment fixtures. Collect the closed observations
+   with actual repository/owner/run/attempt/job
+   identities and raw retained evidence. Independently authenticate and review
+   those identities, acquisitions, source closure and selections. A valid receipt
+   proves only its signed contents; independent catalog/source/root approval is
+   still required and cannot be supplied by that receipt or its checksum. Only then
+   update the source-owned measured pins and implement their production selector.
+
+New workflow files on a feature branch may be unavailable to manual dispatch
+until registered on a repository's default branch. The concrete safe option is
+an explicitly authorized disposable mirror whose default branch contains the
+approved source commit plus the reviewed staging workflow. Record its actual
+repository and owner IDs as disposable observations. Do not merge into this
+project's main branch to register the proposal. A mirror's identity never satisfies
+the fixed production IAB repository/SAN/policy, and no production policy changes
+are authorized by rehearsal. Repository creation/default-branch registration,
+resource spending and dispatch remain separate permission gates.
+
+Missing native Intel or the GNU baseline stops this cohort. Only after actual
+hosted qualification may the final Task 8 commit use the title `Qualify controlled
+release build environments`. The local framework commit MUST use an accurate
+title such as `Add release environment qualification checks`.
diff --git a/scripts/release/qualification/SECCOMP-LICENSE b/scripts/release/qualification/SECCOMP-LICENSE
new file mode 100644
index 0000000000..d645695673
--- /dev/null
+++ b/scripts/release/qualification/SECCOMP-LICENSE
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/scripts/release/qualification/approvals.json b/scripts/release/qualification/approvals.json
new file mode 100644
index 0000000000..9c9af1782b
--- /dev/null
+++ b/scripts/release/qualification/approvals.json
@@ -0,0 +1 @@
+{"schema_version":1,"environments":{"gnu-builder-x86_64":null,"macos15-aarch64":null,"macos15-x86_64":null},"qualifications":{"tsjs":null,"trusted-server-fastly.wasm":null,"ts-aarch64-apple-darwin":null,"ts-x86_64-apple-darwin":null,"ts-x86_64-unknown-linux-gnu":null}}
diff --git a/scripts/release/qualification/hosted-workflow.proposal.yml b/scripts/release/qualification/hosted-workflow.proposal.yml
new file mode 100644
index 0000000000..166b72e5c2
--- /dev/null
+++ b/scripts/release/qualification/hosted-workflow.proposal.yml
@@ -0,0 +1,49 @@
+# Inert proposal: this file is deliberately outside .github/workflows.
+# Action pins here require manual review/maintenance; Dependabot does not scan this path.
+# Register only in a separately authorized disposable mirror after Task 9 and
+# independently authenticated candidate acquisitions are reviewed.
+name: Disposable release environment qualification
+on:
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: disposable-release-qualification
+  cancel-in-progress: false
+jobs:
+  qualification:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-24.04
+            environment: gnu-builder-x86_64
+          - runner: macos-15
+            environment: macos15-aarch64
+          - runner: macos-15-intel
+            environment: macos15-x86_64
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 120
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 (Node 24)
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+          fetch-depth: 0
+      - name: Refuse incomplete shared recipes and staging acquisitions
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p "$RUNNER_TEMP/qualification-logs"
+          /bin/sh scripts/release/bootstrap.sh qualify check-ready 2>&1 | tee "$RUNNER_TEMP/qualification-logs/readiness.log"
+      - name: Retain diagnostic logs
+        if: always()
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 (Node 24)
+        with:
+          name: qualification-${{ matrix.environment }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/qualification-logs/
+          if-no-files-found: error
+          retention-days: 7
+          compression-level: 0
diff --git a/scripts/release/qualification/results.schema.json b/scripts/release/qualification/results.schema.json
new file mode 100644
index 0000000000..9ca1ef7072
--- /dev/null
+++ b/scripts/release/qualification/results.schema.json
@@ -0,0 +1,554 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://example.com/release/qualification-results-v1.schema.json",
+  "title": "Disposable release environment observations (not qualification authority)",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "schema_version": {
+      "const": 1,
+      "type": "integer"
+    },
+    "purpose": {
+      "const": "disposable-rehearsal-observation"
+    },
+    "source_commit": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{40}$"
+    },
+    "closure_sha256": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{64}$"
+    },
+    "selection_sha256": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{64}$"
+    },
+    "raw_tools_sha256": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{64}$"
+    },
+    "dependency_sha256": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{64}$"
+    },
+    "run": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "repository_id": {
+          "type": "string",
+          "pattern": "^[1-9][0-9]*$"
+        },
+        "owner_id": {
+          "type": "string",
+          "pattern": "^[1-9][0-9]*$"
+        },
+        "run_id": {
+          "type": "string",
+          "pattern": "^[1-9][0-9]*$"
+        },
+        "attempt": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 1000
+        },
+        "job": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 4096
+        },
+        "runner": {
+          "const": "github-hosted"
+        }
+      },
+      "required": [
+        "repository_id",
+        "owner_id",
+        "run_id",
+        "attempt",
+        "job",
+        "runner"
+      ]
+    },
+    "host": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "environment_id": {
+          "enum": ["gnu-builder-x86_64", "macos15-aarch64", "macos15-x86_64"]
+        },
+        "kind": {
+          "enum": ["oci-builder", "github-hosted-macos"]
+        },
+        "architecture": {
+          "enum": ["aarch64", "x86_64"]
+        },
+        "kernel_architecture": {
+          "enum": ["aarch64", "x86_64"]
+        },
+        "os_version": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 4096
+        },
+        "translated": {
+          "type": "boolean"
+        },
+        "runner_image_version": {
+          "anyOf": [
+            {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 4096
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "oci_index_sha256": {
+          "anyOf": [
+            {
+              "type": "string",
+              "pattern": "^[0-9a-f]{64}$"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "oci_manifest_sha256": {
+          "anyOf": [
+            {
+              "type": "string",
+              "pattern": "^[0-9a-f]{64}$"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "glibc_version": {
+          "anyOf": [
+            {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 4096
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "identity_log_sha256": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{64}$"
+        }
+      },
+      "required": [
+        "environment_id",
+        "kind",
+        "architecture",
+        "kernel_architecture",
+        "os_version",
+        "translated",
+        "runner_image_version",
+        "oci_index_sha256",
+        "oci_manifest_sha256",
+        "glibc_version",
+        "identity_log_sha256"
+      ]
+    },
+    "sdk": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "kind": {
+          "enum": ["apple-sdk", "gnu-sysroot"]
+        },
+        "version": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 4096
+        },
+        "build_version": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 4096
+        },
+        "tree_sha256": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{64}$"
+        },
+        "vendor_evidence_sha256": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{64}$"
+        }
+      },
+      "required": [
+        "kind",
+        "version",
+        "build_version",
+        "tree_sha256",
+        "vendor_evidence_sha256"
+      ]
+    },
+    "tools": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+          "name": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 4096
+          },
+          "version": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 4096
+          },
+          "file_sha256": {
+            "type": "string",
+            "pattern": "^[0-9a-f]{64}$"
+          },
+          "archive_sha256": {
+            "type": "string",
+            "pattern": "^[0-9a-f]{64}$"
+          },
+          "tree_sha256": {
+            "type": "string",
+            "pattern": "^[0-9a-f]{64}$"
+          },
+          "authentication": {
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+              "method": {
+                "enum": [
+                  "vendor-signature",
+                  "github-attestation",
+                  "hosted-platform-sdk"
+                ]
+              },
+              "evidence_sha256": {
+                "type": "string",
+                "pattern": "^[0-9a-f]{64}$"
+              },
+              "trust_root_sha256": {
+                "type": "string",
+                "pattern": "^[0-9a-f]{64}$"
+              }
+            },
+            "required": ["method", "evidence_sha256", "trust_root_sha256"]
+          }
+        },
+        "required": [
+          "name",
+          "version",
+          "file_sha256",
+          "archive_sha256",
+          "tree_sha256",
+          "authentication"
+        ]
+      },
+      "maxItems": 32
+    },
+    "recipe": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "enum": [
+            "ts-aarch64-apple-darwin",
+            "ts-x86_64-apple-darwin",
+            "ts-x86_64-unknown-linux-gnu",
+            "trusted-server-fastly.wasm",
+            "tsjs"
+          ]
+        },
+        "boundary_sha256": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{64}$"
+        },
+        "preparation_log_sha256": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{64}$"
+        },
+        "compile_log_sha256": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{64}$"
+        },
+        "native_log_sha256": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{64}$"
+        },
+        "exit_code": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 255
+        },
+        "full_recipe": {
+          "type": "boolean"
+        },
+        "same_boundary": {
+          "type": "boolean"
+        },
+        "executable_sha256": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{64}$"
+        },
+        "native_materials_sha256": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{64}$"
+        },
+        "deployment_target": {
+          "anyOf": [
+            {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 4096
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "glibc_symbols": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 4096
