story/internal/releaseevidence/bundle.go

package releaseevidence

import (
	"archive/zip"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"os"
	"path/filepath"
	"regexp"
	"slices"
	"sort"
	"strings"
	"time"

	"data-terminal-cloud/internal/agentmodelsconformance"
	"data-terminal-cloud/internal/alertreceiverconformance"
	"data-terminal-cloud/internal/cisupplychainconformance"
	"data-terminal-cloud/internal/firmwareconformance"
	"data-terminal-cloud/internal/infrastructureconformance"
	"data-terminal-cloud/internal/kmsrotationconformance"
	"data-terminal-cloud/internal/recoveryconformance"
	"data-terminal-cloud/internal/rtcconformance"
	"data-terminal-cloud/internal/safariconformance"

	"github.com/google/uuid"
)

const (
	IndexSchemaVersion                   = "release-evidence-index-v2"
	ManifestSchemaVersion                = "release-candidate-evidence-bundle-v3"
	maxEvidenceFileBytes                 = 100 << 20
	firmwareEvidenceCode                 = "REAL_DEVICE_FIRMWARE"
	realDeviceRTCEvidenceCode            = "REAL_DEVICE_RTC"
	realAgentModelsEvidenceCode          = "REAL_AGENT_MODELS"
	firmwareDeviceMinimum                = 3
	alertReceiverEvidenceCode            = "REAL_ALERT_RECEIVER"
	kmsRotationEvidenceCode              = "KMS_ROTATION"
	productionInfrastructureEvidenceCode = "PRODUCTION_INFRASTRUCTURE"
	productionRecoveryEvidenceCode       = "PRODUCTION_RECOVERY"
	safariCompatibilityEvidenceCode      = "SAFARI_COMPATIBILITY"
	remoteCISupplyChainEvidenceCode      = "REMOTE_CI_SUPPLY_CHAIN"
)

var (
	versionPattern        = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$`)
	digestPattern         = regexp.MustCompile(`^sha256:[a-f0-9]{64}$`)
	commitPattern         = regexp.MustCompile(`^[a-f0-9]{40}([a-f0-9]{24})?$`)
	localSourcePattern    = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._-]{2,127}$`)
	openAPIVersionPattern = regexp.MustCompile(`(?m)^  version: ([^\r\n ]+)[\r]?$`)
	requiredCodes         = []string{
		remoteCISupplyChainEvidenceCode,
		realDeviceRTCEvidenceCode,
		firmwareEvidenceCode,
		realAgentModelsEvidenceCode,
		productionInfrastructureEvidenceCode,
		productionRecoveryEvidenceCode,
		kmsRotationEvidenceCode,
		alertReceiverEvidenceCode,
		safariCompatibilityEvidenceCode,
		"BUSINESS_APPROVAL",
	}
	requiredFirmwareScenarios = []string{
		"AB_SUCCESS",
		"AB_ROLLBACK",
		"POWER_LOSS_AFTER_STAGE",
		"POWER_LOSS_DURING_BOOT",
	}
	requiredFirmwareChecks = []string{
		"DEVICE_EVIDENCE_SCHEMA", "EVIDENCE_SOURCE", "CANDIDATE_IDENTITY", "DEVICE_IDENTITY",
		"DEVICE_PLATFORM_METADATA", "ARTIFACT_IDENTITY", "CLOUD_ASSIGNMENT", "RELEASE_BINDING",
		"CLOUD_ARTIFACT_BINDING", "COMMAND_BINDING", "CLOUD_TIMELINE_INTEGRITY", "DEVICE_TIMELINE_INTEGRITY",
		"SCENARIO_SUPPORTED", "CLOUD_PHASE_SEQUENCE", "DEVICE_PHASE_SEQUENCE", "BOOT_ATTEMPT_BINDING",
		"PHASE_TIME_CORRELATION", "SLOT_TRANSITION", "VERSION_TRANSITION", "TERMINAL_OUTCOME",
	}
	requiredAlertReceiverChecks = []string{
		"CAPTURE_SCHEMA", "EVIDENCE_SOURCE", "CANDIDATE_IDENTITY", "CAPTURE_CANDIDATE_BINDING", "RECEIVER_IDENTITY",
		"ACTIVE_ROUTES", "RECEIVER_GROUP_MAPPING", "DELIVERY_TEST_COVERAGE", "DELIVERY_TIME_CORRELATION", "FORMAL_ALERT_DRILL",
	}
	requiredKMSRotationChecks = []string{
		"CAPTURE_SCHEMA", "EVIDENCE_SOURCE", "CANDIDATE_IDENTITY", "CAPTURE_CANDIDATE_BINDING", "PROVIDER_IDENTITY",
		"ROTATION_SCOPE", "VERSION_TRANSITION", "NEW_CREDENTIAL_ACCEPTED", "OLD_CREDENTIAL_REJECTED", "BUSINESS_CONTINUITY", "AUDIT_REFERENCES",
	}
	requiredProductionRecoveryChecks = []string{
		"CAPTURE_SCHEMA", "EVIDENCE_SOURCE", "CANDIDATE_IDENTITY", "CAPTURE_CANDIDATE_BINDING", "ENVIRONMENT_IDENTITY",
		"DRILL_COVERAGE", "TIMELINE_INTEGRITY", "RECOVERY_OUTCOME", "DATA_INTEGRITY", "BUSINESS_CONTINUITY", "AUDIT_REFERENCES",
	}
	requiredProductionInfrastructureChecks = []string{
		"CAPTURE_SCHEMA", "EVIDENCE_SOURCE", "CANDIDATE_IDENTITY", "CAPTURE_CANDIDATE_BINDING", "ENVIRONMENT_IDENTITY",
		"COMPONENT_COVERAGE", "PRODUCTION_CONTROLS", "OBSERVATION_TIMELINE", "EVIDENCE_REFERENCES",
	}
	requiredSafariCompatibilityChecks = []string{
		"CAPTURE_SCHEMA", "EVIDENCE_SOURCE", "CANDIDATE_IDENTITY", "CAPTURE_CANDIDATE_BINDING", "ENVIRONMENT_IDENTITY",
		"SAFARI_RELEASE_COVERAGE", "VIEWPORT_COVERAGE", "WORKFLOW_COVERAGE", "FUNCTIONAL_OUTCOME", "EVIDENCE_REFERENCES", "EXECUTION_TIMELINE",
	}
	requiredRealDeviceRTCChecks = []string{
		"CAPTURE_SCHEMA", "EVIDENCE_SOURCE", "CANDIDATE_IDENTITY", "CAPTURE_CANDIDATE_BINDING", "PROVIDER_IDENTITY", "ENVIRONMENT_IDENTITY",
		"DEVICE_COVERAGE", "SESSION_IDENTITY", "ENGINE_MODE_COVERAGE", "SCENARIO_COVERAGE", "RTC_MEDIA_PATH", "STATE_LIFECYCLE",
		"TOKEN_NETWORK_RECOVERY", "PROVIDER_LIFECYCLE", "TRANSCRIPT_USAGE_QUALITY", "EVIDENCE_REFERENCES", "EXECUTION_TIMELINE",
	}
	requiredRealAgentModelsChecks = []string{
		"CAPTURE_SCHEMA", "EVIDENCE_SOURCE", "CANDIDATE_IDENTITY", "CAPTURE_CANDIDATE_BINDING", "ENVIRONMENT_IDENTITY",
		"GENERATION_PROVIDER", "GENERATION_QUALITY", "MODEL_BINDING", "EMBEDDING_PROVIDER", "EMBEDDING_COVERAGE",
		"CONTENT_SAFETY_PROVIDER", "CONTENT_SAFETY_COVERAGE", "DATA_TERMS_QUOTA", "EVIDENCE_REFERENCES",
	}
	requiredRemoteCISupplyChainChecks = []string{
		"CAPTURE_SCHEMA", "EVIDENCE_SOURCE", "CANDIDATE_IDENTITY", "CAPTURE_CANDIDATE_BINDING", "REMOTE_RUN_IDENTITY",
		"REMOTE_RUN_OUTCOME", "RUN_TIMELINE", "INDEPENDENT_REVIEW", "REQUIRED_CHECKS", "IMAGE_DIGESTS", "CYCLONEDX_SBOMS",
	}
)

type EvidenceIndex struct {
	SchemaVersion    string         `json:"schema_version"`
	CandidateVersion string         `json:"candidate_version"`
	BuildDigest      string         `json:"build_digest"`
	Items            []EvidenceItem `json:"items"`
}

type EvidenceItem struct {
	Code   string   `json:"code"`
	Status string   `json:"status"`
	Owner  string   `json:"owner"`
	Note   string   `json:"note"`
	Files  []string `json:"files"`
}

type Options struct {
	Root                    string
	CandidateVersion        string
	BuildDigest             string
	SourceCommit            string
	AcceptanceSnapshotPath  string
	EvidenceIndexPath       string
	PilotDailySnapshotPaths []string
	PilotWeeklySnapshotPath string
	OutputPath              string
	GeneratedAt             time.Time
}

type Result struct {
	OutputPath string `json:"output_path"`
	SHA256     string `json:"sha256"`
	Status     string `json:"status"`
	Verified   int    `json:"verified"`
	Pending    int    `json:"pending"`
	Waived     int    `json:"waived"`
	Files      int    `json:"files"`
}

type acceptanceSnapshot struct {
	ID                   string    `json:"id"`
	CandidateVersion     string    `json:"candidate_version"`
	BuildDigest          string    `json:"build_digest"`
	Environment          string    `json:"environment"`
	RunType              string    `json:"run_type"`
	TenantID             string    `json:"tenant_id"`
	GeneratedAt          time.Time `json:"generated_at"`
	RedactionPolicy      string    `json:"redaction_policy"`
	OverallGateSatisfied bool      `json:"overall_gate_satisfied"`
}

type pilotDailySnapshot struct {
	ID               string    `json:"id"`
	GeneratedAt      time.Time `json:"generated_at"`
	TenantID         string    `json:"tenant_id"`
	CandidateVersion string    `json:"candidate_version"`
	BuildDigest      string    `json:"build_digest"`
	LocalDate        string    `json:"local_date"`
	Timezone         string    `json:"timezone"`
	WindowStart      time.Time `json:"window_start"`
	WindowEnd        time.Time `json:"window_end"`
	RedactionPolicy  string    `json:"redaction_policy"`
}

type pilotWeeklySnapshot struct {
	ID               string                        `json:"id"`
	GeneratedAt      time.Time                     `json:"generated_at"`
	TenantID         string                        `json:"tenant_id"`
	CandidateVersion string                        `json:"candidate_version"`
	BuildDigest      string                        `json:"build_digest"`
	WeekStart        string                        `json:"week_start"`
	Timezone         string                        `json:"timezone"`
	WindowStart      time.Time                     `json:"window_start"`
	WindowEnd        time.Time                     `json:"window_end"`
	IsComplete       bool                          `json:"is_complete"`
	RedactionPolicy  string                        `json:"redaction_policy"`
	ExternalEvidence []PilotWeeklyExternalEvidence `json:"external_evidence"`
}

type PilotWeeklyExternalEvidence struct {
	Code   string `json:"code"`
	Status string `json:"status"`
}

