@kungfu-tech/buildchain 3.0.2-alpha.0 → 3.0.2-alpha.2

package/packages/core/github-governance-authority.js

@@ -1191,20 +1191,38 @@ export function createGithubRulesetGovernanceRolloutPlan({
   repository,
   targetRef,
   rulesetId,
+  rulesetName,
   inventory,
   rollbackSnapshot,
   desiredProtection,
 } = {}) {
   const fullName = requiredString(repository, "repository");
   const branch = normalizedRef(targetRef);
-  const id = Number(rulesetId);
-  if (!Number.isInteger(id) || id <= 0) {
-    throw new Error("ruleset id must be a positive integer");
+  const creating = rulesetId === null || rulesetId === undefined || rulesetId === "";
+  const id = creating ? null : Number(rulesetId);
+  if (!creating && (!Number.isInteger(id) || id <= 0)) {
+    throw new Error("ruleset id must be a positive integer when supplied");
   }
-  if (!inventory || !rollbackSnapshot) {
-    throw new Error("read-only inventory and frozen rollback snapshot are required");
+  if (!inventory || (!creating && !rollbackSnapshot)) {
+    throw new Error(
+      "read-only inventory and any existing frozen rollback snapshot are required",
+    );
   }
-  const before = normalizeGithubRulesetSnapshot(rollbackSnapshot);
+  const before = creating
+    ? {
+        name: requiredString(rulesetName, "ruleset name"),
+        target: "branch",
+        enforcement: "active",
+        bypass_actors: [],
+        conditions: {
+          ref_name: {
+            include: [`refs/heads/${branch}`],
+            exclude: [],
+          },
+        },
+        rules: [],
+      }
+    : normalizeGithubRulesetSnapshot(rollbackSnapshot);
   const exactInclude = before.conditions?.ref_name?.include || [];
   const exactExclude = before.conditions?.ref_name?.exclude || [];
   if (
@@ -1265,28 +1283,53 @@ export function createGithubRulesetGovernanceRolloutPlan({
   });
   if (pullRequestRules.length === 0) desiredRules.push(desiredPullRequestRule);
   if (statusCheckRules.length === 0) desiredRules.push(desiredStatusCheckRule);
+  if (
+    desiredProtection?.blockDeletions === true &&
+    !desiredRules.some((rule) => rule.type === "deletion")
+  ) {
+    desiredRules.push({ type: "deletion" });
+  }
+  if (
+    desiredProtection?.blockNonFastForward === true &&
+    !desiredRules.some((rule) => rule.type === "non_fast_forward")
+  ) {
+    desiredRules.push({ type: "non_fast_forward" });
+  }
   const desired = {
     ...before,
+    name: rulesetName
+      ? requiredString(rulesetName, "ruleset name")
+      : before.name,
     bypass_actors: providerRulesetBypassActors(
       desiredProtection?.rulesetBypassActors,
     ),
     rules: desiredRules,
   };
-  const endpoint = `repos/${fullName}/rulesets/${id}`;
+  const endpoint = creating
+    ? `repos/${fullName}/rulesets`
+    : `repos/${fullName}/rulesets/${id}`;
   const core = {
     schemaVersion: 1,
     contract: GITHUB_GOVERNANCE_RULESET_ROLLOUT_CONTRACT,
     repository: fullName,
     targetRef: branch,
     rulesetId: id,
+    rulesetName: desired.name,
+    action: creating ? "create" : "update",
     inventoryRoot: githubGovernanceDigest(inventory),
-    rollbackSnapshotRoot: githubGovernanceDigest(before),
-    operations: [{ method: "PUT", endpoint, body: desired }],
+    rollbackSnapshotRoot: creating
+      ? githubGovernanceDigest({ rulesetExists: false, targetRef: branch })
+      : githubGovernanceDigest(before),
+    operations: [
+      { method: creating ? "POST" : "PUT", endpoint, body: desired },
+    ],
     impact: [
       "replace ruleset bypass actors with the exact provider-admitted desired set",
       "require fresh Code Owner review and resolved review threads",
       "bind required status checks and strictness to the authoritative target descriptor",
-      "preserve unrelated ruleset rules and exact target conditions",
+      creating
+        ? "create one exact-branch active ruleset because no matching ruleset exists"
+        : "preserve unrelated ruleset rules and exact target conditions",
     ],
     expectedObservation: {
       rulesetRoot: githubGovernanceDigest(desired),
@@ -1296,12 +1339,24 @@ export function createGithubRulesetGovernanceRolloutPlan({
         desiredProtection?.strictRequiredChecks === true,
       requiredApprovals,
     },
-    rollback: [{
-      method: "PUT",
-      endpoint,
-      body: before,
-      preconditionRoot: githubGovernanceDigest(before),
-    }],
+    rollback: creating
+      ? [
+          {
+            method: "DELETE",
+            endpoint: `repos/${fullName}/rulesets/{ruleset_id}`,
+            body: null,
+            preconditionRoot: githubGovernanceDigest(desired),
+            requiresApplyReceipt: true,
+          },
+        ]
+      : [
+          {
+            method: "PUT",
+            endpoint,
+            body: before,
+            preconditionRoot: githubGovernanceDigest(before),
+          },
+        ],
   };
   return { ...core, planRoot: githubGovernanceDigest(core) };
 }