+          },
+          "maxItems": 8192
+        },
+        "unconfined": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+              "depth": {
+                "type": "integer",
+                "minimum": 0,
+                "maximum": 2
+              },
+              "family": {
+                "enum": ["ipv4", "ipv6", "unix"]
+              },
+              "operation": {
+                "enum": ["bind", "connect", "send", "exchange"]
+              },
+              "destination": {
+                "enum": ["loopback", "external", "private"]
+              },
+              "outcome": {
+                "enum": ["allowed", "denied", "unavailable"]
+              },
+              "errno": {
+                "type": "integer",
+                "minimum": 0,
+                "maximum": 9007199254740991
+              },
+              "phase": {
+                "enum": ["socket", "bind", "connect", "send", "exchange"]
+              },
+              "protocol": {
+                "enum": ["tcp", "udp", "unix"]
+              }
+            },
+            "required": [
+              "depth",
+              "family",
+              "operation",
+              "destination",
+              "outcome",
+              "errno",
+              "phase",
+              "protocol"
+            ]
+          },
+          "maxItems": 75
+        },
+        "confined": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+              "depth": {
+                "type": "integer",
+                "minimum": 0,
+                "maximum": 2
+              },
+              "family": {
+                "enum": ["ipv4", "ipv6", "unix"]
+              },
+              "operation": {
+                "enum": ["bind", "connect", "send", "exchange"]
+              },
+              "destination": {
+                "enum": ["loopback", "external", "private"]
+              },
+              "outcome": {
+                "enum": ["allowed", "denied", "unavailable"]
+              },
+              "errno": {
+                "type": "integer",
+                "minimum": 0,
+                "maximum": 9007199254740991
+              },
+              "phase": {
+                "enum": ["socket", "bind", "connect", "send", "exchange"]
+              },
+              "protocol": {
+                "enum": ["tcp", "udp", "unix"]
+              }
+            },
+            "required": [
+              "depth",
+              "family",
+              "operation",
+              "destination",
+              "outcome",
+              "errno",
+              "phase",
+              "protocol"
+            ]
+          },
+          "maxItems": 75
+        },
+        "download_attempts": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "cargo": {
+              "enum": ["denied", "allowed", "unavailable"]
+            },
+            "npm": {
+              "enum": ["denied", "allowed", "unavailable"]
+            },
+            "missing_tool": {
+              "enum": ["failed", "succeeded", "unavailable"]
+            }
+          },
+          "required": ["cargo", "npm", "missing_tool"]
+        }
+      },
+      "required": [
+        "id",
+        "boundary_sha256",
+        "preparation_log_sha256",
+        "compile_log_sha256",
+        "native_log_sha256",
+        "exit_code",
+        "full_recipe",
+        "same_boundary",
+        "executable_sha256",
+        "native_materials_sha256",
+        "deployment_target",
+        "glibc_symbols",
+        "unconfined",
+        "confined",
+        "download_attempts"
+      ]
+    },
+    "runtime": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+          "environment_id": {
+            "enum": [
+              "ubi9-x86_64",
+              "ubuntu22.04-x86_64",
+              "debian12-x86_64",
+              "macos15-aarch64",
+              "macos15-x86_64",
+              "fastly-viceroy",
+              "js-pair"
+            ]
+          },
+          "architecture": {
+            "enum": ["aarch64", "x86_64", "wasm32"]
+          },
+          "os_version": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 4096
+          },
+          "outside_checkout": {
+            "type": "boolean"
+          },
+          "exit_code": {
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 255
+          },
+          "kind": {
+            "enum": [
+              "cli-startup",
+              "publisher-request",
+              "js-tests-and-equality"
+            ]
+          },
+          "executable_sha256": {
+            "type": "string",
+            "pattern": "^[0-9a-f]{64}$"
+          },
+          "executable_after_sha256": {
+            "type": "string",
+            "pattern": "^[0-9a-f]{64}$"
+          },
+          "log_sha256": {
+            "type": "string",
+            "pattern": "^[0-9a-f]{64}$"
+          },
+          "response_sha256": {
+            "anyOf": [
+              {
+                "type": "string",
+                "pattern": "^[0-9a-f]{64}$"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          }
+        },
+        "required": [
+          "environment_id",
+          "architecture",
+          "os_version",
+          "outside_checkout",
+          "exit_code",
+          "kind",
+          "executable_sha256",
+          "executable_after_sha256",
+          "log_sha256",
+          "response_sha256"
+        ]
+      },
+      "maxItems": 8
+    }
+  },
+  "required": [
+    "schema_version",
+    "purpose",
+    "source_commit",
+    "closure_sha256",
+    "selection_sha256",
+    "raw_tools_sha256",
+    "dependency_sha256",
+    "run",
+    "host",
+    "sdk",
+    "tools",
+    "recipe",
+    "runtime"
+  ]
+}
diff --git a/scripts/release/qualification/seccomp-default.json b/scripts/release/qualification/seccomp-default.json
new file mode 100644
index 0000000000..ea5a494afb
--- /dev/null
+++ b/scripts/release/qualification/seccomp-default.json
@@ -0,0 +1,875 @@
+{
+	"defaultAction": "SCMP_ACT_ERRNO",
+	"defaultErrnoRet": 1,
+	"archMap": [
+		{
+			"architecture": "SCMP_ARCH_X86_64",
+			"subArchitectures": [
+				"SCMP_ARCH_X86",
+				"SCMP_ARCH_X32"
+			]
+		},
+		{
+			"architecture": "SCMP_ARCH_AARCH64",
+			"subArchitectures": [
+				"SCMP_ARCH_ARM"
+			]
+		},
+		{
+			"architecture": "SCMP_ARCH_MIPS64",
+			"subArchitectures": [
+				"SCMP_ARCH_MIPS",
+				"SCMP_ARCH_MIPS64N32"
+			]
+		},
+		{
+			"architecture": "SCMP_ARCH_MIPS64N32",
+			"subArchitectures": [
+				"SCMP_ARCH_MIPS",
+				"SCMP_ARCH_MIPS64"
+			]
+		},
+		{
+			"architecture": "SCMP_ARCH_MIPSEL64",
+			"subArchitectures": [
+				"SCMP_ARCH_MIPSEL",
+				"SCMP_ARCH_MIPSEL64N32"
+			]
+		},
+		{
+			"architecture": "SCMP_ARCH_MIPSEL64N32",
+			"subArchitectures": [
+				"SCMP_ARCH_MIPSEL",
+				"SCMP_ARCH_MIPSEL64"
+			]
+		},
+		{
+			"architecture": "SCMP_ARCH_S390X",
+			"subArchitectures": [
+				"SCMP_ARCH_S390"
+			]
+		},
+		{
+			"architecture": "SCMP_ARCH_RISCV64",
+			"subArchitectures": null
+		},
+		{
+			"architecture": "SCMP_ARCH_LOONGARCH64",
+			"subArchitectures": null
+		}
+	],
+	"syscalls": [
+		{
+			"names": [
+				"accept",
+				"accept4",
+				"access",
+				"adjtimex",
+				"alarm",
+				"bind",
+				"brk",
+				"cachestat",
+				"capget",
+				"capset",
+				"chdir",
+				"chmod",
+				"chown",
+				"chown32",
+				"clock_adjtime",
+				"clock_adjtime64",
+				"clock_getres",
+				"clock_getres_time64",
+				"clock_gettime",
+				"clock_gettime64",
+				"clock_nanosleep",
+				"clock_nanosleep_time64",
+				"close",
+				"close_range",
+				"connect",
+				"copy_file_range",
+				"creat",
+				"dup",
+				"dup2",
+				"dup3",
+				"epoll_create",
+				"epoll_create1",
+				"epoll_ctl",
+				"epoll_ctl_old",
+				"epoll_pwait",
+				"epoll_pwait2",
+				"epoll_wait",
+				"epoll_wait_old",
+				"eventfd",
+				"eventfd2",
+				"execve",
+				"execveat",
+				"exit",
+				"exit_group",
+				"faccessat",
+				"faccessat2",
+				"fadvise64",
+				"fadvise64_64",
+				"fallocate",
+				"fanotify_mark",
+				"fchdir",
+				"fchmod",
+				"fchmodat",
+				"fchmodat2",
+				"fchown",
+				"fchown32",
+				"fchownat",
+				"fcntl",
+				"fcntl64",
+				"fdatasync",
+				"fgetxattr",
+				"flistxattr",
+				"flock",
+				"fork",
+				"fremovexattr",
+				"fsetxattr",
+				"fstat",
+				"fstat64",
+				"fstatat64",
+				"fstatfs",
+				"fstatfs64",
+				"fsync",
+				"ftruncate",
+				"ftruncate64",
+				"futex",
+				"futex_requeue",
+				"futex_time64",
+				"futex_wait",
+				"futex_waitv",
+				"futex_wake",
+				"futimesat",
+				"getcpu",
+				"getcwd",
+				"getdents",
+				"getdents64",
+				"getegid",
+				"getegid32",
+				"geteuid",
+				"geteuid32",
+				"getgid",
+				"getgid32",
+				"getgroups",
+				"getgroups32",
+				"getitimer",
+				"getpeername",
+				"getpgid",
+				"getpgrp",
+				"getpid",
+				"getppid",
+				"getpriority",
+				"getrandom",
+				"getresgid",
+				"getresgid32",
+				"getresuid",
+				"getresuid32",
+				"getrlimit",
+				"get_robust_list",
+				"getrusage",
+				"getsid",
+				"getsockname",
+				"getsockopt",
+				"get_thread_area",
+				"gettid",
+				"gettimeofday",
+				"getuid",
+				"getuid32",
+				"getxattr",
+				"getxattrat",
+				"inotify_add_watch",
+				"inotify_init",
+				"inotify_init1",
+				"inotify_rm_watch",
+				"io_cancel",
+				"ioctl",
+				"io_destroy",
+				"io_getevents",
+				"io_pgetevents",
+				"io_pgetevents_time64",
+				"ioprio_get",
+				"ioprio_set",
+				"io_setup",
+				"io_submit",
+				"ipc",
+				"kill",
+				"landlock_add_rule",
+				"landlock_create_ruleset",
+				"landlock_restrict_self",
+				"lchown",
+				"lchown32",
+				"lgetxattr",
+				"link",
+				"linkat",
+				"listen",
+				"listmount",
+				"listxattr",
+				"listxattrat",
+				"llistxattr",
+				"_llseek",
+				"lremovexattr",
+				"lseek",
+				"lsetxattr",
+				"lstat",
+				"lstat64",
+				"madvise",
+				"map_shadow_stack",
+				"membarrier",
+				"memfd_create",
+				"memfd_secret",
+				"mincore",
+				"mkdir",
+				"mkdirat",
+				"mknod",
+				"mknodat",
+				"mlock",
+				"mlock2",
+				"mlockall",
+				"mmap",
+				"mmap2",
+				"mprotect",
+				"mq_getsetattr",
+				"mq_notify",
+				"mq_open",
+				"mq_timedreceive",
+				"mq_timedreceive_time64",
+				"mq_timedsend",
+				"mq_timedsend_time64",
+				"mq_unlink",
+				"mremap",
+				"mseal",
+				"msgctl",
+				"msgget",
+				"msgrcv",
+				"msgsnd",
+				"msync",
+				"munlock",
+				"munlockall",
+				"munmap",
+				"name_to_handle_at",
+				"nanosleep",
+				"newfstatat",
+				"_newselect",
+				"open",
+				"openat",
+				"openat2",
+				"pause",
+				"pidfd_open",
+				"pidfd_send_signal",
+				"pipe",
+				"pipe2",
+				"pkey_alloc",
+				"pkey_free",
+				"pkey_mprotect",
+				"poll",
+				"ppoll",
+				"ppoll_time64",
+				"prctl",
+				"pread64",
+				"preadv",
+				"preadv2",
+				"prlimit64",
+				"process_mrelease",
+				"pselect6",
+				"pselect6_time64",
+				"pwrite64",
+				"pwritev",
+				"pwritev2",
+				"read",
+				"readahead",
+				"readlink",
+				"readlinkat",
+				"readv",
+				"recv",
+				"recvfrom",
+				"recvmmsg",
+				"recvmmsg_time64",
+				"recvmsg",
+				"remap_file_pages",
+				"removexattr",
+				"removexattrat",
+				"rename",
+				"renameat",
+				"renameat2",
+				"restart_syscall",
