Emit labtrust_to_certifyedge_handoff.json in clean-chain staging

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: fraware

examples/pcs_qc_release/scripts/_pcs_chain_env.sh

@@ -15,6 +15,7 @@ pcs_chain_init() {
   export WORK="${PCS_CHAIN_WORK:-$RELEASE_RUN_DIR}"
 
   export TRACE_JSON="${WORK}/trace.json"
+  export HANDOFF_CE_JSON="${WORK}/labtrust_to_certifyedge_handoff.json"
   export RUNTIME_RECEIPT_JSON="${WORK}/runtime_receipt.json"
   export PENDING_JSON="${WORK}/science_claim_bundle.pending.json"
   export TRACE_CERT_JSON="${WORK}/trace_certificate.json"

examples/pcs_qc_release/scripts/run_pcs_v01_clean_chain.ps1

@@ -64,6 +64,16 @@ Step "LabTrust-Gym: export PCS artifacts"
 & $Labtrust export-pcs --run $RunDir --out $PendingJson
 & $Pcs validate $PendingJson
 
+$HandoffCeJson = Join-Path $Work "labtrust_to_certifyedge_handoff.json"
+Step "LabTrust-Gym: HandoffManifest.v0 (runtime_to_certificate) for CertifyEdge"
+& $Labtrust emit-handoff-to-certifyedge `
+  --trace $TraceJson `
+  --runtime-receipt $ReceiptJson `
+  --out $HandoffCeJson `
+  --release-mode
+& $Pcs validate $HandoffCeJson
+Copy-Item -Force $HandoffCeJson (Join-Path $Work "handoff_to_certifyedge.json")
+
 if ($LabtrustOnly) {
     Step "LabTrust-only chain OK"
     & $Python (Join-Path $PSScriptRoot "verify_pcs_v01_chain.py") --work $Work --stage labtrust
@@ -77,8 +87,12 @@ if (-not $CeCmd) {
 }
 if (-not (Test-Path $CertifyEdgeSpec)) { throw "CertifyEdge spec not found: $CertifyEdgeSpec" }
 
-Step "CertifyEdge: emit and verify TraceCertificate"
-& $CertifyEdgeBin emit-pcs-certificate --spec $CertifyEdgeSpec --trace $TraceJson --out $CertJson
+$HandoffOutJson = Join-Path $Work "certifyedge_to_labtrust_handoff.json"
+Step "CertifyEdge: emit and verify TraceCertificate (HandoffManifest input)"
+& $CertifyEdgeBin --release-mode emit-pcs-certificate `
+  --handoff $HandoffCeJson `
+  --out $CertJson `
+  --handoff-out $HandoffOutJson
 & $Pcs validate $CertJson
 & $CertifyEdgeBin verify-certificate $CertJson --trace $TraceJson
 

examples/pcs_qc_release/scripts/run_pcs_v01_clean_chain.sh

@@ -41,6 +41,16 @@ labtrust export-runtime-receipt --run "$RUN_DIR" --out "$RUNTIME_RECEIPT_JSON"
 labtrust export-pcs --run "$RUN_DIR" --out "$PENDING_JSON"
 pcs validate "$PENDING_JSON"
 
+HANDOFF_CE_JSON="${WORK}/labtrust_to_certifyedge_handoff.json"
+pcs_step "LabTrust-Gym: HandoffManifest.v0 (runtime_to_certificate) for CertifyEdge"
+labtrust emit-handoff-to-certifyedge \
+  --trace "$TRACE_JSON" \
+  --runtime-receipt "$RUNTIME_RECEIPT_JSON" \
+  --out "$HANDOFF_CE_JSON" \
+  --release-mode
+pcs validate "$HANDOFF_CE_JSON"
+cp -f "$HANDOFF_CE_JSON" "${WORK}/handoff_to_certifyedge.json"
+
 if [ "$LABTRUST_ONLY" -eq 1 ]; then
   pcs_step "LabTrust-only chain OK"
   python "$SCRIPT_DIR/verify_pcs_v01_chain.py" --work "$WORK" --stage labtrust
@@ -53,11 +63,12 @@ if [ ! -f "$CERTIFYEDGE_SPEC" ]; then
   exit 1
 fi
 