package/packages/core/index.js

@@ -64,6 +64,16 @@ export {
   verifyPortableDevCachePlan,
 } from "./portable-dev-cache.js";
 
+export {
+  BUILDCHAIN_CACHE_EVIDENCE_SET_CONTRACT,
+  BUILDCHAIN_CACHE_OPERATION_RECEIPT_CONTRACT,
+  cacheEvidenceDigest,
+  createCacheEvidenceSet,
+  createCacheOperationReceipt,
+  verifyCacheEvidenceSet,
+  verifyCacheOperationReceipt,
+} from "./cache-evidence.js";
+
 export {
   explainReleaseLineDryRun,
   formatReleaseLineDryRun,

package/scripts/auditable-demo.mjs

@@ -164,7 +164,18 @@ function validateScene(value) {
   for (const key of ["background", "accent"]) {
     if (value[key] !== undefined) invariant(/^#[0-9a-fA-F]{6}$/.test(value[key]), `scene.${key} is invalid`);
   }
-  return value;
+  return {
+    schema: value.schema,
+    id: value.id,
+    width: value.width,
+    height: value.height,
+    fps: value.fps,
+    durationMs: value.durationMs,
+    title: value.title,
+    commandLabel: value.commandLabel ?? "",
+    background: (value.background ?? "#10151f").toLowerCase(),
+    accent: (value.accent ?? "#67e8a5").toLowerCase(),
+  };
 }
 
 function validateProjection(value, scene, transcriptLineCount) {
@@ -190,7 +201,17 @@ function validateProjection(value, scene, transcriptLineCount) {
     }
     if (cue.annotation !== undefined) text(cue.annotation, 0, 200, `projection.cues[${index}].annotation`);
   }
-  return value;
+  return {
+    schema: value.schema,
+    evidenceClass: value.evidenceClass,
+    claimBoundary: value.claimBoundary,
+    cues: value.cues.map((cue) => ({
+      startMs: cue.startMs,
+      endMs: cue.endMs,
+      transcriptLines: cue.transcriptLines,
+      annotation: cue.annotation ?? "",
+    })),
+  };
 }
 