+				"riscv_hwprobe",
+				"rmdir",
+				"rseq",
+				"rt_sigaction",
+				"rt_sigpending",
+				"rt_sigprocmask",
+				"rt_sigqueueinfo",
+				"rt_sigreturn",
+				"rt_sigsuspend",
+				"rt_sigtimedwait",
+				"rt_sigtimedwait_time64",
+				"rt_tgsigqueueinfo",
+				"sched_getaffinity",
+				"sched_getattr",
+				"sched_getparam",
+				"sched_get_priority_max",
+				"sched_get_priority_min",
+				"sched_getscheduler",
+				"sched_rr_get_interval",
+				"sched_rr_get_interval_time64",
+				"sched_setaffinity",
+				"sched_setattr",
+				"sched_setparam",
+				"sched_setscheduler",
+				"sched_yield",
+				"seccomp",
+				"select",
+				"semctl",
+				"semget",
+				"semop",
+				"semtimedop",
+				"semtimedop_time64",
+				"send",
+				"sendfile",
+				"sendfile64",
+				"sendmmsg",
+				"sendmsg",
+				"sendto",
+				"setfsgid",
+				"setfsgid32",
+				"setfsuid",
+				"setfsuid32",
+				"setgid",
+				"setgid32",
+				"setgroups",
+				"setgroups32",
+				"setitimer",
+				"setpgid",
+				"setpriority",
+				"setregid",
+				"setregid32",
+				"setresgid",
+				"setresgid32",
+				"setresuid",
+				"setresuid32",
+				"setreuid",
+				"setreuid32",
+				"setrlimit",
+				"set_robust_list",
+				"setsid",
+				"setsockopt",
+				"set_thread_area",
+				"set_tid_address",
+				"setuid",
+				"setuid32",
+				"setxattr",
+				"setxattrat",
+				"shmat",
+				"shmctl",
+				"shmdt",
+				"shmget",
+				"shutdown",
+				"sigaltstack",
+				"signalfd",
+				"signalfd4",
+				"sigprocmask",
+				"sigreturn",
+				"socketcall",
+				"socketpair",
+				"splice",
+				"stat",
+				"stat64",
+				"statfs",
+				"statfs64",
+				"statmount",
+				"statx",
+				"symlink",
+				"symlinkat",
+				"sync",
+				"sync_file_range",
+				"syncfs",
+				"sysinfo",
+				"tee",
+				"tgkill",
+				"time",
+				"timer_create",
+				"timer_delete",
+				"timer_getoverrun",
+				"timer_gettime",
+				"timer_gettime64",
+				"timer_settime",
+				"timer_settime64",
+				"timerfd_create",
+				"timerfd_gettime",
+				"timerfd_gettime64",
+				"timerfd_settime",
+				"timerfd_settime64",
+				"times",
+				"tkill",
+				"truncate",
+				"truncate64",
+				"ugetrlimit",
+				"umask",
+				"uname",
+				"unlink",
+				"unlinkat",
+				"uretprobe",
+				"utime",
+				"utimensat",
+				"utimensat_time64",
+				"utimes",
+				"vfork",
+				"vmsplice",
+				"wait4",
+				"waitid",
+				"waitpid",
+				"write",
+				"writev"
+			],
+			"action": "SCMP_ACT_ALLOW"
+		},
+		{
+			"names": [
+				"process_vm_readv",
+				"process_vm_writev",
+				"ptrace"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"includes": {
+				"minKernel": "4.8"
+			}
+		},
+		{
+			"names": [
+				"socket"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"args": [
+				{
+					"index": 0,
+					"value": 38,
+					"op": "SCMP_CMP_LT"
+				}
+			]
+		},
+		{
+			"names": [
+				"socket"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"args": [
+				{
+					"index": 0,
+					"value": 39,
+					"op": "SCMP_CMP_EQ"
+				}
+			]
+		},
+		{
+			"names": [
+				"socket"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"args": [
+				{
+					"index": 0,
+					"value": 40,
+					"op": "SCMP_CMP_GT"
+				}
+			]
+		},
+		{
+			"names": [
+				"personality"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"args": [
+				{
+					"index": 0,
+					"value": 0,
+					"op": "SCMP_CMP_EQ"
+				}
+			]
+		},
+		{
+			"names": [
+				"personality"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"args": [
+				{
+					"index": 0,
+					"value": 8,
+					"op": "SCMP_CMP_EQ"
+				}
+			]
+		},
+		{
+			"names": [
+				"personality"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"args": [
+				{
+					"index": 0,
+					"value": 131072,
+					"op": "SCMP_CMP_EQ"
+				}
+			]
+		},
+		{
+			"names": [
+				"personality"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"args": [
+				{
+					"index": 0,
+					"value": 131080,
+					"op": "SCMP_CMP_EQ"
+				}
+			]
+		},
+		{
+			"names": [
+				"personality"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"args": [
+				{
+					"index": 0,
+					"value": 4294967295,
+					"op": "SCMP_CMP_EQ"
+				}
+			]
+		},
+		{
+			"names": [
+				"sync_file_range2",
+				"swapcontext"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"includes": {
+				"arches": [
+					"ppc64le"
+				]
+			}
+		},
+		{
+			"names": [
+				"arm_fadvise64_64",
+				"arm_sync_file_range",
+				"sync_file_range2",
+				"breakpoint",
+				"cacheflush",
+				"set_tls"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"includes": {
+				"arches": [
+					"arm",
+					"arm64"
+				]
+			}
+		},
+		{
+			"names": [
+				"arch_prctl"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"includes": {
+				"arches": [
+					"amd64",
+					"x32"
+				]
+			}
+		},
+		{
+			"names": [
+				"modify_ldt"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"includes": {
+				"arches": [
+					"amd64",
+					"x32",
+					"x86"
+				]
+			}
+		},
+		{
+			"names": [
+				"s390_pci_mmio_read",
+				"s390_pci_mmio_write",
+				"s390_runtime_instr"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"includes": {
+				"arches": [
+					"s390",
+					"s390x"
+				]
+			}
+		},
+		{
+			"names": [
+				"riscv_flush_icache"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"includes": {
+				"arches": [
+					"riscv64"
+				]
+			}
+		},
+		{
+			"names": [
+				"open_by_handle_at"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"includes": {
+				"caps": [
+					"CAP_DAC_READ_SEARCH"
+				]
+			}
+		},
+		{
+			"names": [
+				"bpf",
+				"clone",
+				"clone3",
+				"fanotify_init",
+				"fsconfig",
+				"fsmount",
+				"fsopen",
+				"fspick",
+				"lookup_dcookie",
+				"lsm_get_self_attr",
+				"lsm_list_modules",
+				"lsm_set_self_attr",
+				"mount",
+				"mount_setattr",
+				"move_mount",
+				"open_tree",
+				"perf_event_open",
+				"quotactl",
+				"quotactl_fd",
+				"setdomainname",
+				"sethostname",
+				"setns",
+				"syslog",
+				"umount",
+				"umount2",
+				"unshare"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"includes": {
+				"caps": [
+					"CAP_SYS_ADMIN"
+				]
+			}
+		},
+		{
+			"names": [
+				"clone"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"args": [
+				{
+					"index": 0,
+					"value": 2114060288,
+					"op": "SCMP_CMP_MASKED_EQ"
+				}
+			],
+			"excludes": {
+				"caps": [
+					"CAP_SYS_ADMIN"
+				],
+				"arches": [
+					"s390",
+					"s390x"
+				]
+			}
+		},
+		{
+			"names": [
+				"clone"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"args": [
+				{
+					"index": 1,
+					"value": 2114060288,
+					"op": "SCMP_CMP_MASKED_EQ"
+				}
+			],
+			"comment": "s390 parameter ordering for clone is different",
+			"includes": {
+				"arches": [
+					"s390",
+					"s390x"
+				]
+			},
+			"excludes": {
+				"caps": [
+					"CAP_SYS_ADMIN"
+				]
+			}
+		},
+		{
+			"names": [
+				"clone3"
+			],
+			"action": "SCMP_ACT_ERRNO",
+			"errnoRet": 38,
+			"excludes": {
+				"caps": [
+					"CAP_SYS_ADMIN"
+				]
+			}
+		},
+		{
+			"names": [
+				"reboot"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"includes": {
+				"caps": [
+					"CAP_SYS_BOOT"
+				]
+			}
+		},
+		{
+			"names": [
+				"chroot"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"includes": {
+				"caps": [
+					"CAP_SYS_CHROOT"
+				]
+			}
+		},
+		{
+			"names": [
+				"delete_module",
+				"init_module",
+				"finit_module"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"includes": {
+				"caps": [
+					"CAP_SYS_MODULE"
+				]
+			}
+		},
+		{
+			"names": [
+				"acct"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"includes": {
+				"caps": [
+					"CAP_SYS_PACCT"
+				]
+			}
+		},
+		{
+			"names": [
+				"kcmp",
+				"pidfd_getfd",
+				"process_madvise",
+				"process_vm_readv",
+				"process_vm_writev",
+				"ptrace"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"includes": {
+				"caps": [
+					"CAP_SYS_PTRACE"
+				]
+			}
+		},
+		{
+			"names": [
+				"iopl",
+				"ioperm"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"includes": {
+				"caps": [
+					"CAP_SYS_RAWIO"
+				]
+			}
+		},
+		{
+			"names": [
+				"settimeofday",
+				"stime",
+				"clock_settime",
+				"clock_settime64"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"includes": {
+				"caps": [
+					"CAP_SYS_TIME"
+				]
+			}
+		},
+		{
+			"names": [
+				"vhangup"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"includes": {
+				"caps": [
+					"CAP_SYS_TTY_CONFIG"
+				]
+			}
+		},
+		{
+			"names": [
+				"get_mempolicy",
+				"mbind",
+				"set_mempolicy",
+				"set_mempolicy_home_node"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"includes": {
+				"caps": [
+					"CAP_SYS_NICE"
+				]
+			}
+		},
+		{
+			"names": [
+				"syslog"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"includes": {
+				"caps": [
+					"CAP_SYSLOG"
+				]
+			}
+		},
+		{
+			"names": [
+				"bpf"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"includes": {
+				"caps": [
+					"CAP_BPF"
+				]
+			}
+		},
+		{
+			"names": [
+				"perf_event_open"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"includes": {
+				"caps": [
+					"CAP_PERFMON"
+				]
+			}
+		}
+	]
+}
\ No newline at end of file
diff --git a/scripts/release/release-cohort.json b/scripts/release/release-cohort.json
new file mode 100644
index 0000000000..be477ccbb3
--- /dev/null
+++ b/scripts/release/release-cohort.json
@@ -0,0 +1,79 @@
+{
+  "artifacts": [
+    {
+      "assurance_profile": "provenance-sbom-repeatable",
+      "bin": "trusted-server-adapter-fastly",
+      "capabilities": ["fastly-production"],
+      "compatibility": {
+        "architecture": "wasm32",
+        "minimum_version": "wasip1",
+        "runtime": "fastly-compute"
+      },
+      "default_features": true,
+      "features": [],
+      "kind": "wasm-core",
+      "name": "trusted-server-fastly.wasm",
+      "package": "trusted-server-adapter-fastly",
+      "role": "server",
+      "target": "wasm32-wasip1",
+      "variant": "default"
+    },
+    {
+      "assurance_profile": "provenance-sbom",
+      "bin": "ts",
+      "capabilities": ["cli-execute"],
+      "compatibility": {
+        "architecture": "aarch64",
+        "minimum_version": "13.0",
+        "runtime": "macos"
+      },
+      "default_features": true,
+      "features": [],
+      "kind": "native-executable",
+      "name": "ts-aarch64-apple-darwin",
+      "package": "trusted-server-cli",
+      "role": "operator-cli",
+      "target": "aarch64-apple-darwin",
+      "variant": "default"
+    },
+    {
+      "assurance_profile": "provenance-sbom",
+      "bin": "ts",
+      "capabilities": ["cli-execute"],
+      "compatibility": {
+        "architecture": "x86_64",
+        "minimum_version": "13.0",
+        "runtime": "macos"
+      },
+      "default_features": true,
+      "features": [],
+      "kind": "native-executable",
+      "name": "ts-x86_64-apple-darwin",
+      "package": "trusted-server-cli",
+      "role": "operator-cli",
+      "target": "x86_64-apple-darwin",
+      "variant": "default"
+    },
+    {
+      "assurance_profile": "provenance-sbom",
+      "bin": "ts",
+      "capabilities": ["cli-execute"],
+      "compatibility": {
+        "architecture": "x86_64",
+        "minimum_version": "glibc-2.34",
