refactor(lab): separate release contract identity

tests/test_observatory_portable_lab_v1_executor.py

@@ -840,14 +840,16 @@ def _release_for_definition(
     )
     identity = release.identity_document()
     identity["definition_version"] = definition.version
-    identity["definition_sha256"] = definition.definition_sha256
+    identity["definition_contract_sha256"] = (
+        definition.executable_contract_sha256
+    )
     identity["executor_image_sha256"] = "f" * 64
     identity["assets"] = [asset.as_dict() for asset in assets]
     identity["declared_blockers"] = []
     return replace(
         release,
         definition_version=definition.version,
-        definition_sha256=definition.definition_sha256,
+        definition_contract_sha256=definition.executable_contract_sha256,
         executor_image_sha256="f" * 64,
         assets=assets,
         declared_blockers=(),
@@ -895,6 +897,39 @@ def test_release_candidate_matches_repository_but_stays_honestly_blocked(
         )
 
 
+def test_release_seal_survives_full_definition_executor_promotion() -> None:
+    blocked = _definition()
+    release = _release_for_definition(blocked)
+    inspection = PortableLabV1ReleaseInspection(
+        candidate_sha256=release.candidate_sha256,
+        matched_assets=tuple(asset.asset_id for asset in release.assets),
+        blockers=(),
+        ready=True,
+    )
+    seal = release.seal(inspection)
+    ready_executor = replace(
+        blocked.executor,
+        state="ready",
+        release_id=seal.release_id,
+        release_sha256=seal.release_sha256,
+        image_sha256=seal.executor_image_sha256,
+        reason_code=None,
+        reason=None,
+    )
+    identity = blocked.identity_document()
+    identity["executor"] = ready_executor.identity_document()
+    promoted = replace(
+        blocked,
+        executor=ready_executor,
+        definition_sha256=canonical_sha256(identity),
+    )
+
+    assert promoted.definition_sha256 != blocked.definition_sha256
+    assert promoted.executable_contract_sha256 == blocked.executable_contract_sha256
+    assert seal.definition_contract_sha256 == blocked.executable_contract_sha256
+    release.bind_definition(promoted)
+
+
 def test_source_materialization_and_effective_config_are_recording_independent(
     tmp_path: Path,
 ) -> None:
@@ -1034,6 +1069,11 @@ def test_release_manifest_is_digest_fenced() -> None:
         repository_root=REPOSITORY_ROOT,
     )
 
+    assert document["schema_version"].endswith("/v2")
+    assert document["definition_contract_sha256"] == (
+        _definition().executable_contract_sha256
+    )
+    assert "definition_sha256" not in document
     assert document["executor_image_sha256"] is None
     with pytest.raises(Exception, match="identity digest changed"):
         replace(release, candidate_sha256="f" * 64)

tests/test_observatory_portable_run_definitions.py

@@ -324,6 +324,8 @@ def test_conversion_to_recorded_definition_requires_and_preserves_sealed_identit
 
     recorded = ready.to_recorded_run_definition()
 
+    assert ready.definition_sha256 != blocked.definition_sha256
+    assert ready.executable_contract_sha256 == blocked.executable_contract_sha256
     assert recorded.setup_id == ready.setup_id
     assert recorded.definition_sha256 == ready.definition_sha256
     assert recorded.source_adapter_sha256 == ready.source_adapter.contract_sha256