 function validateSourceCoordinate(value) {
@@ -427,7 +448,9 @@ function finalizeGate(values) {
   const sourceCoordinate = validateSourceCoordinate(readJson(sourceCoordinatePath, "source artifact coordinate"));
   invariant(sourceCoordinate.sourceSha === sourceSha, "source artifact coordinate SHA mismatch");
   ensureEmptyDirectory(output, "gate bundle");
-  for (const name of REQUIRED_ADAPTER_FILES) copyFile(path.join(adapterOutput, name), path.join(output, name));
+  fs.writeFileSync(path.join(output, "complete-transcript.txt"), normalized.transcript);
+  writeJson(path.join(output, "scene.json"), normalized.scene);
+  writeJson(path.join(output, "public-projection.json"), normalized.projection);
   copyFile(sourceCoordinatePath, path.join(output, "source-artifact.json"));
   copyFile(path.join(diagnostics, "adapter.json"), path.join(output, "adapter.json"));
   for (const name of listFiles(smokeOutput)) {
@@ -454,9 +477,9 @@ function finalizeGate(values) {
       smokeManifestRoot: sha256(readRegular(path.join(smokeOutput, "manifest.json"), "smoke manifest")),
     },
     qualifiedInputs: {
-      transcript: sha256(readRegular(path.join(adapterOutput, "complete-transcript.txt"), "transcript")),
-      projection: sha256(readRegular(path.join(adapterOutput, "public-projection.json"), "projection")),
-      scene: sha256(readRegular(path.join(adapterOutput, "scene.json"), "scene")),
+      transcript: sha256(readRegular(path.join(output, "complete-transcript.txt"), "transcript")),
+      projection: sha256(readRegular(path.join(output, "public-projection.json"), "projection")),
+      scene: sha256(readRegular(path.join(output, "scene.json"), "scene")),
       evidenceClass: normalized.projection.evidenceClass,
       claimBoundary: normalized.projection.claimBoundary,
     },

package/scripts/generate-site-bundle.mjs

@@ -516,6 +516,7 @@ function nodeApiMeta(exportName) {
     "./homebrew": { group: "distribution-indexes", summary: "Homebrew tap fact collection, Formula rendering, update, and check APIs." },
     "./build-facts": { group: "observability-diagnostics", summary: "Git source, version, module output, product artifact, and legacy Kungfu build fact APIs." },
     "./candidate-timeline": { group: "observability-diagnostics", summary: "Source-bound candidate event normalization, per-attempt critical-path-safe aggregation, and compact reporting APIs." },
+    "./cache-evidence": { group: "observability-diagnostics", summary: "Content-addressed cache operation receipts and source/platform-bound evidence-set verification APIs." },
     "./diagnostics": { group: "observability-diagnostics", summary: "Native diagnostics collection, summarization, cache, compiler, and process-sampler APIs." },
     "./logging": { group: "observability-diagnostics", summary: "Buildchain JSONL logging, span, summary, and verification APIs." },
     "./portable-dev-cache": { group: "observability-diagnostics", summary: "Portable dependency/compiler cache plan, exact-root verification, and provider receipt APIs." },

package/scripts/locked-source-checkout.mjs

@@ -177,6 +177,21 @@ function gitObjectDirectory(referencePath) {
   return candidates.find((candidate) => fs.existsSync(candidate) && fs.statSync(candidate).isDirectory()) || "";
 }
 