+        "runtime": "linux-gnu"
+      },
+      "default_features": true,
+      "features": [],
+      "kind": "native-executable",
+      "name": "ts-x86_64-unknown-linux-gnu",
+      "package": "trusted-server-cli",
+      "role": "operator-cli",
+      "target": "x86_64-unknown-linux-gnu",
+      "variant": "default"
+    }
+  ],
+  "cohort": "phase1-fastly-cli",
+  "eligible_branches": ["main"],
+  "schema_version": 1
+}
diff --git a/scripts/release/release-tools.json b/scripts/release/release-tools.json
new file mode 100644
index 0000000000..5abaa8e07b
--- /dev/null
+++ b/scripts/release/release-tools.json
@@ -0,0 +1,490 @@
+{
+  "environments": [
+    {
+      "acquisition": null,
+      "id": "debian12-x86_64",
+      "image_reference": null,
+      "kind": "oci-runtime",
+      "oci_index_sha256": null,
+      "oci_manifest_sha256": null,
+      "qualification": "pending",
+      "role": "compatibility-runtime"
+    },
+    {
+      "acquisition": null,
+      "glibc_maximum": "2.34",
+      "id": "gnu-builder-x86_64",
+      "image_reference": null,
+      "kind": "oci-builder",
+      "oci_index_sha256": null,
+      "oci_manifest_sha256": null,
+      "qualification": "pending",
+      "role": "compilation",
+      "sdk_sha256": null
+    },
+    {
+      "acquisition": null,
+      "id": "macos15-aarch64",
+      "kind": "github-hosted-macos",
+      "qualification": "pending",
+      "role": "compilation",
+      "runner_image_version": null,
+      "runner_label": "macos-15",
+      "sdk_sha256": null
+    },
+    {
+      "acquisition": null,
+      "id": "macos15-x86_64",
+      "kind": "github-hosted-macos",
+      "qualification": "pending",
+      "role": "compilation",
+      "runner_image_version": null,
+      "runner_label": "macos-15-intel",
+      "sdk_sha256": null
+    },
+    {
+      "acquisition": null,
+      "id": "ubi9-x86_64",
+      "image_reference": null,
+      "kind": "oci-runtime",
+      "oci_index_sha256": null,
+      "oci_manifest_sha256": null,
+      "qualification": "pending",
+      "role": "compatibility-runtime"
+    },
+    {
+      "acquisition": null,
+      "id": "ubuntu22.04-x86_64",
+      "image_reference": null,
+      "kind": "oci-runtime",
+      "oci_index_sha256": null,
+      "oci_manifest_sha256": null,
+      "qualification": "pending",
+      "role": "compatibility-runtime"
+    }
+  ],
+  "recipes": [
+    {
+      "environment_id": "gnu-builder-x86_64",
+      "id": "trusted-server-fastly.wasm",
+      "qualification": "pending",
+      "script": "scripts/release/build.sh",
+      "settings": {
+        "ambient_profiles": {
+          "A": {
+            "checkout_root": "external-release-A",
+            "execution_user": "qualification-selected",
+            "jobs": 4,
+            "locale": "C",
+            "timezone": "UTC",
+            "umask": "022"
+          },
+          "B": {
+            "checkout_root": "external-release-B",
+            "execution_user": "qualified-alternate-or-unsupported",
+            "jobs": 2,
+            "locale": "qualification-selected-alternate",
+            "timezone": "qualification-selected-alternate",
+            "umask": "027"
+          }
+        },
+        "aws_lc_target_selector": true,
+        "aws_lc_use_system": false,
+        "cargo_config": ".cargo/config.toml",
+        "cargo_frozen": true,
+        "cargo_home": "private-prepared",
+        "cargo_locked": true,
+        "cargo_message_format": "json-render-diagnostics",
+        "download_control": "actual-cargo-build-script-required",
+        "fresh_target": true,
+        "network_boundary": "source-owned-os-denial-v1",
+        "normalized_inputs": [
+          "compiler-locale-C",
+          "compiler-timezone-UTC",
+          "source-commit-epoch",
+          "remapped-paths"
+        ],
+        "npm_lifecycle": "reviewed-preparation-only",
+        "release_debug": 1,
+        "release_strip": "none",
+        "rust_toolchain": "1.98.1",
+        "sqlite_features": ["bundled"],
+        "sqlite_use_pkg_config": false,
+        "sysroot": "authenticated-sdk-required",
+        "tool_paths": "authenticated-absolute-paths-required",
+        "vite_config_loading": false,
+        "vite_env_loading": false,
+        "vite_mode": "production"
+      },
+      "sha256": null
+    },
+    {
+      "environment_id": "macos15-aarch64",
+      "id": "ts-aarch64-apple-darwin",
+      "qualification": "pending",
+      "script": "scripts/release/build.sh",
+      "settings": {
+        "ambient_profiles": {
+          "A": {
+            "checkout_root": "external-release-A",
+            "execution_user": "qualification-selected",
+            "jobs": 4,
+            "locale": "C",
+            "timezone": "UTC",
+            "umask": "022"
+          },
+          "B": {
+            "checkout_root": "external-release-B",
+            "execution_user": "qualified-alternate-or-unsupported",
+            "jobs": 2,
+            "locale": "qualification-selected-alternate",
+            "timezone": "qualification-selected-alternate",
+            "umask": "027"
+          }
+        },
+        "aws_lc_target_selector": true,
+        "aws_lc_use_system": false,
+        "cargo_config": ".cargo/config.toml",
+        "cargo_frozen": true,
+        "cargo_home": "private-prepared",
+        "cargo_locked": true,
+        "cargo_message_format": "json-render-diagnostics",
+        "download_control": "actual-cargo-build-script-required",
+        "fresh_target": true,
+        "network_boundary": "source-owned-os-denial-v1",
+        "normalized_inputs": [
+          "compiler-locale-C",
+          "compiler-timezone-UTC",
+          "source-commit-epoch",
+          "remapped-paths"
+        ],
+        "npm_lifecycle": "reviewed-preparation-only",
+        "release_debug": 1,
+        "release_strip": "none",
+        "rust_toolchain": "1.98.1",
+        "sqlite_features": ["bundled"],
+        "sqlite_use_pkg_config": false,
+        "sysroot": "authenticated-sdk-required",
+        "tool_paths": "authenticated-absolute-paths-required",
+        "vite_config_loading": false,
+        "vite_env_loading": false,
+        "vite_mode": "production"
+      },
+      "sha256": null
+    },
+    {
+      "environment_id": "macos15-x86_64",
+      "id": "ts-x86_64-apple-darwin",
+      "qualification": "pending",
+      "script": "scripts/release/build.sh",
+      "settings": {
+        "ambient_profiles": {
+          "A": {
+            "checkout_root": "external-release-A",
+            "execution_user": "qualification-selected",
+            "jobs": 4,
+            "locale": "C",
+            "timezone": "UTC",
+            "umask": "022"
+          },
+          "B": {
+            "checkout_root": "external-release-B",
+            "execution_user": "qualified-alternate-or-unsupported",
+            "jobs": 2,
+            "locale": "qualification-selected-alternate",
+            "timezone": "qualification-selected-alternate",
+            "umask": "027"
+          }
+        },
+        "aws_lc_target_selector": true,
+        "aws_lc_use_system": false,
+        "cargo_config": ".cargo/config.toml",
+        "cargo_frozen": true,
+        "cargo_home": "private-prepared",
+        "cargo_locked": true,
+        "cargo_message_format": "json-render-diagnostics",
+        "download_control": "actual-cargo-build-script-required",
+        "fresh_target": true,
+        "network_boundary": "source-owned-os-denial-v1",
+        "normalized_inputs": [
+          "compiler-locale-C",
+          "compiler-timezone-UTC",
+          "source-commit-epoch",
+          "remapped-paths"
+        ],
+        "npm_lifecycle": "reviewed-preparation-only",
+        "release_debug": 1,
+        "release_strip": "none",
+        "rust_toolchain": "1.98.1",
+        "sqlite_features": ["bundled"],
+        "sqlite_use_pkg_config": false,
+        "sysroot": "authenticated-sdk-required",
+        "tool_paths": "authenticated-absolute-paths-required",
+        "vite_config_loading": false,
+        "vite_env_loading": false,
+        "vite_mode": "production"
+      },
+      "sha256": null
+    },
+    {
+      "environment_id": "gnu-builder-x86_64",
+      "id": "ts-x86_64-unknown-linux-gnu",
+      "qualification": "pending",
+      "script": "scripts/release/build.sh",
+      "settings": {
+        "ambient_profiles": {
+          "A": {
+            "checkout_root": "external-release-A",
+            "execution_user": "qualification-selected",
+            "jobs": 4,
+            "locale": "C",
+            "timezone": "UTC",
+            "umask": "022"
+          },
+          "B": {
+            "checkout_root": "external-release-B",
+            "execution_user": "qualified-alternate-or-unsupported",
+            "jobs": 2,
+            "locale": "qualification-selected-alternate",
+            "timezone": "qualification-selected-alternate",
+            "umask": "027"
+          }
+        },
+        "aws_lc_target_selector": true,
+        "aws_lc_use_system": false,
+        "cargo_config": ".cargo/config.toml",
+        "cargo_frozen": true,
+        "cargo_home": "private-prepared",
+        "cargo_locked": true,
+        "cargo_message_format": "json-render-diagnostics",
+        "download_control": "actual-cargo-build-script-required",
+        "fresh_target": true,
+        "network_boundary": "source-owned-os-denial-v1",
+        "normalized_inputs": [
+          "compiler-locale-C",
+          "compiler-timezone-UTC",
+          "source-commit-epoch",
+          "remapped-paths"
+        ],
+        "npm_lifecycle": "reviewed-preparation-only",
+        "release_debug": 1,
+        "release_strip": "none",
+        "rust_toolchain": "1.98.1",
+        "sqlite_features": ["bundled"],
+        "sqlite_use_pkg_config": false,
+        "sysroot": "authenticated-sdk-required",
+        "tool_paths": "authenticated-absolute-paths-required",
+        "vite_config_loading": false,
+        "vite_env_loading": false,
+        "vite_mode": "production"
+      },
+      "sha256": null
+    },
+    {
+      "environment_id": "gnu-builder-x86_64",
+      "id": "tsjs",
+      "qualification": "pending",
+      "script": "scripts/release/build-js.sh",
+      "settings": {
+        "compare": "all-tracked-final-module-bytes",
+        "fresh_installations": 2,
+        "fresh_private_npm_caches": true,
+        "fresh_source": "tracked-objects-only",
+        "mandatory_tests": true,
+        "network_boundary": "source-owned-os-denial-v1",
+        "node_version": "24.20.0",
+        "npm_audit": false,
+        "npm_fund": false,
+        "npm_include_dev": true,
+        "npm_lifecycle": "reviewed-observed-foreground",
+        "npm_offline": true,
+        "npm_version": "11.19.0",
+        "publish": "A-only-after-equality",
+        "tool_paths": "authenticated-absolute-paths-required",
+        "vite_config_loading": false,
+        "vite_env_loading": false,
+        "vite_mode": "production"
+      },
+      "sha256": null
+    }
+  ],
+  "schema_version": 1,
+  "tools": [
+    {
+      "acquisition": null,
+      "name": "actions/attest:github-action",
+      "qualification": "pending",
+      "revision": "1e69f48acb82d1966a394da916b4c1698aa569d6",
+      "sha256": null,
+      "version": "4.2.2"