type pilotBundleEvidence struct {
	WeekStart string
	Timezone  string
	Daily     []bundleFile
	Weekly    bundleFile
}

type manifest struct {
	SchemaVersion                      string                                    `json:"schema_version"`
	CandidateVersion                   string                                    `json:"candidate_version"`
	BuildDigest                        string                                    `json:"build_digest"`
	SourceCommit                       string                                    `json:"source_commit"`
	OpenAPIVersion                     string                                    `json:"openapi_version"`
	Environment                        string                                    `json:"environment"`
	RunType                            string                                    `json:"run_type"`
	AcceptanceSnapshotID               string                                    `json:"acceptance_snapshot_id"`
	AcceptanceGeneratedAt              time.Time                                 `json:"acceptance_generated_at"`
	TechnicalGateSatisfied             bool                                      `json:"technical_gate_satisfied"`
	EvidenceStatus                     string                                    `json:"evidence_status"`
	VerifiedCount                      int                                       `json:"verified_count"`
	PendingCount                       int                                       `json:"pending_count"`
	WaivedCount                        int                                       `json:"waived_count"`
	SBOMCount                          int                                       `json:"sbom_count"`
	RemoteCISupplyChainValidation      RemoteCISupplyChainValidationSummary      `json:"remote_ci_supply_chain_validation"`
	PilotEvidenceIncluded              bool                                      `json:"pilot_evidence_included"`
	PilotWeekStart                     string                                    `json:"pilot_week_start,omitempty"`
	PilotTimezone                      string                                    `json:"pilot_timezone,omitempty"`
	PilotDailyCount                    int                                       `json:"pilot_daily_count"`
	FirmwareValidation                 FirmwareValidationSummary                 `json:"firmware_validation"`
	AlertReceiverValidation            AlertReceiverValidationSummary            `json:"alert_receiver_validation"`
	KMSRotationValidation              KMSRotationValidationSummary              `json:"kms_rotation_validation"`
	ProductionInfrastructureValidation ProductionInfrastructureValidationSummary `json:"production_infrastructure_validation"`
	ProductionRecoveryValidation       ProductionRecoveryValidationSummary       `json:"production_recovery_validation"`
	SafariCompatibilityValidation      SafariCompatibilityValidationSummary      `json:"safari_compatibility_validation"`
	RealDeviceRTCValidation            RealDeviceRTCValidationSummary            `json:"real_device_rtc_validation"`
	RealAgentModelsValidation          RealAgentModelsValidationSummary          `json:"real_agent_models_validation"`
	GeneratedAt                        time.Time                                 `json:"generated_at"`
	Files                              []manifestFile                            `json:"files"`
	Warnings                           []string                                  `json:"warnings"`
}

type FirmwareValidationSummary struct {
	Status               string         `json:"status"`
	RequiredDeviceCount  int            `json:"required_device_count"`
	ObservedDeviceCount  int            `json:"observed_device_count"`
	QualifiedDeviceCount int            `json:"qualified_device_count"`
	ReportCount          int            `json:"report_count"`
	CoverageComplete     bool           `json:"coverage_complete"`
	RequiredScenarios    []string       `json:"required_scenarios"`
	ScenarioDeviceCounts map[string]int `json:"scenario_device_counts"`
	Gaps                 []string       `json:"gaps"`
}

type AlertReceiverValidationSummary struct {
	Status              string   `json:"status"`
	ReportPresent       bool     `json:"report_present"`
	ActiveRouteCount    int      `json:"active_route_count"`
	MappedGroupCount    int      `json:"mapped_group_count"`
	TestReceiptCount    int      `json:"test_receipt_count"`
	FormalDrillVerified bool     `json:"formal_drill_verified"`
	CoverageComplete    bool     `json:"coverage_complete"`
	Gaps                []string `json:"gaps"`
}

type KMSRotationValidationSummary struct {
	Status           string   `json:"status"`
	ReportPresent    bool     `json:"report_present"`
	ProviderRef      string   `json:"provider_ref,omitempty"`
	RotationCount    int      `json:"rotation_count"`
	ConsumptionModes []string `json:"consumption_modes"`
	CoverageComplete bool     `json:"coverage_complete"`
	Gaps             []string `json:"gaps"`
}

type ProductionRecoveryValidationSummary struct {
	Status              string         `json:"status"`
	ReportPresent       bool           `json:"report_present"`
	InfrastructureRef   string         `json:"infrastructure_ref,omitempty"`
	DrillCount          int            `json:"drill_count"`
	CompletedDrillTypes []string       `json:"completed_drill_types"`
	RecoverySeconds     map[string]int `json:"observed_recovery_seconds"`
	CoverageComplete    bool           `json:"coverage_complete"`
	Gaps                []string       `json:"gaps"`
}

type ProductionInfrastructureValidationSummary struct {
	Status             string         `json:"status"`
	ReportPresent      bool           `json:"report_present"`
	Environment        string         `json:"environment,omitempty"`
	RegionRef          string         `json:"region_ref,omitempty"`
	ClusterRef         string         `json:"cluster_ref,omitempty"`
	ComponentCount     int            `json:"component_count"`
	VerifiedComponents []string       `json:"verified_components"`
	ControlCounts      map[string]int `json:"control_counts"`
	CoverageComplete   bool           `json:"coverage_complete"`
	Gaps               []string       `json:"gaps"`
}

type SafariCompatibilityValidationSummary struct {
	Status                string            `json:"status"`
	ReportPresent         bool              `json:"report_present"`
	Environment           string            `json:"environment,omitempty"`
	BrowserVersions       map[string]string `json:"browser_versions"`
	RunCount              int               `json:"run_count"`
	ResultCount           int               `json:"result_count"`
	CompletedReleaseRanks []string          `json:"completed_release_ranks"`
	CoverageComplete      bool              `json:"coverage_complete"`
	Gaps                  []string          `json:"gaps"`
}

type RealDeviceRTCValidationSummary struct {
	Status                string         `json:"status"`
	ReportPresent         bool           `json:"report_present"`
	Environment           string         `json:"environment,omitempty"`
	RTCProviderRef        string         `json:"rtc_provider_ref,omitempty"`
	VoiceProviderRef      string         `json:"voice_provider_ref,omitempty"`
	DeviceCount           int            `json:"device_count"`
	SessionCount          int            `json:"session_count"`
	CompletedEngineModes  []string       `json:"completed_engine_modes"`
	CompletedScenarios    []string       `json:"completed_scenarios"`
	ModeSessionCounts     map[string]int `json:"mode_session_counts"`
	ScenarioSessionCounts map[string]int `json:"scenario_session_counts"`
	CoverageComplete      bool           `json:"coverage_complete"`
	Gaps                  []string       `json:"gaps"`
}

type RealAgentModelsValidationSummary struct {
	Status                   string   `json:"status"`
	ReportPresent            bool     `json:"report_present"`
	Environment              string   `json:"environment,omitempty"`
	GenerationProviderRef    string   `json:"generation_provider_ref,omitempty"`
	AgentVersion             string   `json:"agent_version,omitempty"`
	ModelConfigRef           string   `json:"model_config_ref,omitempty"`
	SuiteVersion             string   `json:"suite_version,omitempty"`
	GenerationCaseCount      int      `json:"generation_case_count"`
	EmbeddingProviderRef     string   `json:"embedding_provider_ref,omitempty"`
	EmbeddingModelRef        string   `json:"embedding_model_ref,omitempty"`
	EmbeddingQueryCount      int      `json:"embedding_query_count"`
	EmbeddingCategories      []string `json:"embedding_categories"`
	ContentSafetyProviderRef string   `json:"content_safety_provider_ref,omitempty"`
	ContentSafetyPolicyRef   string   `json:"content_safety_policy_ref,omitempty"`
	ContentSafetyCaseCount   int      `json:"content_safety_case_count"`
	ContentSafetyCategories  []string `json:"content_safety_categories"`
	CoverageComplete         bool     `json:"coverage_complete"`
	Gaps                     []string `json:"gaps"`
}

type RemoteCISupplyChainValidationSummary struct {
	Status           string            `json:"status"`
	ReportPresent    bool              `json:"report_present"`
	Provider         string            `json:"provider,omitempty"`
	RunID            string            `json:"run_id,omitempty"`
	RunURL           string            `json:"run_url,omitempty"`
	CompletedChecks  []string          `json:"completed_checks"`
	ImageDigests     map[string]string `json:"image_digests"`
	SBOMDigests      map[string]string `json:"sbom_digests"`
	CoverageComplete bool              `json:"coverage_complete"`
	Gaps             []string          `json:"gaps"`
}

type manifestFile struct {
	Path   string `json:"path"`
	SHA256 string `json:"sha256"`
	Size   int64  `json:"size"`
}

type bundleFile struct {
	archivePath string
	data        []byte
}

func RequiredEvidenceCodes() []string { return slices.Clone(requiredCodes) }

func Build(options Options) (Result, error) {
	root, err := filepath.Abs(strings.TrimSpace(options.Root))
	if err != nil || root == "" {
		return Result{}, errors.New("project root is required")
	}
	options.CandidateVersion = strings.TrimSpace(options.CandidateVersion)
	options.BuildDigest = strings.ToLower(strings.TrimSpace(options.BuildDigest))
	options.SourceCommit = strings.ToLower(strings.TrimSpace(options.SourceCommit))
	if !versionPattern.MatchString(options.CandidateVersion) || !digestPattern.MatchString(options.BuildDigest) {
		return Result{}, errors.New("candidate version or build digest is invalid")
	}
	if strings.TrimSpace(options.OutputPath) == "" {
		return Result{}, errors.New("output path is required")
	}
	generatedAt := options.GeneratedAt.UTC()
	if generatedAt.IsZero() {
		generatedAt = time.Now().UTC()
	}

	acceptanceBytes, err := readRegularFile(options.AcceptanceSnapshotPath)
	if err != nil {
		return Result{}, fmt.Errorf("read acceptance snapshot: %w", err)
	}
	acceptance, err := decodeAcceptance(acceptanceBytes)
	if err != nil {
		return Result{}, err
	}
	if acceptance.CandidateVersion != options.CandidateVersion || strings.ToLower(acceptance.BuildDigest) != options.BuildDigest {
		return Result{}, errors.New("acceptance snapshot does not match the candidate version and build digest")
	}
	if !acceptance.OverallGateSatisfied {
		return Result{}, errors.New("acceptance snapshot technical gate is not satisfied")
	}
	if acceptance.RedactionPolicy != "ops-acceptance-minimal-v1" || acceptance.ID == "" || acceptance.GeneratedAt.IsZero() {
		return Result{}, errors.New("acceptance snapshot is missing required identity or redaction metadata")
	}
	if !slices.Contains([]string{"LAB", "STAGING", "PRODUCTION"}, acceptance.Environment) || !slices.Contains([]string{"REAL_DEVICE_PROVIDER", "PILOT", "PRODUCTION_RELEASE"}, acceptance.RunType) {
		return Result{}, errors.New("acceptance snapshot environment or run type is invalid")
	}
	if strings.EqualFold(acceptance.Environment, "LAB") {
		if !localSourcePattern.MatchString(options.SourceCommit) {
			return Result{}, errors.New("source commit or explicit local source label is required")
		}
	} else if !commitPattern.MatchString(options.SourceCommit) {
		return Result{}, errors.New("staging and production evidence bundles require a 40 or 64 character hexadecimal source commit")
	}