+function directoryBytes(directory) {
+  if (!fs.existsSync(directory)) return 0;
+  let bytes = 0;
+  const pending = [directory];
+  while (pending.length) {
+    const current = pending.pop();
+    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+      const child = path.join(current, entry.name);
+      if (entry.isDirectory()) pending.push(child);
+      else if (entry.isFile()) bytes += fs.statSync(child).size;
+    }
+  }
+  return bytes;
+}
+
 function writeAlternates(targetPath, referencePath) {
   const objectDirectory = gitObjectDirectory(referencePath);
   if (!objectDirectory) {
@@ -413,6 +428,13 @@ export function lockedSourceCheckout({
       fallbackUsed: normalizedMode === "off",
       fallbackReason: normalizedMode === "off" ? "cache disabled" : "",
       githubFetchAttempts: 0,
+      lookupDurationMs: 0,
+      restoreDurationMs: 0,
+      githubFetchDurationMs: 0,
+      restoredBytes: null,
+      restoredBytesStatus:
+        normalizedMode === "off" ? "not-applicable" : "unavailable",
+      restoredBytesMethod: "",
     },
     verification: {
       head: "",
@@ -425,8 +447,13 @@ export function lockedSourceCheckout({
   let checkoutError;
   let checkoutSha = sha;
   if (normalizedMode !== "off") {
+    const cacheAttemptStartedAt = Date.now();
+    const objectBytesBefore = directoryBytes(
+      path.join(targetPath, ".git", "objects"),
+    );
     try {
       if (renderedReferenceRepository) {
+        const lookupStartedAt = Date.now();
         const alternates = writeAlternates(targetPath, renderedReferenceRepository);
         evidence.cache.transport = "reference-repository";
         evidence.cache.referenceAvailable = alternates;
@@ -436,9 +463,13 @@ export function lockedSourceCheckout({
         if (!hasCommit(targetPath, sha, timeoutMs)) {
           throw new Error("reference repository does not contain source commit");
         }
+        evidence.cache.lookupDurationMs = Date.now() - lookupStartedAt;
+        const restoreStartedAt = Date.now();
         checkoutFetchedCommit(targetPath, sha, timeoutMs);
+        evidence.cache.restoreDurationMs = Date.now() - restoreStartedAt;
       } else if (renderedMirrorUrl) {
         evidence.cache.transport = "mirror-url";
+        const restoreStartedAt = Date.now();
         const fetchResult = fetchSourceCommit({
           targetPath,
           remoteName: "buildchain-cache",
@@ -452,15 +483,29 @@ export function lockedSourceCheckout({
         evidence.cache.fetchMode = fetchResult.fetchMode;
         checkoutSha = fetchResult.checkoutSha || sha;
         checkoutFetchedCommit(targetPath, checkoutSha, timeoutMs);
+        evidence.cache.restoreDurationMs = Date.now() - restoreStartedAt;
       } else {
         throw new Error("checkout cache is enabled but no mirror URL or reference repository template was provided");
       }
       evidence.cache.hit = true;
       evidence.cache.fallbackUsed = false;
+      evidence.cache.restoredBytes = Math.max(
+        0,
+        directoryBytes(path.join(targetPath, ".git", "objects")) -
+          objectBytesBefore,
+      );
+      evidence.cache.restoredBytesStatus = "observed";
+      evidence.cache.restoredBytesMethod = "git-object-store-delta";
     } catch (error) {
       checkoutError = error;
       evidence.cache.hit = false;
       evidence.cache.fallbackReason = error.message;
+      if (
+        evidence.cache.lookupDurationMs === 0 &&
+        evidence.cache.restoreDurationMs === 0
+      ) {
+        evidence.cache.lookupDurationMs = Date.now() - cacheAttemptStartedAt;
+      }
       if (normalizedMode === "require" || normalizedFallback === "fail") {
         evidence.durationMs = Date.now() - startedAt;
         writeEvidence(path.resolve(workspace, diagnosticsPath), evidence);
@@ -477,6 +522,7 @@ export function lockedSourceCheckout({
       evidence.cache.fallbackReason = checkoutError.message;
     }
     try {
+      const githubFetchStartedAt = Date.now();
       const fetchResult = runBoundedFetch({
         attempts: normalizedFetchAttempts,
         fetch: () => fetchSourceCommit({
@@ -496,6 +542,8 @@ export function lockedSourceCheckout({
       evidence.cache.githubFetchAttempts = fetchResult.attempts;
       evidence.cache.fetchMode = fetchResult.value.fetchMode;
       checkoutSha = fetchResult.value.checkoutSha || sha;
+      evidence.cache.githubFetchDurationMs =
+        Date.now() - githubFetchStartedAt;
     } catch (error) {
       evidence.durationMs = Date.now() - startedAt;
       writeEvidence(path.resolve(workspace, diagnosticsPath), evidence);

package/scripts/reconcile-github-governance.mjs

@@ -90,6 +90,12 @@ function readJson(filePath, label) {
   }
 }
 
+function writeJson(filePath, value) {
+  const target = path.resolve(filePath);
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.writeFileSync(target, `${JSON.stringify(value, null, 2)}\n`);
+}
+
 function githubApi(route, { method = "GET", body } = {}) {
   const args = [
     "api",
@@ -142,6 +148,42 @@ function readRuleset(repository, rulesetId) {
   return normalizeGithubRulesetSnapshot(response.data);
 }
 