+    },
+    {
+      "acquisition": null,
+      "name": "fastly:aarch64-apple-darwin",
+      "qualification": "pending",
+      "revision": null,
+      "sha256": null,
+      "version": "16.0.0"
+    },
+    {
+      "acquisition": null,
+      "name": "fastly:x86_64-apple-darwin",
+      "qualification": "pending",
+      "revision": null,
+      "sha256": null,
+      "version": "16.0.0"
+    },
+    {
+      "acquisition": null,
+      "name": "fastly:x86_64-unknown-linux-gnu",
+      "qualification": "pending",
+      "revision": null,
+      "sha256": null,
+      "version": "16.0.0"
+    },
+    {
+      "acquisition": null,
+      "name": "gh:aarch64-apple-darwin",
+      "qualification": "pending",
+      "revision": null,
+      "sha256": null,
+      "version": "2.97.0"
+    },
+    {
+      "acquisition": null,
+      "name": "gh:x86_64-apple-darwin",
+      "qualification": "pending",
+      "revision": null,
+      "sha256": null,
+      "version": "2.97.0"
+    },
+    {
+      "acquisition": null,
+      "name": "gh:x86_64-unknown-linux-gnu",
+      "qualification": "pending",
+      "revision": null,
+      "sha256": null,
+      "version": "2.97.0"
+    },
+    {
+      "acquisition": null,
+      "name": "node:aarch64-apple-darwin",
+      "qualification": "pending",
+      "revision": null,
+      "sha256": null,
+      "version": "24.20.0"
+    },
+    {
+      "acquisition": null,
+      "name": "node:x86_64-apple-darwin",
+      "qualification": "pending",
+      "revision": null,
+      "sha256": null,
+      "version": "24.20.0"
+    },
+    {
+      "acquisition": null,
+      "name": "node:x86_64-unknown-linux-gnu",
+      "qualification": "pending",
+      "revision": null,
+      "sha256": null,
+      "version": "24.20.0"
+    },
+    {
+      "acquisition": null,
+      "name": "npm:aarch64-apple-darwin",
+      "qualification": "pending",
+      "revision": null,
+      "sha256": null,
+      "version": "11.19.0"
+    },
+    {
+      "acquisition": null,
+      "name": "npm:x86_64-apple-darwin",
+      "qualification": "pending",
+      "revision": null,
+      "sha256": null,
+      "version": "11.19.0"
+    },
+    {
+      "acquisition": null,
+      "name": "npm:x86_64-unknown-linux-gnu",
+      "qualification": "pending",
+      "revision": null,
+      "sha256": null,
+      "version": "11.19.0"
+    },
+    {
+      "acquisition": null,
+      "name": "rust:aarch64-apple-darwin",
+      "qualification": "pending",
+      "revision": null,
+      "sha256": null,
+      "version": "1.98.1"
+    },
+    {
+      "acquisition": null,
+      "name": "rust:x86_64-apple-darwin",
+      "qualification": "pending",
+      "revision": null,
+      "sha256": null,
+      "version": "1.98.1"
+    },
+    {
+      "acquisition": null,
+      "name": "rust:x86_64-unknown-linux-gnu",
+      "qualification": "pending",
+      "revision": null,
+      "sha256": null,
+      "version": "1.98.1"
+    },
+    {
+      "acquisition": null,
+      "name": "viceroy:aarch64-apple-darwin",
+      "qualification": "pending",
+      "revision": null,
+      "sha256": null,
+      "version": "0.21.0"
+    },
+    {
+      "acquisition": null,
+      "name": "viceroy:x86_64-apple-darwin",
+      "qualification": "pending",
+      "revision": null,
+      "sha256": null,
+      "version": "0.21.0"
+    },
+    {
+      "acquisition": null,
+      "name": "viceroy:x86_64-unknown-linux-gnu",
+      "qualification": "pending",
+      "revision": null,
+      "sha256": null,
+      "version": "0.21.0"
+    },
+    {
+      "acquisition": null,
+      "name": "wasmtime:aarch64-apple-darwin",
+      "qualification": "pending",
+      "revision": null,
+      "sha256": null,
+      "version": "48.0.1"
+    },
+    {
+      "acquisition": null,
+      "name": "wasmtime:x86_64-apple-darwin",
+      "qualification": "pending",
+      "revision": null,
+      "sha256": null,
+      "version": "48.0.1"
+    },
+    {
+      "acquisition": null,
+      "name": "wasmtime:x86_64-unknown-linux-gnu",
+      "qualification": "pending",
+      "revision": null,
+      "sha256": null,
+      "version": "48.0.1"
+    }
+  ]
+}
diff --git a/scripts/release/tests/candidate-changes.sh b/scripts/release/tests/candidate-changes.sh
new file mode 100644
index 0000000000..d2502d6e8b
--- /dev/null
+++ b/scripts/release/tests/candidate-changes.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Select ordinary candidate jobs unless the comparison is known to be docs-only.
+set -euo pipefail
+
+select_candidates() {
+  echo "$1"
+  exit 0
+}
+
+if [[ $# != 1 || ! "$1" =~ ^[a-f0-9]{40}\.\.\.?[a-f0-9]{40}$ ]]; then
+  select_candidates true
+fi
+
+changed_paths="$(mktemp)"
+trap 'rm -f "$changed_paths"' EXIT
+# Disable rename detection so moving source into docs still includes its deletion.
+if ! git diff --name-only --no-renames -z "$1" -- > "$changed_paths"; then
+  select_candidates true
+fi
+
+while IFS= read -r -d '' changed_path; do
+  case "$changed_path" in
+    docs/*.md | .claude/*.md | .github/*.md | README.md | CONTRIBUTING.md | CHANGELOG.md) ;;
+    *) select_candidates true ;;
+  esac
+done < "$changed_paths"
+select_candidates false
diff --git a/scripts/release/tests/candidate-changes.test.mjs b/scripts/release/tests/candidate-changes.test.mjs
new file mode 100644
index 0000000000..5bc128ceba
--- /dev/null
+++ b/scripts/release/tests/candidate-changes.test.mjs
@@ -0,0 +1,110 @@
+import assert from 'node:assert/strict'
+import { execFileSync } from 'node:child_process'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { test } from 'node:test'
+import { fileURLToPath } from 'node:url'
+
+const script = fileURLToPath(new URL('./candidate-changes.sh', import.meta.url))
+
+function fixture(t, initial = 'README.md') {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'candidate-changes-'))
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }))
+  const env = {
+    PATH: process.env.PATH,
+    HOME: root,
+    LC_ALL: 'C',
+    GIT_CONFIG_NOSYSTEM: '1',
+    GIT_CONFIG_GLOBAL: '/dev/null',
+  }
+  const git = (...args) =>
+    execFileSync(
+      'git',
+      [
+        '-c',
+        'maintenance.auto=false',
+        '-c',
+        'gc.auto=0',
+        '-c',
+        'commit.gpgsign=false',
+        '-c',
+        'user.name=Example',
+        '-c',
+        'user.email=example@example.com',
+        ...args,
+      ],
+      { cwd: root, env, encoding: 'utf8' }
+    ).trim()
+  git('init', '-q')
+  fs.mkdirSync(path.dirname(path.join(root, initial)), { recursive: true })
+  fs.writeFileSync(path.join(root, initial), 'Example\n')
+  git('add', '.')
+  git('commit', '-q', '-m', 'Initial fixture')
+  const base = git('rev-parse', 'HEAD')
+  return {
+    change(name) {
+      fs.mkdirSync(path.dirname(path.join(root, name)), { recursive: true })
+      fs.writeFileSync(path.join(root, name), 'Changed example\n')
+      git('add', '.')
+      git('commit', '-q', '-m', 'Change fixture')
+      return `${base}...${git('rev-parse', 'HEAD')}`
+    },
+    rename(from, to) {
+      fs.mkdirSync(path.dirname(path.join(root, to)), { recursive: true })
+      fs.renameSync(path.join(root, from), path.join(root, to))
+      git('add', '-A')
+      git('commit', '-q', '-m', 'Move fixture')
+      return `${base}...${git('rev-parse', 'HEAD')}`
+    },
+    selected(range) {
+      return execFileSync('bash', [script, range], {
+        cwd: root,
+        env,
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+      }).trim()
+    },
+    base,
+  }
+}
+
+for (const name of [
+  'Cargo.toml',
+  '.cargo/config.toml',
+  'edgezero.toml',
+  'crates/trusted-server-core/src/lib.rs',
+  'crates/trusted-server-openrtb/Cargo.toml',
+  'crates/trusted-server-cli/src/run.rs',
+  'unknown-build-input.json',
+  'crates/trusted-server-core/src/odd\n"name.rs',
+]) {
+  test(`selects candidate jobs for ${JSON.stringify(name)}`, (t) => {
+    const repo = fixture(t)
+    assert.equal(repo.selected(repo.change(name)), 'true')
+  })
+}
+
+test('skips known documentation-only changes and an empty diff', (t) => {
+  const repo = fixture(t)
+  assert.equal(repo.selected(`${repo.base}..${repo.base}`), 'false')
+  assert.equal(repo.selected(repo.change('docs/guide/example.md')), 'false')
+})
+
+test('selects candidate jobs when Git cannot resolve the comparison', (t) => {
+  const repo = fixture(t)
+  assert.equal(
+    repo.selected('missing-example-base...missing-example-head'),
+    'true'
+  )
+  assert.equal(repo.selected(`${'a'.repeat(40)}...${'b'.repeat(40)}`), 'true')
+})
+
+test('selects candidate jobs when source is renamed into documentation', (t) => {
+  const source = 'crates/trusted-server-core/src/example.rs'
+  const repo = fixture(t, source)
+  assert.equal(
+    repo.selected(repo.rename(source, 'docs/retired-source.md')),
+    'true'
+  )
+})
diff --git a/scripts/release/tests/cargo-fixture.Dockerfile b/scripts/release/tests/cargo-fixture.Dockerfile
new file mode 100644
index 0000000000..04e0a3d63b
--- /dev/null
+++ b/scripts/release/tests/cargo-fixture.Dockerfile
@@ -0,0 +1,6 @@
+# Ordinary PR fixture only. This image does not qualify any release recipe.
+# gcc and libc6-dev give Cargo build scripts and proc macros a host linker.
+FROM ubuntu:24.04
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates gcc git libc6-dev libgcc-s1 libstdc++6 \
+    && rm -rf /var/lib/apt/lists/*
diff --git a/scripts/release/tests/cli-builder.Dockerfile b/scripts/release/tests/cli-builder.Dockerfile
new file mode 100644
index 0000000000..1654f45743
--- /dev/null
+++ b/scripts/release/tests/cli-builder.Dockerfile
@@ -0,0 +1,10 @@
+# Ordinary PR fixture only. This image does not qualify any release recipe.
+# UBI 9 keeps glibc 2.34 for the whole RHEL 9 lifecycle, so the Linux `ts`
+# links no symbol version above the reviewed ceiling. gcc (with glibc-devel)
+# is rustc's linker driver and the C compiler of Cargo build scripts (bundled
+# SQLite, ring, aws-lc-sys); git-core matches the optional `git` lookups the
+# Fastly fixture image also offers.
+FROM registry.access.redhat.com/ubi9/ubi:9.6
+RUN dnf install -y --setopt=install_weak_deps=False --nodocs gcc glibc-devel git-core \
+    && dnf clean all \
+    && rm -rf /var/cache/dnf
diff --git a/scripts/release/tests/fixtures/README.md b/scripts/release/tests/fixtures/README.md
new file mode 100644
index 0000000000..d6908e9ce4
--- /dev/null
+++ b/scripts/release/tests/fixtures/README.md
@@ -0,0 +1,63 @@
+# Release document fixtures
+
+The host-only `crates/trusted-server-release` implements current strict document/schema utilities. Introduced Python utilities and requirements are removed; their behavior/results do not establish replacement Rust execution. The [migration addendum](../../../../docs/superpowers/specs/2026-10-14-release-tooling-rust-migration.md) and [primary plan](../../../../docs/superpowers/plans/2026-10-13-attested-release-implementation.md#rust-migration-and-current-execution-boundary) describe remaining source/bootstrap/qualification gates.
+
+Private unit cases live alongside `src/documents.rs` or in registered
+`src/documents/tests.rs`. Shared byte fixtures live under
+`crates/trusted-server-release/tests/fixtures/`, and `tests/commands.rs` exercises
+public process behavior. Do not expose internal APIs for integration tests.