	indexBytes, err := readRegularFile(options.EvidenceIndexPath)
	if err != nil {
		return Result{}, fmt.Errorf("read evidence index: %w", err)
	}
	var index EvidenceIndex
	if err = json.Unmarshal(indexBytes, &index); err != nil {
		return Result{}, fmt.Errorf("decode evidence index: %w", err)
	}
	if err = validateIndex(index, options.CandidateVersion, options.BuildDigest); err != nil {
		return Result{}, err
	}
	remoteCISupplyChainValidation, err := validateRemoteCISupplyChainEvidence(index, filepath.Dir(options.EvidenceIndexPath), options.CandidateVersion, options.BuildDigest, options.SourceCommit)
	if err != nil {
		return Result{}, err
	}
	firmwareValidation, err := validateFirmwareEvidence(index, filepath.Dir(options.EvidenceIndexPath), options.CandidateVersion, options.BuildDigest)
	if err != nil {
		return Result{}, err
	}
	alertReceiverValidation, err := validateAlertReceiverEvidence(index, filepath.Dir(options.EvidenceIndexPath), options.CandidateVersion, options.BuildDigest)
	if err != nil {
		return Result{}, err
	}
	kmsRotationValidation, err := validateKMSRotationEvidence(index, filepath.Dir(options.EvidenceIndexPath), options.CandidateVersion, options.BuildDigest)
	if err != nil {
		return Result{}, err
	}
	productionRecoveryValidation, err := validateProductionRecoveryEvidence(index, filepath.Dir(options.EvidenceIndexPath), options.CandidateVersion, options.BuildDigest)
	if err != nil {
		return Result{}, err
	}
	productionInfrastructureValidation, err := validateProductionInfrastructureEvidence(index, filepath.Dir(options.EvidenceIndexPath), options.CandidateVersion, options.BuildDigest)
	if err != nil {
		return Result{}, err
	}
	safariCompatibilityValidation, err := validateSafariCompatibilityEvidence(index, filepath.Dir(options.EvidenceIndexPath), options.CandidateVersion, options.BuildDigest)
	if err != nil {
		return Result{}, err
	}
	realDeviceRTCValidation, err := validateRealDeviceRTCEvidence(index, filepath.Dir(options.EvidenceIndexPath), options.CandidateVersion, options.BuildDigest)
	if err != nil {
		return Result{}, err
	}
	realAgentModelsValidation, err := validateRealAgentModelsEvidence(index, filepath.Dir(options.EvidenceIndexPath), options.CandidateVersion, options.BuildDigest)
	if err != nil {
		return Result{}, err
	}
	pilotEvidence, err := collectPilotEvidence(options, acceptance)
	if err != nil {
		return Result{}, err
	}

	files := []bundleFile{{archivePath: "acceptance/technical-acceptance-snapshot.json", data: acceptanceBytes}}
	if pilotEvidence.Weekly.archivePath != "" {
		files = append(files, pilotEvidence.Daily...)
		files = append(files, pilotEvidence.Weekly)
	}
	baseline, sbomCount, warnings, err := collectBaseline(root)
	if err != nil {
		return Result{}, err
	}
	files = append(files, baseline...)
	openAPIVersion := ""
	for _, baselineFile := range baseline {
		if baselineFile.archivePath == "baseline/openapi/openapi.yaml" {
			match := openAPIVersionPattern.FindSubmatch(baselineFile.data)
			if len(match) == 2 {
				openAPIVersion = string(match[1])
			}
			break
		}
	}
	if openAPIVersion == "" {
		return Result{}, errors.New("OpenAPI info version could not be read")
	}
	verified, pending, waived := 0, 0, 0
	indexDirectory := filepath.Dir(options.EvidenceIndexPath)
	packagedIndex := index
	packagedIndex.Items = slices.Clone(index.Items)
	for itemPosition, item := range index.Items {
		packagedIndex.Items[itemPosition].Files = []string{}
		switch strings.ToUpper(strings.TrimSpace(item.Status)) {
		case "VERIFIED":
			verified++
		case "PENDING":
			pending++
		case "WAIVED":
			waived++
		}
		for fileIndex, evidencePath := range item.Files {
			resolved := evidencePath
			if !filepath.IsAbs(resolved) {
				resolved = filepath.Join(indexDirectory, resolved)
			}
			data, readErr := readRegularFile(resolved)
			if readErr != nil {
				return Result{}, fmt.Errorf("read evidence for %s: %w", item.Code, readErr)
			}
			name := fmt.Sprintf("evidence/%s/%02d-%s", item.Code, fileIndex+1, safeBaseName(filepath.Base(resolved)))
			files = append(files, bundleFile{archivePath: name, data: data})
			packagedIndex.Items[itemPosition].Files = append(packagedIndex.Items[itemPosition].Files, name)
		}
	}
	packagedIndexBytes, _ := json.MarshalIndent(packagedIndex, "", "  ")
	packagedIndexBytes = append(packagedIndexBytes, '\n')
	files = append(files, bundleFile{archivePath: "evidence-index.json", data: packagedIndexBytes})

	status := "READY_FOR_RELEASE_REVIEW"
	if pending > 0 {
		status = "EXTERNAL_VALIDATION_PENDING"
	} else if waived > 0 {
		status = "RELEASE_REVIEW_WITH_WAIVERS"
	}
	manifestFiles := make([]manifestFile, 0, len(files))
	seen := map[string]bool{}
	for _, file := range files {
		file.archivePath = filepath.ToSlash(file.archivePath)
		if file.archivePath == "" || strings.Contains(file.archivePath, "../") || seen[file.archivePath] {
			return Result{}, fmt.Errorf("duplicate or unsafe archive path: %s", file.archivePath)
		}
		seen[file.archivePath] = true
		digest := sha256.Sum256(file.data)
		manifestFiles = append(manifestFiles, manifestFile{Path: file.archivePath, SHA256: hex.EncodeToString(digest[:]), Size: int64(len(file.data))})
	}
	sort.Slice(manifestFiles, func(i, j int) bool { return manifestFiles[i].Path < manifestFiles[j].Path })
	bundleManifest := manifest{
		SchemaVersion: ManifestSchemaVersion, CandidateVersion: options.CandidateVersion, BuildDigest: options.BuildDigest,
		SourceCommit: options.SourceCommit, OpenAPIVersion: openAPIVersion, Environment: acceptance.Environment, RunType: acceptance.RunType,
		AcceptanceSnapshotID: acceptance.ID, AcceptanceGeneratedAt: acceptance.GeneratedAt.UTC(), TechnicalGateSatisfied: true,
		EvidenceStatus: status, VerifiedCount: verified, PendingCount: pending, WaivedCount: waived, SBOMCount: sbomCount,
		RemoteCISupplyChainValidation: remoteCISupplyChainValidation,
		PilotEvidenceIncluded:         pilotEvidence.Weekly.archivePath != "", PilotWeekStart: pilotEvidence.WeekStart,
		PilotTimezone: pilotEvidence.Timezone, PilotDailyCount: len(pilotEvidence.Daily),
		FirmwareValidation:                 firmwareValidation,
		AlertReceiverValidation:            alertReceiverValidation,
		KMSRotationValidation:              kmsRotationValidation,
		ProductionInfrastructureValidation: productionInfrastructureValidation,
		ProductionRecoveryValidation:       productionRecoveryValidation,
		SafariCompatibilityValidation:      safariCompatibilityValidation,
		RealDeviceRTCValidation:            realDeviceRTCValidation,
		RealAgentModelsValidation:          realAgentModelsValidation,
		GeneratedAt:                        generatedAt, Files: manifestFiles, Warnings: warnings,
	}
	manifestBytes, _ := json.MarshalIndent(bundleManifest, "", "  ")
	manifestBytes = append(manifestBytes, '\n')
	files = append(files, bundleFile{archivePath: "release-manifest.json", data: manifestBytes})
	sort.Slice(files, func(i, j int) bool { return files[i].archivePath < files[j].archivePath })

	outputPath, err := filepath.Abs(options.OutputPath)
	if err != nil {
		return Result{}, fmt.Errorf("resolve output path: %w", err)
	}
	if err = os.MkdirAll(filepath.Dir(outputPath), 0o755); err != nil {
		return Result{}, fmt.Errorf("create output directory: %w", err)
	}
	if _, statErr := os.Lstat(outputPath); statErr == nil {
		return Result{}, errors.New("output bundle already exists; choose a new path")
	} else if !errors.Is(statErr, os.ErrNotExist) {
		return Result{}, fmt.Errorf("inspect output path: %w", statErr)
	}
	temporary, err := os.CreateTemp(filepath.Dir(outputPath), ".release-evidence-*.zip")
	if err != nil {
		return Result{}, fmt.Errorf("create temporary bundle: %w", err)
	}
	temporaryPath := temporary.Name()
	defer os.Remove(temporaryPath)
	if err = writeZIP(temporary, files, generatedAt); err != nil {
		temporary.Close()
		return Result{}, err
	}
	if err = temporary.Close(); err != nil {
		return Result{}, fmt.Errorf("close evidence bundle: %w", err)
	}
	if err = os.Rename(temporaryPath, outputPath); err != nil {
		return Result{}, fmt.Errorf("publish evidence bundle: %w", err)
	}
	digest, err := hashFile(outputPath)
	if err != nil {
		return Result{}, err
	}
	return Result{OutputPath: outputPath, SHA256: digest, Status: status, Verified: verified, Pending: pending, Waived: waived, Files: len(files)}, nil
}