+function readMatchingRulesetEntries(repository, branch) {
+  const response = githubApi(
+    `repos/${repository}/rulesets?includes_parents=false&per_page=100`,
+  );
+  const include = `refs/heads/${branch}`;
+  return (response.data || [])
+    .map((entry) => ({
+      id: Number(entry.id),
+      ruleset: readRuleset(repository, entry.id),
+    }))
+    .filter(({ ruleset }) => {
+      const refName = ruleset.conditions?.ref_name || {};
+      return (
+        ruleset.target === "branch" &&
+        (refName.include || []).length === 1 &&
+        refName.include[0] === include &&
+        (refName.exclude || []).length === 0
+      );
+    })
+    .sort((left, right) => left.ruleset.name.localeCompare(right.ruleset.name));
+}
+
+function readMatchingRulesets(repository, branch) {
+  return readMatchingRulesetEntries(repository, branch).map(
+    ({ ruleset }) => ruleset,
+  );
+}
+
+function rulesetInventory(repository, branch) {
+  return {
+    repository,
+    targetRef: branch,
+    matchingRulesets: readMatchingRulesets(repository, branch),
+  };
+}
+
 function snapshotCore(repository, branch, protection) {
   return {
     schemaVersion: 1,
@@ -200,8 +242,8 @@ function rulesetPlan(args) {
     ...planCore,
     planRoot: githubGovernanceDigest(planCore),
   };
-  fs.writeFileSync(path.resolve(snapshotOutput), `${JSON.stringify(snapshot, null, 2)}\n`);
-  fs.writeFileSync(path.resolve(planOutput), `${JSON.stringify(finalPlan, null, 2)}\n`);
+  writeJson(snapshotOutput, snapshot);
+  writeJson(planOutput, finalPlan);
   return finalPlan;
 }
 