+Exact byte cases must retain duplicate keys, invalid UTF-8/surrogates/BOM, trailing
+controls, nonfinite/unsafe numbers, depth 65 and oversized role inputs. Test lexical
+integer overflow in opaque nested fields and top-level values, decimal/exponent
+float overflow, and exact `i64` negative/`u64` nonnegative boundary controls. Large
+number-like text inside JSON strings, including escaped quotes/backslashes, must
+remain accepted text. Role fixtures additionally reject unsafe integers and
+negative/noninteger lengths. Fixtures
+also cover flat names, integer lengths, ambiguous identities, original-byte hashes,
+deterministic output and atomic replacement failures. Use fictional names and
+`example.com` URLs only.
+
+Run the registered local utility tests:
+
+```sh
+set -eu
+HOST_TARGET=$(rustc -vV | sed -n 's/^host: //p')
+test -n "$HOST_TARGET"
+RELEASE_TEST_LIST=$(mktemp)
+trap 'rm -f "$RELEASE_TEST_LIST"' EXIT
+cargo test -p trusted-server-release --target "$HOST_TARGET" documents::tests -- --list > "$RELEASE_TEST_LIST"
+awk '/: test$/ { count++ } END { if (count == 0) { print "Documents filter selected zero tests"; exit 1 } print "Selected " count " document tests" }' "$RELEASE_TEST_LIST"
+cargo test -p trusted-server-release --target "$HOST_TARGET" documents::tests
+cargo test -p trusted-server-release --target "$HOST_TARGET" --test commands
+cargo clippy -p trusted-server-release --target "$HOST_TARGET" --all-targets --all-features -- -D warnings
+cargo fmt --all -- --check
+```
+
+These source-built developer commands provide local behavior evidence. Production
+uses the independently approved-source, authenticated native bootstrap and reviewed
+qualification; no official release-binary proof follows from this local build.
+
+The implemented Task 2 utility uses a recursive Serde visitor/seed to reject duplicate keys before
+inserting values. Its finite-float check is not a complete strict front end: Serde
+can convert lexical integer overflow to a finite float. Before `deserialize_any`,
+scan the whole document's numeric tokens while correctly skipping quoted text and
+escapes. Negative integers must fit `i64`, nonnegative integers must fit `u64`, and
+decimal/exponent tokens must parse as finite `f64`. The existing scanner in
+`crates/trusted-server-js/build/inventory.rs` is a behavioral reference, not a new
+crate dependency. Apply stricter role safe-integer/length checks afterward.
+It chooses `max_bytes` for each role before reading/allocation;
+container depth is at most 64 including the root, and brackets within strings do
+not increase depth. Hash original bytes before any semantic decoding. Producer
+JSON sorts keys, uses compact UTF-8 and one final newline. Atomic writes use a
+private sibling with mode `0600`, sync before replacement and clean failures.
+
+The selected Rust evaluator is locally checked with explicit offline Draft 2020-12
+`prefixItems`/`items` positives/negatives for governing schemas and Draft 7 for the
+authoritative SPDX 2.3 schema. Retain the 45,312-byte official schema at commit
+`aadf3b0b8dbbabdb4d880b0fc714255fea436ff7`, SHA-256
+`239208b7ac287b3cf5d9a9af23f9d69863971102a5e1587a27a398b43490b89b`.
+Use only known retained schemas, reject remote/file retrieval and unknown refs,
+and permit no arbitrary public schema-file override. The evaluator dependency is locked; native acquisition and production qualification
+remain pending. Schema validation does not
+replace strict byte parsing, original-byte hashing or full real-artifact SPDX
+coverage/semantic checks.
diff --git a/scripts/release/tests/js-fixture.Dockerfile b/scripts/release/tests/js-fixture.Dockerfile
new file mode 100644
index 0000000000..b3cb3b71e2
--- /dev/null
+++ b/scripts/release/tests/js-fixture.Dockerfile
@@ -0,0 +1,5 @@
+# Ordinary PR fixture only. This image does not qualify any release recipe.
+FROM ubuntu:24.04
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends git libstdc++6 libgcc-s1 ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
diff --git a/scripts/release/tests/prepare-cargo-fixture.mjs b/scripts/release/tests/prepare-cargo-fixture.mjs
new file mode 100644
index 0000000000..7ed2b8bd0c
--- /dev/null
+++ b/scripts/release/tests/prepare-cargo-fixture.mjs
@@ -0,0 +1,394 @@
+/**
+ * Acquire ordinary CI Cargo fixture inputs.
+ *
+ * This is unauthenticated ordinary CI acquisition: it copies the runner's
+ * rustup toolchain and downloads crates and Git objects over the network. It
+ * does not authenticate or qualify any release tool, image or input.
+ *
+ * On Linux the fixture also names a locally built container image. On macOS
+ * it names none (`image_id: null`), requires the host Darwin standard
+ * library instead of the Wasm one, and retains a fresh `source/` clone of
+ * HEAD for the candidate run to authenticate.
+ */
+import crypto from 'node:crypto'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { execFileSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+const WASM_TARGET = 'wasm32-wasip1'
+const DARWIN_TARGETS = {
+  arm64: 'aarch64-apple-darwin',
+  x64: 'x86_64-apple-darwin',
+}
+const CRATES_IO = 'registry+https://github.com/rust-lang/crates.io-index'
+const MAXIMUM_CRATE = 64 * 1024 * 1024
+
+const root = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  '../../..'
+)
+
+/** The pinned Rust version: `.tool-versions` and `rust-toolchain.toml` must agree. */
+function pinnedRustVersion() {
+  const pins = fs
+    .readFileSync(path.join(root, '.tool-versions'), 'utf8')
+    .split('\n')
+    .map((line) => line.trim().split(/\s+/))
+    .filter(([tool]) => tool === 'rust')
+  const channel = /^channel = "([^"]+)"$/m.exec(
+    fs.readFileSync(path.join(root, 'rust-toolchain.toml'), 'utf8')
+  )
+  if (
+    pins.length !== 1 ||
+    !/^\d+\.\d+\.\d+$/.test(pins[0][1] ?? '') ||
+    channel?.[1] !== pins[0][1]
+  )
+    throw new Error('Expected one exact Rust pin shared by both tool files')
+  return pins[0][1]
+}
+const RUST_VERSION = pinnedRustVersion()
+const [destinationArgument, producerArgument] = process.argv.slice(2)
+const darwin = process.platform === 'darwin'
+if (process.platform !== 'linux' && !darwin)
+  throw new Error('Cargo fixture requires Linux or macOS')
+if (!destinationArgument || !producerArgument || process.argv.length !== 4)
+  throw new Error(
+    'Expected fresh fixture destination and source-built producer'
+  )
+const destination = path.resolve(destinationArgument)
+const producer = fs.realpathSync(producerArgument)
+if (fs.existsSync(destination))
+  throw new Error('Fixture destination must be fresh')
+fs.mkdirSync(destination, { recursive: true, mode: 0o700 })
+const tools = path.join(destination, 'tools')
+const work = path.join(destination, 'work')
+const source = path.join(work, 'source')
+const cargoHome = path.join(work, 'cargo-home')
+const vendor = path.join(work, 'vendor')
+fs.mkdirSync(work, { mode: 0o700 })
+
+const gitEnvironment = {
+  GIT_CONFIG_NOSYSTEM: '1',
+  GIT_CONFIG_GLOBAL: '/dev/null',
+  GIT_TERMINAL_PROMPT: '0',
+}
+const hostEnvironment = {
+  PATH: process.env.PATH,
+  HOME: os.homedir(),
+  RUSTUP_TOOLCHAIN: RUST_VERSION,
+  ...(process.env.RUSTUP_HOME ? { RUSTUP_HOME: process.env.RUSTUP_HOME } : {}),
+  ...gitEnvironment,
+}
+// Cargo runs from the private tool copy with a fresh home and no rustup.
+const cargoEnvironment = {
+  PATH: `${path.join(tools, 'bin')}:/usr/bin:/bin`,
+  HOME: os.homedir(),
+  CARGO_HOME: cargoHome,
+  RUSTC: path.join(tools, 'bin/rustc'),
+  ...gitEnvironment,
+}
+
+const run = (program, args, { cwd = root, env = hostEnvironment } = {}) =>
+  execFileSync(program, args, {
+    cwd,
+    env,
+    timeout: 20 * 60_000,
+    maxBuffer: 256 * 1024 * 1024,
+    stdio: ['ignore', 'pipe', 'inherit'],
+  })
+const text = (program, args, options) =>
+  run(program, args, options).toString('utf8').trim()
+const sha256 = (bytes) =>
+  crypto.createHash('sha256').update(bytes).digest('hex')
+
+// 1. The private single-link Rust tool root, with the staged probe inside.
+const sysroot = text('rustc', ['--print', 'sysroot'])
+const rustcVersion = text(path.join(sysroot, 'bin/rustc'), ['--version'])
+if (!rustcVersion.startsWith(`rustc ${RUST_VERSION} `))
+  throw new Error(
+    `Fixture requires Rust ${RUST_VERSION}, found ${rustcVersion}`
+  )
+/** The target whose standard library the fixture's builds need. */
+function requiredStdTarget() {
+  if (!darwin) return WASM_TARGET
+  const expected = DARWIN_TARGETS[process.arch]
+  const host = /^host: (\S+)$/m.exec(
+    text(path.join(sysroot, 'bin/rustc'), ['-vV'])
+  )?.[1]
+  if (!expected || host !== expected)
+    throw new Error(
+      `Darwin fixture requires a native ${expected ?? process.arch} toolchain, found ${host}`
+    )
+  return host
+}
+const stdTarget = requiredStdTarget()
+const targetStd = path.join(sysroot, 'lib/rustlib', stdTarget, 'lib')
+if (
+  !fs.existsSync(targetStd) ||
+  !fs.readdirSync(targetStd).some((name) => name.startsWith('libstd-'))
+)
+  throw new Error(`Selected toolchain lacks the ${stdTarget} standard library`)
+fs.cpSync(sysroot, tools, {
+  recursive: true,
+  dereference: false,
+  verbatimSymlinks: true,
+})
+fs.copyFileSync(producer, path.join(tools, 'probe'), fs.constants.COPYFILE_EXCL)
+fs.chmodSync(path.join(tools, 'probe'), 0o700)
+
+// 2. The exact tracked source at HEAD, never the developer working tree.
+run('git', ['clone', '--no-hardlinks', '--no-checkout', '--', root, source])
+run('git', ['checkout', '--detach', '--force', 'HEAD'], { cwd: source })
+const commit = text('git', ['rev-parse', 'HEAD'], { cwd: source })
+const lockBytes = fs.readFileSync(path.join(source, 'Cargo.lock'))
+
+// 3. Unauthenticated network acquisition into a fresh Cargo home.
+process.stderr.write(
+  'Acquiring Cargo originals without authentication (ordinary CI only)\n'
+)
+run(path.join(tools, 'bin/cargo'), ['fetch', '--locked'], {
+  cwd: source,
+  env: cargoEnvironment,
+})
+
+/** Minimal `Cargo.lock` reader: one record per `[[package]]` table. */
+function lockedPackages(bytes) {
+  const packages = []
+  let current = null
+  for (const line of bytes.toString('utf8').split('\n')) {
+    if (line === '[[package]]') {
+      current = {}
+      packages.push(current)
+      continue
+    }
+    const field = /^(name|version|source|checksum) = "([^"]*)"$/.exec(line)
+    if (current && field) current[field[1]] = field[2]
+  }
+  return packages
+}
+const locked = lockedPackages(lockBytes)
+
+// 4. Each original registry archive, checked against its locked checksum.