func validateIndex(index EvidenceIndex, candidateVersion, buildDigest string) error {
	if index.SchemaVersion != IndexSchemaVersion || index.CandidateVersion != candidateVersion || strings.ToLower(index.BuildDigest) != buildDigest {
		return errors.New("evidence index schema or candidate identity does not match")
	}
	seen := map[string]bool{}
	for _, item := range index.Items {
		if item.Code != strings.TrimSpace(item.Code) || item.Status != strings.ToUpper(strings.TrimSpace(item.Status)) {
			return fmt.Errorf("evidence code or status is not canonical: %s", item.Code)
		}
		if !slices.Contains(requiredCodes, item.Code) || seen[item.Code] {
			return fmt.Errorf("unknown or duplicate evidence code: %s", item.Code)
		}
		seen[item.Code] = true
		if item.Status != "VERIFIED" && item.Status != "PENDING" && item.Status != "WAIVED" {
			return fmt.Errorf("invalid evidence status for %s", item.Code)
		}
		if strings.TrimSpace(item.Owner) == "" || len([]rune(item.Owner)) > 120 || len([]rune(item.Note)) > 1000 {
			return fmt.Errorf("evidence owner or note is invalid for %s", item.Code)
		}
		if item.Status == "VERIFIED" && len(item.Files) == 0 {
			return fmt.Errorf("verified evidence %s requires at least one file", item.Code)
		}
		if item.Status == "WAIVED" && strings.TrimSpace(item.Note) == "" {
			return fmt.Errorf("waived evidence %s requires a note", item.Code)
		}
		if item.Code == firmwareEvidenceCode && item.Status == "WAIVED" {
			return errors.New("REAL_DEVICE_FIRMWARE cannot be waived; incomplete hardware scenarios must remain PENDING")
		}
		if item.Code == alertReceiverEvidenceCode && item.Status == "WAIVED" {
			return errors.New("REAL_ALERT_RECEIVER cannot be waived; missing real gateway evidence must remain PENDING")
		}
		if item.Code == kmsRotationEvidenceCode && item.Status == "WAIVED" {
			return errors.New("KMS_ROTATION cannot be waived; missing real KMS/HSM rotation evidence must remain PENDING")
		}
		if item.Code == productionRecoveryEvidenceCode && item.Status == "WAIVED" {
			return errors.New("PRODUCTION_RECOVERY cannot be waived; missing production-equivalent drills must remain PENDING")
		}
		if item.Code == productionInfrastructureEvidenceCode && item.Status == "WAIVED" {
			return errors.New("PRODUCTION_INFRASTRUCTURE cannot be waived; missing production infrastructure evidence must remain PENDING")
		}
		if item.Code == safariCompatibilityEvidenceCode && item.Status == "WAIVED" {
			return errors.New("SAFARI_COMPATIBILITY cannot be waived; missing real Safari matrix must remain PENDING")
		}
		if item.Code == realDeviceRTCEvidenceCode && item.Status == "WAIVED" {
			return errors.New("REAL_DEVICE_RTC cannot be waived; missing real device and provider matrix must remain PENDING")
		}
		if item.Code == realAgentModelsEvidenceCode && item.Status == "WAIVED" {
			return errors.New("REAL_AGENT_MODELS cannot be waived; missing real generation, embedding, or content safety evidence must remain PENDING")
		}
		if item.Code == remoteCISupplyChainEvidenceCode && item.Status == "WAIVED" {
			return errors.New("REMOTE_CI_SUPPLY_CHAIN cannot be waived; missing remote CI, image, or SBOM evidence must remain PENDING")
		}
		if len(item.Files) > 20 {
			return fmt.Errorf("too many evidence files for %s", item.Code)
		}
	}
	for _, code := range requiredCodes {
		if !seen[code] {
			return fmt.Errorf("required evidence code is missing: %s", code)
		}
	}
	return nil
}

func validateRemoteCISupplyChainEvidence(index EvidenceIndex, indexDirectory, candidateVersion, buildDigest, sourceCommit string) (RemoteCISupplyChainValidationSummary, error) {
	gaps := []string{"REMOTE_CI_REPORT:0/1"}
	for _, code := range cisupplychainconformance.RequiredChecks {
		gaps = append(gaps, code+":0/1")
	}
	for _, subject := range cisupplychainconformance.RequiredImages {
		gaps = append(gaps, subject+":0/1")
	}
	for _, subject := range cisupplychainconformance.RequiredSBOMs {
		gaps = append(gaps, "SBOM_"+subject+":0/1")
	}
	summary := RemoteCISupplyChainValidationSummary{Status: "PENDING", CompletedChecks: []string{}, ImageDigests: map[string]string{}, SBOMDigests: map[string]string{}, Gaps: gaps}
	var item EvidenceItem
	found := false
	for _, candidate := range index.Items {
		if candidate.Code == remoteCISupplyChainEvidenceCode {
			item, found = candidate, true
			break
		}
	}
	if !found {
		return summary, errors.New("required evidence code is missing: " + remoteCISupplyChainEvidenceCode)
	}
	summary.Status = item.Status
	if len(item.Files) == 0 {
		if item.Status == "VERIFIED" {
			return summary, errors.New("REMOTE_CI_SUPPLY_CHAIN is incomplete and must remain PENDING: REMOTE_CI_REPORT:0/1")
		}
		return summary, nil
	}
	reportPath := item.Files[0]
	if !filepath.IsAbs(reportPath) {
		reportPath = filepath.Join(indexDirectory, reportPath)
	}
	content, err := readRegularFile(reportPath)
	if err != nil {
		return summary, fmt.Errorf("read remote CI supply-chain report: %w", err)
	}
	report, err := cisupplychainconformance.ParseReport(content)
	if err != nil {
		return summary, err
	}
	if err = validateRemoteCISupplyChainReport(report, candidateVersion, buildDigest, sourceCommit); err != nil {
		return summary, fmt.Errorf("remote CI supply-chain report %s is not eligible: %w", filepath.Base(reportPath), err)
	}
	summary.ReportPresent = true
	summary.Provider = report.Provider
	summary.RunID = report.RunID
	summary.RunURL = report.RunURL
	summary.CompletedChecks = slices.Clone(report.CompletedChecks)
	summary.ImageDigests = mapsCloneString(report.ImageDigests)
	summary.SBOMDigests = mapsCloneString(report.SBOMDigests)
	summary.CoverageComplete = true
	summary.Gaps = []string{}
	return summary, nil
}

func validateRemoteCISupplyChainReport(report cisupplychainconformance.Report, candidateVersion, buildDigest, sourceCommit string) error {
	if report.SchemaVersion != cisupplychainconformance.ReportSchema || report.Result != "PASS" || report.EvidenceScope != "REMOTE_CI_SUPPLY_CHAIN" || report.ExternalValidationRequired {
		return errors.New("report must be a PASS REMOTE_CI_SUPPLY_CHAIN report with external validation completed")
	}
	if report.CandidateVersion != candidateVersion || strings.ToLower(report.BuildDigest) != strings.ToLower(buildDigest) || strings.ToLower(report.SourceCommit) != strings.ToLower(sourceCommit) {
		return errors.New("candidate version, build digest, or source commit does not match the release bundle")
	}
	if report.GeneratedAt.IsZero() || report.Provider == "" || report.RunID == "" || report.RunURL == "" || strings.TrimSpace(report.Disclaimer) == "" {
		return errors.New("report is missing provider, run, time, or disclaimer identity")
	}
	for _, code := range cisupplychainconformance.RequiredChecks {
		if !slices.Contains(report.CompletedChecks, code) {
			return errors.New("required CI check is missing: " + code)
		}
	}
	for _, subject := range cisupplychainconformance.RequiredImages {
		if !digestPattern.MatchString(strings.ToLower(report.ImageDigests[subject])) {
			return errors.New("required image digest is missing: " + subject)
		}
	}
	for _, subject := range cisupplychainconformance.RequiredSBOMs {
		if !digestPattern.MatchString(strings.ToLower(report.SBOMDigests[subject])) {
			return errors.New("required SBOM digest is missing: " + subject)
		}
	}
	if len(report.InputSHA256) != 1 || !digestPattern.MatchString("sha256:"+report.InputSHA256["ci_capture"]) {
		return errors.New("report capture digest is missing or invalid")
	}
	checks := map[string]bool{}
	for _, check := range report.Checks {
		if check.Status != "PASS" || strings.TrimSpace(check.Detail) == "" || checks[check.Code] {
			return errors.New("report contains failed, duplicated, or incomplete checks")
		}
		checks[check.Code] = true
	}
	for _, code := range requiredRemoteCISupplyChainChecks {
		if !checks[code] {
			return fmt.Errorf("required report check is missing: %s", code)
		}
	}
	return nil
}

func validateRealAgentModelsEvidence(index EvidenceIndex, indexDirectory, candidateVersion, buildDigest string) (RealAgentModelsValidationSummary, error) {
	gaps := []string{"REAL_AGENT_MODELS_REPORT:0/1", "REAL_GENERATION:0/1", "REAL_EMBEDDING:0/1"}
	for _, category := range agentmodelsconformance.RequiredEmbeddingCategories {
		gaps = append(gaps, category+":0/1")
	}
	gaps = append(gaps, "REAL_CONTENT_SAFETY:0/1")
	for _, category := range agentmodelsconformance.RequiredSafetyCategories {
		gaps = append(gaps, category+":0/1")
	}
	summary := RealAgentModelsValidationSummary{Status: "PENDING", EmbeddingCategories: []string{}, ContentSafetyCategories: []string{}, Gaps: gaps}
	var item EvidenceItem
	found := false
	for _, candidate := range index.Items {
		if candidate.Code == realAgentModelsEvidenceCode {
			item, found = candidate, true
			break
		}
	}
	if !found {
		return summary, errors.New("required evidence code is missing: " + realAgentModelsEvidenceCode)
	}
	summary.Status = item.Status
	if len(item.Files) == 0 {
		if item.Status == "VERIFIED" {
			return summary, errors.New("REAL_AGENT_MODELS is incomplete and must remain PENDING: REAL_AGENT_MODELS_REPORT:0/1")
		}
		return summary, nil
	}
	reportPath := item.Files[0]
	if !filepath.IsAbs(reportPath) {
		reportPath = filepath.Join(indexDirectory, reportPath)
	}
	content, err := readRegularFile(reportPath)
	if err != nil {
		return summary, fmt.Errorf("read real Agent models report: %w", err)
	}
	report, err := agentmodelsconformance.ParseReport(content)
	if err != nil {
		return summary, err
	}
	if err = validateRealAgentModelsReport(report, candidateVersion, buildDigest); err != nil {
		return summary, fmt.Errorf("real Agent models report %s is not eligible: %w", filepath.Base(reportPath), err)
	}
	summary.ReportPresent = true
	summary.Environment = report.Environment
	summary.GenerationProviderRef = report.GenerationProviderRef
	summary.AgentVersion = report.AgentVersion
	summary.ModelConfigRef = report.ModelConfigRef
	summary.SuiteVersion = report.SuiteVersion
	summary.GenerationCaseCount = report.GenerationCaseCount
	summary.EmbeddingProviderRef = report.EmbeddingProviderRef
	summary.EmbeddingModelRef = report.EmbeddingModelRef
	summary.EmbeddingQueryCount = report.EmbeddingQueryCount
	summary.EmbeddingCategories = slices.Clone(report.EmbeddingCategories)
	summary.ContentSafetyProviderRef = report.ContentSafetyProviderRef
	summary.ContentSafetyPolicyRef = report.ContentSafetyPolicyRef
	summary.ContentSafetyCaseCount = report.ContentSafetyCaseCount
	summary.ContentSafetyCategories = slices.Clone(report.ContentSafetyCategories)
	summary.CoverageComplete = true
	summary.Gaps = []string{}
	return summary, nil
}