-pcs_step "CertifyEdge: emit and verify TraceCertificate"
-"$CERTIFYEDGE_BIN" emit-pcs-certificate \
-  --spec "$CERTIFYEDGE_SPEC" \
-  --trace "$TRACE_JSON" \
-  --out "$TRACE_CERT_JSON"
+HANDOFF_OUT_JSON="${WORK}/certifyedge_to_labtrust_handoff.json"
+pcs_step "CertifyEdge: emit and verify TraceCertificate (HandoffManifest input)"
+"$CERTIFYEDGE_BIN" --release-mode emit-pcs-certificate \
+  --handoff "$HANDOFF_CE_JSON" \
+  --out "$TRACE_CERT_JSON" \
+  --handoff-out "$HANDOFF_OUT_JSON"
 pcs validate "$TRACE_CERT_JSON"
 "$CERTIFYEDGE_BIN" verify-certificate "$TRACE_CERT_JSON" --trace "$TRACE_JSON"
 

src/labtrust_gym/pcs/handoff_manifest.py

@@ -18,6 +18,8 @@
 
 HANDOFF_TO_PF_NAME = "handoff_to_pf.json"
 HANDOFF_TO_CERTIFYEDGE_NAME = "handoff_to_certifyedge.json"
+# Filename used by CertifyEdge release-run / clean-checkout staging (PCS Phase 2).
+LABTRUST_TO_CERTIFYEDGE_HANDOFF_NAME = "labtrust_to_certifyedge_handoff.json"
 CERTIFIED_BUNDLE_NAME = "science_claim_bundle.certified.json"
 TRACE_NAME = "trace.json"
 RUNTIME_RECEIPT_NAME = "runtime_receipt.json"
@@ -325,6 +327,39 @@ def emit_handoff_manifest(
     return doc
 
 
+def write_certifyedge_chain_handoffs(
+    *,
+    trace_path: Path,
+    runtime_receipt_path: Path,
+    work_dir: Path,
+    policy_root: Path | None = None,
+    property_id: str = DEFAULT_PROPERTY_ID,
+    release_mode: bool | None = None,
+    handoff_id: str | None = None,
+) -> dict[str, Any]:
+    """
+    Write runtime_to_certificate HandoffManifest.v0 for CertifyEdge clean-chain staging.
+
+    Emits ``labtrust_to_certifyedge_handoff.json`` (CertifyEdge convention) and
+    ``handoff_to_certifyedge.json`` (release fixture name) under ``work_dir``.
+    """
+    work_dir = work_dir.resolve()
+    doc = emit_handoff_to_certifyedge(
+        trace_path=trace_path,
+        runtime_receipt_path=runtime_receipt_path,
+        out_path=work_dir / LABTRUST_TO_CERTIFYEDGE_HANDOFF_NAME,
+        policy_root=policy_root,
+        property_id=property_id,
+        release_mode=release_mode,
+        handoff_id=handoff_id,
+    )
+    legacy = work_dir / HANDOFF_TO_CERTIFYEDGE_NAME
+    staging = work_dir / LABTRUST_TO_CERTIFYEDGE_HANDOFF_NAME
+    if legacy != staging:
+        legacy.write_text(staging.read_text(encoding="utf-8"), encoding="utf-8")
+    return doc
+
+
 def build_handoff_to_pf_from_release(
     release_root: Path,
     manifest: dict[str, Any],

src/labtrust_gym/pcs/release_protocol_producer.py

@@ -22,8 +22,9 @@
 from labtrust_gym.pcs.handoff_manifest import (
     HANDOFF_TO_CERTIFYEDGE_NAME,
     HANDOFF_TO_PF_NAME,
-    emit_handoff_to_certifyedge,
+    LABTRUST_TO_CERTIFYEDGE_HANDOFF_NAME,
     emit_handoff_to_pf,
+    write_certifyedge_chain_handoffs,
 )
 from labtrust_gym.pcs.manifest import resolve_pcs_core_root
 from labtrust_gym.pcs.release_fragment import (
@@ -48,6 +49,7 @@
 
 LABTRUST_PROTOCOL_HANDOFF_ARTIFACTS: tuple[str, ...] = (
     HANDOFF_TO_CERTIFYEDGE_NAME,
+    LABTRUST_TO_CERTIFYEDGE_HANDOFF_NAME,
     HANDOFF_TO_PF_NAME,
     LABTRUST_RELEASE_FRAGMENT_NAME,
 )
@@ -136,25 +138,24 @@ def regenerate_release_protocol(
     export_runtime_receipt(demo_run, work / "runtime_receipt.json", policy_root=root)
     export_pcs_bundle(demo_run, work / "science_claim_bundle.pending.json", policy_root=root)
 