+const caches = fs.readdirSync(path.join(cargoHome, 'registry/cache'))
+if (caches.length !== 1)
+  throw new Error('Expected exactly one crates.io archive cache')
+const cache = path.join(cargoHome, 'registry/cache', caches[0])
+fs.mkdirSync(path.join(destination, 'crates'), { mode: 0o700 })
+const registry = []
+for (const record of locked.filter((entry) => entry.source === CRATES_IO)) {
+  if (!/^[a-f0-9]{64}$/.test(record.checksum ?? ''))
+    throw new Error(`Registry crate ${record.name} has no locked checksum`)
+  const file = `${record.name}-${record.version}.crate`
+  const bytes = fs.readFileSync(path.join(cache, file))
+  if (bytes.length > MAXIMUM_CRATE || sha256(bytes) !== record.checksum)
+    throw new Error(`Registry crate ${file} differs from its locked checksum`)
+  fs.writeFileSync(path.join(destination, 'crates', file), bytes, {
+    flag: 'wx',
+    mode: 0o600,
+  })
+  registry.push({
+    name: record.name,
+    version: record.version,
+    path: `crates/${file}`,
+  })
+}
+
+// 5. Git objects of every locked Git source; loose and pack objects only.
+const gitPackages = locked
+  .filter((entry) => entry.source?.startsWith('git+'))
+  .map((entry) => {
+    const [selector, revision] = entry.source.split('#')
+    if (!/^[a-f0-9]{40}$/.test(revision ?? ''))
+      throw new Error(`Git package ${entry.name} has no full revision`)
+    return { ...entry, selector, revision }
+  })
+const databases = fs
+  .readdirSync(path.join(cargoHome, 'git/db'))
+  .map((name) => path.join(cargoHome, 'git/db', name))
+const containsCommit = (database, revision) => {
+  try {
+    execFileSync(
+      'git',
+      [`--git-dir=${database}`, 'cat-file', '-e', `${revision}^{commit}`],
+      { env: hostEnvironment, timeout: 60_000, stdio: 'ignore' }
+    )
+    return true
+  } catch {
+    return false
+  }
+}
+function copyObjects(input, output) {
+  fs.mkdirSync(output, { recursive: true, mode: 0o700 })
+  for (const name of fs.readdirSync(input)) {
+    // Commit graphs and alternates live under info/; the verifier needs none.
+    if (name === 'info') continue
+    const loose = /^[a-f0-9]{2}$/.test(name)
+    if (!loose && name !== 'pack')
+      throw new Error(`Unexpected Git object entry ${name}`)
+    fs.mkdirSync(path.join(output, name), { mode: 0o700 })
+    for (const child of fs.readdirSync(path.join(input, name))) {
+      if (name === 'pack' && child.endsWith('.keep')) continue
+      const accepted = loose
+        ? /^[a-f0-9]{38}$/.test(child)
+        : /^pack-[a-f0-9]{40}\.(pack|idx|rev)$/.test(child)
+      if (!accepted) throw new Error(`Unexpected Git object file ${child}`)
+      fs.copyFileSync(
+        path.join(input, name, child),
+        path.join(output, name, child),
+        fs.constants.COPYFILE_EXCL
+      )
+    }
+  }
+}
+const git = []
+const databaseOf = new Map()
+for (const { selector, revision } of gitPackages) {
+  if (git.some((entry) => entry.selector === selector)) continue
+  const matching = databases.filter((database) =>
+    containsCommit(database, revision)
+  )
+  if (matching.length !== 1)
+    throw new Error(`Expected one Git database holding ${revision}`)
+  const objects = `git/${git.length}/objects`
+  copyObjects(
+    path.join(matching[0], 'objects'),
+    path.join(destination, objects)
+  )
+  databaseOf.set(selector, matching[0])
+  git.push({ selector, revision, objects })
+}
+
+// 6. Comparison manifests from `cargo vendor`. The producer normalizes every
+//    inheriting Git manifest itself from the verified tree; these are kept
+//    only so the ignored CI test can compare its output with Cargo's for
+//    dependency resolution (evidence, never a vendor input).
+run(
+  path.join(tools, 'bin/cargo'),
+  ['vendor', '--locked', '--offline', '--versioned-dirs', vendor],
+  { cwd: source, env: cargoEnvironment }
+)
+const metadata = JSON.parse(
+  run(
+    path.join(tools, 'bin/cargo'),
+    ['metadata', '--format-version', '1', '--locked', '--offline'],
+    { cwd: source, env: cargoEnvironment }
+  ).toString('utf8')
+)
+const checkouts = path.join(cargoHome, 'git/checkouts') + path.sep
+const comparisonManifests = []
+let vendoredOriginals = 0
+for (const record of gitPackages) {
+  const described = metadata.packages.filter(
+    (entry) =>
+      entry.name === record.name &&
+      entry.version === record.version &&
+      entry.source === record.source
+  )
+  if (described.length !== 1)
+    throw new Error(`Expected one metadata record for ${record.name}`)
+  const manifestPath = described[0].manifest_path
+  if (!manifestPath.startsWith(checkouts))
+    throw new Error(`Git manifest ${manifestPath} is outside the checkouts`)
+  // <checkouts>/<repository>/<short revision>/<path in repository>
+  const relative = manifestPath.slice(checkouts.length).split(path.sep)
+  const repositoryPath = relative.slice(2).join('/')
+  const original = run('git', [
+    `--git-dir=${databaseOf.get(record.selector)}`,
+    'show',
+    `${record.revision}:${repositoryPath}`,
+  ])
+  if (!original.equals(fs.readFileSync(manifestPath)))
+    throw new Error(`Checkout manifest of ${record.name} differs from its blob`)
+  const directory = `${record.name}-${record.version}`
+  const vendored = path.join(vendor, directory)
+  if (fs.existsSync(path.join(vendored, 'Cargo.toml.orig'))) vendoredOriginals++
+  const output = `cargo-vendor/${directory}`
+  fs.mkdirSync(path.join(destination, output), {
+    recursive: true,
+    mode: 0o700,
+  })
+  fs.copyFileSync(
+    path.join(vendored, 'Cargo.toml'),
+    path.join(destination, output, 'Cargo.toml'),
+    fs.constants.COPYFILE_EXCL
+  )
+  comparisonManifests.push({
+    name: record.name,
+    version: record.version,
+    selector: record.selector,
+    cargo_vendor_manifest: `${output}/Cargo.toml`,
+  })
+}
+
+/** The ordinary CI image with a host linker, identified only by its ID. */
+function buildLinuxImage() {
+  const dockerConfig = path.join(work, 'docker-config')
+  fs.mkdirSync(dockerConfig, { mode: 0o700 })
+  const imageFile = path.join(work, 'image-id')
+  run('/usr/bin/docker', [
+    '--config',
+    dockerConfig,
+    '--host',
+    'unix:///var/run/docker.sock',
+    'build',
+    '--pull',
+    '--iidfile',
+    imageFile,
+    '--file',
+    path.join(source, 'scripts/release/tests/cargo-fixture.Dockerfile'),
+    path.join(source, 'scripts/release/tests'),
+  ])
+  const image = fs.readFileSync(imageFile, 'utf8').trim()
+  if (!/^sha256:[a-f0-9]{64}$/.test(image))
+    throw new Error('Expected actual local fixture image identity')
+  return image
+}
+
+/**
+ * A fresh clone of HEAD retained for source authentication, never the clone
+ * Cargo fetched and vendored in, with the minimal Git configuration the JS
+ * fixture also uses.
+ */
+function retainDarwinSource() {
+  const retained = path.join(destination, 'source')
+  run('git', ['clone', '--no-hardlinks', '--no-checkout', '--', root, retained])
+  run('git', ['checkout', '--detach', '--force', 'HEAD'], { cwd: retained })
+  fs.writeFileSync(
+    path.join(retained, '.git/config'),
+    '[core]\nrepositoryformatversion = 0\nbare = false\nfilemode = true\n'
+  )
+  if (text('git', ['rev-parse', 'HEAD'], { cwd: retained }) !== commit)
+    throw new Error('Retained source is not the fixture commit')
+}
+
+// 7. Linux: the builder image. macOS: no image, and a retained source clone.
+const image = darwin ? null : buildLinuxImage()
+if (darwin) retainDarwinSource()
+
+fs.rmSync(work, { recursive: true, force: true })
+fs.writeFileSync(
+  path.join(destination, 'fixture.json'),
+  JSON.stringify({
+    schema_version: 1,
+    kind: darwin
+      ? 'ordinary-ci-macos-cargo-fixture'
+      : 'ordinary-ci-cargo-fixture',
+    acquisition: 'unauthenticated-ordinary-ci',
+    source_commit: commit,
+    cargo_lock_sha256: sha256(lockBytes),
+    image_id: image,
+    rustc_version: rustcVersion,
+    registry,
+    git,
+    comparison_manifests: comparisonManifests,
+  }) + '\n',
+  { flag: 'wx', mode: 0o600 }
+)
+process.stdout.write(
+  `Prepared ${registry.length} registry originals, ${git.length} Git object ` +
+    `stores and ${comparisonManifests.length} cargo vendor comparison ` +
+    `manifests (cargo vendor wrote Cargo.toml.orig for ${vendoredOriginals}) by ` +
+    'unauthenticated ordinary CI acquisition; this is not release qualification\n'
+)
diff --git a/scripts/release/tests/prepare-cli-fixture.mjs b/scripts/release/tests/prepare-cli-fixture.mjs
new file mode 100644
index 0000000000..5ca8ed3220
--- /dev/null
+++ b/scripts/release/tests/prepare-cli-fixture.mjs
@@ -0,0 +1,133 @@
+/**
+ * Acquire ordinary CI Linux CLI fixture images.
+ *
+ * Builds the glibc 2.34 builder image and pulls the clean startup images,
+ * recording each by its local image ID. This is unauthenticated ordinary CI
+ * acquisition: tags are not identities and nothing here qualifies a release
+ * tool, image or input.
+ */
+import fs from 'node:fs'
+import path from 'node:path'
+import { execFileSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+const root = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  '../../..'
+)
+const DOCKERFILE = 'scripts/release/tests/cli-builder.Dockerfile'
+// Must match `StartupDistribution::reference` in the release producer.
+const STARTUP_IMAGES = [
+  ['ubi9', 'registry.access.redhat.com/ubi9/ubi-minimal:9.6'],
+  ['ubuntu-22.04', 'docker.io/library/ubuntu:22.04'],
+  ['debian-12', 'docker.io/library/debian:12'],
+]
+const IMAGE_ID = /^sha256:[a-f0-9]{64}$/
+
+const [destinationArgument] = process.argv.slice(2)
+if (process.platform !== 'linux') throw new Error('CLI fixture requires Linux')
+if (!destinationArgument || process.argv.length !== 3)
+  throw new Error('Expected one fresh fixture destination')
+const destination = path.resolve(destinationArgument)
+if (fs.existsSync(destination))
+  throw new Error('Fixture destination must be fresh')
+fs.mkdirSync(destination, { recursive: true, mode: 0o700 })
+const dockerConfig = path.join(destination, 'docker-config')
+fs.mkdirSync(dockerConfig, { mode: 0o700 })
+
+const run = (program, args) =>
+  execFileSync(program, args, {
+    cwd: root,
+    env: {
+      PATH: '/usr/bin:/bin',
+      GIT_CONFIG_NOSYSTEM: '1',
+      GIT_CONFIG_GLOBAL: '/dev/null',
+    },
+    timeout: 20 * 60_000,
+    maxBuffer: 64 * 1024 * 1024,
+    stdio: ['ignore', 'pipe', 'inherit'],
+  })
+    .toString('utf8')
+    .trim()
+const docker = (args) =>
+  run('/usr/bin/docker', [
+    '--config',
+    dockerConfig,
+    '--host',
+    'unix:///var/run/docker.sock',
+    ...args,
+  ])
+const imageId = (text, label) => {
+  if (!IMAGE_ID.test(text))
+    throw new Error(`Expected a local image ID for ${label}`)
+  return text
+}
+const requireNoVolumes = (id) => {
+  const volumes = JSON.parse(
+    docker(['image', 'inspect', '--format', '{{json .Config.Volumes}}', id])
+  )
+  if (
+    volumes !== null &&
+    (!volumes ||
+      typeof volumes !== 'object' ||
+      Array.isArray(volumes) ||
+      Object.keys(volumes).length !== 0)
+  )
+    throw new Error(`Fixture image declares implicit writable volumes: ${id}`)
+}
+
+// 1. The tracked builder Dockerfile, unmodified from HEAD.