func validateRealAgentModelsReport(report agentmodelsconformance.Report, candidateVersion, buildDigest string) error {
	if report.SchemaVersion != agentmodelsconformance.ReportSchema || report.Result != "PASS" || report.EvidenceScope != "REAL_AGENT_MODELS" || report.ExternalValidationRequired {
		return errors.New("report must be a PASS REAL_AGENT_MODELS report with external validation completed")
	}
	if report.CandidateVersion != candidateVersion || strings.ToLower(report.BuildDigest) != strings.ToLower(buildDigest) {
		return errors.New("candidate version or build digest does not match the release bundle")
	}
	if report.GeneratedAt.IsZero() || strings.TrimSpace(report.Disclaimer) == "" || !slices.Contains([]string{"STAGING", "PRODUCTION"}, report.Environment) || report.GenerationProviderRef == "" || report.AgentVersion == "" || report.ModelConfigRef == "" || report.SuiteVersion == "" || report.GenerationCaseCount < 10 || report.EmbeddingProviderRef == "" || report.EmbeddingModelRef == "" || report.EmbeddingQueryCount < len(agentmodelsconformance.RequiredEmbeddingCategories) || report.ContentSafetyProviderRef == "" || report.ContentSafetyPolicyRef == "" || report.ContentSafetyCaseCount < len(agentmodelsconformance.RequiredSafetyCategories) {
		return errors.New("report is missing environment, provider, model, suite, or minimum evaluation counts")
	}
	for _, category := range agentmodelsconformance.RequiredEmbeddingCategories {
		if !slices.Contains(report.EmbeddingCategories, category) {
			return errors.New("required embedding category is missing: " + category)
		}
	}
	for _, category := range agentmodelsconformance.RequiredSafetyCategories {
		if !slices.Contains(report.ContentSafetyCategories, category) {
			return errors.New("required content safety category is missing: " + category)
		}
	}
	for _, key := range []string{"models_capture", "agent_suite", "agent_observations", "agent_report"} {
		if !digestPattern.MatchString("sha256:" + report.InputSHA256[key]) {
			return errors.New("report input digest is missing or invalid: " + key)
		}
	}
	if len(report.InputSHA256) != 4 {
		return errors.New("report must contain exactly four input digests")
	}
	checks := map[string]bool{}
	for _, check := range report.Checks {
		if check.Status != "PASS" || strings.TrimSpace(check.Detail) == "" || checks[check.Code] {
			return errors.New("report contains failed, duplicated, or incomplete checks")
		}
		checks[check.Code] = true
	}
	for _, code := range requiredRealAgentModelsChecks {
		if !checks[code] {
			return fmt.Errorf("required report check is missing: %s", code)
		}
	}
	return nil
}

func validateRealDeviceRTCEvidence(index EvidenceIndex, indexDirectory, candidateVersion, buildDigest string) (RealDeviceRTCValidationSummary, error) {
	gaps := []string{"REAL_DEVICE_RTC_PROVIDER_REPORT:0/1", fmt.Sprintf("DEVICES:0/%d", rtcconformance.MinimumDevices), fmt.Sprintf("SESSIONS:0/%d", rtcconformance.MinimumSessions)}
	for _, mode := range rtcconformance.RequiredEngineModes {
		gaps = append(gaps, mode+":0/1")
	}
	for _, scenario := range rtcconformance.RequiredScenarios {
		gaps = append(gaps, scenario+":0/1")
	}
	summary := RealDeviceRTCValidationSummary{Status: "PENDING", CompletedEngineModes: []string{}, CompletedScenarios: []string{}, ModeSessionCounts: map[string]int{}, ScenarioSessionCounts: map[string]int{}, Gaps: gaps}
	var item EvidenceItem
	found := false
	for _, candidate := range index.Items {
		if candidate.Code == realDeviceRTCEvidenceCode {
			item, found = candidate, true
			break
		}
	}
	if !found {
		return summary, errors.New("required evidence code is missing: " + realDeviceRTCEvidenceCode)
	}
	summary.Status = item.Status
	if len(item.Files) == 0 {
		if item.Status == "VERIFIED" {
			return summary, errors.New("REAL_DEVICE_RTC is incomplete and must remain PENDING: REAL_DEVICE_RTC_PROVIDER_REPORT:0/1")
		}
		return summary, nil
	}
	reportPath := item.Files[0]
	if !filepath.IsAbs(reportPath) {
		reportPath = filepath.Join(indexDirectory, reportPath)
	}
	content, err := readRegularFile(reportPath)
	if err != nil {
		return summary, fmt.Errorf("read real device RTC report: %w", err)
	}
	report, err := rtcconformance.ParseReport(content)
	if err != nil {
		return summary, err
	}
	if err = validateRealDeviceRTCReport(report, candidateVersion, buildDigest); err != nil {
		return summary, fmt.Errorf("real device RTC report %s is not eligible: %w", filepath.Base(reportPath), err)
	}
	summary.ReportPresent = true
	summary.Environment = report.Environment
	summary.RTCProviderRef = report.RTCProviderRef
	summary.VoiceProviderRef = report.VoiceProviderRef
	summary.DeviceCount = report.DeviceCount
	summary.SessionCount = report.SessionCount
	summary.CompletedEngineModes = slices.Clone(report.CompletedEngineModes)
	summary.CompletedScenarios = slices.Clone(report.CompletedScenarios)
	summary.ModeSessionCounts = mapsClone(report.ModeSessionCounts)
	summary.ScenarioSessionCounts = mapsClone(report.ScenarioSessionCounts)
	summary.CoverageComplete = true
	summary.Gaps = []string{}
	return summary, nil
}

func validateRealDeviceRTCReport(report rtcconformance.Report, candidateVersion, buildDigest string) error {
	if report.SchemaVersion != rtcconformance.ReportSchema || report.Result != "PASS" || report.EvidenceScope != "REAL_DEVICE_RTC_PROVIDER" || report.ExternalValidationRequired {
		return errors.New("report must be a PASS REAL_DEVICE_RTC_PROVIDER report with external validation completed")
	}
	if report.CandidateVersion != candidateVersion || strings.ToLower(report.BuildDigest) != strings.ToLower(buildDigest) {
		return errors.New("candidate version or build digest does not match the release bundle")
	}
	if report.GeneratedAt.IsZero() || strings.TrimSpace(report.Disclaimer) == "" || !slices.Contains([]string{"STAGING", "PRODUCTION"}, report.Environment) || report.RTCProviderRef == "" || report.VoiceProviderRef == "" || report.DeviceCount < rtcconformance.MinimumDevices || report.SessionCount < rtcconformance.MinimumSessions {
		return errors.New("report is missing environment, provider, device, or session coverage")
	}
	for _, mode := range rtcconformance.RequiredEngineModes {
		if !slices.Contains(report.CompletedEngineModes, mode) || report.ModeSessionCounts[mode] == 0 {
			return errors.New("required engine mode is missing: " + mode)
		}
	}
	for _, scenario := range rtcconformance.RequiredScenarios {
		if !slices.Contains(report.CompletedScenarios, scenario) || report.ScenarioSessionCounts[scenario] == 0 {
			return errors.New("required RTC scenario is missing: " + scenario)
		}
	}
	if len(report.InputSHA256) != 1 || !digestPattern.MatchString("sha256:"+report.InputSHA256["rtc_capture"]) {
		return errors.New("report capture digest is missing or invalid")
	}
	checks := map[string]bool{}
	for _, check := range report.Checks {
		if check.Status != "PASS" || strings.TrimSpace(check.Detail) == "" || checks[check.Code] {
			return errors.New("report contains failed, duplicated, or incomplete checks")
		}
		checks[check.Code] = true
	}
	for _, code := range requiredRealDeviceRTCChecks {
		if !checks[code] {
			return fmt.Errorf("required report check is missing: %s", code)
		}
	}
	return nil
}

func validateSafariCompatibilityEvidence(index EvidenceIndex, indexDirectory, candidateVersion, buildDigest string) (SafariCompatibilityValidationSummary, error) {
	gaps := []string{"REAL_SAFARI_REPORT:0/1"}
	for _, rank := range safariconformance.RequiredReleaseRanks {
		gaps = append(gaps, rank+":0/1")
	}
	summary := SafariCompatibilityValidationSummary{Status: "PENDING", BrowserVersions: map[string]string{}, CompletedReleaseRanks: []string{}, Gaps: gaps}
	var item EvidenceItem
	found := false
	for _, candidate := range index.Items {
		if candidate.Code == safariCompatibilityEvidenceCode {
			item, found = candidate, true
			break
		}
	}
	if !found {
		return summary, errors.New("required evidence code is missing: " + safariCompatibilityEvidenceCode)
	}
	summary.Status = item.Status
	if len(item.Files) == 0 {
		if item.Status == "VERIFIED" {
			return summary, errors.New("SAFARI_COMPATIBILITY is incomplete and must remain PENDING: REAL_SAFARI_REPORT:0/1")
		}
		return summary, nil
	}
	reportPath := item.Files[0]
	if !filepath.IsAbs(reportPath) {
		reportPath = filepath.Join(indexDirectory, reportPath)
	}
	content, err := readRegularFile(reportPath)
	if err != nil {
		return summary, fmt.Errorf("read Safari compatibility report: %w", err)
	}
	report, err := safariconformance.ParseReport(content)
	if err != nil {
		return summary, err
	}
	if err = validateSafariCompatibilityReport(report, candidateVersion, buildDigest); err != nil {
		return summary, fmt.Errorf("Safari compatibility report %s is not eligible: %w", filepath.Base(reportPath), err)
	}
	summary.ReportPresent = true
	summary.Environment = report.Environment
	summary.BrowserVersions = mapsCloneString(report.BrowserVersions)
	summary.RunCount = report.RunCount
	summary.ResultCount = report.ResultCount
	summary.CompletedReleaseRanks = slices.Clone(report.CompletedReleaseRanks)
	summary.CoverageComplete = true
	summary.Gaps = []string{}
	return summary, nil
}

func validateSafariCompatibilityReport(report safariconformance.Report, candidateVersion, buildDigest string) error {
	if report.SchemaVersion != safariconformance.ReportSchema || report.Result != "PASS" || report.EvidenceScope != "REAL_SAFARI" || report.ExternalValidationRequired {
		return errors.New("report must be a PASS REAL_SAFARI report with external validation completed")
	}
	if report.CandidateVersion != candidateVersion || strings.ToLower(report.BuildDigest) != strings.ToLower(buildDigest) {
		return errors.New("candidate version or build digest does not match the release bundle")
	}
	expectedResults := len(safariconformance.RequiredReleaseRanks) * len(safariconformance.RequiredWorkflows) * len(safariconformance.RequiredViewports)
	if report.GeneratedAt.IsZero() || strings.TrimSpace(report.Disclaimer) == "" || !slices.Contains([]string{"STAGING", "PRODUCTION"}, report.Environment) || report.RunCount != len(safariconformance.RequiredReleaseRanks) || report.ResultCount != expectedResults {
		return errors.New("report is missing target environment or required Safari matrix coverage")
	}
	versions := map[string]bool{}
	for _, rank := range safariconformance.RequiredReleaseRanks {
		version := strings.TrimSpace(report.BrowserVersions[rank])
		if version == "" || versions[version] || !slices.Contains(report.CompletedReleaseRanks, rank) {
			return errors.New("required distinct Safari release is missing: " + rank)
		}
		versions[version] = true
	}
	for _, workflow := range safariconformance.RequiredWorkflows {
		if report.CompletedWorkflows[workflow] != len(safariconformance.RequiredReleaseRanks)*len(safariconformance.RequiredViewports) {
			return errors.New("required Safari workflow coverage is missing: " + workflow)
		}
	}
	for _, viewport := range safariconformance.RequiredViewports {
		if report.CompletedViewports[viewport] != len(safariconformance.RequiredReleaseRanks)*len(safariconformance.RequiredWorkflows) {
			return errors.New("required Safari viewport coverage is missing: " + viewport)
		}
	}
	if len(report.InputSHA256) != 1 || !digestPattern.MatchString("sha256:"+report.InputSHA256["safari_capture"]) {
		return errors.New("report capture digest is missing or invalid")
	}
	checks := map[string]bool{}
	for _, check := range report.Checks {
		if check.Status != "PASS" || strings.TrimSpace(check.Detail) == "" || checks[check.Code] {
			return errors.New("report contains failed, duplicated, or incomplete checks")
		}
		checks[check.Code] = true
	}
	for _, code := range requiredSafariCompatibilityChecks {
		if !checks[code] {
			return fmt.Errorf("required report check is missing: %s", code)
		}
	}
	return nil
}