-    emit_handoff_to_certifyedge(
+    write_certifyedge_chain_handoffs(
         trace_path=work / "trace.json",
         runtime_receipt_path=work / "runtime_receipt.json",
-        out_path=work / HANDOFF_TO_CERTIFYEDGE_NAME,
+        work_dir=work,
         policy_root=root,
         property_id=property_id,
         release_mode=True,
     )
 
     cert_path = work / "trace_certificate.json"
+    handoff_ce = work / LABTRUST_TO_CERTIFYEDGE_HANDOFF_NAME
     subprocess.run(
         [
             ce_bin,
             "--release-mode",
             "emit-pcs-certificate",
-            "--spec",
-            str(spec),
-            "--trace",
-            str(work / "trace.json"),
+            "--handoff",
+            str(handoff_ce),
             "--out",
             str(cert_path),
         ],
@@ -241,10 +242,10 @@ def emit_protocol_package_from_release(
     Returns summary dict with paths and digests.
     """
     release_dir = release_dir.resolve()
-    emit_handoff_to_certifyedge(
+    write_certifyedge_chain_handoffs(
         trace_path=release_dir / "trace.json",
         runtime_receipt_path=release_dir / "runtime_receipt.json",
-        out_path=release_dir / HANDOFF_TO_CERTIFYEDGE_NAME,
+        work_dir=release_dir,
         policy_root=policy_root,
         property_id=property_id,
         release_mode=True,

src/labtrust_gym/pcs/release_run.py

@@ -288,9 +288,11 @@ def write_run_manifests(
     (run_dir / RELEASE_HANDOFF_MANIFEST_NAME).write_text(
         json.dumps(handoff_manifest, indent=2, sort_keys=True) + "\n", encoding="utf-8"
     )
-    (run_dir / HANDOFF_TO_CERTIFYEDGE_NAME).write_text(
-        json.dumps(handoff_ce, indent=2, sort_keys=True) + "\n", encoding="utf-8"
-    )
+    handoff_ce_text = json.dumps(handoff_ce, indent=2, sort_keys=True) + "\n"
+    (run_dir / HANDOFF_TO_CERTIFYEDGE_NAME).write_text(handoff_ce_text, encoding="utf-8")
+    from labtrust_gym.pcs.handoff_manifest import LABTRUST_TO_CERTIFYEDGE_HANDOFF_NAME
+
+    (run_dir / LABTRUST_TO_CERTIFYEDGE_HANDOFF_NAME).write_text(handoff_ce_text, encoding="utf-8")
     (run_dir / HANDOFF_FOR_PF_NAME).write_text(
         json.dumps(handoff_pf, indent=2, sort_keys=True) + "\n", encoding="utf-8"
     )

tests/pcs/test_release_protocol_producer.py

@@ -17,10 +17,12 @@
 from labtrust_gym.pcs.handoff_manifest import (
     HANDOFF_TO_CERTIFYEDGE_NAME,
     HANDOFF_TO_PF_NAME,
+    LABTRUST_TO_CERTIFYEDGE_HANDOFF_NAME,
     assert_handoff_manifest_valid,
     assert_handoff_registry_check,
     build_runtime_to_certificate_handoff,
     emit_handoff_manifest,
+    write_certifyedge_chain_handoffs,
 )
 from labtrust_gym.pcs.mock_certificate import build_mock_trace_certificate
 from labtrust_gym.pcs.regenerate_release_chain import compare_release_hashes_to_canonical
@@ -52,6 +54,27 @@ def test_committed_release_protocol_package_complete(release_dir: Path) -> None:
     )
 
 
+def test_write_certifyedge_chain_handoffs_staging_filename(
+    release_dir: Path, tmp_path: Path
+) -> None:
+    work = tmp_path / "staging"
+    work.mkdir()
+    doc = write_certifyedge_chain_handoffs(
+        trace_path=release_dir / "trace.json",
+        runtime_receipt_path=release_dir / "runtime_receipt.json",
+        work_dir=work,
+        release_mode=True,
+    )
+    staging = work / LABTRUST_TO_CERTIFYEDGE_HANDOFF_NAME
+    legacy = work / HANDOFF_TO_CERTIFYEDGE_NAME
+    assert staging.is_file()
+    assert legacy.is_file()
+    assert staging.read_text(encoding="utf-8") == legacy.read_text(encoding="utf-8")
+    assert doc["handoff_kind"] == "runtime_to_certificate"
+    assert_handoff_manifest_valid(doc)
+    assert_handoff_registry_check(staging)
+
+
 def test_emit_handoff_to_certifyedge_validates_against_pcs_core(
     release_dir: Path, tmp_path: Path
 ) -> None: