@kungfu-tech/buildchain 2.12.7-alpha.22 → 2.12.7-alpha.4

package/dist/site/workflow-registry.json

@@ -215,19 +215,14 @@
       "reusable": true,
       "inputs": [
         "admission-json",
-        "authority-workflow-path",
         "auto-admission",
-        "auto-admission-kind",
-        "auto-no-gate",
         "buildchain-ref",
         "buildchain-repository",
         "control-plane-audit-json",
         "dry-run",
-        "evidence-controller-artifact",
         "evidence-manifest-pattern",
         "evidence-passport-artifact",
         "evidence-payload-pattern",
-        "evidence-publication-artifact",
         "evidence-repository",
         "evidence-run-id",
         "evidence-summary-artifact",
@@ -238,13 +233,12 @@
         "publication-target",
         "publication-version",
         "publisher-workflow-path",
-        "required-status-check",
         "runner-provenance-json",
         "source-sha",
         "target-ref",
         "used-nonces-json"
       ],
-      "inputCount": 29,
+      "inputCount": 23,
       "secrets": [],
       "secretCount": 0,
       "outputs": [
@@ -1031,54 +1025,6 @@
       "capabilityGroup": "api-cli-reference",
       "status": "active"
     },
-    {
-      "id": "paper-release-sealed",
-      "path": ".github/workflows/paper-release-sealed.yml",
-      "reusable": true,
-      "inputs": [
-        "artifact-name",
-        "artifact-paths",
-        "artifact-retention-days",
-        "branch-protection-bypass-apps",
-        "branch-protection-bypass-teams",
-        "branch-protection-bypass-users",
-        "buildchain-contract-lock-path",
-        "buildchain-ref",
-        "buildchain-repository",
-        "dry-run",
-        "github-release",
-        "github-release-notes",
-        "github-release-title",
-        "package-name",
-        "publish-dist-tag",
-        "publisher-workflow-path",
-        "release-passport-impact-json",
-        "release-passport-output-dir",
-        "release-passport-product-name",
-        "required-status-check",
-        "target-ref",
-        "target-sha",
-        "toolchain-type",
-        "verify-command",
-        "working-directory"
-      ],
-      "inputCount": 25,
-      "secrets": [
-        "BUILDCHAIN_PROMOTION_TOKEN"
-      ],
-      "secretCount": 1,
-      "outputs": [
-        "github-release-url",
-        "package-name",
-        "package-version",
-        "public-release-tag",
-        "release-passport-path"
-      ],
-      "outputCount": 5,
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active"
-    },
     {
       "id": "paper-release",
       "path": ".github/workflows/paper-release.yml",
@@ -1248,11 +1194,7 @@
         "buildchain-ref",
         "buildchain-repository",
         "node-version",
-        "package-name",
-        "prepare-paper-package",
-        "publish-dist-tag",
         "setup-node",
-        "target-ref",
         "toolchain-command",
         "toolchain-digest",
         "toolchain-image",
@@ -1260,7 +1202,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 21,
+      "inputCount": 17,
       "secrets": [],
       "secretCount": 0,
       "outputs": [
@@ -1271,17 +1213,13 @@
         "controller-receipt-digest",
         "controller-receipt-json",
         "controller-receipt-status",
-        "package-name",
-        "package-version",
         "publication-artifact-name",
         "publication-manifest-json",
         "publication-manifest-path",
         "publication-passport-path",
-        "publication-registry-path",
-        "publish-dist-tag",
-        "runtime-sha"
+        "publication-registry-path"
       ],
-      "outputCount": 16,
+      "outputCount": 12,
       "surface": "repository-workflow",
       "capabilityGroup": "reusable-build",
       "status": "active"
@@ -1310,7 +1248,6 @@
         "package-manager",
         "publication-admission-json",
         "publication-auto-admission",
-        "publication-auto-no-gate",
         "publication-control-plane-audit-json",
         "publication-expected-json",
         "publication-gate-aggregate-json",
@@ -1348,7 +1285,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 56,
+      "inputCount": 55,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",

package/docs/publication-artifacts.md

@@ -182,42 +182,40 @@ on:
 
 jobs:
   paper-release:
-    uses: kungfu-systems/buildchain/.github/workflows/paper-release-sealed.yml@v2
+    uses: kungfu-systems/buildchain/.github/workflows/paper-release.yml@v2
     permissions:
-      actions: read
       checks: write
       contents: write
       id-token: write
       issues: write
     with:
       buildchain-ref: ${{ inputs.buildchain-ref || '' }}
-      publisher-workflow-path: .github/workflows/paper-release.yml
+      publication-admission-json: ${{ needs.authority.outputs.admission-json }}
+      publication-runner-provenance-json: ${{ needs.authority.outputs.runner-provenance-json }}
+      publication-control-plane-audit-json: ${{ needs.authority.outputs.control-plane-audit-json }}
+      publication-expected-json: ${{ needs.authority.outputs.expected-json }}
       toolchain-type: config
       verify-command: make check
-      artifact-paths: _build/paper-name.pdf
       buildchain-contract-lock-path: .buildchain/contract-lock.json
-    secrets:
-      BUILDCHAIN_PROMOTION_TOKEN: ${{ secrets.BUILDCHAIN_PROMOTION_TOKEN }}
 ```
 
-The sealed preset does not use a long-lived token for npm publication. It may
-accept an optional `BUILDCHAIN_PROMOTION_TOKEN` only for machine-generated
-version-state updates on protected channel branches; npm publication remains
-bound to GitHub OIDC trusted publishing. The preset builds and packages the
-paper in a read-only job, then a credential-free authority job downloads that
-exact candidate, audits the external control plane, and seals a capability over
-the source tree, Buildchain runtime, controller receipt, PDF, and npm package
-bytes. Only the final job receives write and OIDC permissions; it downloads the
-admitted candidate, recomputes the capability binding, and publishes without
-executing consumer build commands. npm binds the OIDC identity to the consumer
-workflow named by `publisher-workflow-path`.
+The publication job does not accept a long-lived promotion token. The caller
+must first produce a fresh sealed admission, runner provenance, external
+control-plane audit, and exact expected bindings. The credential-free verifier
+job checks those receipts; only then can the publication job use its short-lived
+`github.token` and caller-bound OIDC trusted publisher identity. npm binds that
+identity to the consumer workflow filename; an npm Environment restriction is
+optional and must be represented explicitly when configured. The workflow fails
+before the publication build when the target branch protection cannot be read.
 
 The preset:
 
-- resolves the floating Buildchain runtime once and binds the exact SHA into the
-  publication candidate and authority capability;
+- resolves the same floating Buildchain runtime and contract lock as the build
+  workflow;
+- verifies that the declared promotion authority can read the protected target
+  channel before starting the publication build;
 - builds the PDF through the declared pinned LaTeX Docker toolchain or custom
-  command in a read-only job;
+  command;
 - verifies the paper repository;
 - writes the publication manifest, publication passport, optional archive
   registry, and source bundle;
@@ -228,8 +226,7 @@ The preset:
 - creates a `publish-gate/<alpha|release>/.../<version>` source lock for the
   channel commit and requires `promote-buildchain-ref` to verify that lock
   before any publish side effect;
-- verifies the complete candidate again after authority and publishes the
-  package through npm Trusted Publishing without rebuilding it;
+- publishes the package through npm Trusted Publishing;
 - writes Buildchain release/passport evidence; and
 - creates or updates the exact-version GitHub Release by default, uploading
   every file declared by `publication.primary_artifact` and

package/docs/publication-authority.md

@@ -109,20 +109,17 @@ artifacts. The denial explicitly records that npm Trusted Publishing and OIDC
 were not evaluated, so downstream diagnostics cannot misclassify an admission
 assembly failure as an npm authentication failure.
 
-An explicitly opted-in managed `workflow_run` promotion lane may assemble those
-inputs from evidence owned by its caller repository. It downloads the exact prior RC passport,
+Buildchain's own `workflow_run` promotion lane may assemble those inputs only
+for `kungfu-systems/buildchain`. It downloads the exact prior RC passport,
 summary, referenced controller receipt, manifests, and product payloads; proves
 the admitted channel commit has the same Git tree as the RC; performs the live
 read-only control-plane audit; records the GitHub-hosted job as ephemeral runner
-provenance; and consumes either a caller-supplied Gate aggregate or an explicit
-caller no-Gate decision. The
+provenance; and creates an explicit Buildchain-owned no-Gate decision. The
 independent verifier then recomputes every receipt and payload digest exactly as
-it does for externally supplied admission. Automatic assembly keeps Buildchain
-as the canonical authority repository, requires evidence to belong to the
-caller, binds a repository-local publisher workflow, and rejects unknown refs,
-non-exact source SHAs, package/target mismatches, or an undeclared Gate policy.
-Manual apply and consumers that do not opt in still require their own explicit
-admission inputs.
+it does for externally supplied admission. The self-assembly mode rejects other
+repositories, unknown refs, non-exact source SHAs, and any caller other than
+`.github/workflows/buildchain-ref-promotion.yml`. Manual apply and external
+consumer workflows still require their own explicit admission inputs.
 
 Before authority verification, the reusable promotion controller runs the same
 release transaction selector in read-only mode. That plan supplies one exact

package/docs/release-candidate.md

@@ -116,22 +116,3 @@ KFD-1 source/artifact contract surfaces, audits KFD-2 public release claims, and
 compares KFD-3 declared shipped public surfaces with artifact-exposed public
 surfaces. The release passport records the results under `kfd-1`, `kfd-2`, and
 the KFD-provided `kfd-3` section.
-
-Managed consumers may also ask the promotion wrapper to assemble sealed
-publication evidence from the exact release candidate instead of producing
-short-lived admission JSON in repository-specific workflow code:
-
-```yaml
-      publication-auto-admission: true
-      publication-auto-no-gate: true
-      publication-publisher-workflow-path: .github/workflows/buildchain-ref-promotion.yml
-      publication-product: Example Product
-      publication-target: npm:@example/product
-      publication-package-name: "@example/product"
-```
-
-`publication-auto-no-gate` is an explicit consumer decision, not a default. A
-consumer with a Shifu Gate registry supplies `publication-gate-aggregate-json`
-instead. Buildchain still requires caller-owned RC evidence, an exact authority
-runtime and source SHA, a repository-local publisher workflow, matching npm
-target/package identity, and a qualifying control-plane audit.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.12.7-alpha.22",
+  "version": "2.12.7-alpha.4",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/buildchain-publication-authority.js

@@ -27,7 +27,6 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/buildchain-stable-candidate-patrol.yml", "governance-write"],
   [".github/workflows/dev-pr-auto-merge.yml", "governance-write"],
   [".github/workflows/npm-publish.yml", "dry-run-only"],
-  [".github/workflows/paper-release-sealed.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],
   [".github/workflows/paper-release.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],
   [".github/workflows/patrol-daily.yml", "governance-write"],
   [".github/workflows/patrol-monthly.yml", "governance-write"],

package/packages/core/controller-evidence.js

@@ -303,7 +303,7 @@ function normalizeEvidence(entries = []) {
 function receiptStatus(plan, stages) {
   if (stages.some((stage) => stage.status === "failed")) return "failed";
   if (stages.length > 0 && stages.every((stage) => stage.status === "skipped")) return "skipped";
-  if (stages.some((stage) => stage.status === "cancelled" || (stage.required && stage.status === "missing"))) return "partial";
+  if (stages.some((stage) => stage.status === "cancelled" || stage.status === "missing")) return "partial";
   const required = new Set(plan.expected.stages.filter((stage) => stage.required).map((stage) => stage.id));
   if (stages.filter((stage) => required.has(stage.id)).every((stage) => stage.status === "passed")) return "passed";
   return "partial";

package/packages/core/index.js

@@ -153,13 +153,6 @@ export {
   verifyPublicationAdmission,
 } from "./publication-authority.js";
 
-export {
-  PUBLICATION_ARTIFACT_CANDIDATE_CONTRACT,
-  createPublicationArtifactCandidate,
-  publicationArtifactCandidateDigest,
-  resolvePublicationCandidateFile,
-} from "./publication-artifact-candidate.js";
-
 export {
   buildchainPublicationAuthorityDescriptors,
   createBuildchainPublicationAuthorityRegistry,

package/packages/core/publication-authority.js

@@ -1,7 +1,6 @@
 import crypto from "node:crypto";
 
 import { validateControllerReceipt } from "./controller-evidence.js";
-import { createPublicationArtifactCandidate } from "./publication-artifact-candidate.js";
 import { sha256Json, validateReleaseCandidatePassport } from "./release-candidate.js";
 
 export const PUBLICATION_AUTHORITY_REGISTRY_CONTRACT =
@@ -382,7 +381,6 @@ export function createPublicationArtifactManifestSet({
 }
 
 function validateGateAggregate(gateAggregate, { admission, passport }) {
-  const passportSourceSha = passport.source?.headSha || passport.source?.sha;
   if (gateAggregate?.contract === "buildchain.shifu-gate-aggregate/v1") {
     const { digest, ...payload } = gateAggregate;
     const actualDigest = sha256Json(payload);
@@ -392,7 +390,7 @@ function validateGateAggregate(gateAggregate, { admission, passport }) {
     if (gateAggregate.status !== "pass" || gateAggregate.qualifying !== true) {
       throw new Error("gate aggregate is not qualifying");
     }
-    if (![admission.sourceSha, passportSourceSha].includes(gateAggregate.sourceSha)) {
+    if (![admission.sourceSha, passport.source?.headSha].includes(gateAggregate.sourceSha)) {
       throw new Error("gate aggregate source SHA mismatch");
     }
     normalizeDigest(gateAggregate.registry?.digest, "gateAggregate.registry.digest");
@@ -410,7 +408,7 @@ function validateGateAggregate(gateAggregate, { admission, passport }) {
   if (gateAggregate.required !== false) {
     throw new Error("a required Gate policy must supply a qualifying Shifu Gate aggregate");
   }
-  if (![admission.sourceSha, passportSourceSha].includes(gateAggregate.sourceSha)) {
+  if (![admission.sourceSha, passport.source?.headSha].includes(gateAggregate.sourceSha)) {
     throw new Error("publication Gate decision source SHA mismatch");
   }
   const normalizedPolicy = {
@@ -430,43 +428,6 @@ function validatePublicationEvidence(publicationEvidence, admission) {
   if (!publicationEvidence || typeof publicationEvidence !== "object" || Array.isArray(publicationEvidence)) {
     throw new Error("independent publication evidence is required");
   }
-  if (publicationEvidence.publicationArtifactCandidate) {
-    const candidate = createPublicationArtifactCandidate(publicationEvidence.publicationArtifactCandidate);
-    const passport = publicationEvidence.publicationArtifactCandidate.passport;
-    const controllerReceipt = publicationEvidence.publicationArtifactCandidate.controllerReceipt;
-    const controllerReceiptDigest = normalizeDigest(controllerReceipt.digest, "controllerReceipt.digest");
-    if (controllerReceiptDigest !== normalizeDigest(admission.controllerReceiptDigest, "admission.controllerReceiptDigest")) {
-      throw new Error("controller receipt evidence binding mismatch");
-    }
-    const contractDigest = normalizeDigest(controllerReceipt.runtime?.contractDigest, "controllerReceipt.runtime.contractDigest");
-    if (contractDigest !== normalizeDigest(admission.contractDigest, "admission.contractDigest")) {
-      throw new Error("runtime contract evidence binding mismatch");
-    }
-    const gate = validateGateAggregate(publicationEvidence.gateAggregate, { admission, passport });
-    if (gate.gateAggregateDigest !== normalizeDigest(admission.gateAggregateDigest, "admission.gateAggregateDigest")) {
-      throw new Error("Gate aggregate evidence binding mismatch");
-    }
-    if (gate.policyDigest !== normalizeDigest(admission.policyDigest, "admission.policyDigest")) {
-      throw new Error("Gate policy evidence binding mismatch");
-    }
-    if (candidate.candidateDigest !== normalizeDigest(admission.artifactDigest, "admission.artifactDigest")) {
-      throw new Error("publication artifact candidate evidence binding mismatch");
-    }
-    return {
-      sourceTreeSha: candidate.sourceTreeSha,
-      controllerReceiptDigest,
-      contractDigest,
-      gateAggregateDigest: gate.gateAggregateDigest,
-      policyDigest: gate.policyDigest,
-      artifactDigest: candidate.candidateDigest,
-      evidenceDigest: publicationAuthorityDigest({
-        sourceTreeSha: candidate.sourceTreeSha,
-        controllerReceiptDigest,
-        gateAggregateDigest: gate.gateAggregateDigest,
-        artifactDigest: candidate.candidateDigest,
-      }),
-    };
-  }
   const passport = publicationEvidence.releaseCandidatePassport;
   const buildSummary = publicationEvidence.buildSummary;
   const passportValidation = validateReleaseCandidatePassport({

package/packages/core/publication-control-plane-audit.js

@@ -16,7 +16,6 @@ export function evaluatePublicationControlPlaneSnapshot({
   branch,
   packageName,
   publisherMode = "npm-trusted-publisher",
-  requiredStatusCheck = "check",
   snapshot,
   observedAt,
   expiresAt,
@@ -73,8 +72,7 @@ export function evaluatePublicationControlPlaneSnapshot({
     branchPolicy.protected === true &&
     branchPolicy.enforcementLevel === "everyone" &&
     Array.isArray(branchPolicy.requiredStatusChecks) &&
-    branchPolicy.requiredStatusCheck === requiredStatusCheck &&
-    branchPolicy.requiredStatusChecks.includes(requiredStatusCheck) &&
+    branchPolicy.requiredStatusChecks.includes("check") &&
     branchPolicy.requiredCheckPassed === true &&
     branchPolicy.sourceSha === branchPolicy.headSha &&
     branchPolicy.mergedPullRequest === true &&

package/scripts/assemble-self-publication-admission.mjs

@@ -115,22 +115,13 @@ async function main() {
     manifests,
     payloads: manifests.map((manifest) => payloadFor(manifest, path.join(evidenceRoot, "payloads"))),
   });
-  const suppliedGateAggregate = String(process.env.BUILDCHAIN_GATE_AGGREGATE_JSON || "").trim();
-  let gateAggregate;
-  if (suppliedGateAggregate) {
-    gateAggregate = JSON.parse(suppliedGateAggregate);
-  } else {
-    if (process.env.BUILDCHAIN_ALLOW_NO_GATE !== "true") {
-      throw new Error("managed release-candidate admission requires a Gate aggregate or explicit no-Gate decision");
-    }
-    gateAggregate = createPublicationGateDecision({
-      sourceSha,
-      profile: process.env.BUILDCHAIN_GATE_PROFILE || "managed-release-candidate-no-gate",
-      required: false,
-      rationale: process.env.BUILDCHAIN_GATE_RATIONALE || "The consumer explicitly declared no Shifu Gate registry for this publication transaction.",
-      policy: { scope: "managed-release-candidate", repository },
-    });
-  }
+  const gateAggregate = createPublicationGateDecision({
+    sourceSha,
+    profile: process.env.BUILDCHAIN_GATE_PROFILE || "buildchain-self-publication",
+    required: false,
+    rationale: process.env.BUILDCHAIN_GATE_RATIONALE || "Buildchain self-publication has no consumer-owned Shifu Gate registry.",
+    policy: { scope: "buildchain-self-publication", repository },
+  });
   const runnerProvenance = createRunnerProvenance({
     runnerClass: "ephemeral",
     os: required("RUNNER_OS"),
@@ -187,6 +178,6 @@ async function main() {
 }
 
 main().catch((error) => {
-  console.error(`assemble release-candidate admission: ${error.message}`);
+  console.error(`assemble self publication admission: ${error.message}`);
   process.exitCode = 1;
 });

package/scripts/audit-publication-control-plane.mjs

@@ -191,7 +191,6 @@ function main() {
   const workflowPath = flag("workflow", ".github/workflows/release-candidate-promote.yml");
   const workflowRef = flag("workflow-ref");
   const publisherWorkflowPath = flag("publisher-workflow", workflowPath);
-  const requiredStatusCheck = flag("required-status-check", "check");
   const jobId = flag("job", "promote");
   const environment = flag("environment", "none");
   const providerEnvironment = environment === "none" ? "" : environment;
@@ -281,16 +280,15 @@ function main() {
     const checkRuns = githubJson(`repos/${repository}/commits/${sourceSha}/check-runs?per_page=100`, "source check runs");
     const requiredStatusCheckPolicy = branchState.protection?.required_status_checks || {};
     const requiredStatusChecks = requiredStatusCheckPolicy.contexts || [];
-    const requiredCheckSource = (requiredStatusCheckPolicy.checks || []).find((entry) => entry.context === requiredStatusCheck);
+    const requiredCheckSource = (requiredStatusCheckPolicy.checks || []).find((entry) => entry.context === "check");
     branchPolicy = {
       ref: branch,
       policyMode: "provider-enforced-transaction",
       protected: branchState.protected === true,
       enforcementLevel: branchState.protection?.required_status_checks?.enforcement_level || "",
       requiredStatusChecks,
-      requiredStatusCheck,
       requiredCheckPassed: (checkRuns.check_runs || []).some((entry) =>
-        entry.name === requiredStatusCheck &&
+        entry.name === "check" &&
         entry.conclusion === "success" &&
         (!requiredCheckSource?.app_id || entry.app?.id === requiredCheckSource.app_id)
       ),
@@ -352,7 +350,6 @@ function main() {
     branch,
     packageName,
     publisherMode,
-    requiredStatusCheck,
     observedAt: observedAt.toISOString(),
     expiresAt: expiresAt.toISOString(),
     snapshot: {

package/scripts/locked-source-checkout.mjs

@@ -6,7 +6,6 @@ import path from "node:path";
 import { pathToFileURL } from "node:url";
 
 export const LOCKED_SOURCE_CHECKOUT_CONTRACT = "kungfu-buildchain-locked-source-checkout-cache";
-export const ISOLATED_GIT_GLOBAL_CONFIG = process.platform === "win32" ? "NUL" : "/dev/null";
 
 const GIT_SHA_PATTERN = /^[0-9a-f]{40}$/i;
 
@@ -134,24 +133,6 @@ function githubAuthEnv(token = "") {
   };
 }
 
-function isolatedGitFetchEnv(env = {}, targetPath) {
-  const configuredCount = Number.parseInt(env.GIT_CONFIG_COUNT || "0", 10);
-  const safeDirectoryIndex = Number.isInteger(configuredCount) && configuredCount >= 0
-    ? configuredCount
-    : 0;
-  return {
-    ...env,
-    // Runner-global URL rewrites are shared mutable state. A concurrent job
-    // may point the same repository URL at a different single-SHA bundle, so
-    // network fetches must not consult the account-level Git config.