func validateProductionInfrastructureEvidence(index EvidenceIndex, indexDirectory, candidateVersion, buildDigest string) (ProductionInfrastructureValidationSummary, error) {
	gaps := []string{"PRODUCTION_INFRASTRUCTURE_REPORT:0/1"}
	for _, component := range infrastructureconformance.RequiredComponents {
		gaps = append(gaps, component+":0/1")
	}
	summary := ProductionInfrastructureValidationSummary{Status: "PENDING", VerifiedComponents: []string{}, ControlCounts: map[string]int{}, Gaps: gaps}
	var item EvidenceItem
	found := false
	for _, candidate := range index.Items {
		if candidate.Code == productionInfrastructureEvidenceCode {
			item, found = candidate, true
			break
		}
	}
	if !found {
		return summary, errors.New("required evidence code is missing: " + productionInfrastructureEvidenceCode)
	}
	summary.Status = item.Status
	if len(item.Files) == 0 {
		if item.Status == "VERIFIED" {
			return summary, errors.New("PRODUCTION_INFRASTRUCTURE is incomplete and must remain PENDING: PRODUCTION_INFRASTRUCTURE_REPORT:0/1")
		}
		return summary, nil
	}
	reportPath := item.Files[0]
	if !filepath.IsAbs(reportPath) {
		reportPath = filepath.Join(indexDirectory, reportPath)
	}
	content, err := readRegularFile(reportPath)
	if err != nil {
		return summary, fmt.Errorf("read production infrastructure report: %w", err)
	}
	report, err := infrastructureconformance.ParseReport(content)
	if err != nil {
		return summary, err
	}
	if err = validateProductionInfrastructureReport(report, candidateVersion, buildDigest); err != nil {
		return summary, fmt.Errorf("production infrastructure report %s is not eligible: %w", filepath.Base(reportPath), err)
	}
	summary.ReportPresent = true
	summary.Environment = report.Environment
	summary.RegionRef = report.RegionRef
	summary.ClusterRef = report.ClusterRef
	summary.ComponentCount = report.ComponentCount
	summary.VerifiedComponents = slices.Clone(report.VerifiedComponents)
	summary.ControlCounts = mapsClone(report.ControlCounts)
	summary.CoverageComplete = true
	summary.Gaps = []string{}
	return summary, nil
}

func validateProductionInfrastructureReport(report infrastructureconformance.Report, candidateVersion, buildDigest string) error {
	if report.SchemaVersion != infrastructureconformance.ReportSchema || report.Result != "PASS" || report.EvidenceScope != "PRODUCTION_INFRASTRUCTURE" || report.ExternalValidationRequired {
		return errors.New("report must be a PASS PRODUCTION_INFRASTRUCTURE report with external validation completed")
	}
	if report.CandidateVersion != candidateVersion || strings.ToLower(report.BuildDigest) != strings.ToLower(buildDigest) {
		return errors.New("candidate version or build digest does not match the release bundle")
	}
	if report.GeneratedAt.IsZero() || strings.TrimSpace(report.Disclaimer) == "" || !slices.Contains([]string{"STAGING", "PRODUCTION"}, report.Environment) || strings.TrimSpace(report.RegionRef) == "" || strings.TrimSpace(report.ClusterRef) == "" || report.ComponentCount != len(infrastructureconformance.RequiredComponents) {
		return errors.New("report is missing environment, region, cluster, or required component coverage")
	}
	for _, component := range infrastructureconformance.RequiredComponents {
		if !slices.Contains(report.VerifiedComponents, component) || report.ControlCounts[component] < len(infrastructureconformance.RequiredControls(component)) {
			return errors.New("required infrastructure component or controls are missing: " + component)
		}
	}
	if len(report.InputSHA256) != 1 || !digestPattern.MatchString("sha256:"+report.InputSHA256["infrastructure_capture"]) {
		return errors.New("report capture digest is missing or invalid")
	}
	checks := map[string]bool{}
	for _, check := range report.Checks {
		if check.Status != "PASS" || strings.TrimSpace(check.Detail) == "" || checks[check.Code] {
			return errors.New("report contains failed, duplicated, or incomplete checks")
		}
		checks[check.Code] = true
	}
	for _, code := range requiredProductionInfrastructureChecks {
		if !checks[code] {
			return fmt.Errorf("required report check is missing: %s", code)
		}
	}
	return nil
}

func validateProductionRecoveryEvidence(index EvidenceIndex, indexDirectory, candidateVersion, buildDigest string) (ProductionRecoveryValidationSummary, error) {
	gaps := make([]string, 0, len(recoveryconformance.RequiredDrillTypes)+1)
	gaps = append(gaps, "PRODUCTION_EQUIVALENT_REPORT:0/1")
	for _, drillType := range recoveryconformance.RequiredDrillTypes {
		gaps = append(gaps, drillType+":0/1")
	}
	summary := ProductionRecoveryValidationSummary{Status: "PENDING", CompletedDrillTypes: []string{}, RecoverySeconds: map[string]int{}, Gaps: gaps}
	var item EvidenceItem
	found := false
	for _, candidate := range index.Items {
		if candidate.Code == productionRecoveryEvidenceCode {
			item, found = candidate, true
			break
		}
	}
	if !found {
		return summary, errors.New("required evidence code is missing: " + productionRecoveryEvidenceCode)
	}
	summary.Status = item.Status
	if len(item.Files) == 0 {
		if item.Status == "VERIFIED" {
			return summary, errors.New("PRODUCTION_RECOVERY is incomplete and must remain PENDING: PRODUCTION_EQUIVALENT_REPORT:0/1")
		}
		return summary, nil
	}
	reportPath := item.Files[0]
	if !filepath.IsAbs(reportPath) {
		reportPath = filepath.Join(indexDirectory, reportPath)
	}
	content, err := readRegularFile(reportPath)
	if err != nil {
		return summary, fmt.Errorf("read production recovery report: %w", err)
	}
	report, err := recoveryconformance.ParseReport(content)
	if err != nil {
		return summary, err
	}
	if err = validateProductionRecoveryReport(report, candidateVersion, buildDigest); err != nil {
		return summary, fmt.Errorf("production recovery report %s is not eligible: %w", filepath.Base(reportPath), err)
	}
	summary.ReportPresent = true
	summary.InfrastructureRef = report.InfrastructureRef
	summary.DrillCount = report.DrillCount
	summary.CompletedDrillTypes = slices.Clone(report.CompletedDrillTypes)
	summary.RecoverySeconds = mapsClone(report.ObservedRecoverySeconds)
	summary.CoverageComplete = true
	summary.Gaps = []string{}
	return summary, nil
}

func validateProductionRecoveryReport(report recoveryconformance.Report, candidateVersion, buildDigest string) error {
	if report.SchemaVersion != recoveryconformance.ReportSchema || report.Result != "PASS" || report.EvidenceScope != "PRODUCTION_EQUIVALENT" || report.ExternalValidationRequired {
		return errors.New("report must be a PASS PRODUCTION_EQUIVALENT report with external validation completed")
	}
	if report.CandidateVersion != candidateVersion || strings.ToLower(report.BuildDigest) != strings.ToLower(buildDigest) {
		return errors.New("candidate version or build digest does not match the release bundle")
	}
	if report.GeneratedAt.IsZero() || strings.TrimSpace(report.Disclaimer) == "" || strings.TrimSpace(report.InfrastructureRef) == "" || !slices.Contains([]string{"STAGING", "PRODUCTION"}, report.Environment) || report.DrillCount != len(recoveryconformance.RequiredDrillTypes) {
		return errors.New("report is missing environment, infrastructure, or required drill coverage")
	}
	for _, drillType := range recoveryconformance.RequiredDrillTypes {
		if !slices.Contains(report.CompletedDrillTypes, drillType) {
			return errors.New("required recovery drill is missing: " + drillType)
		}
		if _, ok := report.ObservedRecoverySeconds[drillType]; !ok {
			return errors.New("observed recovery duration is missing: " + drillType)
		}
	}
	if len(report.InputSHA256) != 1 || !digestPattern.MatchString("sha256:"+report.InputSHA256["recovery_capture"]) {
		return errors.New("report capture digest is missing or invalid")
	}
	checks := map[string]bool{}
	for _, check := range report.Checks {
		if check.Status != "PASS" || strings.TrimSpace(check.Detail) == "" || checks[check.Code] {
			return errors.New("report contains failed, duplicated, or incomplete checks")
		}
		checks[check.Code] = true
	}
	for _, code := range requiredProductionRecoveryChecks {
		if !checks[code] {
			return fmt.Errorf("required report check is missing: %s", code)
		}
	}
	return nil
}

func mapsClone(source map[string]int) map[string]int {
	result := make(map[string]int, len(source))
	for key, value := range source {
		result[key] = value
	}
	return result
}

func mapsCloneString(source map[string]string) map[string]string {
	result := make(map[string]string, len(source))
	for key, value := range source {
		result[key] = value
	}
	return result
}

func validateKMSRotationEvidence(index EvidenceIndex, indexDirectory, candidateVersion, buildDigest string) (KMSRotationValidationSummary, error) {
	summary := KMSRotationValidationSummary{Status: "PENDING", ConsumptionModes: []string{}, Gaps: []string{"REAL_KMS_HSM_REPORT:0/1", "DYNAMIC_READ:0/1", "ROLLING_RESTART:0/1"}}
	var item EvidenceItem
	found := false
	for _, candidate := range index.Items {
		if candidate.Code == kmsRotationEvidenceCode {
			item, found = candidate, true
			break
		}
	}
	if !found {
		return summary, errors.New("required evidence code is missing: " + kmsRotationEvidenceCode)
	}
	summary.Status = item.Status
	if len(item.Files) == 0 {
		if item.Status == "VERIFIED" {
			return summary, errors.New("KMS_ROTATION is incomplete and must remain PENDING: REAL_KMS_HSM_REPORT:0/1")
		}
		return summary, nil
	}
	reportPath := item.Files[0]
	if !filepath.IsAbs(reportPath) {
		reportPath = filepath.Join(indexDirectory, reportPath)
	}
	content, err := readRegularFile(reportPath)
	if err != nil {
		return summary, fmt.Errorf("read KMS rotation conformance report: %w", err)
	}
	report, err := kmsrotationconformance.ParseReport(content)
	if err != nil {
		return summary, err
	}
	if err = validateKMSRotationReport(report, candidateVersion, buildDigest); err != nil {
		return summary, fmt.Errorf("KMS rotation report %s is not eligible: %w", filepath.Base(reportPath), err)
	}
	summary.ReportPresent = true
	summary.ProviderRef = report.ProviderRef
	summary.RotationCount = report.RotationCount
	summary.ConsumptionModes = slices.Clone(report.ConsumptionModes)
	summary.CoverageComplete = true
	summary.Gaps = []string{}
	return summary, nil
}