+run('git', ['diff', '--quiet', 'HEAD', '--', DOCKERFILE])
+const imageFile = path.join(destination, 'builder-image-id')
+docker([
+  'build',
+  '--pull',
+  '--iidfile',
+  imageFile,
+  '--file',
+  path.join(root, DOCKERFILE),
+  path.join(root, 'scripts/release/tests'),
+])
+const builderImage = imageId(
+  fs.readFileSync(imageFile, 'utf8').trim(),
+  'the builder'
+)
+requireNoVolumes(builderImage)
+const glibc = docker([
+  'run',
+  '--rm',
+  '--network=none',
+  builderImage,
+  'ldd',
+  '--version',
+])
+if (!/ 2\.34$/m.test(glibc.split('\n')[0] ?? ''))
+  throw new Error(`Builder glibc is not 2.34: ${glibc.split('\n')[0]}`)
+
+// 2. Clean startup images, selected later only by local image ID.
+const startupImages = STARTUP_IMAGES.map(([distribution, reference]) => {
+  docker(['pull', '--quiet', reference])
+  const id = docker(['image', 'inspect', '--format', '{{.Id}}', reference])
+  const selected = imageId(id, reference)
+  requireNoVolumes(selected)
+  return { distribution, reference, image_id: selected }
+})
+
+fs.rmSync(dockerConfig, { recursive: true, force: true })
+fs.writeFileSync(
+  path.join(destination, 'cli-fixture.json'),
+  JSON.stringify({
+    schema_version: 1,
+    kind: 'ordinary-ci-cli-fixture',
+    acquisition: 'unauthenticated-ordinary-ci',
+    builder_image_id: builderImage,
+    builder_glibc: glibc.split('\n')[0],
+    startup_images: startupImages,
+  }) + '\n',
+  { flag: 'wx', mode: 0o600 }
+)
+process.stdout.write(
+  `Prepared the glibc 2.34 builder ${builderImage} and ` +
+    `${startupImages.length} startup images by unauthenticated ordinary ` +
+    'CI acquisition; this is not release qualification\n'
+)
diff --git a/scripts/release/tests/prepare-js-fixture.mjs b/scripts/release/tests/prepare-js-fixture.mjs
new file mode 100644
index 0000000000..a2f3dd0363
--- /dev/null
+++ b/scripts/release/tests/prepare-js-fixture.mjs
@@ -0,0 +1,228 @@
+/** Acquire ordinary CI fixture inputs; this does not authenticate release tools. */
+import crypto from 'node:crypto'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { execFileSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+const root = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  '../../..'
+)
+const [destinationArgument, producerArgument] = process.argv.slice(2)
+if (process.platform !== 'linux' || process.version !== 'v24.20.0')
+  throw new Error('Full JS fixture requires Linux and Node 24.20.0')
+if (!destinationArgument || !producerArgument || process.argv.length !== 4)
+  throw new Error(
+    'Expected fresh fixture destination and source-built producer'
+  )
+const destination = path.resolve(destinationArgument)
+const producer = fs.realpathSync(producerArgument)
+if (fs.existsSync(destination))
+  throw new Error('Fixture destination must be fresh')
+fs.mkdirSync(destination, { recursive: true, mode: 0o700 })
+const source = path.join(destination, 'source')
+const tools = path.join(destination, 'tools')
+const originals = path.join(destination, 'originals')
+const environment = {
+  PATH: process.env.PATH,
+  HOME: os.homedir(),
+  RUSTUP_TOOLCHAIN: '1.98.1',
+  ...(process.env.RUSTUP_HOME ? { RUSTUP_HOME: process.env.RUSTUP_HOME } : {}),
+  GIT_CONFIG_NOSYSTEM: '1',
+  GIT_CONFIG_GLOBAL: '/dev/null',
+  GIT_TERMINAL_PROMPT: '0',
+}
+const execute = (program, args, cwd = root) =>
+  execFileSync(program, args, {
+    cwd,
+    env: environment,
+    timeout: 180_000,
+    maxBuffer: 1024 * 1024,
+    encoding: 'utf8',
+  }).trim()
+execute('git', ['clone', '--no-hardlinks', '--no-checkout', '--', root, source])
+execute('git', ['checkout', '--detach', '--force', 'HEAD'], source)
+fs.writeFileSync(
+  path.join(source, '.git/config'),
+  '[core]\nrepositoryformatversion = 0\nbare = false\nfilemode = true\n'
+)
+const commit = execute('git', ['rev-parse', 'HEAD'], source)
+const nodeRoot = path.resolve(
+  path.dirname(fs.realpathSync(process.execPath)),
+  '..'
+)
+const npm = JSON.parse(
+  fs.readFileSync(path.join(nodeRoot, 'lib/node_modules/npm/package.json'))
+)
+if (npm.version !== '11.19.0') throw new Error('Fixture requires npm 11.19.0')
+fs.cpSync(nodeRoot, tools, {
+  recursive: true,
+  dereference: false,
+  verbatimSymlinks: true,
+})
+fs.copyFileSync(producer, path.join(tools, 'probe'), fs.constants.COPYFILE_EXCL)
+fs.chmodSync(path.join(tools, 'probe'), 0o700)
+if (!execute('rustc', ['--version']).startsWith('rustc 1.98.1 '))
+  throw new Error('Fixture requires selected Rust 1.98.1')
+execute('rustc', [
+  '--crate-type',
+  'cdylib',
+  '--edition',
+  '2024',
+  path.join(source, 'crates/trusted-server-release/src/lifecycle_guard.rs'),
+  '-o',
+  path.join(tools, 'guard.node'),
+])
+execute(path.join(tools, 'bin/node'), [
+  '-e',
+  `
+  const assert = require('node:assert/strict');
+  const { spawnSync } = require('node:child_process');
+  assert.equal(require(process.argv[1]).protected, true);
+  const child = spawnSync(process.execPath, ['-e', String.raw\`
+    const fs = require('node:fs');
+    for (const member of ['mem', 'environ', 'fd/0']) {
+      try {
+        const descriptor = fs.openSync('/proc/' + process.argv[1] + '/' + member, 'r');
+        fs.closeSync(descriptor);
+        throw new Error('Observer process input or memory is accessible');
+      } catch (error) {
+        if (!['EACCES', 'EPERM'].includes(error.code)) throw error;
+      }
+    }
+    process.stdout.write('guarded\\n');
+  \`, String(process.pid)], { env: {}, encoding: 'utf8', timeout: 10000, stdio: ['ignore', 'pipe', 'pipe'] });
+  assert.equal(child.status, 0, child.stderr);
+  assert.equal(child.stdout, 'guarded\\n');
+`,
+  path.join(tools, 'guard.node'),
+])
+fs.mkdirSync(originals, { mode: 0o700 })
+const lock = JSON.parse(
+  fs.readFileSync(
+    path.join(source, 'crates/trusted-server-js/lib/package-lock.json')
+  )
+)
+if (lock.lockfileVersion !== 3)
+  throw new Error('Expected locked npm v3 fixture')
+const requests = new Map()
+for (const [location, record] of Object.entries(lock.packages)) {
+  if (location === '') continue
+  if (!/^sha512-[A-Za-z0-9+/]{86}==$/.test(record.integrity ?? ''))
+    throw new Error('Fixture requires exact locked original SHA-512')
+  const digest = Buffer.from(record.integrity.slice(7), 'base64').toString(
+    'hex'
+  )
+  const url = new URL(record.resolved)
+  if (
+    url.protocol !== 'https:' ||
+    url.hostname !== 'registry.npmjs.org' ||
+    url.port ||
+    url.username ||
+    url.password ||
+    url.search ||
+    url.hash ||
+    url.href !== record.resolved ||
+    !url.pathname.endsWith('.tgz')
+  )
+    throw new Error('Fixture rejects noncanonical registry URL')
+  requests.set(digest, url.href)
+}
+let total = 0
+const maximum = 64 * 1024 * 1024
+const deadline = Date.now() + 10 * 60_000
+const queue = [...requests]
+async function acquire([digest, url]) {
+  const cached = path.join(
+    os.homedir(),
+    '.npm/_cacache/content-v2/sha512',
+    digest.slice(0, 2),
+    digest.slice(2, 4),
+    digest.slice(4)
+  )
+  let bytes
+  try {
+    const metadata = fs.lstatSync(cached)
+    if (metadata.isFile() && metadata.size <= maximum) {
+      const candidate = fs.readFileSync(cached)
+      if (
+        crypto.createHash('sha512').update(candidate).digest('hex') === digest
+      )
+        bytes = candidate
+    }
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error
+  }
+  if (!bytes) {
+    const response = await fetch(url, {
+      redirect: 'error',
+      signal: AbortSignal.timeout(60_000),
+    })
+    if (
+      !response.ok ||
+      Number(response.headers.get('content-length') ?? 0) > maximum
+    )
+      throw new Error('Fixture original download failed or exceeds bound')
+    const pieces = []
+    let size = 0
+    for await (const piece of response.body) {
+      size += piece.length
+      if (size > maximum || Date.now() > deadline)
+        throw new Error('Fixture download limit exceeded')
+      pieces.push(piece)
+    }
+    bytes = Buffer.concat(pieces)
+  }
+  if (crypto.createHash('sha512').update(bytes).digest('hex') !== digest)
+    throw new Error('Fixture original differs from approved lock integrity')
+  total += bytes.length
+  if (total > 2 * 1024 ** 3 || Date.now() > deadline)
+    throw new Error('Fixture acquisition budget exceeded')
+  fs.writeFileSync(path.join(originals, `${digest}.tgz`), bytes, {
+    flag: 'wx',
+    mode: 0o600,
+  })
+}
+await Promise.all(
+  Array.from({ length: 4 }, async () => {
+    for (;;) {
+      const next = queue.pop()
+      if (!next) return
+      await acquire(next)
+    }
+  })
+)
+const dockerConfig = path.join(destination, 'docker-config')
+fs.mkdirSync(dockerConfig, { mode: 0o700 })
+const imageFile = path.join(destination, 'image-id')
+execute('/usr/bin/docker', [
+  '--config',
+  dockerConfig,
+  '--host',
+  'unix:///var/run/docker.sock',
+  'build',
+  '--pull',
+  '--iidfile',
+  imageFile,
+  '--file',
+  path.join(source, 'scripts/release/tests/js-fixture.Dockerfile'),
+  path.join(source, 'scripts/release/tests'),
+])
+const image = fs.readFileSync(imageFile, 'utf8').trim()
+if (!/^sha256:[a-f0-9]{64}$/.test(image))
+  throw new Error('Expected actual local fixture image identity')
+fs.writeFileSync(
+  path.join(destination, 'fixture.json'),
+  JSON.stringify({
+    schema_version: 1,
+    source_commit: commit,
+    original_count: requests.size,
+    image_id: image,
+  }) + '\n',
+  { flag: 'wx', mode: 0o600 }
+)
+process.stdout.write(
+  `Prepared ${requests.size} original-only archives for the full offline JS fixture\n`
+)