Add named pipeline profile composition

internal/config/effective_digest.go

@@ -0,0 +1,69 @@
+package config
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+
+	"gopkg.in/yaml.v3"
+)
+
+const pipelineDefaultOwnershipSource = "default"
+
+func finalizePipelineResolution(cfg *PipelineConfig) error {
+	if cfg == nil || cfg.resolution == nil {
+		return fmt.Errorf("pipeline resolution metadata is required")
+	}
+	declared := make(map[string][]string, len(cfg.resolution.ownership))
+	for _, ownership := range cfg.resolution.ownership {
+		declared[ownership.path] = append([]string(nil), ownership.sources...)
+	}
+	data, err := yaml.Marshal(cfg)
+	if err != nil {
+		return fmt.Errorf("serialize normalized effective pipeline: %w", err)
+	}
+	document, err := parseCompositionBytes("normalized effective pipeline", data)
+	if err != nil {
+		return err
+	}
+	records, err := document.semanticRecords()
+	if err != nil {
+		return err
+	}
+	ownership := make([]pipelineFieldOwnership, 0, len(records))
+	for _, record := range records {
+		sources := declared[record.Path]
+		if len(sources) == 0 {
+			sources = []string{pipelineDefaultOwnershipSource}
+		}
+		ownership = append(ownership, pipelineFieldOwnership{
+			path: record.Path, sources: append([]string(nil), sources...),
+		})
+	}
+	cfg.resolution.ownership = ownership
+	return recomputePipelineEffectiveDigest(cfg)
+}
+
+// recomputePipelineEffectiveDigest is the single package-owned hook for
+// refreshing provenance after later resolution expands concrete pipeline
+// values. Composition declarations and runtime provenance are not serialized.
+func recomputePipelineEffectiveDigest(cfg *PipelineConfig) error {
+	if cfg == nil || cfg.resolution == nil {
+		return fmt.Errorf("pipeline resolution metadata is required")
+	}
+	data, err := yaml.Marshal(cfg)
+	if err != nil {
+		return fmt.Errorf("serialize normalized effective pipeline: %w", err)
+	}
+	document, err := parseCompositionBytes("normalized effective pipeline", data)
+	if err != nil {
+		return err
+	}
+	canonical, err := document.canonicalDigestInput()
+	if err != nil {
+		return err
+	}
+	digest := sha256.Sum256(canonical)
+	cfg.resolution.effectiveDigest = hex.EncodeToString(digest[:])
+	return nil
+}