@@ -209,13 +251,45 @@ function rulesetPolicyPlan(args) {
   const repository = required(flag(args, "repository"), "--repository");
   const branch = required(flag(args, "branch"), "--branch")
     .replace(/^refs\/heads\//, "");
-  const rulesetId = Number(required(flag(args, "ruleset-id"), "--ruleset-id"));
-  if (!Number.isInteger(rulesetId) || rulesetId <= 0) {
-    throw new Error("--ruleset-id must be a positive integer");
-  }
+  const requestedRulesetId = flag(args, "ruleset-id");
+  const rulesetName = required(flag(args, "ruleset-name"), "--ruleset-name");
   const snapshotOutput = required(flag(args, "snapshot-output"), "--snapshot-output");
   const planOutput = required(flag(args, "plan-output"), "--plan-output");
-  const before = readRuleset(repository, rulesetId);
+  const matchingEntries = readMatchingRulesetEntries(repository, branch);
+  const inventory = {
+    repository,
+    targetRef: branch,
+    matchingRulesets: matchingEntries.map(({ ruleset }) => ruleset),
+  };
+  let rulesetId = null;
+  let before = null;
+  if (requestedRulesetId) {
+    rulesetId = Number(requestedRulesetId);
+    if (!Number.isInteger(rulesetId) || rulesetId <= 0) {
+      throw new Error("--ruleset-id must be a positive integer");
+    }
+    before = readRuleset(repository, rulesetId);
+    if (
+      !inventory.matchingRulesets.some(
+        (ruleset) =>
+          githubGovernanceDigest(ruleset) === githubGovernanceDigest(before),
+      )
+    ) {
+      throw new Error("--ruleset-id does not target the exact requested branch");
+    }
+  } else if (matchingEntries.length === 1) {
+    before = matchingEntries[0].ruleset;
+    rulesetId = matchingEntries[0].id;
+    if (!Number.isInteger(rulesetId) || rulesetId <= 0) {
+      throw new Error("matching ruleset id could not be resolved");
+    }
+  } else if (inventory.matchingRulesets.length > 1) {
+    throw new Error("multiple exact-target rulesets are ambiguous");
+  } else if (!hasFlag(args, "create-if-missing")) {
+    throw new Error(
+      "exact-target ruleset is absent; pass --create-if-missing to plan creation",
+    );
+  }
   const targetPolicy = resolveGithubGovernanceTargetPolicy({
     repository,
     targetRef: branch,
@@ -225,6 +299,7 @@ function rulesetPolicyPlan(args) {
     contract: "kungfu-buildchain-github-governance-ruleset-rollback-snapshot",
     repository,
     targetRef: branch,
+    rulesetExists: Boolean(before),
     rulesetId,
     ruleset: before,
   };
@@ -236,13 +311,16 @@ function rulesetPolicyPlan(args) {
     repository,
     targetRef: branch,
     rulesetId,
-    inventory: before,
+    rulesetName,
+    inventory,
     rollbackSnapshot: before,
     desiredProtection: {
       strictRequiredChecks: targetPolicy.strictRequiredChecks,
       requiredCheckBindings: targetPolicy.requiredCheckBindings,
       requiredApprovals: targetPolicy.requiredApprovals,
       rulesetBypassActors: [],
+      blockDeletions: hasFlag(args, "block-deletions"),
+      blockNonFastForward: hasFlag(args, "block-non-fast-forward"),
     },
   });
   const boundCore = {
@@ -255,8 +333,8 @@ function rulesetPolicyPlan(args) {
     ...planCore,
     planRoot: githubGovernanceDigest(planCore),
   };
-  fs.writeFileSync(path.resolve(snapshotOutput), `${JSON.stringify(snapshot, null, 2)}\n`);
-  fs.writeFileSync(path.resolve(planOutput), `${JSON.stringify(finalPlan, null, 2)}\n`);
+  writeJson(snapshotOutput, snapshot);
+  writeJson(planOutput, finalPlan);
   return finalPlan;
 }
 
@@ -276,20 +354,29 @@ function rulesetApply(args) {
       snapshotRoot !== githubGovernanceDigest(snapshotCore)) {
     throw new Error("ruleset rollback snapshot root mismatch");
   }
-  const current = readRuleset(rollout.repository, rollout.rulesetId);
-  if (githubGovernanceDigest(current) !== rollout.inventoryRoot) {
+  const currentInventory = rulesetInventory(
+    rollout.repository,
+    rollout.targetRef,
+  );
+  if (githubGovernanceDigest(currentInventory) !== rollout.inventoryRoot) {
     throw new Error("live GitHub ruleset drifted after planning; apply stopped");
   }
-  githubApi(rollout.operations[0].endpoint, {
+  const result = githubApi(rollout.operations[0].endpoint, {
     method: rollout.operations[0].method,
     body: rollout.operations[0].body,
   });
-  const after = readRuleset(rollout.repository, rollout.rulesetId);
+  const rulesetId =
+    rollout.rulesetId ||
+    Number(result.data?.id || 0);
+  if (!Number.isInteger(rulesetId) || rulesetId <= 0) {
+    throw new Error("GitHub did not return the created ruleset id");
+  }
+  const after = readRuleset(rollout.repository, rulesetId);
   const afterRoot = githubGovernanceDigest(after);
   if (afterRoot !== rollout.expectedObservation.rulesetRoot) {
     throw new Error("post-change GitHub ruleset read-back does not match the rollout plan");
   }
-  return {
+  const receiptCore = {
     schemaVersion: 1,
     contract: "kungfu-buildchain-github-governance-ruleset-rollout-receipt",
     status: "applied",
@@ -297,7 +384,21 @@ function rulesetApply(args) {
     snapshotRoot: rollout.snapshotRoot,
     afterRoot,
     repository: rollout.repository,
-    rulesetId: rollout.rulesetId,
+    targetRef: rollout.targetRef,
+    rulesetId,
+    rollback:
+      rollout.action === "create"
+        ? {
+            method: "DELETE",
+            endpoint: rulesetEndpoint(rollout.repository, rulesetId),
+            body: null,
+            preconditionRoot: afterRoot,
+          }
+        : rollout.rollback[0],
+  };
+  return {
+    ...receiptCore,
+    receiptRoot: githubGovernanceDigest(receiptCore),
   };
 }
 