func validateKMSRotationReport(report kmsrotationconformance.Report, candidateVersion, buildDigest string) error {
	if report.SchemaVersion != kmsrotationconformance.ReportSchema || report.Result != "PASS" || report.EvidenceScope != "REAL_KMS_HSM" || report.ExternalValidationRequired {
		return errors.New("report must be a PASS REAL_KMS_HSM report with external validation completed")
	}
	if report.CandidateVersion != candidateVersion || strings.ToLower(report.BuildDigest) != strings.ToLower(buildDigest) {
		return errors.New("candidate version or build digest does not match the release bundle")
	}
	if report.GeneratedAt.IsZero() || strings.TrimSpace(report.Disclaimer) == "" || strings.TrimSpace(report.ProviderRef) == "" || !slices.Contains([]string{"STAGING", "PRODUCTION"}, report.Environment) || report.RotationCount < 2 || !slices.Contains(report.ConsumptionModes, "DYNAMIC_READ") || !slices.Contains(report.ConsumptionModes, "ROLLING_RESTART") {
		return errors.New("report is missing provider, environment, or required rotation mode coverage")
	}
	if len(report.InputSHA256) != 1 || !digestPattern.MatchString("sha256:"+report.InputSHA256["rotation_capture"]) {
		return errors.New("report capture digest is missing or invalid")
	}
	checks := map[string]bool{}
	for _, check := range report.Checks {
		if check.Status != "PASS" || strings.TrimSpace(check.Detail) == "" || checks[check.Code] {
			return errors.New("report contains failed, duplicated, or incomplete checks")
		}
		checks[check.Code] = true
	}
	for _, code := range requiredKMSRotationChecks {
		if !checks[code] {
			return fmt.Errorf("required report check is missing: %s", code)
		}
	}
	return nil
}

func validateAlertReceiverEvidence(index EvidenceIndex, indexDirectory, candidateVersion, buildDigest string) (AlertReceiverValidationSummary, error) {
	summary := AlertReceiverValidationSummary{Status: "PENDING", Gaps: []string{"REAL_RECEIVER_REPORT:0/1", "FORMAL_ALERT_DRILL:0/1"}}
	var item EvidenceItem
	found := false
	for _, candidate := range index.Items {
		if candidate.Code == alertReceiverEvidenceCode {
			item, found = candidate, true
			break
		}
	}
	if !found {
		return summary, errors.New("required evidence code is missing: " + alertReceiverEvidenceCode)
	}
	summary.Status = item.Status
	if len(item.Files) == 0 {
		if item.Status == "VERIFIED" {
			return summary, errors.New("REAL_ALERT_RECEIVER is incomplete and must remain PENDING: REAL_RECEIVER_REPORT:0/1")
		}
		return summary, nil
	}
	reportPath := item.Files[0]
	if !filepath.IsAbs(reportPath) {
		reportPath = filepath.Join(indexDirectory, reportPath)
	}
	content, err := readRegularFile(reportPath)
	if err != nil {
		return summary, fmt.Errorf("read alert receiver conformance report: %w", err)
	}
	report, err := alertreceiverconformance.ParseReport(content)
	if err != nil {
		return summary, err
	}
	if err = validateAlertReceiverReport(report, candidateVersion, buildDigest); err != nil {
		return summary, fmt.Errorf("alert receiver report %s is not eligible: %w", filepath.Base(reportPath), err)
	}
	summary.ReportPresent = true
	summary.ActiveRouteCount = report.ActiveRouteCount
	summary.MappedGroupCount = report.MappedGroupCount
	summary.TestReceiptCount = report.TestReceiptCount
	summary.FormalDrillVerified = report.FormalDrillVerified
	summary.CoverageComplete = true
	summary.Gaps = []string{}
	return summary, nil
}

func validateAlertReceiverReport(report alertreceiverconformance.Report, candidateVersion, buildDigest string) error {
	if report.SchemaVersion != alertreceiverconformance.ReportSchema || report.Result != "PASS" || report.EvidenceScope != "REAL_RECEIVER" || report.ExternalValidationRequired {
		return errors.New("report must be a PASS REAL_RECEIVER report with external validation completed")
	}
	if report.CandidateVersion != candidateVersion || strings.ToLower(report.BuildDigest) != strings.ToLower(buildDigest) {
		return errors.New("candidate version or build digest does not match the release bundle")
	}
	if report.GeneratedAt.IsZero() || strings.TrimSpace(report.Disclaimer) == "" || strings.TrimSpace(report.ReceiverSystemRef) == "" || !report.FormalDrillVerified || report.ActiveRouteCount < 1 || report.MappedGroupCount < 1 || report.TestReceiptCount != report.ActiveRouteCount || len(report.RouteCoverage) != report.ActiveRouteCount {
		return errors.New("report is missing route coverage, mapping, receipt, drill, or identity evidence")
	}
	if _, err := uuid.Parse(report.TenantID); err != nil {
		return errors.New("report contains an invalid tenant identifier")
	}
	for _, coverage := range report.RouteCoverage {
		if _, err := uuid.Parse(coverage.RoutingPolicyID); err != nil || coverage.Status != "PASS" || strings.TrimSpace(coverage.ReceiverGroup) == "" {
			return errors.New("report contains invalid route coverage")
		}
		if _, err := uuid.Parse(coverage.TestRef); err != nil {
			return errors.New("report contains an invalid delivery test reference")
		}
	}
	inputNames := []string{"cloud_routes", "cloud_tests", "cloud_incident", "receiver_capture"}
	if len(report.InputSHA256) != len(inputNames) {
		return errors.New("report input digest inventory is incomplete")
	}
	for _, name := range inputNames {
		if !digestPattern.MatchString("sha256:" + report.InputSHA256[name]) {
			return errors.New("report input digest is missing or invalid: " + name)
		}
	}
	checks := map[string]bool{}
	for _, check := range report.Checks {
		if check.Status != "PASS" || strings.TrimSpace(check.Detail) == "" || checks[check.Code] {
			return errors.New("report contains failed, duplicated, or incomplete checks")
		}
		checks[check.Code] = true
	}
	for _, code := range requiredAlertReceiverChecks {
		if !checks[code] {
			return fmt.Errorf("required report check is missing: %s", code)
		}
	}
	return nil
}

func validateFirmwareEvidence(index EvidenceIndex, indexDirectory, candidateVersion, buildDigest string) (FirmwareValidationSummary, error) {
	summary := FirmwareValidationSummary{
		Status: "PENDING", RequiredDeviceCount: firmwareDeviceMinimum,
		RequiredScenarios: slices.Clone(requiredFirmwareScenarios), ScenarioDeviceCounts: map[string]int{}, Gaps: []string{},
	}
	var item EvidenceItem
	found := false
	for _, candidate := range index.Items {
		if candidate.Code == firmwareEvidenceCode {
			item, found = candidate, true
			break
		}
	}
	if !found {
		return summary, errors.New("required evidence code is missing: " + firmwareEvidenceCode)
	}
	summary.Status = item.Status
	deviceScenarios := map[string]map[string]bool{}
	seenReport := map[string]bool{}
	for _, reportPath := range item.Files {
		resolved := reportPath
		if !filepath.IsAbs(resolved) {
			resolved = filepath.Join(indexDirectory, resolved)
		}
		content, err := readRegularFile(resolved)
		if err != nil {
			return summary, fmt.Errorf("read firmware conformance report: %w", err)
		}
		report, err := firmwareconformance.ParseReport(content)
		if err != nil {
			return summary, err
		}
		if err = validateFirmwareReport(report, candidateVersion, buildDigest); err != nil {
			return summary, fmt.Errorf("firmware report %s is not eligible: %w", filepath.Base(resolved), err)
		}
		identity := report.DeviceID + "|" + report.Scenario
		if seenReport[identity] {
			return summary, fmt.Errorf("duplicate firmware report for device %s and scenario %s", report.DeviceID, report.Scenario)
		}
		seenReport[identity] = true
		if deviceScenarios[report.DeviceID] == nil {
			deviceScenarios[report.DeviceID] = map[string]bool{}
		}
		deviceScenarios[report.DeviceID][report.Scenario] = true
		summary.ScenarioDeviceCounts[report.Scenario]++
		summary.ReportCount++
	}
	summary.ObservedDeviceCount = len(deviceScenarios)
	for _, scenarios := range deviceScenarios {
		qualified := true
		for _, scenario := range requiredFirmwareScenarios {
			if !scenarios[scenario] {
				qualified = false
				break
			}
		}
		if qualified {
			summary.QualifiedDeviceCount++
		}
	}
	if summary.QualifiedDeviceCount < firmwareDeviceMinimum {
		summary.Gaps = append(summary.Gaps, fmt.Sprintf("QUALIFIED_DEVICE_COUNT:%d/%d", summary.QualifiedDeviceCount, firmwareDeviceMinimum))
	}
	for _, scenario := range requiredFirmwareScenarios {
		count := summary.ScenarioDeviceCounts[scenario]
		if count < firmwareDeviceMinimum {
			summary.Gaps = append(summary.Gaps, fmt.Sprintf("%s:%d/%d", scenario, count, firmwareDeviceMinimum))
		}
	}
	summary.CoverageComplete = summary.QualifiedDeviceCount >= firmwareDeviceMinimum && len(summary.Gaps) == 0
	if item.Status == "VERIFIED" && !summary.CoverageComplete {
		return summary, fmt.Errorf("REAL_DEVICE_FIRMWARE is incomplete and must remain PENDING: %s", strings.Join(summary.Gaps, ", "))
	}
	return summary, nil
}

func validateFirmwareReport(report firmwareconformance.Report, candidateVersion, buildDigest string) error {
	if report.SchemaVersion != firmwareconformance.ReportSchema || report.Result != "PASS" || report.EvidenceScope != "HARDWARE_CAPTURE" || !report.ExternalValidationRequired {
		return errors.New("report must be a PASS HARDWARE_CAPTURE report with external validation retained")
	}
	if report.CandidateVersion != candidateVersion || strings.ToLower(report.BuildDigest) != strings.ToLower(buildDigest) {
		return errors.New("candidate version or build digest does not match the release bundle")
	}
	if report.GeneratedAt.IsZero() || strings.TrimSpace(report.Disclaimer) == "" || report.CloudEventCount == 0 || report.DeviceEventCount == 0 {
		return errors.New("report is missing time, disclaimer, or event counts")
	}
	for _, value := range []string{report.DeviceID, report.ReleaseID, report.RolloutID, report.CommandID} {
		if _, err := uuid.Parse(value); err != nil {
			return errors.New("report contains an invalid public identifier")
		}
	}
	if !slices.Contains(requiredFirmwareScenarios, report.Scenario) {
		return errors.New("report scenario is not part of the required hardware suite")
	}
	if len(report.InputSHA256) != 2 || !digestPattern.MatchString("sha256:"+report.InputSHA256["cloud_rollout"]) || !digestPattern.MatchString("sha256:"+report.InputSHA256["device_evidence"]) {
		return errors.New("report input digests are missing or invalid")
	}
	checks := map[string]bool{}
	for _, check := range report.Checks {
		if check.Status != "PASS" || strings.TrimSpace(check.Detail) == "" || checks[check.Code] {
			return errors.New("report contains failed, duplicated, or incomplete checks")
		}
		checks[check.Code] = true
	}
	for _, code := range requiredFirmwareChecks {
		if !checks[code] {
			return fmt.Errorf("required report check is missing: %s", code)
		}
	}
	return nil
}