-    GIT_CONFIG_GLOBAL: ISOLATED_GIT_GLOBAL_CONFIG,
-    GIT_CONFIG_NOSYSTEM: "1",
-    GIT_CONFIG_COUNT: String(safeDirectoryIndex + 1),
-    [`GIT_CONFIG_KEY_${safeDirectoryIndex}`]: "safe.directory",
-    [`GIT_CONFIG_VALUE_${safeDirectoryIndex}`]: path.resolve(targetPath),
-  };
-}
-
 function markSafeDirectory(targetPath, timeoutMs) {
   try {
     git(["config", "--global", "--add", "safe.directory", path.resolve(targetPath)], {
@@ -222,32 +203,9 @@ export function fetchSourceCommit({
   sourceTreeSha = "",
   timeoutMs,
   env = {},
-  allowFullFetchRetry = false,
   runGit = git,
   containsCommit = hasCommit,
 }) {
-  const fetchEnv = isolatedGitFetchEnv(env, targetPath);
-  const fetch = (refspec) => {
-    const options = { cwd: targetPath, timeoutMs, env: fetchEnv };
-    try {
-      runGit(["fetch", "--no-tags", "--depth=1", remoteName, refspec], options);
-      return "shallow";
-    } catch (error) {
-      if (
-        !allowFullFetchRetry
-        || !/dumb http transport does not support shallow capabilities/i.test(
-          String(error?.message || error || ""),
-        )
-      ) {
-        throw error;
-      }
-      // Dumb HTTP mirrors are intentionally simple static cache endpoints.
-      // Retry only that explicit capability mismatch without --depth; all
-      // network fallbacks remain shallow and bounded by their own policy.
-      runGit(["fetch", "--no-tags", remoteName, refspec], options);
-      return "full";
-    }
-  };
   try {
     runGit(["remote", "remove", remoteName], { cwd: targetPath, timeoutMs, stdio: "ignore" });
   } catch {
@@ -261,9 +219,13 @@ export function fetchSourceCommit({
 
   if (fetchRef) {
     try {
-      const fetchMode = fetch(`+${fetchRef}:refs/buildchain/source-ref`);
+      runGit(["fetch", "--no-tags", "--depth=1", remoteName, `+${fetchRef}:refs/buildchain/source-ref`], {
+        cwd: targetPath,
+        timeoutMs,
+        env,
+      });
       if (containsCommit(targetPath, sha, timeoutMs)) {
-        return { selector: "ref", checkoutSha: sha, fetchMode };
+        return { selector: "ref", checkoutSha: sha };
       }
       if (/^refs\/pull\/\d+\/merge$/.test(fetchRef) && sourceTreeSha) {
         const fetchedSha = runGit(["rev-parse", "refs/buildchain/source-ref^{commit}"], {
@@ -275,7 +237,7 @@ export function fetchSourceCommit({
           timeoutMs,
         });
         if (fetchedTree === sourceTreeSha) {
-          return { selector: "ref-tree", checkoutSha: fetchedSha, fetchMode };
+          return { selector: "ref-tree", checkoutSha: fetchedSha };
         }
       }
     } catch (error) {
@@ -287,11 +249,15 @@ export function fetchSourceCommit({
     }
   }
 
-  const fetchMode = fetch(`+${sha}:refs/buildchain/source`);
+  runGit(["fetch", "--no-tags", "--depth=1", remoteName, `+${sha}:refs/buildchain/source`], {
+    cwd: targetPath,
+    timeoutMs,
+    env,
+  });
   if (!containsCommit(targetPath, sha, timeoutMs)) {
     throw new Error(`fetched ${fetchRef || sha}, but ${sha} is not available`);
   }
-  return { selector: "sha", checkoutSha: sha, fetchMode };
+  return { selector: "sha", checkoutSha: sha };
 }
 
 export function runBoundedFetch({ attempts = 1, fetch, onAttempt = () => {}, onRetry = () => {}, shouldRetry = () => true }) {
@@ -447,9 +413,7 @@ export function lockedSourceCheckout({
           fetchRef,
           sourceTreeSha: treeSha,
           timeoutMs,
-          allowFullFetchRetry: true,
         });
-        evidence.cache.fetchMode = fetchResult.fetchMode;
         checkoutSha = fetchResult.checkoutSha || sha;
         checkoutFetchedCommit(targetPath, checkoutSha, timeoutMs);
       } else {
@@ -494,7 +458,6 @@ export function lockedSourceCheckout({
         shouldRetry: retryableGitFetchError,
       });
       evidence.cache.githubFetchAttempts = fetchResult.attempts;
-      evidence.cache.fetchMode = fetchResult.value.fetchMode;
       checkoutSha = fetchResult.value.checkoutSha || sha;
     } catch (error) {
       evidence.durationMs = Date.now() - startedAt;