@@ -311,14 +412,46 @@ function rulesetRollback(args) {
   if (rollout.snapshotRoot !== confirmed) {
     throw new Error("--confirm-rollback-root does not match the frozen ruleset snapshot");
   }
-  const operation = rollout.rollback[0];
+  let rulesetId = rollout.rulesetId;
+  let operation = rollout.rollback[0];
+  if (operation.requiresApplyReceipt) {
+    const receipt = readJson(
+      required(flag(args, "apply-receipt"), "--apply-receipt"),
+      "ruleset apply receipt",
+    );
+    const { receiptRoot, ...receiptCore } = receipt;
+    if (
+      receiptRoot !== githubGovernanceDigest(receiptCore) ||
+      receipt.planRoot !== rollout.planRoot ||
+      receipt.repository !== rollout.repository ||
+      receipt.targetRef !== rollout.targetRef
+    ) {
+      throw new Error("ruleset apply receipt does not match the rollout plan");
+    }
+    rulesetId = Number(receipt.rulesetId);
+    operation = receipt.rollback;
+    const current = readRuleset(rollout.repository, rulesetId);
+    if (githubGovernanceDigest(current) !== operation.preconditionRoot) {
+      throw new Error("created ruleset drifted after apply; rollback stopped");
+    }
+  }
   githubApi(operation.endpoint, {
     method: operation.method,
     body: operation.body,
   });
-  const restored = readRuleset(rollout.repository, rollout.rulesetId);
-  if (githubGovernanceDigest(restored) !== operation.preconditionRoot) {
-    throw new Error("ruleset rollback read-back does not match the frozen snapshot");
+  if (operation.method === "DELETE") {
+    const remaining = readMatchingRulesets(
+      rollout.repository,
+      rollout.targetRef,
+    );
+    if (remaining.length !== 0) {
+      throw new Error("created ruleset remains after rollback");
+    }
+  } else {
+    const restored = readRuleset(rollout.repository, rulesetId);
+    if (githubGovernanceDigest(restored) !== operation.preconditionRoot) {
+      throw new Error("ruleset rollback read-back does not match the frozen snapshot");
+    }
   }
   return {
     schemaVersion: 1,
@@ -327,7 +460,7 @@ function rulesetRollback(args) {
     planRoot: rollout.planRoot,
     snapshotRoot: rollout.snapshotRoot,
     repository: rollout.repository,
-    rulesetId: rollout.rulesetId,
+    rulesetId,
   };
 }
 
@@ -368,8 +501,8 @@ function protectionPolicyPlan(args) {
     ...boundCore,
     planRoot: githubGovernanceDigest(boundCore),
   };
-  fs.writeFileSync(path.resolve(snapshotOutput), `${JSON.stringify(snapshotWithRoot, null, 2)}\n`);
-  fs.writeFileSync(path.resolve(planOutput), `${JSON.stringify(finalPlan, null, 2)}\n`);
+  writeJson(snapshotOutput, snapshotWithRoot);
+  writeJson(planOutput, finalPlan);
   return finalPlan;
 }
 
@@ -419,8 +552,8 @@ function plan(args) {
     ...boundCore,
     planRoot: githubGovernanceDigest(boundCore),
   };
-  fs.writeFileSync(path.resolve(snapshotOutput), `${JSON.stringify(snapshotWithRoot, null, 2)}\n`);
-  fs.writeFileSync(path.resolve(planOutput), `${JSON.stringify(finalPlan, null, 2)}\n`);
+  writeJson(snapshotOutput, snapshotWithRoot);
+  writeJson(planOutput, finalPlan);
   return finalPlan;
 }