func decodeAcceptance(data []byte) (acceptanceSnapshot, error) {
	var snapshot acceptanceSnapshot
	if err := json.Unmarshal(data, &snapshot); err != nil {
		return acceptanceSnapshot{}, fmt.Errorf("decode acceptance snapshot: %w", err)
	}
	if snapshot.CandidateVersion == "" {
		var envelope struct {
			Data acceptanceSnapshot `json:"data"`
		}
		if err := json.Unmarshal(data, &envelope); err != nil {
			return acceptanceSnapshot{}, fmt.Errorf("decode acceptance snapshot envelope: %w", err)
		}
		snapshot = envelope.Data
	}
	return snapshot, nil
}

func collectPilotEvidence(options Options, acceptance acceptanceSnapshot) (pilotBundleEvidence, error) {
	hasPilotInput := len(options.PilotDailySnapshotPaths) > 0 || strings.TrimSpace(options.PilotWeeklySnapshotPath) != ""
	if acceptance.RunType != "PILOT" && !hasPilotInput {
		return pilotBundleEvidence{}, nil
	}
	if len(options.PilotDailySnapshotPaths) != 7 || strings.TrimSpace(options.PilotWeeklySnapshotPath) == "" {
		return pilotBundleEvidence{}, errors.New("PILOT evidence requires exactly seven daily snapshots and one weekly snapshot")
	}
	if strings.TrimSpace(acceptance.TenantID) == "" {
		return pilotBundleEvidence{}, errors.New("PILOT acceptance snapshot is missing tenant identity")
	}

	weeklyBytes, err := readRegularFile(options.PilotWeeklySnapshotPath)
	if err != nil {
		return pilotBundleEvidence{}, fmt.Errorf("read PILOT weekly snapshot: %w", err)
	}
	var weekly pilotWeeklySnapshot
	if err = decodeArtifact(weeklyBytes, &weekly); err != nil {
		return pilotBundleEvidence{}, fmt.Errorf("decode PILOT weekly snapshot: %w", err)
	}
	location, err := time.LoadLocation(weekly.Timezone)
	if err != nil {
		return pilotBundleEvidence{}, errors.New("PILOT weekly snapshot timezone is invalid")
	}
	weekStart, err := time.ParseInLocation("2006-01-02", weekly.WeekStart, location)
	if err != nil || weekStart.Weekday() != time.Monday || weekly.ID == "" || weekly.TenantID != acceptance.TenantID || weekly.CandidateVersion != acceptance.CandidateVersion || strings.ToLower(weekly.BuildDigest) != strings.ToLower(acceptance.BuildDigest) || weekly.RedactionPolicy != "ops-pilot-weekly-minimal-v1" {
		return pilotBundleEvidence{}, errors.New("PILOT weekly snapshot identity, tenant, candidate, week, or redaction policy is invalid")
	}
	expectedWeekStart := weekStart.UTC()
	expectedWeekEnd := weekStart.AddDate(0, 0, 7).UTC()
	if !weekly.IsComplete || weekly.GeneratedAt.IsZero() || weekly.GeneratedAt.Before(expectedWeekEnd) || !weekly.WindowStart.Equal(expectedWeekStart) || !weekly.WindowEnd.Equal(expectedWeekEnd) {
		return pilotBundleEvidence{}, errors.New("PILOT weekly snapshot is incomplete or has inconsistent calendar boundaries")
	}
	complaintsRequired := false
	for _, item := range weekly.ExternalEvidence {
		if item.Code == "complaints" && item.Status == "REQUIRED" {
			complaintsRequired = true
		}
	}
	if !complaintsRequired {
		return pilotBundleEvidence{}, errors.New("PILOT weekly snapshot must preserve the required external complaints evidence gap")
	}

	result := pilotBundleEvidence{
		WeekStart: weekly.WeekStart,
		Timezone:  weekly.Timezone,
		Daily:     []bundleFile{},
		Weekly:    bundleFile{archivePath: "pilot/weekly/" + weekly.WeekStart + ".json", data: weeklyBytes},
	}
	seenDates := map[string]bool{}
	for _, path := range options.PilotDailySnapshotPaths {
		dailyBytes, readErr := readRegularFile(path)
		if readErr != nil {
			return pilotBundleEvidence{}, fmt.Errorf("read PILOT daily snapshot: %w", readErr)
		}
		var daily pilotDailySnapshot
		if decodeErr := decodeArtifact(dailyBytes, &daily); decodeErr != nil {
			return pilotBundleEvidence{}, fmt.Errorf("decode PILOT daily snapshot: %w", decodeErr)
		}
		localDate, parseErr := time.ParseInLocation("2006-01-02", daily.LocalDate, location)
		if parseErr != nil || daily.ID == "" || daily.GeneratedAt.IsZero() || daily.TenantID != acceptance.TenantID || daily.CandidateVersion != acceptance.CandidateVersion || strings.ToLower(daily.BuildDigest) != strings.ToLower(acceptance.BuildDigest) || daily.Timezone != weekly.Timezone || daily.RedactionPolicy != "ops-pilot-daily-minimal-v1" {
			return pilotBundleEvidence{}, fmt.Errorf("PILOT daily snapshot identity, tenant, candidate, date, timezone, or redaction policy is invalid: %s", daily.LocalDate)
		}
		if localDate.Before(weekStart) || !localDate.Before(weekStart.AddDate(0, 0, 7)) || seenDates[daily.LocalDate] {
			return pilotBundleEvidence{}, fmt.Errorf("PILOT daily snapshot is outside the weekly window or duplicated: %s", daily.LocalDate)
		}
		if !daily.WindowStart.Equal(localDate.UTC()) || !daily.WindowEnd.Equal(localDate.AddDate(0, 0, 1).UTC()) {
			return pilotBundleEvidence{}, fmt.Errorf("PILOT daily snapshot has inconsistent calendar boundaries: %s", daily.LocalDate)
		}
		seenDates[daily.LocalDate] = true
		result.Daily = append(result.Daily, bundleFile{archivePath: "pilot/daily/" + daily.LocalDate + ".json", data: dailyBytes})
	}
	for day := 0; day < 7; day++ {
		expected := weekStart.AddDate(0, 0, day).Format("2006-01-02")
		if !seenDates[expected] {
			return pilotBundleEvidence{}, fmt.Errorf("PILOT daily snapshot is missing: %s", expected)
		}
	}
	sort.Slice(result.Daily, func(i, j int) bool { return result.Daily[i].archivePath < result.Daily[j].archivePath })
	return result, nil
}

func decodeArtifact(data []byte, target any) error {
	var envelope struct {
		Data json.RawMessage `json:"data"`
	}
	if err := json.Unmarshal(data, &envelope); err != nil {
		return err
	}
	if len(envelope.Data) > 0 && string(envelope.Data) != "null" {
		return json.Unmarshal(envelope.Data, target)
	}
	return json.Unmarshal(data, target)
}

func collectBaseline(root string) ([]bundleFile, int, []string, error) {
	required := []string{
		"openapi/openapi.yaml", "compose.yaml", ".github/workflows/ci.yml", "go.mod", "go.sum",
		"web/package.json", "web/package-lock.json", "docs/development-plan.md", "docs/development-status.md",
		"docs/requirements-traceability.md", "docs/external-acceptance-checklist.md", "docs/kubernetes-deployment.md",
		"docs/alert-operations.md", "docs/integration-diagnostics.md", "docs/content-safety-provider.md", "docs/remote-ci-supply-chain-evidence.md", "docs/real-device-rtc-evidence.md", "docs/real-agent-models-evidence.md", "docs/production-infrastructure-evidence.md", "docs/safari-compatibility-evidence.md", "docs/pilot-daily-operations.md", "docs/pilot-weekly-review.md",
	}
	paths := slices.Clone(required)
	for _, directory := range []string{"openapi", "migrations", "deploy/kubernetes"} {
		err := filepath.WalkDir(filepath.Join(root, directory), func(path string, entry os.DirEntry, walkErr error) error {
			if walkErr != nil {
				return walkErr
			}
			if entry.Type().IsRegular() {
				relative, _ := filepath.Rel(root, path)
				paths = append(paths, filepath.ToSlash(relative))
			}
			return nil
		})
		if err != nil {
			return nil, 0, nil, fmt.Errorf("inventory %s: %w", directory, err)
		}
	}
	sbomMatches, _ := filepath.Glob(filepath.Join(root, "artifacts", "*.cdx.json"))
	for _, match := range sbomMatches {
		relative, _ := filepath.Rel(root, match)
		paths = append(paths, filepath.ToSlash(relative))
	}
	sort.Strings(paths)
	paths = slices.Compact(paths)
	files := make([]bundleFile, 0, len(paths))
	for _, relative := range paths {
		data, err := readRegularFile(filepath.Join(root, filepath.FromSlash(relative)))
		if err != nil {
			return nil, 0, nil, fmt.Errorf("read baseline file %s: %w", relative, err)
		}
		files = append(files, bundleFile{archivePath: "baseline/" + relative, data: data})
	}
	warnings := []string{}
	if len(sbomMatches) == 0 {
		warnings = append(warnings, "SBOM_NOT_PRESENT_IN_WORKTREE: use the CI-generated CycloneDX artifacts before release review")
	}
	return files, len(sbomMatches), warnings, nil
}

func readRegularFile(path string) ([]byte, error) {
	path = strings.TrimSpace(path)
	if path == "" {
		return nil, errors.New("file path is required")
	}
	info, err := os.Lstat(path)
	if err != nil {
		return nil, err
	}
	if !info.Mode().IsRegular() || info.Size() > maxEvidenceFileBytes {
		return nil, errors.New("file must be regular and no larger than 100 MiB")
	}
	return os.ReadFile(path)
}

func safeBaseName(value string) string {
	value = regexp.MustCompile(`[^A-Za-z0-9._-]+`).ReplaceAllString(value, "-")
	value = strings.Trim(value, ".-")
	if value == "" {
		return "evidence.bin"
	}
	return value
}

func writeZIP(output *os.File, files []bundleFile, generatedAt time.Time) error {
	writer := zip.NewWriter(output)
	for _, file := range files {
		header := &zip.FileHeader{Name: filepath.ToSlash(file.archivePath), Method: zip.Deflate}
		header.SetMode(0o644)
		header.SetModTime(generatedAt)
		entry, err := writer.CreateHeader(header)
		if err != nil {
			writer.Close()
			return fmt.Errorf("create bundle entry %s: %w", file.archivePath, err)
		}
		if _, err = entry.Write(file.data); err != nil {
			writer.Close()
			return fmt.Errorf("write bundle entry %s: %w", file.archivePath, err)
		}
	}
	if err := writer.Close(); err != nil {
		return fmt.Errorf("close bundle zip: %w", err)
	}
	return nil
}

func hashFile(path string) (string, error) {
	file, err := os.Open(path)
	if err != nil {
		return "", fmt.Errorf("open evidence bundle for hashing: %w", err)
	}
	defer file.Close()
	hash := sha256.New()
	if _, err = io.Copy(hash, file); err != nil {
		return "", fmt.Errorf("hash evidence bundle: %w", err)
	}
	return "sha256:" + hex.EncodeToString(hash.Sum(nil)), nil
}