fix: canonical component runtime integrity

scripts/create-component-release.ts

@@ -1,7 +1,7 @@
 import { createHash } from 'node:crypto';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { resolve } from 'node:path';
-import { componentReleaseSchema, deploymentDigest } from '@treeseed/sdk/deployment';
+import { componentReleaseSchema, deploymentDigest, packageRuntimeSchema } from '@treeseed/sdk/deployment';
 
 const release = process.env.TREESEED_RELEASE, sourceCommit = process.env.TREESEED_SOURCE_COMMIT;
 const adminDigest = process.env.TREESEED_ADMIN_DIGEST;
@@ -13,15 +13,15 @@ const debianRelease = `${release.replace(/-rc\.(\d+)$/u, '~rc$1')}-${revision}`;
 const compose = readFileSync(resolve('deploy/compose.template.yml'), 'utf8').replace('@ADMIN_IMAGE@', `treeseed/admin@${adminDigest}`);
 if (/\bbuild\s*:/u.test(compose) || /@ADMIN_IMAGE@/u.test(compose)) throw new Error('Production Compose bundle is not fully materialized.');
 const composeDigest = `sha256:${createHash('sha256').update(compose).digest('hex')}`;
-const runtime = {
+const runtime = packageRuntimeSchema.parse({
 	schemaVersion: 'treeseed.package-runtime/v1' as const, componentId: 'admin', version: debianRelease,
 	compose: { projectName: 'treeseed-admin', files: [{ path: 'compose.yml', digest: composeDigest }] },
 	services: [{ id: 'admin', composeService: 'admin', endpoints: [{ id: 'http', protocol: 'http' as const, port: 4322,
 		visibility: 'host' as const, defaultAlias: 'admin.treeseed.localhost', aliasOverride: false, tls: 'edge' as const,
 		authentication: 'application' as const, healthGate: { protocol: 'http' as const, path: '/healthz', timeoutSeconds: 120 } }] }],
 	stateVolumes: [], migrations: [], requiredCapabilities: ['docker-compose'],
 	dependencies: [{ id: 'api', capability: 'control-plane-api', locality: 'either' as const, optional: false }],
-};
+});
 const tagUrl = `https://hub.docker.com/r/treeseed/admin/tags?name=${encodeURIComponent(release)}`;
 const bundle = componentReleaseSchema.parse({
 	schemaVersion: 'treeseed.component-release/v1', componentId: 'admin', release: debianRelease, applicationVersion: release,

tests/contract/package/component-release.test.ts

@@ -0,0 +1,29 @@
+import { execFileSync } from 'node:child_process';
+import { copyFileSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { resolve } from 'node:path';
+import { expect, it } from 'vitest';
+import { componentReleaseSchema, deploymentDigest } from '@treeseed/sdk/deployment';
+
+it('publishes a digest of the emitted schema-normalized component runtime', () => {
+  const root = mkdtempSync(resolve(tmpdir(), 'treeseed-component-proof-'));
+  try {
+    mkdirSync(resolve(root, 'deploy'));
+    copyFileSync(resolve('deploy/compose.template.yml'), resolve(root, 'deploy/compose.template.yml'));
+    const digest = `sha256:${'a'.repeat(64)}`;
+    execFileSync(process.execPath, ['--import', resolve('node_modules/tsx/dist/loader.mjs'),
+      resolve('scripts/create-component-release.ts')], {
+      cwd: root, stdio: 'pipe',
+      env: { PATH: process.env.PATH, TREESEED_RELEASE: '0.13.0-rc.1',
+        TREESEED_SOURCE_COMMIT: 'a'.repeat(40), TREESEED_ADMIN_DIGEST: digest,
+        TREESEED_MANAGER_DIGEST: digest, TREESEED_RUNNER_DIGEST: digest,
+        TREESEED_SANDBOX_BASE_DIGEST: digest, TREESEED_GUEST_DIGEST: digest },
+    });
+    const raw = JSON.parse(readFileSync(resolve(root, 'release-assets/component-release.json'), 'utf8'));
+    const parsed = componentReleaseSchema.parse(raw);
+    expect(raw.runtimeDigest).toBe(deploymentDigest(raw.runtime));
+    expect(parsed.runtimeDigest).toBe(deploymentDigest(parsed.runtime));
+    expect(componentReleaseSchema.parse(JSON.parse(JSON.stringify(parsed)))).toEqual(parsed);
+    expect(parsed.runtime.configuration).toBeDefined();
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});