Separate graph execution identity from installation provenance

src/execution-world/candidate.ts

@@ -1,3 +1,4 @@
+import { graphExecutionRepresentation } from "./graph-execution.js";
 import { open, lstat } from "node:fs/promises";
 import { constants } from "node:fs";
 import { join } from "node:path";
@@ -24,7 +25,7 @@ export async function loadCheckedInstallationCandidate(
 ) {
   if (!rootPattern.test(root) || !(await lstat(root)).isDirectory())
     throw Error("Candidate must be an immutable Nix output directory");
-  const [candidate, plan, artifacts, source, entryRequest, kernel, queries] = await Promise.all([
+  const [candidate, plan, artifacts, source, entryRequest, kernel, queries, graph] = await Promise.all([
     readJson(root, "candidate.json"),
     readJson(root, "execution-plan.json"),
     readJson(root, "execution-artifacts.json"),
@@ -32,6 +33,7 @@ export async function loadCheckedInstallationCandidate(
     readJson(root, "entry.json"),
     readJson(root, "kernel.json"),
     readJson(root, "queries.json"),
+    readJson(root, "graph-execution.json"),
   ]);
   const { executionContracts: _legacyContracts, ...workspace } = candidate;
   if (
@@ -81,12 +83,19 @@ export async function loadCheckedInstallationCandidate(
     ["kernel", kernel, "camino-kernel-program-v1"],
     ["queries", queries, "camino-query-program-v1"],
   ] as const)
-    if (program?.codec !== codec || program.plan !== plan.digest || hexDigest(program) !== artifacts.programs?.[name])
+    if (program?.codec !== codec || program.plan !== kernel.plan || hexDigest(program) !== artifacts.programs?.[name])
       throw new ExecutionPlanError(
         "CANDIDATE_PROGRAM_MISMATCH",
         name,
         "Stored interpreter input must match the checked build and plan",
       );
+  const expectedGraph = graphExecutionRepresentation(plan, installation, kernel, queries);
+  if (hexDigest(graph) !== hexDigest(expectedGraph) || artifacts.execution !== hexDigest(graph))
+    throw new ExecutionPlanError(
+      "CANDIDATE_EXECUTION_MISMATCH",
+      root,
+      "Stored graph execution differs from checked inputs",
+    );
   const provenance = {
     workspaceRevision: workspace.id as string,
     source: { repository: source.repository as string, commit: source.commit as string },
@@ -110,8 +119,9 @@ export async function loadCheckedInstallationCandidate(
   return {
     reference,
     workspace: plan.definition.workspace.workspaceId,
-    world: installation.world,
-    plan: plan.digest,
+    world: hexDigest(graph),
+    plan: kernel.plan as string,
+    graphExecution: graph,
     provenance,
     entry,
     kernel,